Bug 2270406

Summary:	[Backport into 4.13] noobaa-core: move node-gyp to devDependencies to avoid shipping it
Product:	[Red Hat Storage] Red Hat OpenShift Data Foundation	Reporter:	Liran Mauda <lmauda>
Component:	Multi-Cloud Object Gateway	Assignee:	Liran Mauda <lmauda>
Status:	CLOSED ERRATA	QA Contact:	Uday kurundwade <ukurundw>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	4.13	CC:	asriram, kramdoss, odf-bz-bot, sheggodu, ukurundw
Target Milestone:	---
Target Release:	ODF 4.13.9
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	4.13.9-2	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:	2270405	Environment:
Last Closed:	2024-06-12 11:48:55 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2270404, 2270405
Bug Blocks:	2166191, 2166192

Description Liran Mauda 2024-03-20 07:26:07 UTC

+++ This bug was initially created as a clone of Bug #2270405 +++

+++ This bug was initially created as a clone of Bug #2270404 +++

Description of problem (please be detailed as possible and provide log
snippests):


Version of all relevant components (if applicable):


Does this issue impact your ability to continue to work with the product
(please explain in detail what is the user impact)?


Is there any workaround available to the best of your knowledge?


Rate from 1 - 5 the complexity of the scenario you performed that caused this
bug (1 - very simple, 5 - very complex)?


Can this issue reproducible?


Can this issue reproduce from the UI?


If this is a regression, please provide more details to justify this:


Steps to Reproduce:
1.
2.
3.


Actual results:


Expected results:


Additional info:

--- Additional comment from Liran Mauda on 2024-03-20 07:18:05 UTC ---

In 4.16 we removed node-gyp from the dependencies (and into the dev dependencies which are not shipped).
This will help us avoid this CVE, and future CVE's related to node-gyp

--- Additional comment from RHEL Program Management on 2024-03-20 07:18:17 UTC ---

This bug having no release flag set previously, is now set with release flag 'odf‑4.15.0' to '?', and so is being proposed to be fixed at the ODF 4.15.0 release. Note that the 3 Acks (pm_ack, devel_ack, qa_ack), if any previously set while release flag was missing, have now been reset since the Acks are to be set against a release flag.

--- Additional comment from RHEL Program Management on 2024-03-20 07:22:11 UTC ---

This bug having no release flag set previously, is now set with release flag 'odf‑4.15.0' to '?', and so is being proposed to be fixed at the ODF 4.15.0 release. Note that the 3 Acks (pm_ack, devel_ack, qa_ack), if any previously set while release flag was missing, have now been reset since the Acks are to be set against a release flag.

Comment 1 krishnaram Karthick 2024-04-15 07:17:38 UTC

The fix has to land in 4.14.z first. moving the bug to 4.13.10.

Comment 8 errata-xmlrpc 2024-06-12 11:48:55 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Red Hat OpenShift Data Foundation 4.13.9 Bug Fix Update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2024:3865