[github-actions]

Change Description

PR to bump pip and npm packages this week

Security Assessment

• This change potentially impacts the Hail Batch instance as deployed by Broad Institute in GCP

Impact Rating

• This change has a low security impact

Impact Description

Regular updates.

Appsec Review

• Required: The impact has been assessed and approved by appsec

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: ba84802d-4d54-44ca-befe-d292198a7c96

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[chrisvittal]

@cjllanwarne We need to update this action workflow to include the COOLDOWN_EXEMPT arg for relevant packages. Notably, certifi was downgraded here, we shouldn't do that.

[chrisvittal]

I took care of those updates on this branch and pushed, someone who isn't me should review.

[cjllanwarne]

@chrisvittal instead of permanently exempting, I think it's better to (1) add a security floor whenever we have to manually exempt a package (to avoid backsliding), and (2) let the packages naturally update after we get past the cooldown. Luckily in this case all the CVE fixes are newer than the cooldown now so "just re-run" is now satisfying the floors files.

[chrisvittal]

How does this impact the "check lockfiles" step if we manually run with an exemption?