Changes according to bug #2389

[cogniware-devops]

Description

The summary of the proposed changes as long as the relevant motivation and context.

Issues

List the issue or RFC link this PR is working on. If there is no such link, please mark it as n/a.

Type of change

List the type of change like below. Please delete options that are not relevant.

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds new functionality)
• Breaking change (fix or feature that would break existing design and interface)
• Others (enhancement, documentation, validation, etc.)

Dependencies

List the newly introduced 3rd party dependency if exists.

Tests

Describe the tests that you ran to verify your changes.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues found.

Scanned Files

• CogniwareIms/frontend/package-lock.json

[joshuayao]

Dependency Review

The following issues were found:

• ❌ 1 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 4 package(s) with unknown licenses.

See the Details below.

Vulnerabilities

CogniwareIms/frontend/package-lock.json

Name Version Vulnerability Severity
next 14.0.4 Authorization Bypass in Next.js Middleware critical
Next.js Server-Side Request Forgery in Server Actions high
Next.js Cache Poisoning high
Next.js authorization bypass vulnerability high
Next Vulnerable to Denial of Service with Server Components high
Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up high
Denial of Service condition in Next.js image optimization moderate
Next.js Allows a Denial of Service (DoS) with Server Actions moderate
Next.js Affected by Cache Key Confusion for Image Optimization API Routes moderate
Next.js Content Injection Vulnerability for Image Optimization moderate
Next.js Improper Middleware Redirect Handling Leads to SSRF moderate
Information exposure in Next.js dev server due to lack of origin verification low
Next.js Race Condition to Cache Poisoning low

License Issues

CogniwareIms/backend/requirements.txt

Package Version License Issue Type
aiohttp >= 3.11.0 Null Unknown License
cryptography >= 43.0.7 Null Unknown License
pypdf >= 4.0.0 Null Unknown License
python-multipart >= 0.0.9 Null Unknown License

Scanned Files

• CogniwareIms/backend/requirements.txt
• CogniwareIms/frontend/package-lock.json

Hi @cogniware-devops could you please upgrade next to fix the above vulnerabilities? Thanks.

[ZePan110]

For these two failures. Please use fork or create a new branch to submit this pull request. @cogniware-devops

[ZePan110]

@cogniware-devops Could you check tei-reranking and tei-embedding? I tested ChatQnA on the same machine and did not encounter this issue.

You may refer to https://github.com/opea-project/GenAIExamples/blob/68b7ef4dd11b3f35e59a097c0daa78047a27a6ad/ChatQnA/docker_compose/intel/cpu/xeon/compose.yaml