CVE-2024-5062: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A reflected Cross-Site Scripting (XSS) vulnerability was identified in zenml-io/zenml version 0.57.1. The vulnerability exists due to improper neutralization of input during web page generation, specifically within the survey redirect parameter. This flaw allows an attacker to redirect users to a specified URL after completing a survey, without proper validation of the 'redirect' parameter. Consequently, an attacker can execute arbitrary JavaScript code in the context of the user's browser session. This vulnerability could be exploited to steal cookies, potentially leading to account takeover.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2024-06-30T16:15Z
Repository: https://github.com/zenml-io/zenml
Language: Markdown
Files changed: README.md, RELEASE_NOTES.md, pyproject.toml, src/zenml/VERSION, src/zenml/zen_server/deploy/helm/Chart.yaml, src/zenml/zen_server/deploy/helm/README.md, src/zenml/zen_stores/migrations/versions/0.58.0_release.py
Commit date: 2024-05-27 18:12:08 +0200
Commit message: Prepare release 0.58.0 (#2726)

* Prepare release 0.58.0

* Apply suggestions from code review

Co-authored-by: Alex Strick van Linschoten <strickvl@users.noreply.github.com>

---------

Co-authored-by: Alex Strick van Linschoten <strickvl@users.noreply.github.com>
Diff: diff --git a/README.md b/README.md
index 67fac85399..42b7c0ba28 100644
--- a/README.md
+++ b/README.md
@@ -287,11 +287,11 @@ the Apache License Version 2.0.
     <a href="https://github.com/issues?q=is%3Aopen+is%3Aissue+archived%3Afalse+user%3Azenml-io+label%3A%22good+first+issue%22">Contribute to Open Source</a>
     ·
     <a href="https://github.com/zenml-io/zenml-projects">Projects Showcase</a>
     <br />
     <br />
-    🎉 Version 0.57.1 is out. Check out the release notes
+    🎉 Version 0.58.0 is out. Check out the release notes
     <a href="https://github.com/zenml-io/zenml/releases">here</a>.
     <br />
     🖥️ Download our VS Code Extension <a href="https://marketplace.visualstudio.com/items?itemName=ZenML.zenml-vscode">here</a>.
     <br />
   </p>
diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md
index 5bb6e644fc..e176b4c336 100644
--- a/RELEASE_NOTES.md
+++ b/RELEASE_NOTES.md
@@ -1,7 +1,95 @@
 <!-- markdown-link-check-disable -->
 
+# 0.58.0
+
+## New Annotators
+This release brings in three new integrations for our annotator stack component: [Prodigy](https://prodi.gy/), [Argilla](https://github.com/argilla-io/argilla) and [Pigeon](https://github.com/agermanidis/pigeon).
+* Pigeon works within Jupyter notebooks and supports a limited feature set but is great for 
+experimentation and demos.
+* Argilla works both locally-deployed and when the annotation instance lives in the cloud 
+(i.e. in the Hugging Face Spaces deployment which they recommend).
+* Prodigy is a powerful closed-source annotation tool that allows for efficient data labeling. With this 
+integration, users can now connect ZenML with Prodigy and leverage its annotation capabilities 
+in their ML pipelines.
+
+## Retry configuration for steps
+This release also includes new `retry` configuration for the steps. The following parameters 
+can be set:
+
+- _**max_retries**_: The maximum number of times the step should be retried in case of failure.
+- _**delay**_: The initial delay in seconds before the first retry attempt.
+- _**backoff**_: The factor by which the delay should be multiplied after each retry attempt.
+
+To use this in your code:
+
+```python
+from zenml.config.retry_config import StepRetryConfig
+
+@step(retry=StepRetryConfig(max_retries=3, delay=10, backoff=2))
+def step_3() -> None:
+    # Step implementation
+    raise Exception("This is a test exception")
+```
+
+or using a `config.yaml`:
+
+```yaml
+steps:
+  my_step:
+    retry:
+      max_retries: 3
+      delay: 10
+      backoff: 2
+ ```
+
+In addition, this release includes a number of bug fixes and documentation updates, such
+as a new LLM finetuning template powered by PEFT and BitsAndBytes and instructions for the
+new annotators.
+
+
+## Breaking changes
+* The interface for the base class of the annotator stack component has been updated to 
+account for the fact that not all annotators will launch with a specific URL. So there is 
+no longer an url argument passed in.
+
+## 🥳 Community Contributions 🥳
+
+We'd like to give a special thanks to @christianversloot who contributed to this release 
+by bumping the `mlflow` version to 2.12.2
+
+## What's Changed
+* Add more failure logs for code repositories and build reuse by @schustmi in https://github.com/zenml-io/zenml/pull/2697
+* Prodigy annotator by @strickvl in https://github.com/zenml-io/zenml/pull/2655
+* Bump mlflow support to version 2.12.2 by @christianversloot in https://github.com/zenml-io/zenml/pull/2693
+* add 0.57.1 to migration test scripts by @safoinme in https://github.com/zenml-io/zenml/pull/2702
+* Pigeon annotator by @strickvl in https://github.com/zenml-io/zenml/pull/2641
+* Allow credentials expiry to be configured for service connectors by @stefannica in https://github.com/zenml-io/zenml/pull/2704
+* Argilla annotator by @strickvl in https://github.com/zenml-io/zenml/pull/2687
+* Add `MySQL` and `mariadb` migration tests to Slow CI by @safoinme in https://github.com/zenml-io/zenml/pull/2686
+* Misc small fixes by @schustmi in https://github.com/zenml-io/zenml/pull/2712
+* Allow resetting server and user metadata by @schustmi in https://github.com/zenml-io/zenml/pull/2666
+* Fix Docker failures in the CI by @avishniakov in https://github.com/zenml-io/zenml/pull/2716
+* Add note about helm dependencies by @strickvl in https://github.com/zenml-io/zenml/pull/2709
+* Add retry config for failing steps by @safoinme in https://github.com/zenml-io/zenml/pull/2627
+* Update pyparsing version by @strickvl in https://github.com/zenml-io/zenml/pull/2710
+* New ruff issue by @avishniakov in https://github.com/zenml-io/zenml/pull/2718
+* PEFT LLM Template by @avishniakov in https://github.com/zenml-io/zenml/pull/2719
+* Add `model_version_id` as part of the Model config by @avishniakov in https://github.com/zenml-io/zenml/pull/2703
+* Add more runners to fast CI by @safoinme in https://github.com/zenml-io/zenml/pull/2706
+* Fail faster on notebook installation and only clone / download the branch we need for `zenml go` by @strickvl in https://github.com/zenml-io/zenml/pull/2721
+* Make a clear separation between server and dashboard API in the server configuration by @stefannica in https://github.com/zenml-io/zenml/pull/2722
+* Update pymysql to fix CVE-2024-36039 by @stefannica in https://github.com/zenml-io/zenml/pull/2714
+* Allow specifying privileged mode for Kubernetes orchestrator containers by @schustmi in https://github.com/zenml-io/zenml/pull/2717
+* Don't use pod resources/affinity for kubernetes orchestrator pod by @schustmi in https://github.com/zenml-io/zenml/pull/2707
+* Extra test for artifact listing by @avishniakov in https://github.com/zenml-io/zenml/pull/2715
+* Pipeline run not tracked in cached artifact version by @avishniakov in https://github.com/zenml-io/zenml/pull/2713
+
+
+**Full Changelog**: https://github.com/zenml-io/zenml/compare/0.57.1...0.58.0
+
+
 # 0.57.1
 
 This a minor release that brings a variety of enhancements for
 the new dashboard release, a new update to the LLMOps guide (covering the use of rerankers in RAG pipelines) and [an updated README](README.md). It also introduces some new improvement to the service connectors.
 
diff --git a/pyproject.toml b/pyproject.toml
index 166dc1cba0..07bf014b1c 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,8 +1,8 @@
 [tool.poetry]
 name = "zenml"
-version = "0.57.1"
+version = "0.58.0"
 packages = [{ include = "zenml", from = "src" }]
 description = "ZenML: Write production-ready ML code."
 authors = ["ZenML GmbH <info@zenml.io>"]
 readme = "README.md"
 homepage = "https://zenml.io"
diff --git a/src/zenml/VERSION b/src/zenml/VERSION
index 68e76af0d9..e8f304f8a6 100644
--- a/src/zenml/VERSION
+++ b/src/zenml/VERSION
@@ -1 +1 @@
-0.57.1
\ No newline at end of file
+0.58.0
\ No newline at end of file
diff --git a/src/zenml/zen_server/deploy/helm/Chart.yaml b/src/zenml/zen_server/deploy/helm/Chart.yaml
index 6e3f3795a6..31339b979e 100644
--- a/src/zenml/zen_server/deploy/helm/Chart.yaml
+++ b/src/zenml/zen_server/deploy/helm/Chart.yaml
@@ -1,8 +1,8 @@
 apiVersion: v2
 name: zenml
-version: "0.57.1"
+version: "0.58.0"
 description: Open source MLOps framework for portable production ready ML pipelines
 keywords:
 - mlops
 - zenml
 - server
diff --git a/src/zenml/zen_server/deploy/helm/README.md b/src/zenml/zen_server/deploy/helm/README.md
index a49b549bf8..25ac1a1a68 100644
--- a/src/zenml/zen_server/deploy/helm/README.md
+++ b/src/zenml/zen_server/deploy/helm/README.md
@@ -18,12 +18,12 @@ ZenML is an open-source MLOps framework designed to help you create robust, main
 ### Install the Chart
 
 To install the ZenML chart directly from Amazon ECR, use the following command:
 
 ```bash
-# example command for version 0.57.1
-helm install my-zenml oci://public.ecr.aws/zenml/zenml --version 0.57.1
+# example command for version 0.58.0
+helm install my-zenml oci://public.ecr.aws/zenml/zenml --version 0.58.0
 ```
 
 Note: Ensure you have OCI support enabled in your Helm client and that you are authenticated with Amazon ECR.
 
 ## Configuration
diff --git a/src/zenml/zen_stores/migrations/versions/0.58.0_release.py b/src/zenml/zen_stores/migrations/versions/0.58.0_release.py
new file mode 100644
index 0000000000..fdb901c58d
--- /dev/null
+++ b/src/zenml/zen_stores/migrations/versions/0.58.0_release.py
@@ -0,0 +1,23 @@
+"""Release [0.58.0].
+
+Revision ID: 0.58.0
+Revises: 0.57.1
+Create Date: 2024-05-27 15:22:16.565094
+
+"""
+
+# revision identifiers, used by Alembic.
+revision = "0.58.0"
+down_revision = "0.57.1"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    """Upgrade database schema and/or data, creating a new revision."""
+    pass
+
+
+def downgrade() -> None:
+    """Downgrade database schema and/or data back to the previous revision."""
+    pass

Vulnerable code:     🎉 Version 0.57.1 is out. Check out the release notes
version = "0.57.1"
0.57.1
version: "0.57.1"
# example command for version 0.57.1
helm install my-zenml oci://public.ecr.aws/zenml/zenml --version 0.57.1
Fixed code:     🎉 Version 0.58.0 is out. Check out the release notes
# 0.58.0

## New Annotators
This release brings in three new integrations for our annotator stack component: [Prodigy](https://prodi.gy/), [Argilla](https://github.com/argilla-io/argilla) and [Pigeon](https://github.com/agermanidis/pigeon).
* Pigeon works within Jupyter notebooks and supports a limited feature set but is great for 
experimentation and demos.
* Argilla works both locally-deployed and when the annotation instance lives in the cloud 
(i.e. in the Hugging Face Spaces deployment which they recommend).
* Prodigy is a powerful closed-source annotation tool that allows for efficient data labeling. With this 
integration, users can now connect ZenML with Prodigy and leverage its annotation capabilities 
in their ML pipelines.

## Retry configuration for steps
This release also includes new `retry` configuration for the steps. The following parameters 
can be set:

- _**max_retries**_: The maximum number of times the step should be retried in case of failure.
- _**delay**_: The initial delay in seconds before the first retry attempt.
- _**backoff**_: The factor by which the delay should be multiplied after each retry attempt.

To use this in your code:

```python
from zenml.config.retry_config import StepRetryConfig

@step(retry=StepRetryConfig(max_retries=3, delay=10, backoff=2))
def step_3() -> None:
    # Step implementation
    raise Exception("This is a test exception")
```

or using a `config.yaml`:

```yaml
steps:
  my_step:
    retry:
      max_retries: 3
      delay: 10
      backoff: 2
 ```

In addition, this release includes a number of bug fixes and documentation updates, such
as a new LLM finetuning template powered by PEFT and BitsAndBytes and instructions for the
new annotators.


## Breaking changes
* The interface for the base class of the annotator stack component has been updated to 
account for the fact that not all annotators will launch with a specific URL. So there is 
no longer an url argument passed in.

## 🥳 Community Contributions 🥳

We'd like to give a special thanks to @christianversloot who contributed to this release 
by bumping the `mlflow` version to 2.12.2

## What's Changed
* Add more failure logs for code repositories and build reuse by @schustmi in https://github.com/zenml-io/zenml/pull/2697
* Prodigy annotator by @strickvl in https://github.com/zenml-io/zenml/pull/2655
* Bump mlflow support to version 2.12.2 by @christianversloot in https://github.com/zenml-io/zenml/pull/2693
* add 0.57.1 to migration test scripts by @safoinme in https://github.com/zenml-io/zenml/pull/2702
* Pigeon annotator by @strickvl in https://github.com/zenml-io/zenml/pull/2641
* Allow credentials expiry to be configured for service connectors by @stefannica in https://github.com/zenml-io/zenml/pull/2704
* Argilla annotator by @strickvl in https://github.com/zenml-io/zenml/pull/2687
* Add `MySQL` and `mariadb` migration tests to Slow CI by @safoinme in https://github.com/zenml-io/zenml/pull/2686
* Misc small fixes by @schustmi in https://github.com/zenml-io/zenml/pull/2712
* Allow resetting server and user metadata by @schustmi in https://github.com/zenml-io/zenml/pull/2666
* Fix Docker failures in the CI by @avishniakov in https://github.com/zenml-io/zenml/pull/2716
* Add note about helm dependencies by @strickvl in https://github.com/zenml-io/zenml/pull/2709
* Add retry config for failing steps by @safoinme in https://github.com/zenml-io/zenml/pull/2627
* Update pyparsing version by @strickvl in https://github.com/zenml-io/zenml/pull/2710
* New ruff issue by @avishniakov in https://github.com/zenml-io/zenml/pull/2718
* PEFT LLM Template by @avishniakov in https://github.com/zenml-io/zenml/pull/2719
* Add `model_version_id` as part of the Model config by @avishniakov in https://github.com/zenml-io/zenml/pull/2703
* Add more runners to fast CI by @safoinme in https://github.com/zenml-io/zenml/pull/2706
* Fail faster on notebook installation and only clone / download the branch we need for `zenml go` by @strickvl in https://github.com/zenml-io/zenml/pull/2721
* Make a clear separation between server and dashboard API in the server configuration by @stefannica in https://github.com/zenml-io/zenml/pull/2722
* Update pymysql to fix CVE-2024-36039 by @stefannica in https://github.com/zenml-io/zenml/pull/2714
* Allow specifying privileged mode for Kubernetes orchestrator containers by @schustmi in https://github.com/zenml-io/zenml/pull/2717
* Don't use pod resources/affinity for kubernetes orchestrator pod by @schustmi in https://github.com/zenml-io/zenml/pull/2707
* Extra test for artifact listing by @avishniakov in https://github.com/zenml-io/zenml/pull/2715
* Pipeline run not tracked in cached artifact version by @avishniakov in https://github.com/zenml-io/zenml/pull/2713


**Full Changelog**: https://github.com/zenml-io/zenml/compare/0.57.1...0.58.0


version = "0.58.0"
0.58.0
version: "0.58.0"
# example command for version 0.58.0
helm install my-zenml oci://public.ecr.aws/zenml/zenml --version 0.58.0
"""Release [0.58.0].

Revision ID: 0.58.0
Revises: 0.57.1
Create Date: 2024-05-27 15:22:16.565094

"""

# revision identifiers, used by Alembic.
revision = "0.58.0"
down_revision = "0.57.1"
branch_labels = None
depends_on = None


def upgrade() -> None:
    """Upgrade database schema and/or data, creating a new revision."""
    pass


def downgrade() -> None:
    """Downgrade database schema and/or data back to the previous revision."""
    pass