fix multiple CVEs by updating brace-expansion to patched versions - #771
Open
sbouchet wants to merge 2 commits into
Open
fix multiple CVEs by updating brace-expansion to patched versions#771sbouchet wants to merge 2 commits into
sbouchet wants to merge 2 commits into
Conversation
Contributor
|
Click here to review and test in web IDE: |
&message=Dev%20cluster%20(for%20maintainers)&logo=eclipseche&color=525C86&labelColor=FDB940)
Contributor
|
Hi! I'm che-ai-assistant — I help with your pull requests. Available commands:
|
Contributor
|
Pull Request images published ✨ Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-771-amd64 |
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>
Extends brace-expansion overrides to all affected packages to fix DoS via unbounded intermediate arrays (CRW-12223). Signed-off-by: Stephane Bouchet <sbouchet@redhat.com> Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
sbouchet
force-pushed
the
CVE-2026-13149
branch
from
August 5, 2026 22:22
03977a9 to
dcf0f66
Compare
sbouchet
marked this pull request as ready for review
August 5, 2026 22:23
sbouchet
requested review from
RomanNikitenko,
azatsarynnyy,
rgrunber and
vitaliy-guliy
as code owners
August 5, 2026 22:23
sbouchet
changed the title
📝 WalkthroughWalkthroughThe pull request updates package override configurations across build, extension, test, and launcher manifests. It pins Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.rebase/CHANGELOG.md:
- Around line 11-24: Add launcher/package.json to the PR `#771` file list in the
`@sbouchet` changelog entry, preserving the existing entries and ordering.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 8414b664-d1f2-4507-b9ae-e5d4b80bf7ae
⛔ Files ignored due to path filters (19)
code/build/npm/gyp/package-lock.jsonis excluded by!**/package-lock.jsoncode/build/package-lock.jsonis excluded by!**/package-lock.jsoncode/extensions/che-api/package-lock.jsonis excluded by!**/package-lock.jsoncode/extensions/che-port/package-lock.jsonis excluded by!**/package-lock.jsoncode/extensions/che-remote/package-lock.jsonis excluded by!**/package-lock.jsoncode/extensions/che-resource-monitor/package-lock.jsonis excluded by!**/package-lock.jsoncode/extensions/copilot/chat-lib/package-lock.jsonis excluded by!**/package-lock.jsoncode/extensions/copilot/package-lock.jsonis excluded by!**/package-lock.jsoncode/extensions/css-language-features/package-lock.jsonis excluded by!**/package-lock.jsoncode/extensions/html-language-features/package-lock.jsonis excluded by!**/package-lock.jsoncode/extensions/json-language-features/package-lock.jsonis excluded by!**/package-lock.jsoncode/extensions/markdown-language-features/package-lock.jsonis excluded by!**/package-lock.jsoncode/extensions/npm/package-lock.jsonis excluded by!**/package-lock.jsoncode/package-lock.jsonis excluded by!**/package-lock.jsoncode/remote/package-lock.jsonis excluded by!**/package-lock.jsoncode/test/automation/package-lock.jsonis excluded by!**/package-lock.jsoncode/test/integration/browser/package-lock.jsonis excluded by!**/package-lock.jsoncode/test/sanity/package-lock.jsonis excluded by!**/package-lock.jsonlauncher/package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (33)
.rebase/CHANGELOG.md.rebase/add/code/build/npm/gyp/package.json.rebase/add/code/build/package.json.rebase/add/code/extensions/copilot/chat-lib/package.json.rebase/add/code/extensions/copilot/package.json.rebase/add/code/extensions/css-language-features/package.json.rebase/add/code/extensions/html-language-features/package.json.rebase/add/code/extensions/json-language-features/package.json.rebase/add/code/extensions/markdown-language-features/package.json.rebase/add/code/extensions/npm/package.json.rebase/add/code/package.json.rebase/add/code/test/automation/package.json.rebase/add/code/test/integration/browser/package.json.rebase/add/code/test/sanity/package.jsoncode/build/npm/gyp/package.jsoncode/build/package.jsoncode/extensions/che-api/package.jsoncode/extensions/che-port/package.jsoncode/extensions/che-remote/package.jsoncode/extensions/che-resource-monitor/package.jsoncode/extensions/copilot/chat-lib/package.jsoncode/extensions/copilot/package.jsoncode/extensions/css-language-features/package.jsoncode/extensions/html-language-features/package.jsoncode/extensions/json-language-features/package.jsoncode/extensions/markdown-language-features/package.jsoncode/extensions/npm/package.jsoncode/package.jsoncode/test/automation/package.jsoncode/test/integration/browser/package.jsoncode/test/sanity/package.jsonlauncher/package.jsonrebase.sh
Comment on lines
+11
to
+24
| #### @sbouchet | ||
| https://github.com/che-incubator/che-code/pull/771 | ||
|
|
||
| - code/package.json | ||
| - code/build/package.json | ||
| - code/build/npm/gyp/package.json | ||
| - code/extensions/copilot/package.json | ||
| - code/extensions/copilot/chat-lib/package.json | ||
| - code/extensions/markdown-language-features/package.json | ||
| - code/extensions/npm/package.json | ||
| - code/test/automation/package.json | ||
| - code/test/integration/browser/package.json | ||
| - code/test/sanity/package.json | ||
| --- |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
Keep the PR #771 file list complete.
The supplied PR context identifies launcher/package.json as a changed launcher manifest, but Lines 14-23 do not list it. Add it to this entry. An incomplete list can leave a changed file without the expected rebase conflict handling.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.rebase/CHANGELOG.md around lines 11 - 24, Add launcher/package.json to the
PR `#771` file list in the `@sbouchet` changelog entry, preserving the existing
entries and ordering.
Contributor
|
Pull Request images published ✨ Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-771-amd64 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
This PR fixes CVE-2026-13149 and CVE-2026-69152
brace-expansionversions are updated to5.0.9,2.1.4and1.1.18What issues does this PR fix?
https://redhat.atlassian.net/browse/CRW-11666
https://redhat.atlassian.net/browse/CRW-12223
How to test this PR?
Does this PR contain changes that override default upstream Code-OSS behavior?
git rebasewere added to the .rebase folderSummary by CodeRabbit
Bug Fixes
Documentation
Chores