fix multiple CVEs by updating brace-expansion to patched versions by sbouchet · Pull Request #771 · che-incubator/che-code

sbouchet · 2026-07-24T20:20:58Z

What does this PR do?

This PR fixes CVE-2026-13149 and CVE-2026-69152

brace-expansion versions are updated to 5.0.9, 2.1.4 and 1.1.18

What issues does this PR fix?

https://redhat.atlassian.net/browse/CRW-11666
https://redhat.atlassian.net/browse/CRW-12223

How to test this PR?

Does this PR contain changes that override default upstream Code-OSS behavior?

the PR contains changes in the code folder (you can skip it if your changes are placed in a che extension )
the corresponding items were added to the CHANGELOG.md file
rules for automatic git rebase were added to the .rebase folder

Summary by CodeRabbit

Bug Fixes
- Updated bundled dependency versions and compatibility rules to improve reliability.
- Standardized dependency handling across development, testing, extension, and launcher components.
Documentation
- Corrected changelog text and added missing release entries.
Chores
- Improved automated conflict resolution for package configuration updates.
- Applied consistent dependency version controls across supported components and tooling.

github-actions · 2026-07-24T20:21:07Z

Click here to review and test in web IDE:

tolusha · 2026-07-24T20:23:00Z

Hi! I'm che-ai-assistant — I help with your pull requests.

Available commands:

/che-ai-assistant generate-che-doc — Generate a documentation PR based on this PR's changes
/che-ai-assistant ok-pr-review — Run a comprehensive PR review (summary, code review, deep review, impact analysis)
/che-ai-assistant check-pr-test-failures — Analyze failing CI checks, identify root causes, and suggest fixes
/che-ai-assistant update-che-e2e-tests — Update Eclipse Che e2e tests
/che-ai-assistant claude — Run a free-form instruction on this PR
/che-ai-assistant help — Show this help message

github-actions · 2026-07-27T20:28:01Z

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-771-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-771-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-771-dev-amd64

coderabbitai · 2026-08-05T22:31:36Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 55aa43d6-d974-4726-8f77-351228867147

📥 Commits

Reviewing files that changed from the base of the PR and between 198d112 and e28e998.

⛔ Files ignored due to path filters (3)

code/build/npm/gyp/package-lock.json is excluded by !**/package-lock.json
code/extensions/copilot/package-lock.json is excluded by !**/package-lock.json
code/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (5)

.rebase/CHANGELOG.md
.rebase/add/code/build/npm/gyp/package.json
code/build/npm/gyp/package.json
code/extensions/copilot/package.json
code/package.json

🚧 Files skipped from review as they are similar to previous changes (4)

code/package.json
code/build/npm/gyp/package.json
.rebase/add/code/build/npm/gyp/package.json
code/extensions/copilot/package.json

📝 Walkthrough

Walkthrough

The pull request updates package override configurations across build, extension, test, and launcher manifests. It pins brace-expansion major versions 1 and 2 and updates version 5 from 5.0.7 to 5.0.9. It adds rebase conflict handlers for three package manifests. It also corrects and extends .rebase/CHANGELOG.md.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

che-incubator/che-code#745: Extends earlier brace-expansion override changes in the same package manifests.
che-incubator/che-code#756: Implements related npm dependency remediation workflows.
che-incubator/che-code#669: Updates rebase.sh conflict-resolution rules for package manifests.

Suggested reviewers: azatsarynnyy, rgrunber, vitaliy-guliy

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise, uses imperative mood, and clearly describes updating brace-expansion to patched versions for CVE fixes.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Rebase Rules For Upstream Changes	✅ Passed	All 13 qualifying code package files have corresponding .rebase rules and rebase.sh routes; .rebase/CHANGELOG.md contains the PR `#771` entry.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.rebase/CHANGELOG.md:
- Around line 11-24: Add launcher/package.json to the PR `#771` file list in the
`@sbouchet` changelog entry, preserving the existing entries and ordering.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 8414b664-d1f2-4507-b9ae-e5d4b80bf7ae

📥 Commits

Reviewing files that changed from the base of the PR and between 9d00081 and dcf0f66.

⛔ Files ignored due to path filters (19)

code/build/npm/gyp/package-lock.json is excluded by !**/package-lock.json
code/build/package-lock.json is excluded by !**/package-lock.json
code/extensions/che-api/package-lock.json is excluded by !**/package-lock.json
code/extensions/che-port/package-lock.json is excluded by !**/package-lock.json
code/extensions/che-remote/package-lock.json is excluded by !**/package-lock.json
code/extensions/che-resource-monitor/package-lock.json is excluded by !**/package-lock.json
code/extensions/copilot/chat-lib/package-lock.json is excluded by !**/package-lock.json
code/extensions/copilot/package-lock.json is excluded by !**/package-lock.json
code/extensions/css-language-features/package-lock.json is excluded by !**/package-lock.json
code/extensions/html-language-features/package-lock.json is excluded by !**/package-lock.json
code/extensions/json-language-features/package-lock.json is excluded by !**/package-lock.json
code/extensions/markdown-language-features/package-lock.json is excluded by !**/package-lock.json
code/extensions/npm/package-lock.json is excluded by !**/package-lock.json
code/package-lock.json is excluded by !**/package-lock.json
code/remote/package-lock.json is excluded by !**/package-lock.json
code/test/automation/package-lock.json is excluded by !**/package-lock.json
code/test/integration/browser/package-lock.json is excluded by !**/package-lock.json
code/test/sanity/package-lock.json is excluded by !**/package-lock.json
launcher/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (33)

.rebase/CHANGELOG.md
.rebase/add/code/build/npm/gyp/package.json
.rebase/add/code/build/package.json
.rebase/add/code/extensions/copilot/chat-lib/package.json
.rebase/add/code/extensions/copilot/package.json
.rebase/add/code/extensions/css-language-features/package.json
.rebase/add/code/extensions/html-language-features/package.json
.rebase/add/code/extensions/json-language-features/package.json
.rebase/add/code/extensions/markdown-language-features/package.json
.rebase/add/code/extensions/npm/package.json
.rebase/add/code/package.json
.rebase/add/code/test/automation/package.json
.rebase/add/code/test/integration/browser/package.json
.rebase/add/code/test/sanity/package.json
code/build/npm/gyp/package.json
code/build/package.json
code/extensions/che-api/package.json
code/extensions/che-port/package.json
code/extensions/che-remote/package.json
code/extensions/che-resource-monitor/package.json
code/extensions/copilot/chat-lib/package.json
code/extensions/copilot/package.json
code/extensions/css-language-features/package.json
code/extensions/html-language-features/package.json
code/extensions/json-language-features/package.json
code/extensions/markdown-language-features/package.json
code/extensions/npm/package.json
code/package.json
code/test/automation/package.json
code/test/integration/browser/package.json
code/test/sanity/package.json
launcher/package.json
rebase.sh

github-actions · 2026-08-05T23:02:24Z

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-771-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-771-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-771-dev-amd64

RomanNikitenko

@sbouchet
I've got git changes when I built che-code:

che-code dockerfiles use v24.18.0 Node.js
could you try to rebuild che-code using v24.18.0 vestion?

RomanNikitenko

other looks good to me

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>

Extends brace-expansion overrides to all affected packages to fix DoS via unbounded intermediate arrays (CRW-12223). Signed-off-by: Stephane Bouchet <sbouchet@redhat.com> Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>

coderabbitai · 2026-08-06T13:13:39Z

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

github-actions · 2026-08-06T13:49:50Z

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-771-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-771-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-771-dev-amd64

github-actions · 2026-08-07T15:51:09Z

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-771-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-771-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-771-dev-amd64

sbouchet force-pushed the CVE-2026-13149 branch from 03977a9 to dcf0f66 Compare August 5, 2026 22:22

sbouchet marked this pull request as ready for review August 5, 2026 22:23

sbouchet requested review from RomanNikitenko, azatsarynnyy, rgrunber and vitaliy-guliy as code owners August 5, 2026 22:23

sbouchet changed the title ~~fix: override brace-expansion to patched versions~~ fix multiple CVEs by updating brace-expansion to patched versions Aug 5, 2026

coderabbitai Bot reviewed Aug 5, 2026

View reviewed changes

Comment thread .rebase/CHANGELOG.md

RomanNikitenko reviewed Aug 6, 2026

View reviewed changes

RomanNikitenko approved these changes Aug 6, 2026

View reviewed changes

sbouchet and others added 3 commits August 6, 2026 08:11

fix: override brace-expansion to patched versions (CVE-2026-13149)

9d5c6b1

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>

regen with NodeJs 24.18

198d112

Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>

sbouchet force-pushed the CVE-2026-13149 branch from dcf0f66 to 198d112 Compare August 6, 2026 13:13

Merge branch 'main' into CVE-2026-13149

e28e998

sbouchet mentioned this pull request Aug 7, 2026

[7.121] fix multiple CVEs by updating brace-expansion to patched versions #783

Open

3 tasks

coderabbitai Bot mentioned this pull request Aug 7, 2026

fix: override js-yaml to patched versions #777

Open

3 tasks

Navigation Menu

Uh oh!

fix multiple CVEs by updating brace-expansion to patched versions - #771

fix multiple CVEs by updating brace-expansion to patched versions#771
sbouchet wants to merge 4 commits into
che-incubator:mainfrom
sbouchet:CVE-2026-13149

sbouchet commented Jul 24, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

github-actions Bot commented Jul 24, 2026 •

edited

Loading

Uh oh!

tolusha commented Jul 24, 2026

Uh oh!

github-actions Bot commented Jul 27, 2026

Uh oh!

coderabbitai Bot commented Aug 5, 2026 •

edited

Loading

Walkthrough

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

github-actions Bot commented Aug 5, 2026

Uh oh!

RomanNikitenko left a comment

Uh oh!

RomanNikitenko left a comment

Uh oh!

coderabbitai Bot commented Aug 6, 2026

Uh oh!

github-actions Bot commented Aug 6, 2026

Uh oh!

github-actions Bot commented Aug 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

sbouchet commented Jul 24, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

What issues does this PR fix?

How to test this PR?

Does this PR contain changes that override default upstream Code-OSS behavior?

Summary by CodeRabbit

Uh oh!

github-actions Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tolusha commented Jul 24, 2026

Uh oh!

github-actions Bot commented Jul 27, 2026

Uh oh!

coderabbitai Bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot commented Aug 5, 2026

Uh oh!

RomanNikitenko left a comment

Choose a reason for hiding this comment

Uh oh!

RomanNikitenko left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot commented Aug 6, 2026

Uh oh!

github-actions Bot commented Aug 6, 2026

Uh oh!

github-actions Bot commented Aug 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

sbouchet commented Jul 24, 2026 •

edited by coderabbitai Bot

Loading

github-actions Bot commented Jul 24, 2026 •

edited

Loading

coderabbitai Bot commented Aug 5, 2026 •

edited

Loading