fix multiple CVEs by updating ip-adress to patched version by sbouchet · Pull Request #796 · che-incubator/che-code

sbouchet · 2026-08-24T15:09:01Z

What does this PR do?

This PR fixes CVE-2026-69192 and CVE-2026-54272
ip-adress versions is updated to 10.3.1

What issues does this PR fix?

https://redhat.atlassian.net/browse/CRW-12233
https://redhat.atlassian.net/browse/CRW-12161

How to test this PR?

Does this PR contain changes that override default upstream Code-OSS behavior?

the PR contains changes in the code folder (you can skip it if your changes are placed in a che extension )
the corresponding items were added to the CHANGELOG.md file
rules for automatic git rebase were added to the .rebase folder

Summary by CodeRabbit

Maintenance
- Updated networking components across application, extension, remote, test, build, and launcher areas.
- Applied consistent updates across packaged and mirrored configurations.
- Improved package version management for more consistent installations and builds.
Documentation
- Added a changelog entry recording the update and associated release information.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>

github-actions · 2026-08-24T15:09:10Z

Click here to review and test in web IDE:

Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>

coderabbitai · 2026-08-24T15:17:18Z

Warning

Review limit reached

Next included review available in 59 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: edafc7bb-3ac0-4646-8eac-77376e1a5528

📥 Commits

Reviewing files that changed from the base of the PR and between 02a56bb and 30039d2.

⛔ Files ignored due to path filters (2)

code/extensions/copilot/package-lock.json is excluded by !**/package-lock.json
code/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (5)

.rebase/CHANGELOG.md
.rebase/add/code/extensions/copilot/package.json
.rebase/add/code/package.json
code/extensions/copilot/package.json
code/package.json

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 7e7beb88-32b1-4c8f-a217-8799e2ea3e63

📥 Commits

Reviewing files that changed from the base of the PR and between 28467ba and 02a56bb.

⛔ Files ignored due to path filters (8)

code/extensions/che-api/package-lock.json is excluded by !**/package-lock.json
code/extensions/che-commands/package-lock.json is excluded by !**/package-lock.json
code/extensions/che-github-authentication/package-lock.json is excluded by !**/package-lock.json
code/extensions/che-resource-monitor/package-lock.json is excluded by !**/package-lock.json
code/extensions/copilot/package-lock.json is excluded by !**/package-lock.json
code/package-lock.json is excluded by !**/package-lock.json
code/remote/package-lock.json is excluded by !**/package-lock.json
launcher/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (11)

.rebase/CHANGELOG.md
.rebase/add/code/package.json
.rebase/add/code/remote/package.json
code/extensions/che-api/package.json
code/extensions/che-commands/package.json
code/extensions/che-github-authentication/package.json
code/extensions/che-resource-monitor/package.json
code/extensions/copilot/package.json
code/package.json
code/remote/package.json
launcher/package.json

🚧 Files skipped from review as they are similar to previous changes (1)

code/extensions/copilot/package.json

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

Walkthrough

The pull request updates ip-address override constraints from ^10.2.0 to ^10.3.1 across package manifests. It removes the direct js-yaml dependency from the main manifest and adds a js-yaml@4 override requiring ^4.3.1. It also adds a changelog entry for pull request #796.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 02a56

This PR updates dependency declarations and lockfiles to address the listed vulnerabilities; no actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: romannikitenko, azatsarynnyy

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is under 72 characters, uses imperative wording, and describes the dependency update to address CVEs. It contains a minor spelling error in "ip-adress," but the change remains clear.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Rebase Rules For Upstream Changes	✅ Passed	All in-scope `code/` changes have rebase coverage. The PR changes `code/build/npm/gyp/package.json`, `code/extensions/copilot/package.json`, `code/package.json`, `code/remote/package.json`, and `code/…

Full details: Rebase Rules For Upstream Changes

Explanation

All in-scope code/ changes have rebase coverage. The PR changes code/build/npm/gyp/package.json, code/extensions/copilot/package.json, code/package.json, code/remote/package.json, and code/test/mcp/package.json; each has a matching .rebase/add/ rule. .rebase/CHANGELOG.md lists all five files. rebase.sh already contains conflict-routing branches for all five paths, including the base code/package.json handler. Che-only extension changes and lock files are excluded by the check. The PR checklist has all three required boxes checked.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-08-24T15:51:49Z