From 9d5c6b15a33c89dd23f7c558a5fc4003ef6bf070 Mon Sep 17 00:00:00 2001 From: Stephane Bouchet Date: Fri, 24 Jul 2026 15:13:25 -0500 Subject: [PATCH 1/3] fix: override brace-expansion to patched versions (CVE-2026-13149) Co-Authored-By: Claude Opus 4.6 Signed-off-by: Stephane Bouchet --- .rebase/CHANGELOG.md | 12 ++++- .../add/code/extensions/copilot/package.json | 5 +++ .rebase/add/code/package.json | 5 +++ code/build/npm/gyp/package-lock.json | 6 +-- code/build/npm/gyp/package.json | 3 +- code/build/package-lock.json | 6 +-- code/build/package.json | 3 +- code/extensions/che-api/package-lock.json | 6 +-- code/extensions/che-api/package.json | 3 +- code/extensions/che-port/package-lock.json | 6 +-- code/extensions/che-port/package.json | 3 +- code/extensions/che-remote/package-lock.json | 7 +-- code/extensions/che-remote/package.json | 3 +- .../che-resource-monitor/package-lock.json | 6 +-- .../che-resource-monitor/package.json | 3 +- .../copilot/chat-lib/package-lock.json | 6 +-- code/extensions/copilot/chat-lib/package.json | 1 + code/extensions/copilot/package-lock.json | 24 +++++----- code/extensions/copilot/package.json | 2 + .../package-lock.json | 6 +-- .../markdown-language-features/package.json | 3 ++ code/extensions/npm/package-lock.json | 6 +-- code/extensions/npm/package.json | 3 ++ code/package-lock.json | 45 ++++++++++--------- code/package.json | 2 + code/remote/package-lock.json | 3 ++ code/test/automation/package-lock.json | 6 +-- code/test/automation/package.json | 3 +- .../integration/browser/package-lock.json | 6 +-- code/test/integration/browser/package.json | 3 ++ code/test/sanity/package-lock.json | 6 +-- code/test/sanity/package.json | 3 +- launcher/package.json | 3 +- 33 files changed, 128 insertions(+), 80 deletions(-) diff --git a/.rebase/CHANGELOG.md b/.rebase/CHANGELOG.md index 004107ea8370..aaa7a271d815 100644 --- a/.rebase/CHANGELOG.md +++ b/.rebase/CHANGELOG.md @@ -1,6 +1,6 @@ -# che-code chagelog +# che-code changelog -The file to keep a list of changed files which will potentionaly help to resolve rebase conflicts. +The file to keep a list of changed files which will potentially help to resolve rebase conflicts. #### @rnikitenko https://github.com/che-incubator/che-code/commit/177a26a8ef76ea41a26eb6ac0ef9d6006b9af53e @@ -8,6 +8,13 @@ https://github.com/che-incubator/che-code/commit/177a26a8ef76ea41a26eb6ac0ef9d60 - code/src/vs/workbench/services/configuration/browser/configurationService.ts --- +#### @sbouchet +https://github.com/che-incubator/che-code/pull/771 + +- code/package.json +- code/extensions/copilot/package.json +--- + #### @sbouchet https://github.com/che-incubator/che-code/pull/750 @@ -15,6 +22,7 @@ https://github.com/che-incubator/che-code/pull/750 - code/extensions/copilot/chat-lib/package.json --- +#### @sbouchet https://github.com/che-incubator/che-code/pull/745 - code/package.json diff --git a/.rebase/add/code/extensions/copilot/package.json b/.rebase/add/code/extensions/copilot/package.json index 043bb9c2ebd6..0463742ac194 100644 --- a/.rebase/add/code/extensions/copilot/package.json +++ b/.rebase/add/code/extensions/copilot/package.json @@ -4,6 +4,11 @@ "qs": "6.15.2", "ip-address": "^10.2.0", "ws": "^8.21.0", + "webdriver": { + "undici@6": "^6.27.0" + }, + "brace-expansion@1": "^1.1.18", + "brace-expansion@2": "^2.1.4", "brace-expansion@5": "5.0.7", "form-data@4": "^4.0.6", "@vscode/vsce": { diff --git a/.rebase/add/code/package.json b/.rebase/add/code/package.json index d3e5cb3c6c5b..619388b57a91 100644 --- a/.rebase/add/code/package.json +++ b/.rebase/add/code/package.json @@ -18,6 +18,11 @@ "shell-quote": "^1.8.4", "qs": "6.15.2", "ip-address": "^10.2.0", + "webdriver": { + "undici@6": "^6.27.0" + }, + "brace-expansion@1": "^1.1.18", + "brace-expansion@2": "^2.1.4", "test-exclude": { "brace-expansion@5": "5.0.7" }, diff --git a/code/build/npm/gyp/package-lock.json b/code/build/npm/gyp/package-lock.json index 7533caf0666f..38c46d7b0451 100644 --- a/code/build/npm/gyp/package-lock.json +++ b/code/build/npm/gyp/package-lock.json @@ -138,9 +138,9 @@ "license": "MIT" }, "node_modules/brace-expansion": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz", - "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", "dev": true, "license": "MIT", "dependencies": { diff --git a/code/build/npm/gyp/package.json b/code/build/npm/gyp/package.json index 7276ab0f3964..450b6733340e 100644 --- a/code/build/npm/gyp/package.json +++ b/code/build/npm/gyp/package.json @@ -7,7 +7,8 @@ "node-gyp": "^11.2.0" }, "overrides": { - "ip-address": "^10.2.0" + "ip-address": "^10.2.0", + "brace-expansion@2": "^2.1.4" }, "scripts": {} } diff --git a/code/build/package-lock.json b/code/build/package-lock.json index 0502d3c5ebaf..7ad7dae224ec 100644 --- a/code/build/package-lock.json +++ b/code/build/package-lock.json @@ -6762,9 +6762,9 @@ } }, "node_modules/vscode-universal-bundler/node_modules/brace-expansion": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz", - "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", "dev": true, "license": "MIT", "dependencies": { diff --git a/code/build/package.json b/code/build/package.json index 61623814e8c5..31ee44d82b85 100644 --- a/code/build/package.json +++ b/code/build/package.json @@ -86,6 +86,7 @@ "brace-expansion": "5.0.7", "form-data": "^4.0.6" }, - "form-data@4": "^4.0.6" + "form-data@4": "^4.0.6", + "brace-expansion@2": "^2.1.4" } } diff --git a/code/extensions/che-api/package-lock.json b/code/extensions/che-api/package-lock.json index e23bfaa05eaa..6aa0d4314334 100644 --- a/code/extensions/che-api/package-lock.json +++ b/code/extensions/che-api/package-lock.json @@ -1566,9 +1566,9 @@ } }, "node_modules/brace-expansion": { - "version": "1.1.12", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz", - "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==", + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", "dev": true, "license": "MIT", "dependencies": { diff --git a/code/extensions/che-api/package.json b/code/extensions/che-api/package.json index 1fa470ae9283..c5d124e8c9d7 100644 --- a/code/extensions/che-api/package.json +++ b/code/extensions/che-api/package.json @@ -68,7 +68,8 @@ }, "axios": { "form-data": "^4.0.6" - } + }, + "brace-expansion@1": "^1.1.18" }, "repository": { "type": "git", diff --git a/code/extensions/che-port/package-lock.json b/code/extensions/che-port/package-lock.json index f1c08035f98b..e000ea912c8c 100644 --- a/code/extensions/che-port/package-lock.json +++ b/code/extensions/che-port/package-lock.json @@ -1302,9 +1302,9 @@ } }, "node_modules/brace-expansion": { - "version": "1.1.12", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz", - "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==", + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", "dev": true, "license": "MIT", "dependencies": { diff --git a/code/extensions/che-port/package.json b/code/extensions/che-port/package.json index d4231d8de533..0f8d29c7fbde 100644 --- a/code/extensions/che-port/package.json +++ b/code/extensions/che-port/package.json @@ -52,7 +52,8 @@ "form-data@2": "^2.5.6" }, "minimatch": "^3.1.5", - "handlebars": "4.7.9" + "handlebars": "4.7.9", + "brace-expansion@1": "^1.1.18" }, "repository": { "type": "git", diff --git a/code/extensions/che-remote/package-lock.json b/code/extensions/che-remote/package-lock.json index b416d2de5768..c1633ee5f369 100644 --- a/code/extensions/che-remote/package-lock.json +++ b/code/extensions/che-remote/package-lock.json @@ -1697,10 +1697,11 @@ } }, "node_modules/brace-expansion": { - "version": "1.1.11", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz", - "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==", + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", "dev": true, + "license": "MIT", "dependencies": { "balanced-match": "^1.0.0", "concat-map": "0.0.1" diff --git a/code/extensions/che-remote/package.json b/code/extensions/che-remote/package.json index ab71b1ceda7c..5125fbc03c52 100644 --- a/code/extensions/che-remote/package.json +++ b/code/extensions/che-remote/package.json @@ -65,7 +65,8 @@ "flatted": "^3.4.2", "axios": { "form-data": "^4.0.6" - } + }, + "brace-expansion@1": "^1.1.18" }, "repository": { "type": "git", diff --git a/code/extensions/che-resource-monitor/package-lock.json b/code/extensions/che-resource-monitor/package-lock.json index 20404f96c8ec..e0e18dc8d182 100644 --- a/code/extensions/che-resource-monitor/package-lock.json +++ b/code/extensions/che-resource-monitor/package-lock.json @@ -1553,9 +1553,9 @@ } }, "node_modules/brace-expansion": { - "version": "1.1.12", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz", - "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==", + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", "dev": true, "license": "MIT", "dependencies": { diff --git a/code/extensions/che-resource-monitor/package.json b/code/extensions/che-resource-monitor/package.json index 49c5d83e82ed..348e76c8ec0e 100644 --- a/code/extensions/che-resource-monitor/package.json +++ b/code/extensions/che-resource-monitor/package.json @@ -59,7 +59,8 @@ }, "@types/node-fetch": { "form-data": "^4.0.6" - } + }, + "brace-expansion@1": "^1.1.18" }, "repository": { "type": "git", diff --git a/code/extensions/copilot/chat-lib/package-lock.json b/code/extensions/copilot/chat-lib/package-lock.json index 75a527bb1fbc..5314eb86f35a 100644 --- a/code/extensions/copilot/chat-lib/package-lock.json +++ b/code/extensions/copilot/chat-lib/package-lock.json @@ -1638,9 +1638,9 @@ "dev": true }, "node_modules/brace-expansion": { - "version": "1.1.14", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz", - "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==", + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", "dev": true, "license": "MIT", "dependencies": { diff --git a/code/extensions/copilot/chat-lib/package.json b/code/extensions/copilot/chat-lib/package.json index f397c5e9163c..b2ba7ec19c95 100644 --- a/code/extensions/copilot/chat-lib/package.json +++ b/code/extensions/copilot/chat-lib/package.json @@ -71,6 +71,7 @@ }, "overrides": { "shell-quote": "^1.8.4", + "brace-expansion@1": "^1.1.18", "minimatch@10": { "brace-expansion": "5.0.7" } diff --git a/code/extensions/copilot/package-lock.json b/code/extensions/copilot/package-lock.json index 3a3fc30200b7..8e4217649b4f 100644 --- a/code/extensions/copilot/package-lock.json +++ b/code/extensions/copilot/package-lock.json @@ -6497,9 +6497,9 @@ } }, "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz", - "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", "dev": true, "license": "MIT", "dependencies": { @@ -7011,9 +7011,9 @@ } }, "node_modules/@vscode/test-cli/node_modules/brace-expansion": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz", - "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", "dev": true, "license": "MIT", "dependencies": { @@ -8097,9 +8097,9 @@ "license": "BSD-2-Clause" }, "node_modules/brace-expansion": { - "version": "1.1.13", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz", - "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==", + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", "dev": true, "license": "MIT", "dependencies": { @@ -12734,9 +12734,9 @@ } }, "node_modules/mocha/node_modules/brace-expansion": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz", - "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", "dev": true, "license": "MIT", "dependencies": { diff --git a/code/extensions/copilot/package.json b/code/extensions/copilot/package.json index 497ff5f3fac5..d64e946bc04c 100644 --- a/code/extensions/copilot/package.json +++ b/code/extensions/copilot/package.json @@ -7252,6 +7252,8 @@ "qs": "6.15.2", "ip-address": "^10.2.0", "ws": "^8.21.0", + "brace-expansion@1": "^1.1.18", + "brace-expansion@2": "^2.1.4", "brace-expansion@5": "5.0.7", "form-data@4": "^4.0.6", "@vscode/vsce": { diff --git a/code/extensions/markdown-language-features/package-lock.json b/code/extensions/markdown-language-features/package-lock.json index 13bdb2e042cc..39aeb3014253 100644 --- a/code/extensions/markdown-language-features/package-lock.json +++ b/code/extensions/markdown-language-features/package-lock.json @@ -661,9 +661,9 @@ "license": "ISC" }, "node_modules/brace-expansion": { - "version": "1.1.13", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz", - "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==", + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", "license": "MIT", "dependencies": { "balanced-match": "^1.0.0", diff --git a/code/extensions/markdown-language-features/package.json b/code/extensions/markdown-language-features/package.json index 45c08f7dc560..72e1aa119ef6 100644 --- a/code/extensions/markdown-language-features/package.json +++ b/code/extensions/markdown-language-features/package.json @@ -927,6 +927,9 @@ "vscode-languageserver-types": "^3.17.2", "vscode-markdown-languageservice": "0.5.0" }, + "overrides": { + "brace-expansion@1": "^1.1.18" + }, "repository": { "type": "git", "url": "https://github.com/microsoft/vscode.git" diff --git a/code/extensions/npm/package-lock.json b/code/extensions/npm/package-lock.json index e530dc602695..9375cebc44a6 100644 --- a/code/extensions/npm/package-lock.json +++ b/code/extensions/npm/package-lock.json @@ -63,9 +63,9 @@ "integrity": "sha1-ibTRmasr7kneFk6gK4nORi1xt2c= sha512-9Y0g0Q8rmSt+H33DfKv7FOc3v+iRI+o1lbzt8jGcIosYW37IIW/2XVYq5NPdmaD5NQ59Nk26Kl/vZbwW9Fr8vg==" }, "node_modules/brace-expansion": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz", - "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", "license": "MIT", "dependencies": { "balanced-match": "^1.0.0" diff --git a/code/extensions/npm/package.json b/code/extensions/npm/package.json index 6964d702e1d9..4326944e9de0 100644 --- a/code/extensions/npm/package.json +++ b/code/extensions/npm/package.json @@ -384,6 +384,9 @@ } ] }, + "overrides": { + "brace-expansion@2": "^2.1.4" + }, "repository": { "type": "git", "url": "https://github.com/microsoft/vscode.git" diff --git a/code/package-lock.json b/code/package-lock.json index d93adf0aa529..618ab0fe758b 100644 --- a/code/package-lock.json +++ b/code/package-lock.json @@ -2889,9 +2889,9 @@ } }, "node_modules/@ts-morph/common/node_modules/brace-expansion": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz", - "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", "dev": true, "license": "MIT", "dependencies": { @@ -3410,9 +3410,9 @@ } }, "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz", - "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", "dev": true, "license": "MIT", "dependencies": { @@ -3812,9 +3812,9 @@ } }, "node_modules/@vscode/l10n-dev/node_modules/brace-expansion": { - "version": "2.1.2", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz", - "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", "dev": true, "license": "MIT", "dependencies": { @@ -4077,9 +4077,9 @@ } }, "node_modules/@vscode/test-cli/node_modules/brace-expansion": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz", - "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", "dev": true, "license": "MIT", "dependencies": { @@ -5523,9 +5523,9 @@ "dev": true }, "node_modules/brace-expansion": { - "version": "1.1.13", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz", - "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==", + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", "dev": true, "license": "MIT", "dependencies": { @@ -13276,9 +13276,9 @@ } }, "node_modules/mocha/node_modules/brace-expansion": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz", - "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", "dev": true, "license": "MIT", "dependencies": { @@ -16449,6 +16449,9 @@ "nan": "^2.23.0" } }, + "node_modules/ssh2/node_modules/cpu-features": { + "optional": true + }, "node_modules/stable": { "version": "0.1.8", "resolved": "https://registry.npmjs.org/stable/-/stable-0.1.8.tgz", @@ -17191,9 +17194,9 @@ "license": "MIT" }, "node_modules/test-exclude/node_modules/glob/node_modules/brace-expansion": { - "version": "2.1.2", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz", - "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", "dev": true, "license": "MIT", "dependencies": { diff --git a/code/package.json b/code/package.json index 4a2d86c46f1a..7f03bfaedbed 100644 --- a/code/package.json +++ b/code/package.json @@ -292,6 +292,8 @@ "shell-quote": "^1.8.4", "qs": "6.15.2", "ip-address": "^10.2.0", + "brace-expansion@1": "^1.1.18", + "brace-expansion@2": "^2.1.4", "test-exclude": { "brace-expansion@5": "5.0.7" }, diff --git a/code/remote/package-lock.json b/code/remote/package-lock.json index a168b8f5a35f..392a21cc14b0 100644 --- a/code/remote/package-lock.json +++ b/code/remote/package-lock.json @@ -2205,6 +2205,9 @@ "nan": "^2.23.0" } }, + "node_modules/ssh2/node_modules/cpu-features": { + "optional": true + }, "node_modules/stream-buffers": { "version": "3.0.3", "resolved": "https://registry.npmjs.org/stream-buffers/-/stream-buffers-3.0.3.tgz", diff --git a/code/test/automation/package-lock.json b/code/test/automation/package-lock.json index 7865e34b97b9..a79b53b28e35 100644 --- a/code/test/automation/package-lock.json +++ b/code/test/automation/package-lock.json @@ -114,9 +114,9 @@ } }, "node_modules/brace-expansion": { - "version": "1.1.13", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz", - "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==", + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", "dev": true, "license": "MIT", "dependencies": { diff --git a/code/test/automation/package.json b/code/test/automation/package.json index f3c3fd610209..8cdabb2c03e0 100644 --- a/code/test/automation/package.json +++ b/code/test/automation/package.json @@ -33,6 +33,7 @@ "npm-run-all2": "^8.0.4" }, "overrides": { - "shell-quote": "^1.8.4" + "shell-quote": "^1.8.4", + "brace-expansion@1": "^1.1.18" } } diff --git a/code/test/integration/browser/package-lock.json b/code/test/integration/browser/package-lock.json index 1f44058fcea8..e899c83cc938 100644 --- a/code/test/integration/browser/package-lock.json +++ b/code/test/integration/browser/package-lock.json @@ -74,9 +74,9 @@ "dev": true }, "node_modules/brace-expansion": { - "version": "1.1.13", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz", - "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==", + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", "dev": true, "license": "MIT", "dependencies": { diff --git a/code/test/integration/browser/package.json b/code/test/integration/browser/package.json index b48e2564bf9c..55350c890067 100644 --- a/code/test/integration/browser/package.json +++ b/code/test/integration/browser/package.json @@ -14,5 +14,8 @@ "tmp": "0.2.6", "tree-kill": "1.2.2", "vscode-uri": "^3.0.2" + }, + "overrides": { + "brace-expansion@1": "^1.1.18" } } diff --git a/code/test/sanity/package-lock.json b/code/test/sanity/package-lock.json index 378ccd82d4d4..574da98c8e3b 100644 --- a/code/test/sanity/package-lock.json +++ b/code/test/sanity/package-lock.json @@ -113,9 +113,9 @@ "license": "MIT" }, "node_modules/brace-expansion": { - "version": "2.1.0", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.0.tgz", - "integrity": "sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w==", + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz", + "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==", "license": "MIT", "dependencies": { "balanced-match": "^1.0.0" diff --git a/code/test/sanity/package.json b/code/test/sanity/package.json index 6e67f1d1663f..fda50b7b51c1 100644 --- a/code/test/sanity/package.json +++ b/code/test/sanity/package.json @@ -22,6 +22,7 @@ "typescript": "^6.0.0-dev.20251110" }, "overrides": { - "serialize-javascript": "^7.0.3" + "serialize-javascript": "^7.0.3", + "brace-expansion@2": "^2.1.4" } } diff --git a/launcher/package.json b/launcher/package.json index 03eb2dc6a0c2..cfc9184a7fdf 100644 --- a/launcher/package.json +++ b/launcher/package.json @@ -59,7 +59,8 @@ "ws": "^8.21.0", "@types/node-fetch": { "form-data": "^4.0.6" - } + }, + "brace-expansion@1": "^1.1.18" }, "jest": { "collectCoverage": true, From 544344ea831f269e6159259e75b5bb3f675553ea Mon Sep 17 00:00:00 2001 From: Stephane Bouchet Date: Wed, 5 Aug 2026 16:27:53 -0500 Subject: [PATCH 2/3] fix: override brace-expansion to patched versions (CVE-2026-69152) Extends brace-expansion overrides to all affected packages to fix DoS via unbounded intermediate arrays (CRW-12223). Signed-off-by: Stephane Bouchet Co-Authored-By: Claude Opus 4.6 --- .rebase/CHANGELOG.md | 8 +++ .rebase/add/code/build/npm/gyp/package.json | 3 +- .rebase/add/code/build/package.json | 5 +- .../extensions/copilot/chat-lib/package.json | 3 +- .../add/code/extensions/copilot/package.json | 5 +- .../css-language-features/package.json | 2 +- .../html-language-features/package.json | 2 +- .../json-language-features/package.json | 2 +- .../markdown-language-features/package.json | 5 ++ .rebase/add/code/extensions/npm/package.json | 5 ++ .rebase/add/code/package.json | 5 +- .rebase/add/code/test/automation/package.json | 3 +- .../test/integration/browser/package.json | 5 ++ .rebase/add/code/test/sanity/package.json | 5 ++ code/build/package-lock.json | 64 ++++++++++++------- code/build/package.json | 2 +- .../copilot/chat-lib/package-lock.json | 8 +-- code/extensions/copilot/chat-lib/package.json | 2 +- code/extensions/copilot/package-lock.json | 8 +-- code/extensions/copilot/package.json | 2 +- .../css-language-features/package-lock.json | 8 +-- .../css-language-features/package.json | 2 +- .../html-language-features/package-lock.json | 8 +-- .../html-language-features/package.json | 2 +- .../json-language-features/package-lock.json | 8 +-- .../json-language-features/package.json | 2 +- code/package-lock.json | 11 ++-- code/package.json | 2 +- launcher/package-lock.json | 7 +- rebase.sh | 6 ++ 30 files changed, 124 insertions(+), 76 deletions(-) create mode 100644 .rebase/add/code/extensions/markdown-language-features/package.json create mode 100644 .rebase/add/code/extensions/npm/package.json create mode 100644 .rebase/add/code/test/integration/browser/package.json create mode 100644 .rebase/add/code/test/sanity/package.json diff --git a/.rebase/CHANGELOG.md b/.rebase/CHANGELOG.md index aaa7a271d815..eed98f5d3d39 100644 --- a/.rebase/CHANGELOG.md +++ b/.rebase/CHANGELOG.md @@ -12,7 +12,15 @@ https://github.com/che-incubator/che-code/commit/177a26a8ef76ea41a26eb6ac0ef9d60 https://github.com/che-incubator/che-code/pull/771 - code/package.json +- code/build/package.json +- code/build/npm/gyp/package.json - code/extensions/copilot/package.json +- code/extensions/copilot/chat-lib/package.json +- code/extensions/markdown-language-features/package.json +- code/extensions/npm/package.json +- code/test/automation/package.json +- code/test/integration/browser/package.json +- code/test/sanity/package.json --- #### @sbouchet diff --git a/.rebase/add/code/build/npm/gyp/package.json b/.rebase/add/code/build/npm/gyp/package.json index f84376a26fef..c61f3efb14e5 100644 --- a/.rebase/add/code/build/npm/gyp/package.json +++ b/.rebase/add/code/build/npm/gyp/package.json @@ -1,5 +1,6 @@ { "overrides": { - "ip-address": "^10.2.0" + "ip-address": "^10.2.0", + "brace-expansion@2": "^2.1.4" } } diff --git a/.rebase/add/code/build/package.json b/.rebase/add/code/build/package.json index f15eb491805f..769eebab99d3 100644 --- a/.rebase/add/code/build/package.json +++ b/.rebase/add/code/build/package.json @@ -3,9 +3,10 @@ "lodash": "^4.18.1", "qs": "6.15.2", "@vscode/vsce": { - "brace-expansion": "5.0.7", + "brace-expansion": "5.0.9", "form-data": "^4.0.6" }, - "form-data@4": "^4.0.6" + "form-data@4": "^4.0.6", + "brace-expansion@2": "^2.1.4" } } diff --git a/.rebase/add/code/extensions/copilot/chat-lib/package.json b/.rebase/add/code/extensions/copilot/chat-lib/package.json index df758fefcec2..8b3e97c5e0b7 100644 --- a/.rebase/add/code/extensions/copilot/chat-lib/package.json +++ b/.rebase/add/code/extensions/copilot/chat-lib/package.json @@ -1,8 +1,9 @@ { "overrides": { "shell-quote": "^1.8.4", + "brace-expansion@1": "^1.1.18", "minimatch@10": { - "brace-expansion": "5.0.7" + "brace-expansion": "5.0.9" } } } diff --git a/.rebase/add/code/extensions/copilot/package.json b/.rebase/add/code/extensions/copilot/package.json index 0463742ac194..71cbdab4766d 100644 --- a/.rebase/add/code/extensions/copilot/package.json +++ b/.rebase/add/code/extensions/copilot/package.json @@ -4,12 +4,9 @@ "qs": "6.15.2", "ip-address": "^10.2.0", "ws": "^8.21.0", - "webdriver": { - "undici@6": "^6.27.0" - }, "brace-expansion@1": "^1.1.18", "brace-expansion@2": "^2.1.4", - "brace-expansion@5": "5.0.7", + "brace-expansion@5": "5.0.9", "form-data@4": "^4.0.6", "@vscode/vsce": { "form-data": "^4.0.6" diff --git a/.rebase/add/code/extensions/css-language-features/package.json b/.rebase/add/code/extensions/css-language-features/package.json index 8009421bfe42..5bf6fc874476 100644 --- a/.rebase/add/code/extensions/css-language-features/package.json +++ b/.rebase/add/code/extensions/css-language-features/package.json @@ -1,7 +1,7 @@ { "overrides": { "minimatch": { - "brace-expansion": "5.0.7" + "brace-expansion": "5.0.9" } } } diff --git a/.rebase/add/code/extensions/html-language-features/package.json b/.rebase/add/code/extensions/html-language-features/package.json index 8009421bfe42..5bf6fc874476 100644 --- a/.rebase/add/code/extensions/html-language-features/package.json +++ b/.rebase/add/code/extensions/html-language-features/package.json @@ -1,7 +1,7 @@ { "overrides": { "minimatch": { - "brace-expansion": "5.0.7" + "brace-expansion": "5.0.9" } } } diff --git a/.rebase/add/code/extensions/json-language-features/package.json b/.rebase/add/code/extensions/json-language-features/package.json index 8009421bfe42..5bf6fc874476 100644 --- a/.rebase/add/code/extensions/json-language-features/package.json +++ b/.rebase/add/code/extensions/json-language-features/package.json @@ -1,7 +1,7 @@ { "overrides": { "minimatch": { - "brace-expansion": "5.0.7" + "brace-expansion": "5.0.9" } } } diff --git a/.rebase/add/code/extensions/markdown-language-features/package.json b/.rebase/add/code/extensions/markdown-language-features/package.json new file mode 100644 index 000000000000..82386cb59b85 --- /dev/null +++ b/.rebase/add/code/extensions/markdown-language-features/package.json @@ -0,0 +1,5 @@ +{ + "overrides": { + "brace-expansion@1": "^1.1.18" + } +} diff --git a/.rebase/add/code/extensions/npm/package.json b/.rebase/add/code/extensions/npm/package.json new file mode 100644 index 000000000000..e660b0825146 --- /dev/null +++ b/.rebase/add/code/extensions/npm/package.json @@ -0,0 +1,5 @@ +{ + "overrides": { + "brace-expansion@2": "^2.1.4" + } +} diff --git a/.rebase/add/code/package.json b/.rebase/add/code/package.json index 619388b57a91..c86a1dfcba76 100644 --- a/.rebase/add/code/package.json +++ b/.rebase/add/code/package.json @@ -18,13 +18,10 @@ "shell-quote": "^1.8.4", "qs": "6.15.2", "ip-address": "^10.2.0", - "webdriver": { - "undici@6": "^6.27.0" - }, "brace-expansion@1": "^1.1.18", "brace-expansion@2": "^2.1.4", "test-exclude": { - "brace-expansion@5": "5.0.7" + "brace-expansion@5": "5.0.9" }, "axios": { "form-data": "^4.0.6" diff --git a/.rebase/add/code/test/automation/package.json b/.rebase/add/code/test/automation/package.json index 88da4d1b65bd..6413da81db9e 100644 --- a/.rebase/add/code/test/automation/package.json +++ b/.rebase/add/code/test/automation/package.json @@ -1,5 +1,6 @@ { "overrides": { - "shell-quote": "^1.8.4" + "shell-quote": "^1.8.4", + "brace-expansion@1": "^1.1.18" } } diff --git a/.rebase/add/code/test/integration/browser/package.json b/.rebase/add/code/test/integration/browser/package.json new file mode 100644 index 000000000000..82386cb59b85 --- /dev/null +++ b/.rebase/add/code/test/integration/browser/package.json @@ -0,0 +1,5 @@ +{ + "overrides": { + "brace-expansion@1": "^1.1.18" + } +} diff --git a/.rebase/add/code/test/sanity/package.json b/.rebase/add/code/test/sanity/package.json new file mode 100644 index 000000000000..e660b0825146 --- /dev/null +++ b/.rebase/add/code/test/sanity/package.json @@ -0,0 +1,5 @@ +{ + "overrides": { + "brace-expansion@2": "^2.1.4" + } +} diff --git a/code/build/package-lock.json b/code/build/package-lock.json index 7ad7dae224ec..06a7ba792e59 100644 --- a/code/build/package-lock.json +++ b/code/build/package-lock.json @@ -2135,6 +2135,29 @@ "url": "https://github.com/chalk/ansi-styles?sponsor=1" } }, + "node_modules/@vscode/vsce/node_modules/balanced-match": { + "version": "4.0.4", + "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz", + "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==", + "dev": true, + "license": "MIT", + "engines": { + "node": "18 || 20 || >=22" + } + }, + "node_modules/@vscode/vsce/node_modules/brace-expansion": { + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", + "dev": true, + "license": "MIT", + "dependencies": { + "balanced-match": "^4.0.2" + }, + "engines": { + "node": "20 || >=22" + } + }, "node_modules/@vscode/vsce/node_modules/chalk": { "version": "4.1.2", "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz", @@ -2545,29 +2568,6 @@ "dev": true, "license": "BSD-2-Clause" }, - "node_modules/brace-expansion": { - "version": "5.0.7", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", - "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", - "dev": true, - "license": "MIT", - "dependencies": { - "balanced-match": "^4.0.2" - }, - "engines": { - "node": "18 || 20 || >=22" - } - }, - "node_modules/brace-expansion/node_modules/balanced-match": { - "version": "4.0.4", - "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz", - "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==", - "dev": true, - "license": "MIT", - "engines": { - "node": "18 || 20 || >=22" - } - }, "node_modules/braces": { "version": "3.0.3", "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz", @@ -2899,6 +2899,13 @@ "node": ">=18" } }, + "node_modules/concat-map": { + "version": "0.0.1", + "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz", + "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==", + "dev": true, + "license": "MIT" + }, "node_modules/core-util-is": { "version": "1.0.2", "resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.2.tgz", @@ -4745,6 +4752,17 @@ "node": "*" } }, + "node_modules/minimatch/node_modules/brace-expansion": { + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", + "dev": true, + "license": "MIT", + "dependencies": { + "balanced-match": "^1.0.0", + "concat-map": "0.0.1" + } + }, "node_modules/minimist": { "version": "1.2.8", "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz", diff --git a/code/build/package.json b/code/build/package.json index 31ee44d82b85..5bbff1232b00 100644 --- a/code/build/package.json +++ b/code/build/package.json @@ -83,7 +83,7 @@ "lodash": "^4.18.1", "qs": "6.15.2", "@vscode/vsce": { - "brace-expansion": "5.0.7", + "brace-expansion": "5.0.9", "form-data": "^4.0.6" }, "form-data@4": "^4.0.6", diff --git a/code/extensions/copilot/chat-lib/package-lock.json b/code/extensions/copilot/chat-lib/package-lock.json index 5314eb86f35a..3c36d6dc60ac 100644 --- a/code/extensions/copilot/chat-lib/package-lock.json +++ b/code/extensions/copilot/chat-lib/package-lock.json @@ -3532,16 +3532,16 @@ } }, "node_modules/minimatch/node_modules/brace-expansion": { - "version": "5.0.7", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", - "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", "dev": true, "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/mkdirp": { diff --git a/code/extensions/copilot/chat-lib/package.json b/code/extensions/copilot/chat-lib/package.json index b2ba7ec19c95..13966ae443bb 100644 --- a/code/extensions/copilot/chat-lib/package.json +++ b/code/extensions/copilot/chat-lib/package.json @@ -73,7 +73,7 @@ "shell-quote": "^1.8.4", "brace-expansion@1": "^1.1.18", "minimatch@10": { - "brace-expansion": "5.0.7" + "brace-expansion": "5.0.9" } } } diff --git a/code/extensions/copilot/package-lock.json b/code/extensions/copilot/package-lock.json index 8e4217649b4f..c8585eb21221 100644 --- a/code/extensions/copilot/package-lock.json +++ b/code/extensions/copilot/package-lock.json @@ -12561,15 +12561,15 @@ } }, "node_modules/minimatch/node_modules/brace-expansion": { - "version": "5.0.7", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", - "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/minimist": { diff --git a/code/extensions/copilot/package.json b/code/extensions/copilot/package.json index d64e946bc04c..37b589492f67 100644 --- a/code/extensions/copilot/package.json +++ b/code/extensions/copilot/package.json @@ -7254,7 +7254,7 @@ "ws": "^8.21.0", "brace-expansion@1": "^1.1.18", "brace-expansion@2": "^2.1.4", - "brace-expansion@5": "5.0.7", + "brace-expansion@5": "5.0.9", "form-data@4": "^4.0.6", "@vscode/vsce": { "form-data": "^4.0.6" diff --git a/code/extensions/css-language-features/package-lock.json b/code/extensions/css-language-features/package-lock.json index aa092c374939..b48341215618 100644 --- a/code/extensions/css-language-features/package-lock.json +++ b/code/extensions/css-language-features/package-lock.json @@ -39,15 +39,15 @@ } }, "node_modules/brace-expansion": { - "version": "5.0.7", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", - "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/minimatch": { diff --git a/code/extensions/css-language-features/package.json b/code/extensions/css-language-features/package.json index cd3b5ca70563..b2c61ffd0983 100644 --- a/code/extensions/css-language-features/package.json +++ b/code/extensions/css-language-features/package.json @@ -1001,7 +1001,7 @@ }, "overrides": { "minimatch": { - "brace-expansion": "5.0.7" + "brace-expansion": "5.0.9" } }, "repository": { diff --git a/code/extensions/html-language-features/package-lock.json b/code/extensions/html-language-features/package-lock.json index b0bf43e5f022..bb701c92d8d4 100644 --- a/code/extensions/html-language-features/package-lock.json +++ b/code/extensions/html-language-features/package-lock.json @@ -188,15 +188,15 @@ } }, "node_modules/brace-expansion": { - "version": "5.0.7", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", - "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/minimatch": { diff --git a/code/extensions/html-language-features/package.json b/code/extensions/html-language-features/package.json index e7d114f153f9..83786ffae0fc 100644 --- a/code/extensions/html-language-features/package.json +++ b/code/extensions/html-language-features/package.json @@ -273,7 +273,7 @@ }, "overrides": { "minimatch": { - "brace-expansion": "5.0.7" + "brace-expansion": "5.0.9" } }, "repository": { diff --git a/code/extensions/json-language-features/package-lock.json b/code/extensions/json-language-features/package-lock.json index 9df45bbbcd0f..5ec1ee4da348 100644 --- a/code/extensions/json-language-features/package-lock.json +++ b/code/extensions/json-language-features/package-lock.json @@ -188,15 +188,15 @@ } }, "node_modules/brace-expansion": { - "version": "5.0.7", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", - "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/minimatch": { diff --git a/code/extensions/json-language-features/package.json b/code/extensions/json-language-features/package.json index d98dbb294de8..40e78aace72f 100644 --- a/code/extensions/json-language-features/package.json +++ b/code/extensions/json-language-features/package.json @@ -197,7 +197,7 @@ }, "overrides": { "minimatch": { - "brace-expansion": "5.0.7" + "brace-expansion": "5.0.9" } }, "repository": { diff --git a/code/package-lock.json b/code/package-lock.json index 618ab0fe758b..4bb6ac57de0a 100644 --- a/code/package-lock.json +++ b/code/package-lock.json @@ -16449,9 +16449,6 @@ "nan": "^2.23.0" } }, - "node_modules/ssh2/node_modules/cpu-features": { - "optional": true - }, "node_modules/stable": { "version": "0.1.8", "resolved": "https://registry.npmjs.org/stable/-/stable-0.1.8.tgz", @@ -17152,16 +17149,16 @@ } }, "node_modules/test-exclude/node_modules/brace-expansion": { - "version": "5.0.7", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz", - "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==", + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", "dev": true, "license": "MIT", "dependencies": { "balanced-match": "^4.0.2" }, "engines": { - "node": "18 || 20 || >=22" + "node": "20 || >=22" } }, "node_modules/test-exclude/node_modules/glob": { diff --git a/code/package.json b/code/package.json index 7f03bfaedbed..d02cdb2fa5b5 100644 --- a/code/package.json +++ b/code/package.json @@ -295,7 +295,7 @@ "brace-expansion@1": "^1.1.18", "brace-expansion@2": "^2.1.4", "test-exclude": { - "brace-expansion@5": "5.0.7" + "brace-expansion@5": "5.0.9" }, "axios": { "form-data": "^4.0.6" diff --git a/launcher/package-lock.json b/launcher/package-lock.json index 8344c064b5e8..4dca0b3d7cab 100644 --- a/launcher/package-lock.json +++ b/launcher/package-lock.json @@ -1820,10 +1820,11 @@ } }, "node_modules/brace-expansion": { - "version": "1.1.11", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz", - "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==", + "version": "1.1.18", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", + "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", "dev": true, + "license": "MIT", "dependencies": { "balanced-match": "^1.0.0", "concat-map": "0.0.1" diff --git a/rebase.sh b/rebase.sh index 348f7613b01d..4c27dea4e17b 100755 --- a/rebase.sh +++ b/rebase.sh @@ -508,6 +508,10 @@ resolve_conflicts() { apply_package_changes_by_path "$conflictingFile" elif [[ "$conflictingFile" == "code/test/monaco/package.json" ]]; then apply_package_changes_by_path "$conflictingFile" + elif [[ "$conflictingFile" == "code/test/integration/browser/package.json" ]]; then + apply_package_changes_by_path "$conflictingFile" + elif [[ "$conflictingFile" == "code/test/sanity/package.json" ]]; then + apply_package_changes_by_path "$conflictingFile" elif [[ "$conflictingFile" == "code/extensions/notebook-renderers/package.json" ]]; then apply_package_changes_by_path "$conflictingFile" elif [[ "$conflictingFile" == "code/extensions/css-language-features/package.json" ]]; then @@ -516,6 +520,8 @@ resolve_conflicts() { apply_package_changes_by_path "$conflictingFile" elif [[ "$conflictingFile" == "code/extensions/json-language-features/package.json" ]]; then apply_package_changes_by_path "$conflictingFile" + elif [[ "$conflictingFile" == "code/extensions/markdown-language-features/package.json" ]]; then + apply_package_changes_by_path "$conflictingFile" elif [[ "$conflictingFile" == "code/src/vs/platform/workspaces/common/workspaceIdentifier.ts" ]]; then apply_changes_multi_line "$conflictingFile" else From 198d112c1a9a581fcdd06e10978bdf2625e7a0a8 Mon Sep 17 00:00:00 2001 From: Stephane Bouchet Date: Thu, 6 Aug 2026 08:13:10 -0500 Subject: [PATCH 3/3] regen with NodeJs 24.18 Signed-off-by: Stephane Bouchet --- code/build/package-lock.json | 64 +++++++++++++---------------------- code/remote/package-lock.json | 3 -- 2 files changed, 23 insertions(+), 44 deletions(-) diff --git a/code/build/package-lock.json b/code/build/package-lock.json index 06a7ba792e59..fc53efb9948a 100644 --- a/code/build/package-lock.json +++ b/code/build/package-lock.json @@ -2135,29 +2135,6 @@ "url": "https://github.com/chalk/ansi-styles?sponsor=1" } }, - "node_modules/@vscode/vsce/node_modules/balanced-match": { - "version": "4.0.4", - "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz", - "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==", - "dev": true, - "license": "MIT", - "engines": { - "node": "18 || 20 || >=22" - } - }, - "node_modules/@vscode/vsce/node_modules/brace-expansion": { - "version": "5.0.9", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", - "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", - "dev": true, - "license": "MIT", - "dependencies": { - "balanced-match": "^4.0.2" - }, - "engines": { - "node": "20 || >=22" - } - }, "node_modules/@vscode/vsce/node_modules/chalk": { "version": "4.1.2", "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz", @@ -2568,6 +2545,29 @@ "dev": true, "license": "BSD-2-Clause" }, + "node_modules/brace-expansion": { + "version": "5.0.9", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz", + "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==", + "dev": true, + "license": "MIT", + "dependencies": { + "balanced-match": "^4.0.2" + }, + "engines": { + "node": "20 || >=22" + } + }, + "node_modules/brace-expansion/node_modules/balanced-match": { + "version": "4.0.4", + "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz", + "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==", + "dev": true, + "license": "MIT", + "engines": { + "node": "18 || 20 || >=22" + } + }, "node_modules/braces": { "version": "3.0.3", "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz", @@ -2899,13 +2899,6 @@ "node": ">=18" } }, - "node_modules/concat-map": { - "version": "0.0.1", - "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz", - "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==", - "dev": true, - "license": "MIT" - }, "node_modules/core-util-is": { "version": "1.0.2", "resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.2.tgz", @@ -4752,17 +4745,6 @@ "node": "*" } }, - "node_modules/minimatch/node_modules/brace-expansion": { - "version": "1.1.18", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", - "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", - "dev": true, - "license": "MIT", - "dependencies": { - "balanced-match": "^1.0.0", - "concat-map": "0.0.1" - } - }, "node_modules/minimist": { "version": "1.2.8", "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz", diff --git a/code/remote/package-lock.json b/code/remote/package-lock.json index 392a21cc14b0..a168b8f5a35f 100644 --- a/code/remote/package-lock.json +++ b/code/remote/package-lock.json @@ -2205,9 +2205,6 @@ "nan": "^2.23.0" } }, - "node_modules/ssh2/node_modules/cpu-features": { - "optional": true - }, "node_modules/stream-buffers": { "version": "3.0.3", "resolved": "https://registry.npmjs.org/stream-buffers/-/stream-buffers-3.0.3.tgz",