From 2e584eef693b4a6cd042c35052746ac21fb846a2 Mon Sep 17 00:00:00 2001 From: Stephane Bouchet Date: Wed, 29 Jul 2026 10:55:01 -0500 Subject: [PATCH 01/12] fix: update js-yaml to patched versions (CVE-2026-59869) Bump js-yaml direct dependencies to ^4.3.0 and add overrides for transitive js-yaml@3 to ^3.15.0 and js-yaml@4 to ^4.3.0 across all affected workspaces to fix DoS via crafted YAML documents. Signed-off-by: Stephane Bouchet Co-Authored-By: Claude Opus 4.6 Signed-off-by: Stephane Bouchet --- code/build/package.json | 4 +- code/extensions/che-api/package-lock.json | 25 ++++++++---- code/extensions/che-api/package.json | 5 ++- .../extensions/che-commands/package-lock.json | 19 +++++++-- code/extensions/che-commands/package.json | 2 +- .../package-lock.json | 17 ++++++-- .../che-github-authentication/package.json | 3 +- code/extensions/che-port/package-lock.json | 6 +-- code/extensions/che-port/package.json | 3 +- code/extensions/che-remote/package-lock.json | 25 ++++++++---- code/extensions/che-remote/package.json | 5 ++- .../che-resource-monitor/package-lock.json | 40 ++++++++++++------- .../che-resource-monitor/package.json | 4 +- .../extensions/che-terminal/package-lock.json | 19 +++++++-- code/extensions/che-terminal/package.json | 2 +- code/extensions/npm/package.json | 3 +- code/package-lock.json | 2 +- code/package.json | 2 +- code/remote/package-lock.json | 2 +- code/remote/package.json | 2 +- 20 files changed, 132 insertions(+), 58 deletions(-) diff --git a/code/build/package.json b/code/build/package.json index 5bbff1232b00..5ca139e50028 100644 --- a/code/build/package.json +++ b/code/build/package.json @@ -87,6 +87,8 @@ "form-data": "^4.0.6" }, "form-data@4": "^4.0.6", - "brace-expansion@2": "^2.1.4" + "brace-expansion@2": "^2.1.4", + "js-yaml@3": "^3.15.0", + "js-yaml@4": "^4.3.0" } } diff --git a/code/extensions/che-api/package-lock.json b/code/extensions/che-api/package-lock.json index 6aa0d4314334..f375bc06824f 100644 --- a/code/extensions/che-api/package-lock.json +++ b/code/extensions/che-api/package-lock.json @@ -14,7 +14,7 @@ "@kubernetes/client-node": "^1.4.0", "fs-extra": "^11.2.0", "inversify": "^6.0.2", - "js-yaml": "^4.1.0", + "js-yaml": "^4.3.0", "reflect-metadata": "^0.2.2", "vscode-nls": "^5.0.0" }, @@ -615,9 +615,9 @@ } }, "node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml": { - "version": "3.14.2", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz", - "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==", + "version": "3.15.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.0.tgz", + "integrity": "sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==", "dev": true, "license": "MIT", "dependencies": { @@ -3329,9 +3329,20 @@ "license": "MIT" }, "node_modules/js-yaml": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz", - "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==", + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", + "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/puzrin" + }, + { + "type": "github", + "url": "https://github.com/sponsors/nodeca" + } + ], + "license": "MIT", "dependencies": { "argparse": "^2.0.1" }, diff --git a/code/extensions/che-api/package.json b/code/extensions/che-api/package.json index e6991021efc8..5a4e3a81ee89 100644 --- a/code/extensions/che-api/package.json +++ b/code/extensions/che-api/package.json @@ -35,7 +35,7 @@ "@kubernetes/client-node": "^1.4.0", "fs-extra": "^11.2.0", "inversify": "^6.0.2", - "js-yaml": "^4.1.0", + "js-yaml": "^4.3.0", "reflect-metadata": "^0.2.2", "vscode-nls": "^5.0.0" }, @@ -69,7 +69,8 @@ "axios": { "form-data": "^4.0.6" }, - "brace-expansion@1": "^1.1.18" + "brace-expansion@1": "^1.1.18", + "js-yaml@3": "^3.15.0" }, "repository": { "type": "git", diff --git a/code/extensions/che-commands/package-lock.json b/code/extensions/che-commands/package-lock.json index 6b7f56e26e80..f43ac12005d6 100644 --- a/code/extensions/che-commands/package-lock.json +++ b/code/extensions/che-commands/package-lock.json @@ -12,7 +12,7 @@ "@devfile/api": "^2.3.0-1738854228", "@kubernetes/client-node": "^1.4.0", "fs-extra": "^11.2.0", - "js-yaml": "^4.1.0", + "js-yaml": "^4.3.0", "reflect-metadata": "^0.2.2", "vscode-nls": "^5.0.0" }, @@ -590,9 +590,20 @@ } }, "node_modules/js-yaml": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz", - "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==", + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", + "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/puzrin" + }, + { + "type": "github", + "url": "https://github.com/sponsors/nodeca" + } + ], + "license": "MIT", "dependencies": { "argparse": "^2.0.1" }, diff --git a/code/extensions/che-commands/package.json b/code/extensions/che-commands/package.json index 30255130c924..8f335835f4b0 100644 --- a/code/extensions/che-commands/package.json +++ b/code/extensions/che-commands/package.json @@ -33,7 +33,7 @@ "reflect-metadata": "^0.2.2", "fs-extra": "^11.2.0", "vscode-nls": "^5.0.0", - "js-yaml": "^4.1.0", + "js-yaml": "^4.3.0", "@devfile/api": "^2.3.0-1738854228", "@kubernetes/client-node": "^1.4.0" }, diff --git a/code/extensions/che-github-authentication/package-lock.json b/code/extensions/che-github-authentication/package-lock.json index 68d106698dd4..a8c9f5caed25 100644 --- a/code/extensions/che-github-authentication/package-lock.json +++ b/code/extensions/che-github-authentication/package-lock.json @@ -950,9 +950,20 @@ } }, "node_modules/js-yaml": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz", - "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==", + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", + "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/puzrin" + }, + { + "type": "github", + "url": "https://github.com/sponsors/nodeca" + } + ], + "license": "MIT", "dependencies": { "argparse": "^2.0.1" }, diff --git a/code/extensions/che-github-authentication/package.json b/code/extensions/che-github-authentication/package.json index 0d1e0e34164f..c93c50e799fa 100644 --- a/code/extensions/che-github-authentication/package.json +++ b/code/extensions/che-github-authentication/package.json @@ -75,7 +75,8 @@ }, "@types/node-fetch": { "form-data": "^4.0.6" - } + }, + "js-yaml@4": "^4.3.0" }, "repository": { "type": "git", diff --git a/code/extensions/che-port/package-lock.json b/code/extensions/che-port/package-lock.json index e000ea912c8c..6b5c3b5e3e8a 100644 --- a/code/extensions/che-port/package-lock.json +++ b/code/extensions/che-port/package-lock.json @@ -2983,9 +2983,9 @@ "license": "MIT" }, "node_modules/js-yaml": { - "version": "3.14.2", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz", - "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==", + "version": "3.15.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.0.tgz", + "integrity": "sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==", "dev": true, "license": "MIT", "dependencies": { diff --git a/code/extensions/che-port/package.json b/code/extensions/che-port/package.json index 0f8d29c7fbde..4e1e94609b4b 100644 --- a/code/extensions/che-port/package.json +++ b/code/extensions/che-port/package.json @@ -53,7 +53,8 @@ }, "minimatch": "^3.1.5", "handlebars": "4.7.9", - "brace-expansion@1": "^1.1.18" + "brace-expansion@1": "^1.1.18", + "js-yaml@3": "^3.15.0" }, "repository": { "type": "git", diff --git a/code/extensions/che-remote/package-lock.json b/code/extensions/che-remote/package-lock.json index c1633ee5f369..23cc7b202aff 100644 --- a/code/extensions/che-remote/package-lock.json +++ b/code/extensions/che-remote/package-lock.json @@ -12,7 +12,7 @@ "@eclipse-che/che-devworkspace-generator": "7.113.0", "axios": "^1.17.0", "https": "^1.0.0", - "js-yaml": "^4.0.0", + "js-yaml": "^4.3.0", "vscode-nls": "^5.0.0" }, "devDependencies": { @@ -774,9 +774,9 @@ } }, "node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml": { - "version": "3.14.2", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz", - "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==", + "version": "3.15.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.0.tgz", + "integrity": "sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==", "dev": true, "license": "MIT", "dependencies": { @@ -3747,9 +3747,20 @@ "license": "MIT" }, "node_modules/js-yaml": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz", - "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==", + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", + "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/puzrin" + }, + { + "type": "github", + "url": "https://github.com/sponsors/nodeca" + } + ], + "license": "MIT", "dependencies": { "argparse": "^2.0.1" }, diff --git a/code/extensions/che-remote/package.json b/code/extensions/che-remote/package.json index a402561c4822..bd934ae20d54 100644 --- a/code/extensions/che-remote/package.json +++ b/code/extensions/che-remote/package.json @@ -35,7 +35,7 @@ "axios": "^1.17.0", "@eclipse-che/che-devworkspace-generator": "7.113.0", "https": "^1.0.0", - "js-yaml": "^4.0.0" + "js-yaml": "^4.3.0" }, "devDependencies": { "jest": "29.7.0", @@ -66,7 +66,8 @@ "axios": { "form-data": "^4.0.6" }, - "brace-expansion@1": "^1.1.18" + "brace-expansion@1": "^1.1.18", + "js-yaml@3": "^3.15.0" }, "repository": { "type": "git", diff --git a/code/extensions/che-resource-monitor/package-lock.json b/code/extensions/che-resource-monitor/package-lock.json index e0e18dc8d182..4f643e61e083 100644 --- a/code/extensions/che-resource-monitor/package-lock.json +++ b/code/extensions/che-resource-monitor/package-lock.json @@ -591,9 +591,9 @@ } }, "node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml": { - "version": "3.14.2", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz", - "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==", + "version": "3.15.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.0.tgz", + "integrity": "sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==", "dev": true, "license": "MIT", "dependencies": { @@ -1029,6 +1029,28 @@ "node": ">= 6" } }, + "node_modules/@kubernetes/client-node/node_modules/js-yaml": { + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", + "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/puzrin" + }, + { + "type": "github", + "url": "https://github.com/sponsors/nodeca" + } + ], + "license": "MIT", + "dependencies": { + "argparse": "^2.0.1" + }, + "bin": { + "js-yaml": "bin/js-yaml.js" + } + }, "node_modules/@kubernetes/client-node/node_modules/undici-types": { "version": "7.16.0", "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.16.0.tgz", @@ -3300,18 +3322,6 @@ "dev": true, "license": "MIT" }, - "node_modules/js-yaml": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz", - "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==", - "license": "MIT", - "dependencies": { - "argparse": "^2.0.1" - }, - "bin": { - "js-yaml": "bin/js-yaml.js" - } - }, "node_modules/jsep": { "version": "1.4.0", "resolved": "https://registry.npmjs.org/jsep/-/jsep-1.4.0.tgz", diff --git a/code/extensions/che-resource-monitor/package.json b/code/extensions/che-resource-monitor/package.json index b3a14e851a70..3693242c923e 100644 --- a/code/extensions/che-resource-monitor/package.json +++ b/code/extensions/che-resource-monitor/package.json @@ -60,7 +60,9 @@ "@types/node-fetch": { "form-data": "^4.0.6" }, - "brace-expansion@1": "^1.1.18" + "brace-expansion@1": "^1.1.18", + "js-yaml@4": "^4.3.0", + "js-yaml@3": "^3.15.0" }, "repository": { "type": "git", diff --git a/code/extensions/che-terminal/package-lock.json b/code/extensions/che-terminal/package-lock.json index 7b2b8be126e6..d0b124f4086c 100644 --- a/code/extensions/che-terminal/package-lock.json +++ b/code/extensions/che-terminal/package-lock.json @@ -10,7 +10,7 @@ "license": "EPL-2.0", "dependencies": { "fs-extra": "^11.2.0", - "js-yaml": "^4.1.0", + "js-yaml": "^4.3.0", "vscode-nls": "^5.2.0", "ws": "^8.21.0" }, @@ -81,9 +81,20 @@ "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==" }, "node_modules/js-yaml": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz", - "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==", + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", + "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/puzrin" + }, + { + "type": "github", + "url": "https://github.com/sponsors/nodeca" + } + ], + "license": "MIT", "dependencies": { "argparse": "^2.0.1" }, diff --git a/code/extensions/che-terminal/package.json b/code/extensions/che-terminal/package.json index e857502fc1ae..489b28c57394 100644 --- a/code/extensions/che-terminal/package.json +++ b/code/extensions/che-terminal/package.json @@ -40,7 +40,7 @@ }, "dependencies": { "fs-extra": "^11.2.0", - "js-yaml": "^4.1.0", + "js-yaml": "^4.3.0", "vscode-nls": "^5.2.0", "ws": "^8.21.0" }, diff --git a/code/extensions/npm/package.json b/code/extensions/npm/package.json index 4326944e9de0..727ecf7bde8b 100644 --- a/code/extensions/npm/package.json +++ b/code/extensions/npm/package.json @@ -385,7 +385,8 @@ ] }, "overrides": { - "brace-expansion@2": "^2.1.4" + "brace-expansion@2": "^2.1.4", + "js-yaml@3": "^3.15.0" }, "repository": { "type": "git", diff --git a/code/package-lock.json b/code/package-lock.json index e2eeaef50f87..17df92c0100b 100644 --- a/code/package-lock.json +++ b/code/package-lock.json @@ -55,7 +55,7 @@ "detect-libc": "^2.1.2", "http-proxy-agent": "^7.0.0", "https-proxy-agent": "^7.0.2", - "js-yaml": "^4.1.0", + "js-yaml": "^4.3.0", "jschardet": "3.1.4", "katex": "^0.16.22", "kerberos": "2.1.1", diff --git a/code/package.json b/code/package.json index ff7e858e1541..1cd4664bc431 100644 --- a/code/package.json +++ b/code/package.json @@ -159,7 +159,7 @@ "yauzl": "^3.3.1", "yazl": "^2.4.3", "zod": "^3.25.76", - "js-yaml": "^4.1.0" + "js-yaml": "^4.3.0" }, "devDependencies": { "@anthropic-ai/claude-agent-sdk": "0.3.198", diff --git a/code/remote/package-lock.json b/code/remote/package-lock.json index 42195e3dca62..e2780d9641a3 100644 --- a/code/remote/package-lock.json +++ b/code/remote/package-lock.json @@ -42,7 +42,7 @@ "detect-libc": "^2.1.2", "http-proxy-agent": "^7.0.0", "https-proxy-agent": "^7.0.2", - "js-yaml": "^4.1.0", + "js-yaml": "^4.3.0", "jschardet": "3.1.4", "katex": "^0.16.22", "kerberos": "2.1.1", diff --git a/code/remote/package.json b/code/remote/package.json index b9394dbb17b8..d0b25e905341 100644 --- a/code/remote/package.json +++ b/code/remote/package.json @@ -52,7 +52,7 @@ "yauzl": "^3.3.1", "yazl": "^2.4.3", "zod": "^3.25.76", - "js-yaml": "^4.1.0", + "js-yaml": "^4.3.0", "@kubernetes/client-node": "^1.4.0" }, "overrides": { From 4f44606f024ac43c2bca769bce574bda86e204b0 Mon Sep 17 00:00:00 2001 From: Stephane Bouchet Date: Wed, 29 Jul 2026 10:55:14 -0500 Subject: [PATCH 02/12] chore: add rebase rules for js-yaml overrides Signed-off-by: Stephane Bouchet Co-Authored-By: Claude Opus 4.6 Signed-off-by: Stephane Bouchet --- .rebase/CHANGELOG.md | 9 +++++++++ .rebase/add/code/build/package.json | 4 +++- .rebase/add/code/extensions/copilot/package.json | 3 ++- .rebase/add/code/extensions/npm/package.json | 3 ++- .rebase/add/code/package.json | 2 +- .rebase/add/code/remote/package.json | 2 +- .rebase/override/code/extensions/copilot/package.json | 4 +++- 7 files changed, 21 insertions(+), 6 deletions(-) diff --git a/.rebase/CHANGELOG.md b/.rebase/CHANGELOG.md index 27c0fabd2903..7a9809878dcf 100644 --- a/.rebase/CHANGELOG.md +++ b/.rebase/CHANGELOG.md @@ -39,6 +39,15 @@ https://github.com/che-incubator/che-code/pull/774 --- #### @sbouchet +https://github.com/che-incubator/che-code/pull/NNN + +- code/package.json +- code/remote/package.json +- code/build/package.json +- code/extensions/copilot/package.json +- code/extensions/npm/package.json +--- + https://github.com/che-incubator/che-code/pull/750 - code/extensions/copilot/package.json diff --git a/.rebase/add/code/build/package.json b/.rebase/add/code/build/package.json index 769eebab99d3..98e3f9550d99 100644 --- a/.rebase/add/code/build/package.json +++ b/.rebase/add/code/build/package.json @@ -7,6 +7,8 @@ "form-data": "^4.0.6" }, "form-data@4": "^4.0.6", - "brace-expansion@2": "^2.1.4" + "brace-expansion@2": "^2.1.4", + "js-yaml@3": "^3.15.0", + "js-yaml@4": "^4.3.0" } } diff --git a/.rebase/add/code/extensions/copilot/package.json b/.rebase/add/code/extensions/copilot/package.json index 1e2720e2cfdb..256b25374221 100644 --- a/.rebase/add/code/extensions/copilot/package.json +++ b/.rebase/add/code/extensions/copilot/package.json @@ -13,6 +13,7 @@ }, "@grpc/proto-loader": { "protobufjs": "^7.6.5" - } + }, + "js-yaml@3": "^3.15.0" } } diff --git a/.rebase/add/code/extensions/npm/package.json b/.rebase/add/code/extensions/npm/package.json index e660b0825146..a5e1e246282e 100644 --- a/.rebase/add/code/extensions/npm/package.json +++ b/.rebase/add/code/extensions/npm/package.json @@ -1,5 +1,6 @@ { "overrides": { - "brace-expansion@2": "^2.1.4" + "brace-expansion@2": "^2.1.4", + "js-yaml@3": "^3.15.0" } } diff --git a/.rebase/add/code/package.json b/.rebase/add/code/package.json index c86a1dfcba76..84ae5cabd749 100644 --- a/.rebase/add/code/package.json +++ b/.rebase/add/code/package.json @@ -1,6 +1,6 @@ { "dependencies": { - "js-yaml": "^4.1.0" + "js-yaml": "^4.3.0" }, "devDependencies": { "@types/js-yaml": "^4.0.5", diff --git a/.rebase/add/code/remote/package.json b/.rebase/add/code/remote/package.json index b55146aab3b4..2d581f56d50b 100644 --- a/.rebase/add/code/remote/package.json +++ b/.rebase/add/code/remote/package.json @@ -1,6 +1,6 @@ { "dependencies": { - "js-yaml": "^4.1.0", + "js-yaml": "^4.3.0", "@kubernetes/client-node": "^1.4.0" }, "overrides": { diff --git a/.rebase/override/code/extensions/copilot/package.json b/.rebase/override/code/extensions/copilot/package.json index f274eebf9d9f..391f1fca7674 100644 --- a/.rebase/override/code/extensions/copilot/package.json +++ b/.rebase/override/code/extensions/copilot/package.json @@ -3,6 +3,8 @@ "undici": "^7.28.0" }, "devDependencies": { - "tar": "^7.5.22" + "tar": "^7.5.22", + "undici": "^7.28.0", + "js-yaml": "^4.3.0" } } From 48f4eae1905bca41f5b6faf9aa76a7e4b9e6ff40 Mon Sep 17 00:00:00 2001 From: Stephane Bouchet Date: Wed, 29 Jul 2026 11:27:18 -0500 Subject: [PATCH 03/12] fix: update js-yaml in launcher to patched versions (CVE-2026-59869) Bump js-yaml direct dependency to ^4.3.0 and add override for transitive js-yaml@3 to ^3.15.0 in the launcher workspace. Signed-off-by: Stephane Bouchet Co-Authored-By: Claude Opus 4.6 Signed-off-by: Stephane Bouchet --- launcher/package-lock.json | 40 +++++++++++++++++++++++++------------- launcher/package.json | 5 +++-- 2 files changed, 30 insertions(+), 15 deletions(-) diff --git a/launcher/package-lock.json b/launcher/package-lock.json index 4dca0b3d7cab..d4f43af0c1a4 100644 --- a/launcher/package-lock.json +++ b/launcher/package-lock.json @@ -9,7 +9,7 @@ "version": "0.0.1", "dependencies": { "@kubernetes/client-node": "^1.4.0", - "js-yaml": "^4.1.0" + "js-yaml": "^4.3.0" }, "bin": { "che-code-launcher": "out/entrypoint.js" @@ -740,10 +740,11 @@ } }, "node_modules/@eslint/eslintrc/node_modules/js-yaml": { - "version": "3.14.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.1.tgz", - "integrity": "sha512-okMH7OXXJ7YrN9Ok3/SXrnu4iX9yOk+25nqX4imS2npuvTYDmo/QEZoqwZkYaIDk3jVvBOTOIEgEhaLOynBS9g==", + "version": "3.15.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.0.tgz", + "integrity": "sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==", "dev": true, + "license": "MIT", "dependencies": { "argparse": "^1.0.7", "esprima": "^4.0.0" @@ -800,10 +801,11 @@ } }, "node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml": { - "version": "3.14.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.1.tgz", - "integrity": "sha512-okMH7OXXJ7YrN9Ok3/SXrnu4iX9yOk+25nqX4imS2npuvTYDmo/QEZoqwZkYaIDk3jVvBOTOIEgEhaLOynBS9g==", + "version": "3.15.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.0.tgz", + "integrity": "sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==", "dev": true, + "license": "MIT", "dependencies": { "argparse": "^1.0.7", "esprima": "^4.0.0" @@ -2460,10 +2462,11 @@ } }, "node_modules/eslint/node_modules/js-yaml": { - "version": "3.14.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.1.tgz", - "integrity": "sha512-okMH7OXXJ7YrN9Ok3/SXrnu4iX9yOk+25nqX4imS2npuvTYDmo/QEZoqwZkYaIDk3jVvBOTOIEgEhaLOynBS9g==", + "version": "3.15.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.0.tgz", + "integrity": "sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==", "dev": true, + "license": "MIT", "dependencies": { "argparse": "^1.0.7", "esprima": "^4.0.0" @@ -3928,9 +3931,20 @@ "dev": true }, "node_modules/js-yaml": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz", - "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==", + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", + "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/puzrin" + }, + { + "type": "github", + "url": "https://github.com/sponsors/nodeca" + } + ], + "license": "MIT", "dependencies": { "argparse": "^2.0.1" }, diff --git a/launcher/package.json b/launcher/package.json index cfc9184a7fdf..0824724c5e68 100644 --- a/launcher/package.json +++ b/launcher/package.json @@ -31,7 +31,7 @@ "url": "git+https://github.com/che-incubator/che-code.git" }, "dependencies": { - "js-yaml": "^4.1.0", + "js-yaml": "^4.3.0", "@kubernetes/client-node": "^1.4.0" }, "devDependencies": { @@ -60,7 +60,8 @@ "@types/node-fetch": { "form-data": "^4.0.6" }, - "brace-expansion@1": "^1.1.18" + "brace-expansion@1": "^1.1.18", + "js-yaml@3": "^3.15.0" }, "jest": { "collectCoverage": true, From 99b2486c50e735fdde033ea8c975fce8c54d3eb4 Mon Sep 17 00:00:00 2001 From: Stephane Bouchet Date: Wed, 29 Jul 2026 11:32:30 -0500 Subject: [PATCH 04/12] fix: override js-yaml in test/sanity workspace (CVE-2026-59869) Add js-yaml@4 override to ^4.3.0 in code/test/sanity, add rebase rule, and register the file in rebase.sh conflict handler. Signed-off-by: Stephane Bouchet Co-Authored-By: Claude Opus 4.6 Signed-off-by: Stephane Bouchet --- .rebase/CHANGELOG.md | 1 + .rebase/add/code/test/sanity/package.json | 3 ++- code/test/sanity/package.json | 3 ++- 3 files changed, 5 insertions(+), 2 deletions(-) diff --git a/.rebase/CHANGELOG.md b/.rebase/CHANGELOG.md index 7a9809878dcf..0d75c88afe79 100644 --- a/.rebase/CHANGELOG.md +++ b/.rebase/CHANGELOG.md @@ -46,6 +46,7 @@ https://github.com/che-incubator/che-code/pull/NNN - code/build/package.json - code/extensions/copilot/package.json - code/extensions/npm/package.json +- code/test/sanity/package.json --- https://github.com/che-incubator/che-code/pull/750 diff --git a/.rebase/add/code/test/sanity/package.json b/.rebase/add/code/test/sanity/package.json index e660b0825146..0613d6e5f829 100644 --- a/.rebase/add/code/test/sanity/package.json +++ b/.rebase/add/code/test/sanity/package.json @@ -1,5 +1,6 @@ { "overrides": { - "brace-expansion@2": "^2.1.4" + "brace-expansion@2": "^2.1.4", + "js-yaml@4": "^4.3.0" } } diff --git a/code/test/sanity/package.json b/code/test/sanity/package.json index fda50b7b51c1..baf68c7b8021 100644 --- a/code/test/sanity/package.json +++ b/code/test/sanity/package.json @@ -23,6 +23,7 @@ }, "overrides": { "serialize-javascript": "^7.0.3", - "brace-expansion@2": "^2.1.4" + "brace-expansion@2": "^2.1.4", + "js-yaml@4": "^4.3.0" } } From 15031cbaf4c841bc062afd551ab3d12f7ed9897c Mon Sep 17 00:00:00 2001 From: Stephane Bouchet Date: Wed, 29 Jul 2026 14:17:11 -0500 Subject: [PATCH 05/12] use use correct URL Signed-off-by: Stephane Bouchet --- .rebase/CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.rebase/CHANGELOG.md b/.rebase/CHANGELOG.md index 0d75c88afe79..37a46d312f2f 100644 --- a/.rebase/CHANGELOG.md +++ b/.rebase/CHANGELOG.md @@ -39,7 +39,7 @@ https://github.com/che-incubator/che-code/pull/774 --- #### @sbouchet -https://github.com/che-incubator/che-code/pull/NNN +https://github.com/che-incubator/che-code/pull/777 - code/package.json - code/remote/package.json From 31c7a1b9cac8e2ba97e4c1460dd2578af4e24a35 Mon Sep 17 00:00:00 2001 From: Stephane Bouchet Date: Thu, 6 Aug 2026 10:27:20 -0500 Subject: [PATCH 06/12] fix: override js-yaml to patched version Signed-off-by: Stephane Bouchet --- .rebase/add/code/build/package.json | 2 +- .rebase/add/code/package.json | 2 +- .rebase/add/code/remote/package.json | 2 +- .rebase/add/code/test/sanity/package.json | 2 +- .../code/extensions/copilot/package.json | 2 +- code/build/package-lock.json | 6 +-- code/build/package.json | 2 +- code/extensions/che-api/package-lock.json | 8 ++-- code/extensions/che-api/package.json | 2 +- .../extensions/che-commands/package-lock.json | 8 ++-- code/extensions/che-commands/package.json | 2 +- .../package-lock.json | 6 +-- .../che-github-authentication/package.json | 2 +- code/extensions/che-remote/package-lock.json | 8 ++-- code/extensions/che-remote/package.json | 2 +- .../che-resource-monitor/package-lock.json | 44 +++++++++---------- .../che-resource-monitor/package.json | 2 +- .../extensions/che-terminal/package-lock.json | 8 ++-- code/extensions/che-terminal/package.json | 2 +- code/extensions/copilot/package-lock.json | 8 ++-- code/extensions/copilot/package.json | 2 +- code/package-lock.json | 8 ++-- code/package.json | 2 +- code/remote/package-lock.json | 8 ++-- code/remote/package.json | 2 +- code/test/sanity/package-lock.json | 6 +-- code/test/sanity/package.json | 2 +- launcher/package-lock.json | 8 ++-- launcher/package.json | 2 +- 29 files changed, 80 insertions(+), 80 deletions(-) diff --git a/.rebase/add/code/build/package.json b/.rebase/add/code/build/package.json index 98e3f9550d99..4388554b923a 100644 --- a/.rebase/add/code/build/package.json +++ b/.rebase/add/code/build/package.json @@ -9,6 +9,6 @@ "form-data@4": "^4.0.6", "brace-expansion@2": "^2.1.4", "js-yaml@3": "^3.15.0", - "js-yaml@4": "^4.3.0" + "js-yaml@4": "^4.3.1" } } diff --git a/.rebase/add/code/package.json b/.rebase/add/code/package.json index 84ae5cabd749..fb803a9e36ee 100644 --- a/.rebase/add/code/package.json +++ b/.rebase/add/code/package.json @@ -1,6 +1,6 @@ { "dependencies": { - "js-yaml": "^4.3.0" + "js-yaml": "^4.3.1" }, "devDependencies": { "@types/js-yaml": "^4.0.5", diff --git a/.rebase/add/code/remote/package.json b/.rebase/add/code/remote/package.json index 2d581f56d50b..b1140231ebbb 100644 --- a/.rebase/add/code/remote/package.json +++ b/.rebase/add/code/remote/package.json @@ -1,6 +1,6 @@ { "dependencies": { - "js-yaml": "^4.3.0", + "js-yaml": "^4.3.1", "@kubernetes/client-node": "^1.4.0" }, "overrides": { diff --git a/.rebase/add/code/test/sanity/package.json b/.rebase/add/code/test/sanity/package.json index 0613d6e5f829..38a9f0a69709 100644 --- a/.rebase/add/code/test/sanity/package.json +++ b/.rebase/add/code/test/sanity/package.json @@ -1,6 +1,6 @@ { "overrides": { "brace-expansion@2": "^2.1.4", - "js-yaml@4": "^4.3.0" + "js-yaml@4": "^4.3.1" } } diff --git a/.rebase/override/code/extensions/copilot/package.json b/.rebase/override/code/extensions/copilot/package.json index 391f1fca7674..a27370e4e932 100644 --- a/.rebase/override/code/extensions/copilot/package.json +++ b/.rebase/override/code/extensions/copilot/package.json @@ -5,6 +5,6 @@ "devDependencies": { "tar": "^7.5.22", "undici": "^7.28.0", - "js-yaml": "^4.3.0" + "js-yaml": "^4.3.1" } } diff --git a/code/build/package-lock.json b/code/build/package-lock.json index fc53efb9948a..3018242701d1 100644 --- a/code/build/package-lock.json +++ b/code/build/package-lock.json @@ -4318,9 +4318,9 @@ "license": "MIT" }, "node_modules/js-yaml": { - "version": "4.2.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz", - "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==", + "version": "4.3.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", + "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", "dev": true, "funding": [ { diff --git a/code/build/package.json b/code/build/package.json index 5ca139e50028..115e8514456b 100644 --- a/code/build/package.json +++ b/code/build/package.json @@ -89,6 +89,6 @@ "form-data@4": "^4.0.6", "brace-expansion@2": "^2.1.4", "js-yaml@3": "^3.15.0", - "js-yaml@4": "^4.3.0" + "js-yaml@4": "^4.3.1" } } diff --git a/code/extensions/che-api/package-lock.json b/code/extensions/che-api/package-lock.json index f375bc06824f..cdfc7f943681 100644 --- a/code/extensions/che-api/package-lock.json +++ b/code/extensions/che-api/package-lock.json @@ -14,7 +14,7 @@ "@kubernetes/client-node": "^1.4.0", "fs-extra": "^11.2.0", "inversify": "^6.0.2", - "js-yaml": "^4.3.0", + "js-yaml": "^4.3.1", "reflect-metadata": "^0.2.2", "vscode-nls": "^5.0.0" }, @@ -3329,9 +3329,9 @@ "license": "MIT" }, "node_modules/js-yaml": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", - "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", + "version": "4.3.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", + "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", "funding": [ { "type": "github", diff --git a/code/extensions/che-api/package.json b/code/extensions/che-api/package.json index 5a4e3a81ee89..effad2bf3bdb 100644 --- a/code/extensions/che-api/package.json +++ b/code/extensions/che-api/package.json @@ -35,7 +35,7 @@ "@kubernetes/client-node": "^1.4.0", "fs-extra": "^11.2.0", "inversify": "^6.0.2", - "js-yaml": "^4.3.0", + "js-yaml": "^4.3.1", "reflect-metadata": "^0.2.2", "vscode-nls": "^5.0.0" }, diff --git a/code/extensions/che-commands/package-lock.json b/code/extensions/che-commands/package-lock.json index f43ac12005d6..2af589bb34f7 100644 --- a/code/extensions/che-commands/package-lock.json +++ b/code/extensions/che-commands/package-lock.json @@ -12,7 +12,7 @@ "@devfile/api": "^2.3.0-1738854228", "@kubernetes/client-node": "^1.4.0", "fs-extra": "^11.2.0", - "js-yaml": "^4.3.0", + "js-yaml": "^4.3.1", "reflect-metadata": "^0.2.2", "vscode-nls": "^5.0.0" }, @@ -590,9 +590,9 @@ } }, "node_modules/js-yaml": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", - "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", + "version": "4.3.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", + "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", "funding": [ { "type": "github", diff --git a/code/extensions/che-commands/package.json b/code/extensions/che-commands/package.json index 8f335835f4b0..2a08627f3e56 100644 --- a/code/extensions/che-commands/package.json +++ b/code/extensions/che-commands/package.json @@ -33,7 +33,7 @@ "reflect-metadata": "^0.2.2", "fs-extra": "^11.2.0", "vscode-nls": "^5.0.0", - "js-yaml": "^4.3.0", + "js-yaml": "^4.3.1", "@devfile/api": "^2.3.0-1738854228", "@kubernetes/client-node": "^1.4.0" }, diff --git a/code/extensions/che-github-authentication/package-lock.json b/code/extensions/che-github-authentication/package-lock.json index a8c9f5caed25..20d35a49d1cd 100644 --- a/code/extensions/che-github-authentication/package-lock.json +++ b/code/extensions/che-github-authentication/package-lock.json @@ -950,9 +950,9 @@ } }, "node_modules/js-yaml": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", - "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", + "version": "4.3.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", + "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", "funding": [ { "type": "github", diff --git a/code/extensions/che-github-authentication/package.json b/code/extensions/che-github-authentication/package.json index c93c50e799fa..b0b32b4ea4db 100644 --- a/code/extensions/che-github-authentication/package.json +++ b/code/extensions/che-github-authentication/package.json @@ -76,7 +76,7 @@ "@types/node-fetch": { "form-data": "^4.0.6" }, - "js-yaml@4": "^4.3.0" + "js-yaml@4": "^4.3.1" }, "repository": { "type": "git", diff --git a/code/extensions/che-remote/package-lock.json b/code/extensions/che-remote/package-lock.json index 23cc7b202aff..27323eb8bfb2 100644 --- a/code/extensions/che-remote/package-lock.json +++ b/code/extensions/che-remote/package-lock.json @@ -12,7 +12,7 @@ "@eclipse-che/che-devworkspace-generator": "7.113.0", "axios": "^1.17.0", "https": "^1.0.0", - "js-yaml": "^4.3.0", + "js-yaml": "^4.3.1", "vscode-nls": "^5.0.0" }, "devDependencies": { @@ -3747,9 +3747,9 @@ "license": "MIT" }, "node_modules/js-yaml": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", - "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", + "version": "4.3.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", + "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", "funding": [ { "type": "github", diff --git a/code/extensions/che-remote/package.json b/code/extensions/che-remote/package.json index bd934ae20d54..84bfa02cfe61 100644 --- a/code/extensions/che-remote/package.json +++ b/code/extensions/che-remote/package.json @@ -35,7 +35,7 @@ "axios": "^1.17.0", "@eclipse-che/che-devworkspace-generator": "7.113.0", "https": "^1.0.0", - "js-yaml": "^4.3.0" + "js-yaml": "^4.3.1" }, "devDependencies": { "jest": "29.7.0", diff --git a/code/extensions/che-resource-monitor/package-lock.json b/code/extensions/che-resource-monitor/package-lock.json index 4f643e61e083..7c76c928173b 100644 --- a/code/extensions/che-resource-monitor/package-lock.json +++ b/code/extensions/che-resource-monitor/package-lock.json @@ -1029,28 +1029,6 @@ "node": ">= 6" } }, - "node_modules/@kubernetes/client-node/node_modules/js-yaml": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", - "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/puzrin" - }, - { - "type": "github", - "url": "https://github.com/sponsors/nodeca" - } - ], - "license": "MIT", - "dependencies": { - "argparse": "^2.0.1" - }, - "bin": { - "js-yaml": "bin/js-yaml.js" - } - }, "node_modules/@kubernetes/client-node/node_modules/undici-types": { "version": "7.16.0", "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.16.0.tgz", @@ -3322,6 +3300,28 @@ "dev": true, "license": "MIT" }, + "node_modules/js-yaml": { + "version": "4.3.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", + "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/puzrin" + }, + { + "type": "github", + "url": "https://github.com/sponsors/nodeca" + } + ], + "license": "MIT", + "dependencies": { + "argparse": "^2.0.1" + }, + "bin": { + "js-yaml": "bin/js-yaml.js" + } + }, "node_modules/jsep": { "version": "1.4.0", "resolved": "https://registry.npmjs.org/jsep/-/jsep-1.4.0.tgz", diff --git a/code/extensions/che-resource-monitor/package.json b/code/extensions/che-resource-monitor/package.json index 3693242c923e..b02224fcae77 100644 --- a/code/extensions/che-resource-monitor/package.json +++ b/code/extensions/che-resource-monitor/package.json @@ -61,7 +61,7 @@ "form-data": "^4.0.6" }, "brace-expansion@1": "^1.1.18", - "js-yaml@4": "^4.3.0", + "js-yaml@4": "^4.3.1", "js-yaml@3": "^3.15.0" }, "repository": { diff --git a/code/extensions/che-terminal/package-lock.json b/code/extensions/che-terminal/package-lock.json index d0b124f4086c..e3c8d1d13562 100644 --- a/code/extensions/che-terminal/package-lock.json +++ b/code/extensions/che-terminal/package-lock.json @@ -10,7 +10,7 @@ "license": "EPL-2.0", "dependencies": { "fs-extra": "^11.2.0", - "js-yaml": "^4.3.0", + "js-yaml": "^4.3.1", "vscode-nls": "^5.2.0", "ws": "^8.21.0" }, @@ -81,9 +81,9 @@ "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==" }, "node_modules/js-yaml": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", - "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", + "version": "4.3.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", + "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", "funding": [ { "type": "github", diff --git a/code/extensions/che-terminal/package.json b/code/extensions/che-terminal/package.json index 489b28c57394..6b63bcbba868 100644 --- a/code/extensions/che-terminal/package.json +++ b/code/extensions/che-terminal/package.json @@ -40,7 +40,7 @@ }, "dependencies": { "fs-extra": "^11.2.0", - "js-yaml": "^4.3.0", + "js-yaml": "^4.3.1", "vscode-nls": "^5.2.0", "ws": "^8.21.0" }, diff --git a/code/extensions/copilot/package-lock.json b/code/extensions/copilot/package-lock.json index 499e59ca33b2..71b22fbd06fc 100644 --- a/code/extensions/copilot/package-lock.json +++ b/code/extensions/copilot/package-lock.json @@ -106,7 +106,7 @@ "esbuild": "0.28.1", "fastq": "^1.19.1", "glob": "^11.1.0", - "js-yaml": "^4.3.0", + "js-yaml": "^4.3.1", "minimist": "^1.2.8", "mobx": "^6.13.7", "mobx-react-lite": "^4.1.0", @@ -11506,9 +11506,9 @@ "dev": true }, "node_modules/js-yaml": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", - "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", + "version": "4.3.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", + "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", "dev": true, "funding": [ { diff --git a/code/extensions/copilot/package.json b/code/extensions/copilot/package.json index d74d6a36766b..533009001682 100644 --- a/code/extensions/copilot/package.json +++ b/code/extensions/copilot/package.json @@ -7161,7 +7161,7 @@ "esbuild": "0.28.1", "fastq": "^1.19.1", "glob": "^11.1.0", - "js-yaml": "^4.3.0", + "js-yaml": "^4.3.1", "minimist": "^1.2.8", "mobx": "^6.13.7", "mobx-react-lite": "^4.1.0", diff --git a/code/package-lock.json b/code/package-lock.json index 17df92c0100b..dc26ab8d6bdd 100644 --- a/code/package-lock.json +++ b/code/package-lock.json @@ -55,7 +55,7 @@ "detect-libc": "^2.1.2", "http-proxy-agent": "^7.0.0", "https-proxy-agent": "^7.0.2", - "js-yaml": "^4.3.0", + "js-yaml": "^4.3.1", "jschardet": "3.1.4", "katex": "^0.16.22", "kerberos": "2.1.1", @@ -12367,9 +12367,9 @@ "license": "MIT" }, "node_modules/js-yaml": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", - "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", + "version": "4.3.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", + "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", "funding": [ { "type": "github", diff --git a/code/package.json b/code/package.json index 1cd4664bc431..cc6b996cbee6 100644 --- a/code/package.json +++ b/code/package.json @@ -159,7 +159,7 @@ "yauzl": "^3.3.1", "yazl": "^2.4.3", "zod": "^3.25.76", - "js-yaml": "^4.3.0" + "js-yaml": "^4.3.1" }, "devDependencies": { "@anthropic-ai/claude-agent-sdk": "0.3.198", diff --git a/code/remote/package-lock.json b/code/remote/package-lock.json index e2780d9641a3..8e0acff12c7e 100644 --- a/code/remote/package-lock.json +++ b/code/remote/package-lock.json @@ -42,7 +42,7 @@ "detect-libc": "^2.1.2", "http-proxy-agent": "^7.0.0", "https-proxy-agent": "^7.0.2", - "js-yaml": "^4.3.0", + "js-yaml": "^4.3.1", "jschardet": "3.1.4", "katex": "^0.16.22", "kerberos": "2.1.1", @@ -1664,9 +1664,9 @@ } }, "node_modules/js-yaml": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", - "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", + "version": "4.3.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", + "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", "funding": [ { "type": "github", diff --git a/code/remote/package.json b/code/remote/package.json index d0b25e905341..c905fa25de5f 100644 --- a/code/remote/package.json +++ b/code/remote/package.json @@ -52,7 +52,7 @@ "yauzl": "^3.3.1", "yazl": "^2.4.3", "zod": "^3.25.76", - "js-yaml": "^4.3.0", + "js-yaml": "^4.3.1", "@kubernetes/client-node": "^1.4.0" }, "overrides": { diff --git a/code/test/sanity/package-lock.json b/code/test/sanity/package-lock.json index 574da98c8e3b..1b14572350ae 100644 --- a/code/test/sanity/package-lock.json +++ b/code/test/sanity/package-lock.json @@ -588,9 +588,9 @@ } }, "node_modules/js-yaml": { - "version": "4.2.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz", - "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==", + "version": "4.3.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", + "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", "funding": [ { "type": "github", diff --git a/code/test/sanity/package.json b/code/test/sanity/package.json index baf68c7b8021..edce04fc0561 100644 --- a/code/test/sanity/package.json +++ b/code/test/sanity/package.json @@ -24,6 +24,6 @@ "overrides": { "serialize-javascript": "^7.0.3", "brace-expansion@2": "^2.1.4", - "js-yaml@4": "^4.3.0" + "js-yaml@4": "^4.3.1" } } diff --git a/launcher/package-lock.json b/launcher/package-lock.json index d4f43af0c1a4..8c1d54b0b810 100644 --- a/launcher/package-lock.json +++ b/launcher/package-lock.json @@ -9,7 +9,7 @@ "version": "0.0.1", "dependencies": { "@kubernetes/client-node": "^1.4.0", - "js-yaml": "^4.3.0" + "js-yaml": "^4.3.1" }, "bin": { "che-code-launcher": "out/entrypoint.js" @@ -3931,9 +3931,9 @@ "dev": true }, "node_modules/js-yaml": { - "version": "4.3.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", - "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", + "version": "4.3.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", + "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", "funding": [ { "type": "github", diff --git a/launcher/package.json b/launcher/package.json index 0824724c5e68..c7685ddb9410 100644 --- a/launcher/package.json +++ b/launcher/package.json @@ -31,7 +31,7 @@ "url": "git+https://github.com/che-incubator/che-code.git" }, "dependencies": { - "js-yaml": "^4.3.0", + "js-yaml": "^4.3.1", "@kubernetes/client-node": "^1.4.0" }, "devDependencies": { From 6adf2914229807307bc41b0667ae4c08ebbb03f7 Mon Sep 17 00:00:00 2001 From: Stephane Bouchet Date: Thu, 6 Aug 2026 16:58:56 -0500 Subject: [PATCH 07/12] fixed changelog Signed-off-by: Stephane Bouchet --- .rebase/CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/.rebase/CHANGELOG.md b/.rebase/CHANGELOG.md index 37a46d312f2f..2ea3fa25f05c 100644 --- a/.rebase/CHANGELOG.md +++ b/.rebase/CHANGELOG.md @@ -49,6 +49,7 @@ https://github.com/che-incubator/che-code/pull/777 - code/test/sanity/package.json --- +#### @sbouchet https://github.com/che-incubator/che-code/pull/750 - code/extensions/copilot/package.json From ebd6dd84eac26e9cd1e1bba82050863a966d231f Mon Sep 17 00:00:00 2001 From: Stephane Bouchet Date: Thu, 6 Aug 2026 17:20:29 -0500 Subject: [PATCH 08/12] removed @ when not necessary Signed-off-by: Stephane Bouchet --- .rebase/add/code/build/package.json | 3 +-- .rebase/add/code/extensions/npm/package.json | 2 +- .rebase/add/code/test/sanity/package.json | 2 +- code/build/package.json | 3 +-- code/extensions/che-github-authentication/package.json | 2 +- code/extensions/che-port/package.json | 2 +- code/extensions/che-resource-monitor/package.json | 4 ++-- code/extensions/npm/package.json | 2 +- code/test/sanity/package.json | 2 +- 9 files changed, 10 insertions(+), 12 deletions(-) diff --git a/.rebase/add/code/build/package.json b/.rebase/add/code/build/package.json index 4388554b923a..960ede5d417e 100644 --- a/.rebase/add/code/build/package.json +++ b/.rebase/add/code/build/package.json @@ -8,7 +8,6 @@ }, "form-data@4": "^4.0.6", "brace-expansion@2": "^2.1.4", - "js-yaml@3": "^3.15.0", - "js-yaml@4": "^4.3.1" + "js-yaml": "^4.3.1" } } diff --git a/.rebase/add/code/extensions/npm/package.json b/.rebase/add/code/extensions/npm/package.json index a5e1e246282e..983ddee0a734 100644 --- a/.rebase/add/code/extensions/npm/package.json +++ b/.rebase/add/code/extensions/npm/package.json @@ -1,6 +1,6 @@ { "overrides": { "brace-expansion@2": "^2.1.4", - "js-yaml@3": "^3.15.0" + "js-yaml": "^3.15.0" } } diff --git a/.rebase/add/code/test/sanity/package.json b/.rebase/add/code/test/sanity/package.json index 38a9f0a69709..0b96988a84ce 100644 --- a/.rebase/add/code/test/sanity/package.json +++ b/.rebase/add/code/test/sanity/package.json @@ -1,6 +1,6 @@ { "overrides": { "brace-expansion@2": "^2.1.4", - "js-yaml@4": "^4.3.1" + "js-yaml": "^4.3.1" } } diff --git a/code/build/package.json b/code/build/package.json index 115e8514456b..e69edbf9e3a1 100644 --- a/code/build/package.json +++ b/code/build/package.json @@ -88,7 +88,6 @@ }, "form-data@4": "^4.0.6", "brace-expansion@2": "^2.1.4", - "js-yaml@3": "^3.15.0", - "js-yaml@4": "^4.3.1" + "js-yaml": "^4.3.1" } } diff --git a/code/extensions/che-github-authentication/package.json b/code/extensions/che-github-authentication/package.json index b0b32b4ea4db..81bf5d94189e 100644 --- a/code/extensions/che-github-authentication/package.json +++ b/code/extensions/che-github-authentication/package.json @@ -76,7 +76,7 @@ "@types/node-fetch": { "form-data": "^4.0.6" }, - "js-yaml@4": "^4.3.1" + "js-yaml": "^4.3.1" }, "repository": { "type": "git", diff --git a/code/extensions/che-port/package.json b/code/extensions/che-port/package.json index 4e1e94609b4b..8c5ce65747b4 100644 --- a/code/extensions/che-port/package.json +++ b/code/extensions/che-port/package.json @@ -54,7 +54,7 @@ "minimatch": "^3.1.5", "handlebars": "4.7.9", "brace-expansion@1": "^1.1.18", - "js-yaml@3": "^3.15.0" + "js-yaml": "^3.15.0" }, "repository": { "type": "git", diff --git a/code/extensions/che-resource-monitor/package.json b/code/extensions/che-resource-monitor/package.json index b02224fcae77..5bf35269cf5c 100644 --- a/code/extensions/che-resource-monitor/package.json +++ b/code/extensions/che-resource-monitor/package.json @@ -61,8 +61,8 @@ "form-data": "^4.0.6" }, "brace-expansion@1": "^1.1.18", - "js-yaml@4": "^4.3.1", - "js-yaml@3": "^3.15.0" + "js-yaml@3": "^3.15.0", + "js-yaml@4": "^4.3.1" }, "repository": { "type": "git", diff --git a/code/extensions/npm/package.json b/code/extensions/npm/package.json index 727ecf7bde8b..69e67690982a 100644 --- a/code/extensions/npm/package.json +++ b/code/extensions/npm/package.json @@ -386,7 +386,7 @@ }, "overrides": { "brace-expansion@2": "^2.1.4", - "js-yaml@3": "^3.15.0" + "js-yaml": "^3.15.0" }, "repository": { "type": "git", diff --git a/code/test/sanity/package.json b/code/test/sanity/package.json index edce04fc0561..076600478a39 100644 --- a/code/test/sanity/package.json +++ b/code/test/sanity/package.json @@ -24,6 +24,6 @@ "overrides": { "serialize-javascript": "^7.0.3", "brace-expansion@2": "^2.1.4", - "js-yaml@4": "^4.3.1" + "js-yaml": "^4.3.1" } } From edb7ff9c6e2ee6c186414954d044c88ead963997 Mon Sep 17 00:00:00 2001 From: Stephane Bouchet Date: Thu, 6 Aug 2026 18:19:52 -0500 Subject: [PATCH 09/12] fixed rebase rules Signed-off-by: Stephane Bouchet --- .rebase/add/code/package.json | 3 --- .rebase/add/code/remote/package.json | 1 - .rebase/override/code/package.json | 3 ++- .rebase/override/code/remote/package.json | 3 ++- 4 files changed, 4 insertions(+), 6 deletions(-) diff --git a/.rebase/add/code/package.json b/.rebase/add/code/package.json index fb803a9e36ee..0787f754eb7e 100644 --- a/.rebase/add/code/package.json +++ b/.rebase/add/code/package.json @@ -1,7 +1,4 @@ { - "dependencies": { - "js-yaml": "^4.3.1" - }, "devDependencies": { "@types/js-yaml": "^4.0.5", "@types/minimatch": "^3.0.5" diff --git a/.rebase/add/code/remote/package.json b/.rebase/add/code/remote/package.json index b1140231ebbb..f80d3b23cbcb 100644 --- a/.rebase/add/code/remote/package.json +++ b/.rebase/add/code/remote/package.json @@ -1,6 +1,5 @@ { "dependencies": { - "js-yaml": "^4.3.1", "@kubernetes/client-node": "^1.4.0" }, "overrides": { diff --git a/.rebase/override/code/package.json b/.rebase/override/code/package.json index e2e092489af4..31b1d4382afb 100644 --- a/.rebase/override/code/package.json +++ b/.rebase/override/code/package.json @@ -2,7 +2,8 @@ "name": "che-code", "bin": "out/vs/server/main.js", "dependencies": { - "ws": "^8.21.0" + "ws": "^8.21.0", + "js-yaml": "^4.3.1" }, "devDependencies": { "@vscode/l10n-dev": "0.0.18", diff --git a/.rebase/override/code/remote/package.json b/.rebase/override/code/remote/package.json index 038041c99799..b4212846b3f3 100644 --- a/.rebase/override/code/remote/package.json +++ b/.rebase/override/code/remote/package.json @@ -1,6 +1,7 @@ { "dependencies": { "ws": "^8.21.0", - "tar": "^7.5.22" + "tar": "^7.5.22", + "js-yaml": "^4.3.1" } } From f6a43e5ea231e25e6d4d80a880673eb787cdeee2 Mon Sep 17 00:00:00 2001 From: Stephane Bouchet Date: Fri, 7 Aug 2026 15:30:12 -0500 Subject: [PATCH 10/12] fixed changelog Signed-off-by: Stephane Bouchet --- .rebase/CHANGELOG.md | 1 - 1 file changed, 1 deletion(-) diff --git a/.rebase/CHANGELOG.md b/.rebase/CHANGELOG.md index 2ea3fa25f05c..a3606e7e824f 100644 --- a/.rebase/CHANGELOG.md +++ b/.rebase/CHANGELOG.md @@ -45,7 +45,6 @@ https://github.com/che-incubator/che-code/pull/777 - code/remote/package.json - code/build/package.json - code/extensions/copilot/package.json -- code/extensions/npm/package.json - code/test/sanity/package.json --- From 0bae832dfb2b3d4168473d88d0a27935bc2fe275 Mon Sep 17 00:00:00 2001 From: Stephane Bouchet Date: Fri, 21 Aug 2026 12:17:12 -0500 Subject: [PATCH 11/12] fixed rebase rules Signed-off-by: Stephane Bouchet --- .rebase/add/code/extensions/copilot/package.json | 3 +-- .rebase/add/code/package.json | 3 ++- .rebase/add/code/remote/package.json | 3 ++- .rebase/override/code/extensions/copilot/package.json | 1 - .rebase/override/code/package.json | 3 +-- .rebase/override/code/remote/package.json | 3 +-- code/package-lock.json | 5 +++-- code/package.json | 6 +++--- code/remote/package-lock.json | 1 - code/remote/package.json | 4 ++-- 10 files changed, 15 insertions(+), 17 deletions(-) diff --git a/.rebase/add/code/extensions/copilot/package.json b/.rebase/add/code/extensions/copilot/package.json index 256b25374221..1e2720e2cfdb 100644 --- a/.rebase/add/code/extensions/copilot/package.json +++ b/.rebase/add/code/extensions/copilot/package.json @@ -13,7 +13,6 @@ }, "@grpc/proto-loader": { "protobufjs": "^7.6.5" - }, - "js-yaml@3": "^3.15.0" + } } } diff --git a/.rebase/add/code/package.json b/.rebase/add/code/package.json index 0787f754eb7e..5dd9ce359bab 100644 --- a/.rebase/add/code/package.json +++ b/.rebase/add/code/package.json @@ -22,6 +22,7 @@ }, "axios": { "form-data": "^4.0.6" - } + }, + "js-yaml@4": "^4.3.1" } } diff --git a/.rebase/add/code/remote/package.json b/.rebase/add/code/remote/package.json index f80d3b23cbcb..5bc4d51d67f4 100644 --- a/.rebase/add/code/remote/package.json +++ b/.rebase/add/code/remote/package.json @@ -8,6 +8,7 @@ "undici": "^7.28.0", "@types/node-fetch": { "form-data": "^4.0.6" - } + }, + "js-yaml": "^4.3.1" } } diff --git a/.rebase/override/code/extensions/copilot/package.json b/.rebase/override/code/extensions/copilot/package.json index a27370e4e932..edaa5347adf6 100644 --- a/.rebase/override/code/extensions/copilot/package.json +++ b/.rebase/override/code/extensions/copilot/package.json @@ -4,7 +4,6 @@ }, "devDependencies": { "tar": "^7.5.22", - "undici": "^7.28.0", "js-yaml": "^4.3.1" } } diff --git a/.rebase/override/code/package.json b/.rebase/override/code/package.json index 31b1d4382afb..e2e092489af4 100644 --- a/.rebase/override/code/package.json +++ b/.rebase/override/code/package.json @@ -2,8 +2,7 @@ "name": "che-code", "bin": "out/vs/server/main.js", "dependencies": { - "ws": "^8.21.0", - "js-yaml": "^4.3.1" + "ws": "^8.21.0" }, "devDependencies": { "@vscode/l10n-dev": "0.0.18", diff --git a/.rebase/override/code/remote/package.json b/.rebase/override/code/remote/package.json index b4212846b3f3..038041c99799 100644 --- a/.rebase/override/code/remote/package.json +++ b/.rebase/override/code/remote/package.json @@ -1,7 +1,6 @@ { "dependencies": { "ws": "^8.21.0", - "tar": "^7.5.22", - "js-yaml": "^4.3.1" + "tar": "^7.5.22" } } diff --git a/code/package-lock.json b/code/package-lock.json index dc26ab8d6bdd..ecf91b59209f 100644 --- a/code/package-lock.json +++ b/code/package-lock.json @@ -55,7 +55,6 @@ "detect-libc": "^2.1.2", "http-proxy-agent": "^7.0.0", "https-proxy-agent": "^7.0.2", - "js-yaml": "^4.3.1", "jschardet": "3.1.4", "katex": "^0.16.22", "kerberos": "2.1.1", @@ -4970,7 +4969,8 @@ "node_modules/argparse": { "version": "2.0.1", "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz", - "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==" + "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==", + "dev": true }, "node_modules/arr-diff": { "version": "4.0.0", @@ -12370,6 +12370,7 @@ "version": "4.3.1", "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz", "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==", + "dev": true, "funding": [ { "type": "github", diff --git a/code/package.json b/code/package.json index cc6b996cbee6..c06d36155231 100644 --- a/code/package.json +++ b/code/package.json @@ -158,8 +158,7 @@ "ws": "^8.21.0", "yauzl": "^3.3.1", "yazl": "^2.4.3", - "zod": "^3.25.76", - "js-yaml": "^4.3.1" + "zod": "^3.25.76" }, "devDependencies": { "@anthropic-ai/claude-agent-sdk": "0.3.198", @@ -299,7 +298,8 @@ }, "axios": { "form-data": "^4.0.6" - } + }, + "js-yaml@4": "^4.3.1" }, "repository": { "type": "git", diff --git a/code/remote/package-lock.json b/code/remote/package-lock.json index 8e0acff12c7e..207bdb8846ca 100644 --- a/code/remote/package-lock.json +++ b/code/remote/package-lock.json @@ -42,7 +42,6 @@ "detect-libc": "^2.1.2", "http-proxy-agent": "^7.0.0", "https-proxy-agent": "^7.0.2", - "js-yaml": "^4.3.1", "jschardet": "3.1.4", "katex": "^0.16.22", "kerberos": "2.1.1", diff --git a/code/remote/package.json b/code/remote/package.json index c905fa25de5f..f0a8ac9d8e6e 100644 --- a/code/remote/package.json +++ b/code/remote/package.json @@ -52,7 +52,6 @@ "yauzl": "^3.3.1", "yazl": "^2.4.3", "zod": "^3.25.76", - "js-yaml": "^4.3.1", "@kubernetes/client-node": "^1.4.0" }, "overrides": { @@ -69,6 +68,7 @@ "undici": "^7.28.0", "@types/node-fetch": { "form-data": "^4.0.6" - } + }, + "js-yaml": "^4.3.1" } } From b7bd81f8986e5eaa2104fff289a1bfde1637237d Mon Sep 17 00:00:00 2001 From: Stephane Bouchet Date: Mon, 24 Aug 2026 10:19:45 -0500 Subject: [PATCH 12/12] fixed rebase rules Signed-off-by: Stephane Bouchet --- .rebase/CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/.rebase/CHANGELOG.md b/.rebase/CHANGELOG.md index a3606e7e824f..2ea3fa25f05c 100644 --- a/.rebase/CHANGELOG.md +++ b/.rebase/CHANGELOG.md @@ -45,6 +45,7 @@ https://github.com/che-incubator/che-code/pull/777 - code/remote/package.json - code/build/package.json - code/extensions/copilot/package.json +- code/extensions/npm/package.json - code/test/sanity/package.json ---