fix multiple CVEs by updating ip-adress to patched version by sbouchet · Pull Request #796 · che-incubator/che-code

sbouchet · 2026-08-24T15:09:01Z

What does this PR do?

This PR fixes CVE-2026-69192 and CVE-2026-54272
ip-adress versions is updated to 10.3.1

What issues does this PR fix?

https://redhat.atlassian.net/browse/CRW-12233
https://redhat.atlassian.net/browse/CRW-12161

How to test this PR?

Does this PR contain changes that override default upstream Code-OSS behavior?

the PR contains changes in the code folder (you can skip it if your changes are placed in a che extension )
the corresponding items were added to the CHANGELOG.md file
rules for automatic git rebase were added to the .rebase folder

Summary by CodeRabbit

Maintenance
- Updated networking components across application, extension, remote, test, build, and launcher areas.
- Standardized package version management across packaged and mirrored configurations.
- Improved consistency and reliability during installations and builds.
Documentation
- Added a changelog entry documenting the update and associated release information.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>

github-actions · 2026-08-24T15:09:10Z

Click here to review and test in web IDE:

Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>

coderabbitai · 2026-08-24T15:17:18Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 942fc6dc-2665-489c-8c43-71b28f961e4f

📥 Commits

Reviewing files that changed from the base of the PR and between 02a56bb and 54df553.

⛔ Files ignored due to path filters (2)

code/extensions/copilot/package-lock.json is excluded by !**/package-lock.json
code/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (5)

.rebase/CHANGELOG.md
.rebase/add/code/extensions/copilot/package.json
.rebase/add/code/package.json
code/extensions/copilot/package.json
code/package.json

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

Walkthrough

The pull request updates ip-address override constraints from ^10.2.0 to ^10.3.1 across package manifests. It also adds a vite override that pins postcss to ^8.5.26 and records pull request #796 in the changelog.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 54df5

The PR updates dependency references and lockfiles to a patched version to address reported vulnerabilities. No actionable merge-blocking risk remains in the supplied evidence; it is merge-ready after normal checks and review.

Suggested reviewers: rgrunber, azatsarynnyy, vitaliy-guliy, romannikitenko

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Rebase Rules For Upstream Changes	❌ Error	Qualifying files under `code/` changed: `code/package.json`, `code/build/npm/gyp/package.json`, `code/extensions/copilot/package.json`, `code/remote/package.json`, and `code/test/mcp/package.json`. Th…	Update `rebase.sh` in this PR to include the required `resolve_conflicts` routing for all qualifying rule paths. Keep one appropriate `elif` branch per path and do not add duplicate branches.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise, uses imperative mood, and clearly describes updating ip-address to address multiple CVEs. It contains a minor spelling error in "ip-adress" but remains understandable.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Rebase Rules For Upstream Changes

Explanation

Qualifying files under code/ changed: code/package.json, code/build/npm/gyp/package.json, code/extensions/copilot/package.json, code/remote/package.json, and code/test/mcp/package.json. The PR updates matching .rebase/add/ rules and adds a .rebase/CHANGELOG.md entry. However, git diff origin/main...HEAD -- rebase.sh is empty. The resolver branches exist only from the base revision, so rebase.sh routing was not updated in this PR.

Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-08-24T15:51:49Z