From e69992db6641f062186dae7de5a1ac033eb506d8 Mon Sep 17 00:00:00 2001 From: Stephane Bouchet Date: Fri, 21 Aug 2026 16:36:34 -0500 Subject: [PATCH 1/3] fix: update ip-address to ^10.3.1 (CVE-2026-69192) Co-Authored-By: Claude Opus 4.6 Signed-off-by: Stephane Bouchet --- code/build/npm/gyp/package-lock.json | 6 +++--- code/build/npm/gyp/package.json | 2 +- code/extensions/che-api/package-lock.json | 6 +++--- code/extensions/che-api/package.json | 2 +- code/extensions/che-commands/package-lock.json | 6 +++--- code/extensions/che-commands/package.json | 2 +- code/extensions/che-github-authentication/package-lock.json | 6 +++--- code/extensions/che-github-authentication/package.json | 2 +- code/extensions/che-resource-monitor/package-lock.json | 6 +++--- code/extensions/che-resource-monitor/package.json | 2 +- code/extensions/copilot/package-lock.json | 6 +++--- code/extensions/copilot/package.json | 2 +- code/package-lock.json | 6 +++--- code/package.json | 2 +- code/remote/package-lock.json | 6 +++--- code/remote/package.json | 2 +- code/test/mcp/package-lock.json | 6 +++--- code/test/mcp/package.json | 2 +- launcher/package-lock.json | 6 +++--- launcher/package.json | 2 +- 20 files changed, 40 insertions(+), 40 deletions(-) diff --git a/code/build/npm/gyp/package-lock.json b/code/build/npm/gyp/package-lock.json index 89cdc780e5bd..df17d7759027 100644 --- a/code/build/npm/gyp/package-lock.json +++ b/code/build/npm/gyp/package-lock.json @@ -438,9 +438,9 @@ } }, "node_modules/ip-address": { - "version": "10.2.0", - "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz", - "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==", + "version": "10.5.0", + "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.5.0.tgz", + "integrity": "sha512-R5SnVLJmgYYvf2F2ZgwSBnelz5G4q5AxIC277GDfUaNbrZKNANcBC7RHqYYePlszf4kBolVkJauG0ZjHHFh55g==", "dev": true, "license": "MIT", "engines": { diff --git a/code/build/npm/gyp/package.json b/code/build/npm/gyp/package.json index 13db14d8dc77..88d80fafbefa 100644 --- a/code/build/npm/gyp/package.json +++ b/code/build/npm/gyp/package.json @@ -7,7 +7,7 @@ "node-gyp": "^11.2.0" }, "overrides": { - "ip-address": "^10.2.0", + "ip-address": "^10.3.1", "brace-expansion@2": "^2.1.4", "tar": "^7.5.22" }, diff --git a/code/extensions/che-api/package-lock.json b/code/extensions/che-api/package-lock.json index 6aa0d4314334..a7a6864c6200 100644 --- a/code/extensions/che-api/package-lock.json +++ b/code/extensions/che-api/package-lock.json @@ -2543,9 +2543,9 @@ "integrity": "sha512-i9m8j/7YIv4mDuYXUAcrpKPSaju/CIly9AHK5jvCBeoiM/2KEsuCQTTP+rzSWWpLYWRukdXFSl6ZTk2/uumbiA==" }, "node_modules/ip-address": { - "version": "10.2.0", - "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz", - "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==", + "version": "10.5.0", + "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.5.0.tgz", + "integrity": "sha512-R5SnVLJmgYYvf2F2ZgwSBnelz5G4q5AxIC277GDfUaNbrZKNANcBC7RHqYYePlszf4kBolVkJauG0ZjHHFh55g==", "license": "MIT", "engines": { "node": ">= 12" diff --git a/code/extensions/che-api/package.json b/code/extensions/che-api/package.json index e6991021efc8..e97941d2e845 100644 --- a/code/extensions/che-api/package.json +++ b/code/extensions/che-api/package.json @@ -55,7 +55,7 @@ "axios": "^0.32.0" }, "follow-redirects": "^1.16.0", - "ip-address": "^10.2.0", + "ip-address": "^10.3.1", "ws": "^8.21.0", "@devfile/api": { "form-data@2": "^2.5.6" diff --git a/code/extensions/che-commands/package-lock.json b/code/extensions/che-commands/package-lock.json index 6b7f56e26e80..0a9e68286606 100644 --- a/code/extensions/che-commands/package-lock.json +++ b/code/extensions/che-commands/package-lock.json @@ -565,9 +565,9 @@ } }, "node_modules/ip-address": { - "version": "10.2.0", - "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz", - "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==", + "version": "10.5.0", + "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.5.0.tgz", + "integrity": "sha512-R5SnVLJmgYYvf2F2ZgwSBnelz5G4q5AxIC277GDfUaNbrZKNANcBC7RHqYYePlszf4kBolVkJauG0ZjHHFh55g==", "license": "MIT", "engines": { "node": ">= 12" diff --git a/code/extensions/che-commands/package.json b/code/extensions/che-commands/package.json index 30255130c924..b1f966e78734 100644 --- a/code/extensions/che-commands/package.json +++ b/code/extensions/che-commands/package.json @@ -43,7 +43,7 @@ "@types/node": "22.x" }, "overrides": { - "ip-address": "^10.2.0", + "ip-address": "^10.3.1", "ws": "^8.21.0", "@devfile/api": { "form-data@2": "^2.5.6" diff --git a/code/extensions/che-github-authentication/package-lock.json b/code/extensions/che-github-authentication/package-lock.json index 68d106698dd4..f1b92565a481 100644 --- a/code/extensions/che-github-authentication/package-lock.json +++ b/code/extensions/che-github-authentication/package-lock.json @@ -924,9 +924,9 @@ "integrity": "sha512-i9m8j/7YIv4mDuYXUAcrpKPSaju/CIly9AHK5jvCBeoiM/2KEsuCQTTP+rzSWWpLYWRukdXFSl6ZTk2/uumbiA==" }, "node_modules/ip-address": { - "version": "10.2.0", - "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz", - "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==", + "version": "10.5.0", + "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.5.0.tgz", + "integrity": "sha512-R5SnVLJmgYYvf2F2ZgwSBnelz5G4q5AxIC277GDfUaNbrZKNANcBC7RHqYYePlszf4kBolVkJauG0ZjHHFh55g==", "license": "MIT", "engines": { "node": ">= 12" diff --git a/code/extensions/che-github-authentication/package.json b/code/extensions/che-github-authentication/package.json index 0d1e0e34164f..a9a14a7cb483 100644 --- a/code/extensions/che-github-authentication/package.json +++ b/code/extensions/che-github-authentication/package.json @@ -65,7 +65,7 @@ "@types/uuid": "8.0.0" }, "overrides": { - "ip-address": "^10.2.0", + "ip-address": "^10.3.1", "ws": "^8.21.0", "@devfile/api": { "form-data@2": "^2.5.6" diff --git a/code/extensions/che-resource-monitor/package-lock.json b/code/extensions/che-resource-monitor/package-lock.json index e0e18dc8d182..1c215bc6ba98 100644 --- a/code/extensions/che-resource-monitor/package-lock.json +++ b/code/extensions/che-resource-monitor/package-lock.json @@ -2514,9 +2514,9 @@ } }, "node_modules/ip-address": { - "version": "10.2.0", - "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz", - "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==", + "version": "10.5.0", + "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.5.0.tgz", + "integrity": "sha512-R5SnVLJmgYYvf2F2ZgwSBnelz5G4q5AxIC277GDfUaNbrZKNANcBC7RHqYYePlszf4kBolVkJauG0ZjHHFh55g==", "license": "MIT", "engines": { "node": ">= 12" diff --git a/code/extensions/che-resource-monitor/package.json b/code/extensions/che-resource-monitor/package.json index b3a14e851a70..e6243ed6d2b3 100644 --- a/code/extensions/che-resource-monitor/package.json +++ b/code/extensions/che-resource-monitor/package.json @@ -49,7 +49,7 @@ "overrides": { "minimatch": "^3.1.5", "handlebars": "4.7.9", - "ip-address": "^10.2.0", + "ip-address": "^10.3.1", "ws": "^8.21.0", "@devfile/api": { "form-data@2": "^2.5.6" diff --git a/code/extensions/copilot/package-lock.json b/code/extensions/copilot/package-lock.json index 499e59ca33b2..6910b43969ef 100644 --- a/code/extensions/copilot/package-lock.json +++ b/code/extensions/copilot/package-lock.json @@ -10827,9 +10827,9 @@ } }, "node_modules/ip-address": { - "version": "10.2.0", - "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz", - "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==", + "version": "10.5.0", + "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.5.0.tgz", + "integrity": "sha512-R5SnVLJmgYYvf2F2ZgwSBnelz5G4q5AxIC277GDfUaNbrZKNANcBC7RHqYYePlszf4kBolVkJauG0ZjHHFh55g==", "license": "MIT", "engines": { "node": ">= 12" diff --git a/code/extensions/copilot/package.json b/code/extensions/copilot/package.json index d74d6a36766b..2b700443572b 100644 --- a/code/extensions/copilot/package.json +++ b/code/extensions/copilot/package.json @@ -7250,7 +7250,7 @@ "zod": "3.25.76", "shell-quote": "^1.8.4", "qs": "6.15.2", - "ip-address": "^10.2.0", + "ip-address": "^10.3.1", "ws": "^8.21.0", "brace-expansion@1": "^1.1.18", "brace-expansion@2": "^2.1.4", diff --git a/code/package-lock.json b/code/package-lock.json index 519b91501f3a..fbae703a8d8f 100644 --- a/code/package-lock.json +++ b/code/package-lock.json @@ -11159,9 +11159,9 @@ } }, "node_modules/ip-address": { - "version": "10.2.0", - "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz", - "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==", + "version": "10.5.0", + "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.5.0.tgz", + "integrity": "sha512-R5SnVLJmgYYvf2F2ZgwSBnelz5G4q5AxIC277GDfUaNbrZKNANcBC7RHqYYePlszf4kBolVkJauG0ZjHHFh55g==", "license": "MIT", "engines": { "node": ">= 12" diff --git a/code/package.json b/code/package.json index 8b2e8991a3d9..b21cf27915fc 100644 --- a/code/package.json +++ b/code/package.json @@ -290,7 +290,7 @@ "flatted": "^3.4.2", "shell-quote": "^1.8.4", "qs": "6.15.2", - "ip-address": "^10.2.0", + "ip-address": "^10.3.1", "brace-expansion@1": "^1.1.18", "brace-expansion@2": "^2.1.4", "test-exclude": { diff --git a/code/remote/package-lock.json b/code/remote/package-lock.json index 42195e3dca62..083d0797a809 100644 --- a/code/remote/package-lock.json +++ b/code/remote/package-lock.json @@ -1618,9 +1618,9 @@ "integrity": "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==" }, "node_modules/ip-address": { - "version": "10.2.0", - "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz", - "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==", + "version": "10.5.0", + "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.5.0.tgz", + "integrity": "sha512-R5SnVLJmgYYvf2F2ZgwSBnelz5G4q5AxIC277GDfUaNbrZKNANcBC7RHqYYePlszf4kBolVkJauG0ZjHHFh55g==", "license": "MIT", "engines": { "node": ">= 12" diff --git a/code/remote/package.json b/code/remote/package.json index b9394dbb17b8..5916a45fab20 100644 --- a/code/remote/package.json +++ b/code/remote/package.json @@ -65,7 +65,7 @@ }, "yauzl": "^3.3.1", "shell-quote": "^1.8.4", - "ip-address": "^10.2.0", + "ip-address": "^10.3.1", "undici": "^7.28.0", "@types/node-fetch": { "form-data": "^4.0.6" diff --git a/code/test/mcp/package-lock.json b/code/test/mcp/package-lock.json index 01b614f675f4..253f7a425ac4 100644 --- a/code/test/mcp/package-lock.json +++ b/code/test/mcp/package-lock.json @@ -753,9 +753,9 @@ "license": "ISC" }, "node_modules/ip-address": { - "version": "10.2.0", - "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz", - "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==", + "version": "10.5.0", + "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.5.0.tgz", + "integrity": "sha512-R5SnVLJmgYYvf2F2ZgwSBnelz5G4q5AxIC277GDfUaNbrZKNANcBC7RHqYYePlszf4kBolVkJauG0ZjHHFh55g==", "license": "MIT", "engines": { "node": ">= 12" diff --git a/code/test/mcp/package.json b/code/test/mcp/package.json index 4dc20d70308e..bd531a49d403 100644 --- a/code/test/mcp/package.json +++ b/code/test/mcp/package.json @@ -26,7 +26,7 @@ "overrides": { "shell-quote": "^1.8.4", "qs": "6.15.2", - "ip-address": "^10.2.0", + "ip-address": "^10.3.1", "@types/node-fetch": { "form-data": "^4.0.6" } diff --git a/launcher/package-lock.json b/launcher/package-lock.json index 4dca0b3d7cab..ee8992038b86 100644 --- a/launcher/package-lock.json +++ b/launcher/package-lock.json @@ -3118,9 +3118,9 @@ "dev": true }, "node_modules/ip-address": { - "version": "10.2.0", - "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz", - "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==", + "version": "10.5.0", + "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.5.0.tgz", + "integrity": "sha512-R5SnVLJmgYYvf2F2ZgwSBnelz5G4q5AxIC277GDfUaNbrZKNANcBC7RHqYYePlszf4kBolVkJauG0ZjHHFh55g==", "license": "MIT", "engines": { "node": ">= 12" diff --git a/launcher/package.json b/launcher/package.json index cfc9184a7fdf..81e40a3c1f93 100644 --- a/launcher/package.json +++ b/launcher/package.json @@ -55,7 +55,7 @@ "minimatch": "^3.1.5", "handlebars": "4.7.9", "flatted": "^3.4.2", - "ip-address": "^10.2.0", + "ip-address": "^10.3.1", "ws": "^8.21.0", "@types/node-fetch": { "form-data": "^4.0.6" From 7115ba26466f296ac5d59a5503d3b9bd3827fe32 Mon Sep 17 00:00:00 2001 From: Stephane Bouchet Date: Fri, 21 Aug 2026 16:47:41 -0500 Subject: [PATCH 2/3] chore: add rebase rules for ip-address update Co-Authored-By: Claude Opus 4.6 Signed-off-by: Stephane Bouchet --- .rebase/CHANGELOG.md | 10 ++++++++++ .rebase/add/code/build/npm/gyp/package.json | 2 +- .rebase/add/code/extensions/copilot/package.json | 2 +- .rebase/add/code/package.json | 2 +- .rebase/add/code/remote/package.json | 2 +- .rebase/add/code/test/mcp/package.json | 2 +- 6 files changed, 15 insertions(+), 5 deletions(-) diff --git a/.rebase/CHANGELOG.md b/.rebase/CHANGELOG.md index 27c0fabd2903..8f25690b6702 100644 --- a/.rebase/CHANGELOG.md +++ b/.rebase/CHANGELOG.md @@ -2,6 +2,16 @@ The file to keep a list of changed files which will potentially help to resolve rebase conflicts. +#### @sbouchet +CVE-2026-69192: bump ip-address override from ^10.2.0 to ^10.3.1 + +- .rebase/add/code/package.json +- .rebase/add/code/build/npm/gyp/package.json +- .rebase/add/code/extensions/copilot/package.json +- .rebase/add/code/remote/package.json +- .rebase/add/code/test/mcp/package.json +--- + #### @rnikitenko https://github.com/che-incubator/che-code/commit/177a26a8ef76ea41a26eb6ac0ef9d6006b9af53e diff --git a/.rebase/add/code/build/npm/gyp/package.json b/.rebase/add/code/build/npm/gyp/package.json index 5b48b7687659..2e04dea49f8f 100644 --- a/.rebase/add/code/build/npm/gyp/package.json +++ b/.rebase/add/code/build/npm/gyp/package.json @@ -1,6 +1,6 @@ { "overrides": { - "ip-address": "^10.2.0", + "ip-address": "^10.3.1", "brace-expansion@2": "^2.1.4", "tar": "^7.5.22" } diff --git a/.rebase/add/code/extensions/copilot/package.json b/.rebase/add/code/extensions/copilot/package.json index 1e2720e2cfdb..942de1d0ec55 100644 --- a/.rebase/add/code/extensions/copilot/package.json +++ b/.rebase/add/code/extensions/copilot/package.json @@ -2,7 +2,7 @@ "overrides": { "shell-quote": "^1.8.4", "qs": "6.15.2", - "ip-address": "^10.2.0", + "ip-address": "^10.3.1", "ws": "^8.21.0", "brace-expansion@1": "^1.1.18", "brace-expansion@2": "^2.1.4", diff --git a/.rebase/add/code/package.json b/.rebase/add/code/package.json index c86a1dfcba76..3391b5a5f497 100644 --- a/.rebase/add/code/package.json +++ b/.rebase/add/code/package.json @@ -17,7 +17,7 @@ "flatted": "^3.4.2", "shell-quote": "^1.8.4", "qs": "6.15.2", - "ip-address": "^10.2.0", + "ip-address": "^10.3.1", "brace-expansion@1": "^1.1.18", "brace-expansion@2": "^2.1.4", "test-exclude": { diff --git a/.rebase/add/code/remote/package.json b/.rebase/add/code/remote/package.json index b55146aab3b4..507ab5d6ae21 100644 --- a/.rebase/add/code/remote/package.json +++ b/.rebase/add/code/remote/package.json @@ -5,7 +5,7 @@ }, "overrides": { "shell-quote": "^1.8.4", - "ip-address": "^10.2.0", + "ip-address": "^10.3.1", "undici": "^7.28.0", "@types/node-fetch": { "form-data": "^4.0.6" diff --git a/.rebase/add/code/test/mcp/package.json b/.rebase/add/code/test/mcp/package.json index c9abbd654ad0..955f0de7b971 100644 --- a/.rebase/add/code/test/mcp/package.json +++ b/.rebase/add/code/test/mcp/package.json @@ -2,7 +2,7 @@ "overrides": { "shell-quote": "^1.8.4", "qs": "6.15.2", - "ip-address": "^10.2.0", + "ip-address": "^10.3.1", "@types/node-fetch": { "form-data": "^4.0.6" } From 28467badd6c66e3bc6863f83058021e9872cbf8f Mon Sep 17 00:00:00 2001 From: Stephane Bouchet Date: Mon, 24 Aug 2026 10:12:27 -0500 Subject: [PATCH 3/3] use correct URL Signed-off-by: Stephane Bouchet --- .rebase/CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.rebase/CHANGELOG.md b/.rebase/CHANGELOG.md index 8f25690b6702..fac469a4e2b5 100644 --- a/.rebase/CHANGELOG.md +++ b/.rebase/CHANGELOG.md @@ -3,7 +3,7 @@ The file to keep a list of changed files which will potentially help to resolve rebase conflicts. #### @sbouchet -CVE-2026-69192: bump ip-address override from ^10.2.0 to ^10.3.1 +https://github.com/che-incubator/che-code/pull/796 - .rebase/add/code/package.json - .rebase/add/code/build/npm/gyp/package.json