Skip to content

fix(deps): upgrade deps to fix multiple CVEs - #1662

Merged
olexii4 merged 4 commits into
mainfrom
fix_cve
Sep 4, 2026
Merged

fix(deps): upgrade deps to fix multiple CVEs#1662
olexii4 merged 4 commits into
mainfrom
fix_cve

Conversation

@olexii4

@olexii4 olexii4 commented Sep 3, 2026 •
edited by openshift-ci Bot
Loading

Copy link
Copy Markdown
Contributor

What does this PR do?

Upgrades fast-uri, find-my-way, qs, nanoid, fastify, and sanitize-html to address seven security vulnerabilities.

  1. fast-uri 3.1.3 → 3.1.7 — fixes six CVEs: host confusion via unbalanced URI brackets (CRW-12866), authority injection via unvalidated port serialization (CRW-12860), URI parsing flaw enabling SSRF via percent-encoded scheme (CRW-12727), SSRF via malformed IPv6 normalization (CRW-12723), SSRF via repeated hostname percent-decoding (CRW-12714), host confusion via skipped IDN canonicalization on scheme-relative references (CRW-12710). All six are fixed in 3.1.7, which rejects invalid schemes after decoding, validates full IPv6 grammar, and canonicalizes the host consistently regardless of whether a scheme is present.

  2. find-my-way 9.0.1 → 9.9.0 — fixes a remotely triggerable DoS (CRW-12683): lookup() passes req.method into find(), which indexes this.trees[method]. Since this.trees is a plain object, HTTP/2 method values like constructor or __proto__ resolve inherited properties instead of undefined, causing a crash at currentNode.prefix.length. Fixed in 9.0.7+ by using Object.create(null) for the tree map.

  3. qs 6.15.2 → 6.16.0 — fixes a DoS via array limit bypass (CRW-12801): with comma: true and throwOnLimitExceeded: true, a bracket-push key (a[]=1,2,3,...) bypassed the arrayLimit check introduced in 6.14.2, allowing unbounded inner-array allocation. Fixed in 6.16.0 by removing the isFlatArrayValue gate so every comma-split value is counted against arrayLimit.

  4. nanoid 3.3.12 → 3.3.18 — fixes a DoS via infinite loop (CRW-12641): customAlphabet and customRandom with size: 0 never satisfy the exit condition and spin indefinitely. Fixed in 3.3.18 with an explicit guard on the size parameter.

  5. fastify ^5.8.3 → ^5.12.1 — dependency maintenance.

  6. sanitize-html ^2.17.4 → ^2.17.7 — dependency maintenance.

fast-uri and find-my-way are transitively required by fastify, so both upgrades require resolutions overrides in the root package.json. qs is a direct dependency of dashboard-frontend.

Screenshot/screencast of this PR

N/A

What issues does this PR fix or reference?

fixes https://redhat.atlassian.net/browse/CRW-12866
fixes https://redhat.atlassian.net/browse/CRW-12860
fixes https://redhat.atlassian.net/browse/CRW-12801
fixes https://redhat.atlassian.net/browse/CRW-12727
fixes https://redhat.atlassian.net/browse/CRW-12723
fixes https://redhat.atlassian.net/browse/CRW-12714
fixes https://redhat.atlassian.net/browse/CRW-12710
fixes https://redhat.atlassian.net/browse/CRW-12683
fixes https://redhat.atlassian.net/browse/CRW-12641

Is it tested? How?

  • No runtime logic changed — pure dependency upgrades.
  • yarn install resolves cleanly: fast-uri@3.1.7, find-my-way@9.9.0, qs@6.16.0, nanoid@3.3.18, fastify@5.12.1, sanitize-html@2.17.7 installed; old versions removed from yarn.lock.
  • yarn license:generate completes without unresolved dependencies. fast-uri@3.1.7 and find-my-way@9.9.0 added to EXCLUDED/dev.md as transitive dependencies (not yet indexed on ClearlyDefined); fastify@5.12.1, qs@6.16.0, sanitize-html@2.17.7 added to EXCLUDED/prod.md.
  • yarn license:check passes.

Release Notes

Updated fast-uri, find-my-way, qs, nanoid, fastify, and sanitize-html to address host confusion, SSRF, authority injection, and denial-of-service vulnerabilities.

Docs PR

N/A

@olexii4
fix(deps): upgrade deps to fix multiple CVEs
a900ea9 
Upgrades fast-uri, find-my-way, qs, nanoid, fastify, and
sanitize-html to address seven security vulnerabilities:

1. fast-uri 3.1.3→3.1.7: host confusion via unbalanced URI
   brackets (CRW-12866), authority injection via unvalidated port
   serialization (CRW-12860), URI parsing flaw enabling SSRF
   (CRW-12727), SSRF via malformed IPv6 normalization (CRW-12723),
   SSRF via repeated hostname percent-decoding (CRW-12714), host
   confusion via skipped IDN canonicalization (CRW-12710)
2. find-my-way 9.0.1→9.9.0: DoS via HTTP/2 prototype pollution
   in method lookup (CRW-12683)
3. qs 6.15.2→6.16.0: DoS via array limit bypass in query string
   parsing with bracket-push keys (CRW-12801)
4. nanoid 3.3.12→3.3.18: DoS via infinite loop when size is 0
   in customAlphabet/customRandom (CRW-12641)
5. fastify ^5.8.3→^5.12.1: dependency maintenance
6. sanitize-html ^2.17.4→^2.17.7: dependency maintenance

Assisted-by: Claude Sonnet 4.6
Signed-off-by: Oleksii Orel <oorel@redhat.com>
@olexii4
olexii4 requested a review from svor September 3, 2026 14:20
@che-bot

che-bot commented Sep 3, 2026

Copy link
Copy Markdown
Contributor

Click here to review and test in web IDE: Contribute

@olexii4
chore(claude): require build+test before push in skills and rules
8fbd1d5 
Add a mandatory build-and-test gate to rebase-to-main (step 5.5) and
fix-cve-dep (step 6.5) skills, and reinforce the same rule in
che-dashboard-dev.md. Dep upgrades can introduce test suite failures
that only appear in CI without this gate.

Exclude .claude/ from prettier to preserve compact table formatting.

Assisted-by: Claude Sonnet 4.6
Signed-off-by: Oleksii Orel <oorel@redhat.com>
@olexii4
docs: update project spec and AGENTS.md to reflect current features
0185ee6 
Rewrite openspec/project.md with the full current feature set:
- User Preferences tabs: AI provider keys, device auth tokens
- AI tools and assistant integration
- Backup and restore functionality
- SSRF-protected data resolver
- All backend API routes (AI, device auth, backup, editors, samples)
- Security section

Add a Project Documentation section to AGENTS.md linking to
openspec/project.md, and expand the Project Overview feature list.

Assisted-by: Claude Sonnet 4.6
Signed-off-by: Oleksii Orel <oorel@redhat.com>
@eclipse-che eclipse-che deleted a comment from tolusha Sep 3, 2026
@tolusha

tolusha commented Sep 3, 2026

Copy link
Copy Markdown
Contributor

⚠️ Warning: IDE/tool configuration files detected

This PR contains changes to files in directories that are typically not intended to be committed:

  • .claude/rules/che-dashboard-dev.md
  • .claude/skills/fix-cve-dep/SKILL.md
  • .claude/skills/rebase-to-main/SKILL.md

Please verify these changes are intentional.

@olexii4
fix(deps): pin htmlparser2@^12 to v10 to restore Jest CJS compat
b285060 
sanitize-html@2.17.7 requires htmlparser2@^12.0.0, which dropped the
require export condition and is ESM-only. v10.1.0 ships both a CJS and
ESM build, so require() resolves to the CJS path in Jest.

The resolution targets only the ^12.0.0 range, leaving other packages
(renderkid@^6, css-select@^8) on their existing versions.

Assisted-by: Claude Sonnet 4.6
Signed-off-by: Oleksii Orel <oorel@redhat.com>
@github-actions

github-actions Bot commented Sep 3, 2026

Copy link
Copy Markdown

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-1662 (linux/amd64, linux/arm64, linux/s390x)

kubectl patch command 
kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/dashboard/deployment", "value": {containers: [{image: "quay.io/eclipse/che-dashboard:pr-1662", name: che-dashboard}]}}]"

@openshift-ci openshift-ci Bot added the lgtm label Sep 4, 2026
@openshift-ci

openshift-ci Bot commented Sep 4, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: olexii4, svor

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@olexii4
olexii4 merged commit e9aa836 into main Sep 4, 2026
17 of 18 checks passed
@olexii4
olexii4 deleted the fix_cve branch September 4, 2026 15:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@svor svor svor approved these changes
@akurinnoy akurinnoy Awaiting requested review from akurinnoy akurinnoy is a code owner
@ibuziuk ibuziuk Awaiting requested review from ibuziuk ibuziuk is a code owner

Assignees

@svor svor

Labels

lgtm

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@olexii4 @che-bot @tolusha @svor