Fix CVEs by updating minimatch to patched versions#659
Fix CVEs by updating minimatch to patched versions#659sbouchet wants to merge 12 commits intoche-incubator:mainfrom
Conversation
fixes: - CVE-2026-27904 - CVE-2026-26996 - CVE-2026-27903 Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
sbouchet
requested review from
RomanNikitenko,
azatsarynnyy,
rgrunber and
vitaliy-guliy
as code owners
|
Click here to review and test in web IDE: |
&message=Dev%20cluster%20(for%20maintainers)&logo=eclipseche&color=525C86&labelColor=FDB940)
Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>
sbouchet
force-pushed
the
CVE-2026-27904
branch
from
3d4e706 to
3aae53d
Compare
|
Pull Request images published ✨ Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-659-amd64 |
sbouchet
force-pushed
the
CVE-2026-27904
branch
2 times, most recently
from
f9cda9a to
a3d6992
Compare
Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>
sbouchet
force-pushed
the
CVE-2026-27904
branch
from
a3d6992 to
3caa8d5
Compare
|
Pull Request images published ✨ Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-659-amd64 |
2 similar comments
|
Pull Request images published ✨ Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-659-amd64 |
|
Pull Request images published ✨ Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-659-amd64 |
|
Pull Request images published ✨ Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-659-amd64 |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughAdds pinned Changes
Sequence Diagram(s)(omitted) Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
launcher/package.json (1)
54-55: Consider adding a CI check to prevent minimatch version regressions.The current dependency
"^3.1.5"resolves to safe versions across the codebase (3.1.5, 5.1.9, 7.4.9, 9.0.9, 10.2.4—all at or above patched minima). Adding automated CI validation to fail if a lockfile resolution unexpectedly introduces a vulnerable minimatch version would be a useful safeguard against future regressions.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@launcher/package.json` around lines 54 - 55, Add a CI job that parses the project's lockfile(s) (package-lock.json, yarn.lock or pnpm-lock.yaml) and fails the run if the resolved version of the "minimatch" dependency (the "minimatch" entry referenced in package.json) falls below the safe minimum (ensure resolved version >= 3.1.5 or matches your approved set of patched versions); implement this by adding a workflow step that extracts the resolved minimatch version from lockfile(s) and exits non‑zero on violation, or use an existing security/audit action configured to reject vulnerable minimatch ranges.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.rebase/CHANGELOG.md:
- Line 6: Change the heading "#### `@sbouchet`" so it only steps one level deeper
than the preceding header (replace "#### `@sbouchet`" with a single-step deeper
heading, e.g. "## `@sbouchet`" or "### `@sbouchet`" to match the surrounding
headings) to fix the markdown heading-level jump MD001.
In `@rebase.sh`:
- Around line 540-555: The override_json_file function unconditionally runs rm
"$filename.tmp" which can fail under set -e when no .rebase/override/$filename
or .rebase/add/$filename was created; change the cleanup to a defensive remove
so missing temp files don't abort the script (e.g., use a conditional test or a
force/remove-without-error behavior) and keep the rest of override_json_file
logic intact so it still removes the temp only when present; reference
override_json_file and the .rebase/override/.rebase/add metadata checks to
locate where to replace the unconditional rm.
---
Nitpick comments:
In `@launcher/package.json`:
- Around line 54-55: Add a CI job that parses the project's lockfile(s)
(package-lock.json, yarn.lock or pnpm-lock.yaml) and fails the run if the
resolved version of the "minimatch" dependency (the "minimatch" entry referenced
in package.json) falls below the safe minimum (ensure resolved version >= 3.1.5
or matches your approved set of patched versions); implement this by adding a
workflow step that extracts the resolved minimatch version from lockfile(s) and
exits non‑zero on violation, or use an existing security/audit action configured
to reject vulnerable minimatch ranges.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 988ff1e7-e27a-4d90-9a73-4a38094bbd33
⛔ Files ignored due to path filters (17)
code/build/npm/gyp/package-lock.jsonis excluded by!**/package-lock.jsoncode/build/package-lock.jsonis excluded by!**/package-lock.jsoncode/extensions/che-api/package-lock.jsonis excluded by!**/package-lock.jsoncode/extensions/che-port/package-lock.jsonis excluded by!**/package-lock.jsoncode/extensions/che-remote/package-lock.jsonis excluded by!**/package-lock.jsoncode/extensions/che-resource-monitor/package-lock.jsonis excluded by!**/package-lock.jsoncode/extensions/css-language-features/package-lock.jsonis excluded by!**/package-lock.jsoncode/extensions/html-language-features/package-lock.jsonis excluded by!**/package-lock.jsoncode/extensions/json-language-features/package-lock.jsonis excluded by!**/package-lock.jsoncode/extensions/markdown-language-features/package-lock.jsonis excluded by!**/package-lock.jsoncode/extensions/npm/package-lock.jsonis excluded by!**/package-lock.jsoncode/package-lock.jsonis excluded by!**/package-lock.jsoncode/test/automation/package-lock.jsonis excluded by!**/package-lock.jsoncode/test/integration/browser/package-lock.jsonis excluded by!**/package-lock.jsoncode/test/mcp/package-lock.jsonis excluded by!**/package-lock.jsoncode/test/smoke/package-lock.jsonis excluded by!**/package-lock.jsonlauncher/package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (32)
.rebase/CHANGELOG.md.rebase/add/code/build/npm/gyp/package.json.rebase/add/code/build/package.json.rebase/add/code/extensions/css-language-features/package.json.rebase/add/code/extensions/html-language-features/package.json.rebase/add/code/extensions/json-language-features/package.json.rebase/add/code/extensions/markdown-language-features/package.json.rebase/add/code/package.json.rebase/add/code/test/automation/package.json.rebase/add/code/test/integration/browser/package.json.rebase/add/code/test/mcp/package.json.rebase/add/code/test/smoke/package.json.rebase/override/code/extensions/npm/package.json.rebase/override/code/package.jsoncode/build/npm/gyp/package.jsoncode/build/package.jsoncode/extensions/che-api/package.jsoncode/extensions/che-port/package.jsoncode/extensions/che-remote/package.jsoncode/extensions/che-resource-monitor/package.jsoncode/extensions/css-language-features/package.jsoncode/extensions/html-language-features/package.jsoncode/extensions/json-language-features/package.jsoncode/extensions/markdown-language-features/package.jsoncode/extensions/npm/package.jsoncode/package.jsoncode/test/automation/package.jsoncode/test/integration/browser/package.jsoncode/test/mcp/package.jsoncode/test/smoke/package.jsonlauncher/package.jsonrebase.sh
|
Pull Request images published ✨ Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-659-amd64 |
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.rebase/add/code/build/npm/gyp/package.json (1)
4-5: Remove this rebase-add patch; it is redundant.The entire
overridessection in.rebase/add/code/build/npm/gyp/package.jsonmatches the target file exactly (glob: 10.5.0, tar: ^7.5.11, minimatch: ^9.0.9), making this patch a no-op. Removing it reduces rebase rule maintenance with no functional impact.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.rebase/add/code/build/npm/gyp/package.json around lines 4 - 5, Remove the redundant rebase-add patch that inserts an overrides section identical to the target; specifically delete the patch that adds overrides with entries "glob": "10.5.0", "tar": "^7.5.11", and "minimatch": "^9.0.9" (or remove that overrides block from the patch), so the rebase rules no longer include a no-op change and maintenance burden is reduced.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In @.rebase/add/code/build/npm/gyp/package.json:
- Around line 4-5: Remove the redundant rebase-add patch that inserts an
overrides section identical to the target; specifically delete the patch that
adds overrides with entries "glob": "10.5.0", "tar": "^7.5.11", and "minimatch":
"^9.0.9" (or remove that overrides block from the patch), so the rebase rules no
longer include a no-op change and maintenance burden is reduced.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: ea53557f-6910-49cd-968d-d57e9179783b
⛔ Files ignored due to path filters (2)
code/build/npm/gyp/package-lock.jsonis excluded by!**/package-lock.jsoncode/package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (5)
.rebase/CHANGELOG.md.rebase/add/code/build/npm/gyp/package.json.rebase/add/code/package.jsoncode/build/npm/gyp/package.jsoncode/package.json
🚧 Files skipped from review as they are similar to previous changes (2)
- code/package.json
- code/build/npm/gyp/package.json
|
Pull Request images published ✨ Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-659-amd64 |
@coderabbitai |
|
Tip For best results, initiate chat on the files or code changes. Let me check the upstream vscode
Since the upstream I'll retract the nitpick comment. ✏️ Learnings added
|
|
Pull Request images published ✨ Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-659-amd64 |
|
Pull Request images published ✨ Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-659-amd64 |
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.rebase/add/code/build/package.json:
- Around line 11-20: Resolve the leftover Git conflict markers in package.json
by removing the "<<<<<<<", "=======", and ">>>>>>>" lines and merging both
changes: keep the overrides for "@vscode/vsce" and "vscode-universal-bundler"
that pin "minimatch": "^3.1.5" and "^9.0.9" respectively, and also retain the
existing "fast-xml-parser": "^4.5.4" entry so the final JSON contains both the
minimatch overrides and the fast-xml-parser override; ensure the resulting file
is valid JSON (commas/braces intact) before committing.
In `@code/package.json`:
- Around line 266-285: Update the minimatch override for the `@ts-morph/common`
entry in package.json to match the package's required major version: change the
pinned version from ^7.4.9 to a 10.x range (e.g., ^10.0.1) so `@ts-morph/common`
uses a compatible minimatch; ensure only the "@ts-morph/common" override is
modified and leave "@vscode/test-cli" as-is.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 7d8b3c58-2fde-44df-9d9d-8f3eff922b03
⛔ Files ignored due to path filters (2)
code/build/package-lock.jsonis excluded by!**/package-lock.jsoncode/package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (5)
.rebase/CHANGELOG.md.rebase/add/code/build/package.json.rebase/add/code/package.jsoncode/build/package.jsoncode/package.json
🚧 Files skipped from review as they are similar to previous changes (2)
- code/build/package.json
- .rebase/add/code/package.json
|
Pull Request images published ✨ Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-659-amd64 |
Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>
|
Pull Request images published ✨ Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-659-amd64 |
2 participants
What does this PR do?
This PR fixes CVE-2026-27903, CVE-2026-27904 and CVE-2026-26996.
minimatch versions are updated to latest versions
3.1.2,3.0.5->3.1.55.16. ->5.1.99.0.5->9.0.910.0.1->10.2.4...What issues does this PR fix?
https://issues.redhat.com/browse/CRW-10241
https://issues.redhat.com/browse/CRW-10242
https://issues.redhat.com/browse/CRW-10305
https://issues.redhat.com/browse/CRW-10306
How to test this PR?
Does this PR contain changes that override default upstream Code-OSS behavior?
git rebasewere added to the .rebase folderSummary by CodeRabbit
Chores
Documentation