fix multiple CVEs by updating fast-uri to patched versions by sbouchet · Pull Request #812 · che-incubator/che-code

sbouchet · 2026-09-16T15:59:30Z

What does this PR do?

This PR fixes CVE-2026-76172, CVE-2026-75975, CVE-2026-75899, CVE-2026-75931, CVE-2026-84394 and CVE-2026-84292.
fast-uri version is updated to 3.1.8

What issues does this PR fix?

https://redhat.atlassian.net/browse/CRW-12729
https://redhat.atlassian.net/browse/CRW-12725
https://redhat.atlassian.net/browse/CRW-12721
https://redhat.atlassian.net/browse/CRW-12712
https://redhat.atlassian.net/browse/CRW-12865
https://redhat.atlassian.net/browse/CRW-12858
https://redhat.atlassian.net/browse/CRW-13183

How to test this PR?

Does this PR contain changes that override default upstream Code-OSS behavior?

the PR contains changes in the code folder (you can skip it if your changes are placed in a che extension )
the corresponding items were added to the CHANGELOG.md file
rules for automatic git rebase were added to the .rebase folder

Summary by CodeRabbit

Bug Fixes
- Standardized the resolved version of a transitive dependency across build, extension, launcher, and testing workflows, helping avoid inconsistencies that can affect installations and builds.
Chores
- Updated automated rebase conflict handling to preserve package configuration changes.
- Added a changelog entry documenting the maintenance updates.

github-actions · 2026-09-16T15:59:39Z

Click here to review and test in web IDE:

github-actions · 2026-09-16T16:39:09Z

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-812-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-812-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-812-dev-amd64

github-actions · 2026-09-16T16:43:51Z

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-812-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-812-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-812-dev-amd64

sbouchet · 2026-09-17T13:09:17Z

regen made some changes on the file. i can't control how it's generated :(

it looks like only order was changed, so - no problem
I also get the change when I build this package in the main, your changes fix the problem
thanks!

coderabbitai · 2026-09-17T13:16:34Z

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: che-incubator/che-code/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 4db3587a-2675-46d7-9887-7c7c706f5e58

📥 Commits

Reviewing files that changed from the base of the PR and between 0a03c0b and ba80ab6.

⛔ Files ignored due to path filters (8)

code/build/agent-sdk/agents/claude/package-lock.json is excluded by !**/package-lock.json
code/build/package-lock.json is excluded by !**/package-lock.json
code/build/rspack/package-lock.json is excluded by !**/package-lock.json
code/extensions/copilot/package-lock.json is excluded by !**/package-lock.json
code/package-lock.json is excluded by !**/package-lock.json
code/test/mcp/package-lock.json is excluded by !**/package-lock.json
code/test/monaco/package-lock.json is excluded by !**/package-lock.json
launcher/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (6)

.rebase/CHANGELOG.md
.rebase/add/code/build/package.json
.rebase/add/code/package.json
code/build/package.json
code/package.json
launcher/package.json

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

Walkthrough

The package manifests add overrides that pin ajv’s transitive fast-uri dependency to ^3.1.8. launcher/package.json adds a direct fast-uri override. Existing overrides remain in place. The changelog records the package changes. rebase.sh adds conflict-resolution branches for the Rspack and Claude Agent SDK package files.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to ba80a

The dependency updates and rebase rules show no actionable merge-blocking issue; the PR is ready for normal checks.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise, uses imperative mood, stays under 72 characters, and clearly describes the fast-uri security update.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Rebase Rules For Upstream Changes	✅ Passed	All seven in-scope `code/**/package.json` files have matching `.rebase/add/` rules. `.rebase/CHANGELOG.md` lists all seven paths. `rebase.sh` routes each package file through the package override hand…

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create a new PR

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-09-23T13:24:31Z

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-812-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-812-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-812-dev-amd64

CVE-2026-76172, CVE-2026-75975, CVE-2026-75899, CVE-2026-75931, CVE-2026-84394, CVE-2026-84292 Signed-off-by: Stephane Bouchet <sbouchet@redhat.com> Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>

Signed-off-by: Stephane Bouchet <sbouchet@redhat.com> Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>

Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>

github-actions · 2026-09-24T10:22:33Z

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-812-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-812-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-812-dev-amd64

sbouchet marked this pull request as ready for review September 17, 2026 13:04

sbouchet requested review from RomanNikitenko, azatsarynnyy, rgrunber and vitaliy-guliy as code owners September 17, 2026 13:04

sbouchet commented Sep 17, 2026

View reviewed changes

RomanNikitenko approved these changes Sep 24, 2026

View reviewed changes

sbouchet and others added 3 commits September 24, 2026 11:43

chore: add rebase rules for fast-uri update

622762b

Signed-off-by: Stephane Bouchet <sbouchet@redhat.com> Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>

use correct URL

ba80ab6

Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>

sbouchet force-pushed the fix-fast-uri-cves branch from 0a03c0b to ba80ab6 Compare September 24, 2026 09:45

sbouchet merged commit 6e3ff24 into che-incubator:main Sep 24, 2026
14 checks passed

sbouchet deleted the fix-fast-uri-cves branch September 24, 2026 16:42

Navigation Menu

fix multiple CVEs by updating fast-uri to patched versions - #812

fix multiple CVEs by updating fast-uri to patched versions#812
sbouchet merged 3 commits into
che-incubator:mainfrom
sbouchet:fix-fast-uri-cves

sbouchet commented Sep 16, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

github-actions Bot commented Sep 16, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 16, 2026

Uh oh!

github-actions Bot commented Sep 16, 2026

Uh oh!

sbouchet Sep 17, 2026

Uh oh!

RomanNikitenko Sep 24, 2026

Uh oh!

coderabbitai Bot commented Sep 17, 2026 •

edited

Loading

Walkthrough

Uh oh!

github-actions Bot commented Sep 23, 2026

Uh oh!

github-actions Bot commented Sep 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

sbouchet commented Sep 16, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

What issues does this PR fix?

How to test this PR?

Does this PR contain changes that override default upstream Code-OSS behavior?

Summary by CodeRabbit

Summary by CodeRabbit

Uh oh!

github-actions Bot commented Sep 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 16, 2026

Uh oh!

github-actions Bot commented Sep 16, 2026

Uh oh!

sbouchet Sep 17, 2026

Choose a reason for hiding this comment

Uh oh!

RomanNikitenko Sep 24, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Uh oh!

github-actions Bot commented Sep 23, 2026

Uh oh!

github-actions Bot commented Sep 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

sbouchet commented Sep 16, 2026 •

edited by coderabbitai Bot

Loading

github-actions Bot commented Sep 16, 2026 •

edited

Loading

coderabbitai Bot commented Sep 17, 2026 •

edited

Loading