From 88eae8f776d894eea17cf2bfbcb19d9efc462286 Mon Sep 17 00:00:00 2001 From: Stephane Bouchet Date: Tue, 21 Jul 2026 15:44:49 -0500 Subject: [PATCH 1/2] fix: override axios to patched version (CVE-2026-42264) Signed-off-by: Stephane Bouchet --- .rebase/CHANGELOG.md | 6 ++++++ .rebase/add/code/package.json | 3 +++ code/package-lock.json | 6 +++--- code/package.json | 3 +++ 4 files changed, 15 insertions(+), 3 deletions(-) diff --git a/.rebase/CHANGELOG.md b/.rebase/CHANGELOG.md index 282efd1610c..e16af5aefb8 100644 --- a/.rebase/CHANGELOG.md +++ b/.rebase/CHANGELOG.md @@ -2,6 +2,12 @@ The file to keep a list of changed files which will potentionaly help to resolve rebase conflicts. +#### @sbouchet +https://github.com/che-incubator/che-code/pull/ + +- code/package.json +--- + #### @sbouchet https://github.com/che-incubator/che-code/pull/750 diff --git a/.rebase/add/code/package.json b/.rebase/add/code/package.json index e52a30139b6..b4914879f94 100644 --- a/.rebase/add/code/package.json +++ b/.rebase/add/code/package.json @@ -27,6 +27,9 @@ }, "form-data@3": "^3.0.5", "form-data@4": "^4.0.6", + "@microsoft/dev-tunnels-management": { + "axios": "1.15.2" + }, "axios": { "form-data": "^4.0.6" }, diff --git a/code/package-lock.json b/code/package-lock.json index 361c5afc7a4..cc4c1dc3d1b 100644 --- a/code/package-lock.json +++ b/code/package-lock.json @@ -5505,9 +5505,9 @@ "license": "MIT" }, "node_modules/axios": { - "version": "1.15.0", - "resolved": "https://registry.npmjs.org/axios/-/axios-1.15.0.tgz", - "integrity": "sha512-wWyJDlAatxk30ZJer+GeCWS209sA42X+N5jU2jy6oHTp7ufw8uzUTVFBX9+wTfAlhiJXGS0Bq7X6efruWjuK9Q==", + "version": "1.15.2", + "resolved": "https://registry.npmjs.org/axios/-/axios-1.15.2.tgz", + "integrity": "sha512-wLrXxPtcrPTsNlJmKjkPnNPK2Ihe0hn0wGSaTEiHRPxwjvJwT3hKmXF4dpqxmPO9SoNb2FsYXj/xEo0gHN+D5A==", "license": "MIT", "dependencies": { "follow-redirects": "^1.15.11", diff --git a/code/package.json b/code/package.json index 8c70c74d308..1c66741dc67 100644 --- a/code/package.json +++ b/code/package.json @@ -282,6 +282,9 @@ }, "form-data@3": "^3.0.5", "form-data@4": "^4.0.6", + "@microsoft/dev-tunnels-management": { + "axios": "1.15.2" + }, "axios": { "form-data": "^4.0.6" }, From 8a171bada7f3c25b2a8217ae18cf6173c1dda403 Mon Sep 17 00:00:00 2001 From: Stephane Bouchet Date: Fri, 24 Jul 2026 22:10:46 +0200 Subject: [PATCH 2/2] Fix pull request link in CHANGELOG Updated pull request link in CHANGELOG.md --- .rebase/CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.rebase/CHANGELOG.md b/.rebase/CHANGELOG.md index e16af5aefb8..9dc23edc9c7 100644 --- a/.rebase/CHANGELOG.md +++ b/.rebase/CHANGELOG.md @@ -3,7 +3,7 @@ The file to keep a list of changed files which will potentionaly help to resolve rebase conflicts. #### @sbouchet -https://github.com/che-incubator/che-code/pull/ +https://github.com/che-incubator/che-code/pull/770 - code/package.json ---