Skip to content

Fix CVE-2026-42035 by updating axios to patched version #110

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sbouchet wants to merge 13 commits into
base: master
Choose a base branch
from
Open

Fix CVE-2026-42035 by updating axios to patched version #110

Show file tree
Hide file tree
Changes from 11 commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
fd08244
Fix CVE-2026-42035 by updating axios to patched version
sbouchet Apr 30, 2026
f22e69e
tentative build fix.
sbouchet Apr 30, 2026
121495c
Fix TypeScript type compatibility for optional config property
sbouchet May 4, 2026
f6029b1
Add skipLibCheck to fix axios 0.31.1 type compatibility
sbouchet May 4, 2026
506e9c8
Set transpileOnly in ts-loader for axios 0.31.1 compatibility
sbouchet May 4, 2026
66ebec2
Upgrade TypeScript to 4.9.5 and fix webpack md4 hash for Node 22
sbouchet May 27, 2026
a355eb6
fix after review
sbouchet May 27, 2026
9c7b898
Upgrade jest/ts-jest to v29, fix yarn.lock format, and add webpack co…
sbouchet May 27, 2026
0093638
Downgrade jest/ts-jest to v27 for Node 12 compatibility
sbouchet May 27, 2026
b47974b
Pin node-releases to 2.0.19 for Node 12 compatibility
sbouchet May 27, 2026
16c1266
Pin minimatch to 9.0.9 for Node 12 compatibility
sbouchet May 27, 2026
d02e9ce
Fix minimatch pin to 3.1.5 for Node 12 compatibility
sbouchet May 27, 2026
e6f261e
Add npm overrides to match yarn resolutions for Node 12 pins
sbouchet May 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 11 additions & 6 deletions javascript/src/typescript/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,8 @@
"browser": "dist/client.js",
"types": "dist/src/index.d.ts",
"scripts": {
"build": "rimraf dist && webpack-cli --mode production --config webpack.config.js",
"type-check": "tsc --noEmit",
"build": "npm run type-check && rimraf dist && webpack-cli --mode production --config webpack.config.js",
"test": "jest",
"prepare": "npm run test && npm run build",
"publish:next": "yarn publish --access=public --registry=https://registry.npmjs.org/ --no-git-tag-version --new-version 0.0.1-\"$(date +%s)\""
Expand All @@ -20,17 +21,17 @@
"license": "EPL-2.0",
"dependencies": {
"@eclipse-che/api": "^7.38.1",
"axios": "^0.24.0"
"axios": "^0.31.1"
},
"devDependencies": {
"@types/jest": "22.1.3",
"@types/jest": "^27",
"@types/node": "9.4.6",
"jest": "22.4.2",
"jest": "^27",
"rimraf": "2.6.2",
"ts-jest": "^23",
"ts-jest": "^27",
"ts-loader": "^7",
"tslint": "5.9.1",
"typescript": "3.1.3",
"typescript": "4.9.5",
"webpack": "4.1.1",
"webpack-cli": "2.0.12"
},
Expand All @@ -51,6 +52,10 @@
"json"
]
},
"resolutions": {
"node-releases": "2.0.19",
"minimatch": "9.0.9"
},
"repository": {
"type": "git",
"url": "https://github.com/che-incubator/che-workspace-telemetry-client"
Expand Down
4 changes: 2 additions & 2 deletions javascript/src/typescript/src/index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,7 +61,7 @@ export interface IResponse<T> extends AxiosResponse<T> {

export interface IRequestError extends Error {
status?: number;
config: AxiosRequestConfig;
config?: AxiosRequestConfig;
request?: any;
response?: IResponse<any>;
}
Expand All @@ -71,7 +71,7 @@ class RequestError implements IRequestError {
status: number | undefined;
name: string;
message: string;
config: AxiosRequestConfig;
config?: AxiosRequestConfig;
request: any;
response: AxiosResponse | undefined;

Expand Down
1 change: 1 addition & 0 deletions javascript/src/typescript/tsconfig.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
{
"compilerOptions": {
"strict": true,
"skipLibCheck": true,
"target": "es5",
"lib": ["es6", "dom", ],
"types": [
Expand Down
6 changes: 6 additions & 0 deletions javascript/src/typescript/webpack.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,8 @@
const path = require('path');
// Webpack 4 uses md4 which OpenSSL 3.0+ (Node 17+) removed; redirect to sha256. Remove when upgrading to Webpack 5.
const crypto = require('crypto');
const cryptoOrigCreateHash = crypto.createHash;
crypto.createHash = algorithm => cryptoOrigCreateHash(algorithm === 'md4' ? 'sha256' : algorithm);

var server = {
entry: './src/index.ts',
Expand All @@ -10,6 +14,7 @@ var server = {
use: [
{
loader: 'ts-loader',
options: { transpileOnly: true }
Comment thread
coderabbitai[bot] marked this conversation as resolved.
}
],
exclude: /node_modules/
Expand Down Expand Up @@ -39,6 +44,7 @@ var client = {
use: [
{
loader: 'ts-loader',
options: { transpileOnly: true }
}
],
exclude: /node_modules/
Expand Down
Loading
Loading