Skip to content

Fix Orchestrator CVEs for RHDH 1.9.6 Release #3459

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
JessicaJHee wants to merge 3 commits into from
Closed

Fix Orchestrator CVEs for RHDH 1.9.6 Release #3459

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
49015c5
[release-1.9] chore(deps): bumps axios and shell-quote in Orchestrato…
JessicaJHee Jun 16, 2026
5020a1c
[release-1.9] chore(deps): bumps ip-address and ws in Orchestrator wo…
JessicaJHee Jun 18, 2026
50e172f
add changesets for 1.9.6 Orchestrator CVEs (#3458)
JessicaJHee Jun 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions workspaces/orchestrator/.changeset/angry-deers-smell.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
---
'@red-hat-developer-hub/backstage-plugin-scaffolder-backend-module-orchestrator': patch
'@red-hat-developer-hub/backstage-plugin-orchestrator-backend-module-loki': patch
'@red-hat-developer-hub/backstage-plugin-orchestrator-form-widgets': patch
'@red-hat-developer-hub/backstage-plugin-orchestrator-form-react': patch
'@red-hat-developer-hub/backstage-plugin-orchestrator-form-api': patch
'@red-hat-developer-hub/backstage-plugin-orchestrator-backend': patch
'@red-hat-developer-hub/backstage-plugin-orchestrator-common': patch
'@red-hat-developer-hub/backstage-plugin-orchestrator-node': patch
'@red-hat-developer-hub/backstage-plugin-orchestrator': patch
---

bumps ip-address, ws, axios and shell-quote in Orchestrator to resolve CVEs
40 changes: 26 additions & 14 deletions workspaces/orchestrator/yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25201,13 +25201,10 @@ __metadata:
languageName: node
linkType: hard

"ip-address@npm:^9.0.5":
version: 9.0.5
resolution: "ip-address@npm:9.0.5"
dependencies:
jsbn: 1.1.0
sprintf-js: ^1.1.3
checksum: aa15f12cfd0ef5e38349744e3654bae649a34c3b10c77a674a167e99925d1549486c5b14730eebce9fea26f6db9d5e42097b00aa4f9f612e68c79121c71652dc
"ip-address@npm:^10.1.1":
version: 10.1.1
resolution: "ip-address@npm:10.1.1"
checksum: 4a370ba2708290b3f6381110097960e99a6d0a67aee5487562dd3bb3d600b9c5b5614c6b38d5143ee5103c4652922f53d47e5154209c332ca437fba7b8e7619f
languageName: node
linkType: hard

Expand Down Expand Up @@ -26690,7 +26687,7 @@ __metadata:
languageName: node
linkType: hard

"jsbn@npm:1.1.0, jsbn@npm:^1.1.0":
"jsbn@npm:^1.1.0":
version: 1.1.0
resolution: "jsbn@npm:1.1.0"
checksum: 944f924f2bd67ad533b3850eee47603eed0f6ae425fd1ee8c760f477e8c34a05f144c1bd4f5a5dd1963141dc79a2c55f89ccc5ab77d039e7077f3ad196b64965
Expand Down Expand Up @@ -34747,12 +34744,12 @@ __metadata:
linkType: hard

"socks@npm:^2.6.2, socks@npm:^2.8.3":
version: 2.8.3
resolution: "socks@npm:2.8.3"
version: 2.8.9
resolution: "socks@npm:2.8.9"
dependencies:
ip-address: ^9.0.5
ip-address: ^10.1.1
smart-buffer: ^4.2.0
checksum: 7a6b7f6eedf7482b9e4597d9a20e09505824208006ea8f2c49b71657427f3c137ca2ae662089baa73e1971c62322d535d9d0cf1c9235cf6f55e315c18203eadd
checksum: b573ed4cfb935624d3688e7065cd03fd72ca258156923c9ebb9d462e545cd78f296b64a0e36f911b16326c94aabe2bf94ff405f8afef27ac7bf80fa3c971c6f6
languageName: node
linkType: hard

Expand Down Expand Up @@ -34909,7 +34906,7 @@ __metadata:
languageName: node
linkType: hard

"sprintf-js@npm:^1.1.2, sprintf-js@npm:^1.1.3":
"sprintf-js@npm:^1.1.2":
version: 1.1.3
resolution: "sprintf-js@npm:1.1.3"
checksum: a3fdac7b49643875b70864a9d9b469d87a40dfeaf5d34d9d0c5b1cda5fd7d065531fcb43c76357d62254c57184a7b151954156563a4d6a747015cfb41021cad0
Expand Down Expand Up @@ -38329,7 +38326,22 @@ __metadata:
languageName: node
linkType: hard

"ws@npm:*, ws@npm:8.18.0, ws@npm:^8.11.0, ws@npm:^8.13.0, ws@npm:^8.17.1, ws@npm:^8.18.0, ws@npm:^8.8.0":
"ws@npm:*, ws@npm:^8.11.0, ws@npm:^8.13.0, ws@npm:^8.17.1, ws@npm:^8.18.0, ws@npm:^8.8.0":
version: 8.21.0
resolution: "ws@npm:8.21.0"
peerDependencies:
bufferutil: ^4.0.1
utf-8-validate: ">=5.0.2"
peerDependenciesMeta:
bufferutil:
optional: true
utf-8-validate:
optional: true
checksum: 83ff89ae011bc5c3c5605a45a0d50e12589143c7500ca4de83a8d43b3cd26e71f422cb3206fd1a9e6d541d666eeb66255c30d095d62d413b3c7afe5d2c5cb928
languageName: node
linkType: hard

"ws@npm:8.18.0":
version: 8.18.0
resolution: "ws@npm:8.18.0"
peerDependencies:
Expand Down
66 changes: 35 additions & 31 deletions yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5959,13 +5959,14 @@ __metadata:
linkType: hard

"axios@npm:^1.6.7, axios@npm:^1.7.4":
version: 1.8.2
resolution: "axios@npm:1.8.2"
version: 1.18.0
resolution: "axios@npm:1.18.0"
dependencies:
follow-redirects: ^1.15.6
form-data: ^4.0.0
proxy-from-env: ^1.1.0
checksum: c47a43b79a058aa9e53a65bec9ade35c9f6e76a3999c795a79a2d205fb5f803fd4245497a0209a9727cbbe4f558791dd852ad2c168c5fc030259c11598ed8fd7
follow-redirects: ^1.16.0
form-data: ^4.0.5
https-proxy-agent: ^5.0.1
proxy-from-env: ^2.1.0
checksum: 87e66c8583f69f3aec2d03d2840e4074d71c67d0e06a5c33de8926b0f11c9d31a8509adc6814167cc1fc470bc3f24f99a10fcb6632843192126567340dd1a8ce
languageName: node
linkType: hard

Expand Down Expand Up @@ -8107,14 +8108,15 @@ __metadata:
languageName: node
linkType: hard

"es-set-tostringtag@npm:^2.0.3":
version: 2.0.3
resolution: "es-set-tostringtag@npm:2.0.3"
"es-set-tostringtag@npm:^2.0.3, es-set-tostringtag@npm:^2.1.0":
version: 2.1.0
resolution: "es-set-tostringtag@npm:2.1.0"
dependencies:
get-intrinsic: ^1.2.4
es-errors: ^1.3.0
get-intrinsic: ^1.2.6
has-tostringtag: ^1.0.2
hasown: ^2.0.1
checksum: 7227fa48a41c0ce83e0377b11130d324ac797390688135b8da5c28994c0165be8b252e15cd1de41e1325e5a5412511586960213e88f9ab4a5e7d028895db5129
hasown: ^2.0.2
checksum: 789f35de4be3dc8d11fdcb91bc26af4ae3e6d602caa93299a8c45cf05d36cc5081454ae2a6d3afa09cceca214b76c046e4f8151e092e6fc7feeb5efb9e794fc6
languageName: node
linkType: hard

Expand Down Expand Up @@ -9230,7 +9232,7 @@ __metadata:
languageName: node
linkType: hard

"follow-redirects@npm:^1.0.0, follow-redirects@npm:^1.15.6":
"follow-redirects@npm:^1.0.0, follow-redirects@npm:^1.16.0":
version: 1.16.0
resolution: "follow-redirects@npm:1.16.0"
peerDependenciesMeta:
Expand Down Expand Up @@ -9313,14 +9315,16 @@ __metadata:
languageName: node
linkType: hard

"form-data@npm:^4.0.0":
version: 4.0.0
resolution: "form-data@npm:4.0.0"
"form-data@npm:^4.0.0, form-data@npm:^4.0.5":
version: 4.0.6
resolution: "form-data@npm:4.0.6"
dependencies:
asynckit: ^0.4.0
combined-stream: ^1.0.8
mime-types: ^2.1.12
checksum: 01135bf8675f9d5c61ff18e2e2932f719ca4de964e3be90ef4c36aacfc7b9cb2fceb5eca0b7e0190e3383fe51c5b37f4cb80b62ca06a99aaabfcfd6ac7c9328c
es-set-tostringtag: ^2.1.0
hasown: ^2.0.4
mime-types: ^2.1.35
checksum: e51b9e97678c250c872cd4ec3e5eaa8fa43bee4b1acf8274c337308aebc6aebb0553091ce0810612826601ffafed9dace12504a63c6ef16c57fffcd7dcfec457
languageName: node
linkType: hard

Expand Down Expand Up @@ -9504,7 +9508,7 @@ __metadata:
languageName: node
linkType: hard

"get-intrinsic@npm:^1.2.1, get-intrinsic@npm:^1.2.3, get-intrinsic@npm:^1.2.4, get-intrinsic@npm:^1.3.0":
"get-intrinsic@npm:^1.2.1, get-intrinsic@npm:^1.2.3, get-intrinsic@npm:^1.2.4, get-intrinsic@npm:^1.2.6, get-intrinsic@npm:^1.3.0":
version: 1.3.1
resolution: "get-intrinsic@npm:1.3.1"
dependencies:
Expand Down Expand Up @@ -9924,12 +9928,12 @@ __metadata:
languageName: node
linkType: hard

"hasown@npm:^2.0.0, hasown@npm:^2.0.1, hasown@npm:^2.0.2":
version: 2.0.2
resolution: "hasown@npm:2.0.2"
"hasown@npm:^2.0.0, hasown@npm:^2.0.2, hasown@npm:^2.0.4":
version: 2.0.4
resolution: "hasown@npm:2.0.4"
dependencies:
function-bind: ^1.1.2
checksum: e8516f776a15149ca6c6ed2ae3110c417a00b62260e222590e54aa367cbcd6ed99122020b37b7fbdf05748df57b265e70095d7bf35a47660587619b15ffb93db
checksum: 4bd8f916b629e06324853593ffbdd45e200022952a85ad0c967f3bd4c2e4c7e1f9a9766fbe6186f60bd394e0afc73e719730caa1da15cd9bd832b7cdf53fd26c
languageName: node
linkType: hard

Expand Down Expand Up @@ -12475,7 +12479,7 @@ __metadata:
languageName: node
linkType: hard

"mime-types@npm:^2.1.12, mime-types@npm:^2.1.18, mime-types@npm:^2.1.27, mime-types@npm:^2.1.31, mime-types@npm:~2.1.17, mime-types@npm:~2.1.24, mime-types@npm:~2.1.34":
"mime-types@npm:^2.1.18, mime-types@npm:^2.1.27, mime-types@npm:^2.1.31, mime-types@npm:^2.1.35, mime-types@npm:~2.1.17, mime-types@npm:~2.1.24, mime-types@npm:~2.1.34":
version: 2.1.35
resolution: "mime-types@npm:2.1.35"
dependencies:
Expand Down Expand Up @@ -14116,10 +14120,10 @@ __metadata:
languageName: node
linkType: hard

"proxy-from-env@npm:^1.1.0":
version: 1.1.0
resolution: "proxy-from-env@npm:1.1.0"
checksum: ed7fcc2ba0a33404958e34d95d18638249a68c430e30fcb6c478497d72739ba64ce9810a24f53a7d921d0c065e5b78e3822759800698167256b04659366ca4d4
"proxy-from-env@npm:^2.1.0":
version: 2.1.0
resolution: "proxy-from-env@npm:2.1.0"
checksum: b106ad790f26d47ba4791af3fe8cba5c8d35d85020119c82c05b413eb11b3ab97d2393ecaed51bca97c2788fa256408283dfeb4d970b2ebcae6702310f064e7e
languageName: node
linkType: hard

Expand Down Expand Up @@ -15168,9 +15172,9 @@ __metadata:
linkType: hard

"shell-quote@npm:^1.7.3, shell-quote@npm:^1.8.1":
version: 1.8.1
resolution: "shell-quote@npm:1.8.1"
checksum: 5f01201f4ef504d4c6a9d0d283fa17075f6770bfbe4c5850b074974c68062f37929ca61700d95ad2ac8822e14e8c4b990ca0e6e9272e64befd74ce5e19f0736b
version: 1.8.4
resolution: "shell-quote@npm:1.8.4"
checksum: 082dc836baa8ade01144ee3068af487ea45ba570ea6ab13a5eddc11ab16a976b8857b51ef2caf7dc9a1e173ff0aea685b8f78b4f6f5a0a1ef24c7b17c51350e2
languageName: node
linkType: hard

Expand Down
Loading