Fix for OCPBUGS-104441: CVE-2026-69152 - #16937
Conversation
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci-robot
added
jira/severity-important
|
@germanparente: This pull request references Jira Issue OCPBUGS-104441, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: germanparente The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
WalkthroughThe package manifests add pinned Yarn resolutions for ChangesDependency resolutions
Estimated code review effort: 1 (Trivial) | ~2 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 14 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (14 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
@germanparente: This pull request references Jira Issue OCPBUGS-104441, which is valid. 3 validation(s) were run on this bug
DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Keep only the brace-expansion resolution in package.json; revert lockfile churn that downgraded @openshift/dynamic-plugin-sdk.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
frontend/package.json (1)
226-228: 🔒 Security & Privacy | 🔵 TrivialRegenerate and verify the lockfile for these resolutions.
The manifest entries do not prove that CI installs the pinned versions. If this project commits a Yarn lockfile, update its locators and integrity metadata. Confirm the resolved graph, SBOM/provenance, and artifact signing before release. (classic.yarnpkg.com)
As per path instructions, verify exact versions, hashes where supported, OSV advisories, SBOM/provenance, and artifact signing.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@frontend/package.json` around lines 226 - 228, Regenerate the committed Yarn lockfile for the three brace-expansion resolutions declared in package.json, ensuring each locator resolves to the exact pinned version with updated integrity metadata. Verify the resulting dependency graph, supported hashes, OSV advisories, SBOM/provenance, and artifact signing before release.Sources: Path instructions, MCP tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@dynamic-demo-plugin/package.json`:
- Line 88: Regenerate dynamic-demo-plugin/yarn.lock from the brace-expansion
dependency pinned to 5.0.9 in dynamic-demo-plugin/package.json, replacing the
vulnerable 5.0.7 entry while retaining valid Yarn checksums. The
frontend/package.json dependency range at lines 226-228 requires no direct
change; ensure the release workflow continues enforcing OSV scanning, SBOM
generation, provenance attestations, and Sigstore/cosign signing.
---
Nitpick comments:
In `@frontend/package.json`:
- Around line 226-228: Regenerate the committed Yarn lockfile for the three
brace-expansion resolutions declared in package.json, ensuring each locator
resolves to the exact pinned version with updated integrity metadata. Verify the
resulting dependency graph, supported hashes, OSV advisories, SBOM/provenance,
and artifact signing before release.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 0bce3e4e-4328-42a9-8a0d-68793819dcc2
⛔ Files ignored due to path filters (2)
dynamic-demo-plugin/yarn.lockis excluded by!**/yarn.lock,!**/*.lockfrontend/yarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (2)
dynamic-demo-plugin/package.jsonfrontend/package.json
| "minimatch@^9.0.4": "^9.0.6", | ||
| "immutable": "^3.8.3" | ||
| "immutable": "^3.8.3", | ||
| "brace-expansion@^5.0.5": "5.0.9" |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
find . -name yarn.lock -not -path '*/node_modules/*' -print
rg -n -C 3 'brace-expansion@|integrity' \
--glob 'yarn.lock' \
--glob '!**/node_modules/**' .
for version in 1.1.18 2.1.4 3.0.6 5.0.9; do
curl -fsS -X POST \
-H 'Content-Type: application/json' \
-d "{\"package\":{\"ecosystem\":\"npm\",\"name\":\"brace-expansion\"},\"version\":\"${version}\"}" \
https://api.osv.dev/v1/query
doneRepository: openshift/console
Length of output: 8280
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- manifests and lockfile headers ---'
sed -n '1,25p' dynamic-demo-plugin/package.json
sed -n '75,95p' dynamic-demo-plugin/package.json
sed -n '1,25p' frontend/package.json
sed -n '215,235p' frontend/package.json
sed -n '1,35p' dynamic-demo-plugin/yarn.lock
sed -n '1,35p' frontend/yarn.lock
printf '%s\n' '--- all brace-expansion lock entries ---'
rg -n -A 9 -B 1 'brace-expansion@' dynamic-demo-plugin/yarn.lock frontend/yarn.lock
printf '%s\n' '--- package-manager and install configuration ---'
git ls-files | rg '(^|/)(packageManager|\\.yarnrc\\.yml|\\.npmrc|yarn\\.config\\.|pnpm-lock\\.yaml|package-lock\\.json|.*\\.github/workflows/.*)$' || true
rg -n -i 'sbom|provenance|attestation|sigstore|cosign|slsa|artifact signing|yarn install|yarn --immutable|yarn --frozen-lockfile' \
--glob '!**/node_modules/**' \
--glob '!**/yarn.lock' \
. || true
printf '%s\n' '--- npm registry integrity metadata ---'
for version in 1.1.18 2.1.4 3.0.6 3.0.7 4.0.0 5.0.7 5.0.9; do
curl -fsS "https://registry.npmjs.org/brace-expansion/${version}" |
jq -r '[.version, .dist.tarball, .dist.integrity, .dist.shasum] | `@tsv`'
done
printf '%s\n' '--- OSV results, reduced to affected ranges and fixed versions ---'
for version in 1.1.18 2.1.4 3.0.6 3.0.7 4.0.0 5.0.7 5.0.9; do
curl -fsS -X POST \
-H 'Content-Type: application/json' \
-d "{\"package\":{\"ecosystem\":\"npm\",\"name\":\"brace-expansion\"},\"version\":\"${version}\"}" \
https://api.osv.dev/v1/query |
jq -c --arg version "$version" '{version:$version, vulns:([.vulns[]? | {id, severity, affected}])}'
doneRepository: openshift/console
Length of output: 45733
🏁 Script executed:
#!/usr/bin/env bash
set -u
printf '%s\n' '--- build and workflow install modes ---'
sed -n '1,80p' build-demos.sh
sed -n '1,80p' build-frontend.sh
git ls-files '.github/workflows' | head -80
rg -n -i 'yarn( install)?|--immutable|sbom|provenance|attestation|cosign|sigstore|slsa' \
.github/workflows build-demos.sh build-frontend.sh 2>/dev/null || true
printf '%s\n' '--- exact brace-expansion descriptors and versions ---'
python3 - <<'PY'
import re
from pathlib import Path
for filename in ("dynamic-demo-plugin/yarn.lock", "frontend/yarn.lock"):
text = Path(filename).read_text()
print(filename)
for match in re.finditer(r'(?m)^"?(brace-expansion@[^"]+)"?:\n((?: .*\n| .*\n)*)', text):
block = match.group(0)
version = re.search(r'(?m)^ version: (.+)$', block)
resolution = re.search(r'(?m)^ resolution: (.+)$', block)
print(" descriptor:", match.group(1))
print(" version:", version.group(1) if version else "MISSING")
print(" resolution:", resolution.group(1) if resolution else "MISSING")
print("manifest resolution targets:")
for filename in ("dynamic-demo-plugin/package.json", "frontend/package.json"):
import json
data = json.loads(Path(filename).read_text())
print(filename, {k:v for k,v in data.get("resolutions", {}).items()
if k.startswith("brace-expansion")})
PY
printf '%s\n' '--- OSV status for available versions ---'
for version in 1.1.18 2.1.4 3.0.6 5.0.7 5.0.9; do
response="$(curl -fsS -X POST \
-H 'Content-Type: application/json' \
-d "{\"package\":{\"ecosystem\":\"npm\",\"name\":\"brace-expansion\"},\"version\":\"${version}\"}" \
https://api.osv.dev/v1/query)" || {
printf '%s\n' "$version: query failed"
continue
}
printf '%s ' "$version"
jq -r 'if .vulns then ([.vulns[] | .id] | join(",")) else "no advisories" end' <<<"$response"
done
printf '%s\n' '--- registry integrity metadata for locked versions ---'
for version in 1.1.18 2.1.4 5.0.7 5.0.9; do
curl -fsS "https://registry.npmjs.org/brace-expansion/${version}" |
jq -r --arg v "$version" '[$v, .dist.integrity, .dist.shasum] | `@tsv`' ||
printf '%s\tmetadata query failed\n' "$version"
doneRepository: openshift/console
Length of output: 2339
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- OSV advisory details for the locked vulnerable version ---'
curl -fsS -X POST \
-H 'Content-Type: application/json' \
-d '{"package":{"ecosystem":"npm","name":"brace-expansion"},"version":"5.0.7"}' \
https://api.osv.dev/v1/query |
jq -c '[.vulns[] | {
id,
summary,
severity,
published,
modified,
affected: [.affected[] | {
ranges: .ranges,
database_specific: .database_specific
}]
}]'
printf '%s\n' '--- tracked repository automation and supply-chain controls ---'
git ls-files | rg '^\.github/|(^|/)(Makefile|Taskfile.*|cosign|.*sbom.*|.*provenance.*|.*attestation.*)$' || true
rg -n -i 'sbom|provenance|attestation|cosign|sigstore|slsa|artifact signing|osv-scanner|audit|yarn install --immutable' \
--glob '!**/vendor/**' \
--glob '!**/node_modules/**' \
--glob '!**/*.lock' \
. || trueRepository: openshift/console
Length of output: 7556
Regenerate dynamic-demo-plugin/yarn.lock for brace-expansion@5.0.9.
dynamic-demo-plugin/yarn.lock installs vulnerable 5.0.7. This version is affected by GHSA-mh99-v99m-4gvg and GHSA-rgw5-rvv9-x895. build-demos.sh uses yarn install --immutable, so it cannot update the stale lockfile.
frontend/yarn.lock contains only the patched 1.1.18, 2.1.4, and 5.0.9 entries. Retain Yarn checksums, and enforce OSV scanning, SBOM generation, provenance attestations, and Sigstore/cosign signing for released artifacts.
📍 Affects 2 files
dynamic-demo-plugin/package.json#L88-L88(this comment)frontend/package.json#L226-L228
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@dynamic-demo-plugin/package.json` at line 88, Regenerate
dynamic-demo-plugin/yarn.lock from the brace-expansion dependency pinned to
5.0.9 in dynamic-demo-plugin/package.json, replacing the vulnerable 5.0.7 entry
while retaining valid Yarn checksums. The frontend/package.json dependency range
at lines 226-228 requires no direct change; ensure the release workflow
continues enforcing OSV scanning, SBOM generation, provenance attestations, and
Sigstore/cosign signing.
Sources: Path instructions, MCP tools
|
@germanparente: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
Summary
Fixes CVE-2026-69152 — Denial of Service via unbounded intermediate array allocation in
brace-expansion'sexpand()function.Resolutions added
frontend/package.json:
brace-expansion@^1.1.7→1.1.18brace-expansion@^2.0.2→2.1.4brace-expansion@^5.0.5→5.0.9dynamic-demo-plugin/package.json:
brace-expansion@^5.0.5→5.0.9Summary by CodeRabbit
brace-expansion.immutableandprotobufjsresolutions.