This is an automated email from the ASF dual-hosted git repository.
josedee pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/incubator-kie-tools.git
The following commit(s) were added to refs/heads/main by this push:
new 0aa7f9c51e6 [NO-ISSUE] CVE fix for proxy-addr, isomorphic-git,
moment, undici, fast-uri (#4031)
0aa7f9c51e6 is described below
commit 0aa7f9c51e61931e98393e833dab05d78888d7bb
Author: athirakm94 <[email protected]>
AuthorDate: Tue Oct 6 13:49:17 2026 +0530
[NO-ISSUE] CVE fix for proxy-addr, isomorphic-git, moment, undici,
fast-uri (#4031)
---
packages/bpmn-editor/package.json | 2 +-
packages/dmn-editor/package.json | 2 +-
packages/dmn-runner/package.json | 2 +-
packages/online-editor/package.json | 4 +-
packages/unitables/package.json | 2 +-
packages/vscode-extension/package.json | 2 +-
packages/workspaces-git-fs/package.json | 2 +-
pnpm-lock.yaml | 91 +++++++++++++++++----------------
pnpm-workspace.yaml | 13 +++--
9 files changed, 64 insertions(+), 56 deletions(-)
diff --git a/packages/bpmn-editor/package.json
b/packages/bpmn-editor/package.json
index fb21d1d83ab..dbffcf604af 100644
--- a/packages/bpmn-editor/package.json
+++ b/packages/bpmn-editor/package.json
@@ -50,7 +50,7 @@
"elkjs": "^0.9.1",
"fast-deep-equal": "^3.1.3",
"immer": "^10.0.3",
- "moment": "^2.29.4",
+ "moment": "^2.31.0",
"react-dom": "^18.3.1",
"react-error-boundary": "^4.1.2",
"reactflow": "^11.8.3",
diff --git a/packages/dmn-editor/package.json b/packages/dmn-editor/package.json
index 2ad4883562c..cd3ea4d609c 100644
--- a/packages/dmn-editor/package.json
+++ b/packages/dmn-editor/package.json
@@ -59,7 +59,7 @@
"elkjs": "^0.9.1",
"fast-deep-equal": "^3.1.3",
"immer": "^10.0.3",
- "moment": "^2.29.4",
+ "moment": "^2.31.0",
"react-error-boundary": "^4.1.2",
"reactflow": "^11.8.3",
"uuid": "^14.0.0",
diff --git a/packages/dmn-runner/package.json b/packages/dmn-runner/package.json
index 654245bd60a..74beacafd6a 100644
--- a/packages/dmn-runner/package.json
+++ b/packages/dmn-runner/package.json
@@ -35,7 +35,7 @@
"deep-object-diff": "^1.1.9",
"json-refs": "^3.0.15",
"lodash": "^4.18.1",
- "moment": "^2.29.4",
+ "moment": "^2.31.0",
"uniforms": "^3.10.2",
"uniforms-bridge-json-schema": "^3.10.2"
},
diff --git a/packages/online-editor/package.json
b/packages/online-editor/package.json
index 6cd118046e5..f09bdca4b11 100644
--- a/packages/online-editor/package.json
+++ b/packages/online-editor/package.json
@@ -73,11 +73,11 @@
"buffer": "^6.0.3",
"cross-env": "^7.0.3",
"deep-object-diff": "^1.1.9",
- "isomorphic-git": "^1.30.1",
+ "isomorphic-git": "^1.42.3",
"js-yaml": "^4.2.0",
"json-refs": "^3.0.15",
"lodash": "^4.18.1",
- "moment": "^2.29.4",
+ "moment": "^2.31.0",
"react": "^18.3.1",
"react-dom": "^18.3.1",
"react-dropzone": "^11.4.2",
diff --git a/packages/unitables/package.json b/packages/unitables/package.json
index 5cd54126e8c..7925160f81e 100644
--- a/packages/unitables/package.json
+++ b/packages/unitables/package.json
@@ -43,7 +43,7 @@
"ajv-formats": "^3.0.1",
"deep-object-diff": "^1.1.9",
"lodash": "^4.18.1",
- "moment": "^2.29.4",
+ "moment": "^2.31.0",
"react-id-generator": "^3.0.1",
"react-table": "^7.6.2",
"uniforms": "^3.10.2",
diff --git a/packages/vscode-extension/package.json
b/packages/vscode-extension/package.json
index 33bcaaa33fa..6dc72490102 100644
--- a/packages/vscode-extension/package.json
+++ b/packages/vscode-extension/package.json
@@ -34,7 +34,7 @@
"@kie-tools-core/vscode-java-code-completion": "workspace:*",
"@kie-tools-core/workspace": "workspace:*",
"@types/vscode": "1.103.0",
- "isomorphic-git": "^1.30.1",
+ "isomorphic-git": "^1.42.3",
"minimatch": "^4.2.5"
},
"devDependencies": {
diff --git a/packages/workspaces-git-fs/package.json
b/packages/workspaces-git-fs/package.json
index d356e69f1a8..bdcb919a235 100644
--- a/packages/workspaces-git-fs/package.json
+++ b/packages/workspaces-git-fs/package.json
@@ -30,7 +30,7 @@
"@kie-tools/emscripten-fs": "^0.0.2",
"@kie-tools/kie-sandbox-fs": "workspace:*",
"client-zip": "^2.3.1",
- "isomorphic-git": "^1.30.1",
+ "isomorphic-git": "^1.42.3",
"minimatch": "^4.2.5",
"uuid": "^14.0.0"
},
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 55ddc84b2fd..fb1c13a1695 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -23,11 +23,12 @@ overrides:
minimatch@^10: 10.2.1
minimatch@^5: 5.1.9
minimatch@^4: 5.1.9
- undici: ^6.28.0
+ undici: ^6.29.0
uuid: ^11.1.1
picomatch@3: 3.0.2
picomatch@4: 4.0.4
'@cypress/request>form-data': 4.0.6
+ proxy-addr: 2.0.8
packageExtensionsChecksum: sha256-oxPwESKKSHRelJQnCQTHzgtG1xkcQOHjfgjFdIfqMfg=
@@ -1410,8 +1411,8 @@ importers:
specifier: ^10.0.3
version: 10.2.0
moment:
- specifier: ^2.29.4
- version: 2.30.1
+ specifier: ^2.31.0
+ version: 2.31.0
react:
specifier: '>=18.3.1 <19.0.0'
version: 18.3.1
@@ -2691,8 +2692,8 @@ importers:
specifier: ^10.0.3
version: 10.2.0
moment:
- specifier: ^2.29.4
- version: 2.30.1
+ specifier: ^2.31.0
+ version: 2.31.0
react:
specifier: '>=18.3.1 <19.0.0'
version: 18.3.1
@@ -3366,8 +3367,8 @@ importers:
specifier: ^4.18.1
version: 4.18.1
moment:
- specifier: ^2.29.4
- version: 2.30.1
+ specifier: ^2.31.0
+ version: 2.31.0
react:
specifier: '>=18.3.1 <19.0.0'
version: 18.3.1
@@ -5759,8 +5760,8 @@ importers:
specifier: ^1.1.9
version: 1.1.9
isomorphic-git:
- specifier: ^1.30.1
- version: 1.38.10
+ specifier: ^1.42.3
+ version: 1.42.6
js-yaml:
specifier: ^4.3.2
version: 4.3.2
@@ -5771,8 +5772,8 @@ importers:
specifier: ^4.18.1
version: 4.18.1
moment:
- specifier: ^2.29.4
- version: 2.30.1
+ specifier: ^2.31.0
+ version: 2.31.0
react:
specifier: ^18.3.1
version: 18.3.1
@@ -6459,7 +6460,7 @@ importers:
version: 18.3.1([email protected])
react-moment:
specifier: 0.9.7
- version: 0.9.7([email protected])([email protected])([email protected])
+ version: 0.9.7([email protected])([email protected])([email protected])
react-router:
specifier: ^7.18.0
version: 7.18.2([email protected]([email protected]))([email protected])
@@ -6867,7 +6868,7 @@ importers:
version: 18.3.1([email protected])
react-moment:
specifier: 0.9.7
- version: 0.9.7([email protected])([email protected])([email protected])
+ version: 0.9.7([email protected])([email protected])([email protected])
react-router:
specifier: ^7.18.0
version: 7.18.2([email protected]([email protected]))([email protected])
@@ -7105,7 +7106,7 @@ importers:
version: 2.3.0([email protected])
react-moment:
specifier: 0.9.7
- version: 0.9.7([email protected])([email protected])([email protected])
+ version: 0.9.7([email protected])([email protected])([email protected])
react-svg-pan-zoom:
specifier: ^3.12.1
version: 3.13.1
@@ -8203,8 +8204,8 @@ importers:
specifier: ^4.18.1
version: 4.18.1
moment:
- specifier: ^2.29.4
- version: 2.30.1
+ specifier: ^2.31.0
+ version: 2.31.0
react:
specifier: '>=18.3.1 <19.0.0'
version: 18.3.1
@@ -8376,8 +8377,8 @@ importers:
specifier: 1.103.0
version: 1.103.0
isomorphic-git:
- specifier: ^1.30.1
- version: 1.38.10
+ specifier: ^1.42.3
+ version: 1.42.6
minimatch:
specifier: 5.1.9
version: 5.1.9
@@ -8689,8 +8690,8 @@ importers:
specifier: ^2.3.1
version: 2.5.0
isomorphic-git:
- specifier: ^1.30.1
- version: 1.38.10
+ specifier: ^1.42.3
+ version: 1.42.6
minimatch:
specifier: 5.1.9
version: 5.1.9
@@ -16969,8 +16970,8 @@ packages:
[email protected]:
resolution: {integrity:
sha512-VhXlQgj9ioXCqGstD37E/HBeqEGV/qOD/kmbVG8h5xKBYvM1L3lR1Zn4555cQ8GkYbJa8aJSipLPndE1k6zK2w==}
- [email protected]:
- resolution: {integrity:
sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==}
+ [email protected]:
+ resolution: {integrity:
sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==}
[email protected]:
resolution: {integrity:
sha512-5jOCVXADYNuRkKFzNJ0dCCewsZiYo0dz8QNYljkOpFC6r2U4OBmKtvm/Tsuh4w1YYdDqDb31a8TVhBJ2OJKdqQ==}
@@ -18288,8 +18289,8 @@ packages:
resolution: {integrity:
sha512-WhB9zCku7EGTj/HQQRz5aUQEUeoQZH2bWcltRErOpymJ4boYE6wL9Tbr23krRPSZ+C5zqNSrSw+Cc7sZZ4b7vg==}
engines: {node: '>=0.10.0'}
- [email protected]:
- resolution: {integrity:
sha512-nJSSq7ypu97vM33rSdxXyPzSWksCberjKspzXhFEcBHdVyxdNkWByAzJ/AURV1jIlfv8pLq37lGdIEt7ORj17Q==}
+ [email protected]:
+ resolution: {integrity:
sha512-MJpYjxITU0k0CNzSE3hXmrsHEIyPO8puRf69cNg5Xim7uhRMU0wh+5VkxpJonhKdAqiy+KTDTQWxgAuTxySqeg==}
engines: {node: '>=14.17'}
hasBin: true
@@ -19521,8 +19522,8 @@ packages:
engines: {node: '>= 14.0.0'}
hasBin: true
- [email protected]:
- resolution: {integrity:
sha512-uEmtNhbDOrWPFS+hdjFCBfy9f2YoyzRpwcl+DqpC6taX21FzsTLQVbMV/W7PzNSX6x/bhC1zA3c2UQ5NzH6how==}
+ [email protected]:
+ resolution: {integrity:
sha512-0acOTfMiWOheYS4eoWb80yYMb/JLvVv9SHbs2PehaDzfUG0Bw855SKyk0IKTnPGa5+U2bmi3W68l1+sGLX/pvw==}
[email protected]:
resolution: {integrity:
sha512-WxdbFHS3Wtz4V9hzhe/Xog5hQRSMxmDLkEEYZwqMDHgJlkZo00HVFZR0j5d0nKypjTUkkygH3dDSXERLG4757A==}
@@ -20746,8 +20747,8 @@ packages:
[email protected]:
resolution: {integrity:
sha512-vtK/94akxsTMhe0/cbfpR+syPuszcuwhqVjJq26CuNDgFGj682oRBXOP5MJpv2r7JtE8MsiepGIqvvOTBwn2vA==}
- [email protected]:
- resolution: {integrity:
sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==}
+ [email protected]:
+ resolution: {integrity:
sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==}
engines: {node: '>= 0.10'}
[email protected]:
@@ -22790,8 +22791,8 @@ packages:
[email protected]:
resolution: {integrity:
sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==}
- [email protected]:
- resolution: {integrity:
sha512-LIY910g9TI13YS95lrMFrs8Rm/u/irgHeTWoKCoteeJ04CUJ92eEfj0rVn+7VKMPBpUPiUoBKfhNyLI23EE/KA==}
+ [email protected]:
+ resolution: {integrity:
sha512-R+RODBqp6i2pPflGdq+xIOUkl+RNfGgHwoinecKu/JCuf2uO06cOKoDbI2P7Dn6KcswdKwrczbU6IYJ6K8X+wg==}
engines: {node: '>=18.17'}
[email protected]:
@@ -24203,7 +24204,7 @@ snapshots:
dependencies:
'@types/json-schema': 7.0.15
js-yaml: 5.2.3
- undici: 6.28.0
+ undici: 6.29.0
'@apidevtools/[email protected]': {}
@@ -31653,14 +31654,14 @@ snapshots:
[email protected]:
dependencies:
fast-deep-equal: 3.1.3
- fast-uri: 3.1.7
+ fast-uri: 3.1.8
json-schema-traverse: 1.0.0
require-from-string: 2.0.2
[email protected]:
dependencies:
fast-deep-equal: 3.1.3
- fast-uri: 3.1.7
+ fast-uri: 3.1.8
json-schema-traverse: 1.0.0
require-from-string: 2.0.2
@@ -32872,7 +32873,7 @@ snapshots:
parse5: 7.3.0
parse5-htmlparser2-tree-adapter: 7.1.0
parse5-parser-stream: 7.1.2
- undici: 6.28.0
+ undici: 6.29.0
whatwg-mimetype: 4.0.0
[email protected]:
@@ -34847,7 +34848,7 @@ snapshots:
on-finished: 2.4.1
parseurl: 1.3.3
path-to-regexp: 0.1.13
- proxy-addr: 2.0.7
+ proxy-addr: 2.0.8
qs: 6.16.0
range-parser: 1.2.1
safe-buffer: 5.2.1
@@ -34882,7 +34883,7 @@ snapshots:
on-finished: 2.4.1
once: 1.4.0
parseurl: 1.3.3
- proxy-addr: 2.0.7
+ proxy-addr: 2.0.8
qs: 6.16.0
range-parser: 1.3.0
router: 2.2.0
@@ -34957,7 +34958,7 @@ snapshots:
[email protected]: {}
- [email protected]: {}
+ [email protected]: {}
[email protected]:
dependencies:
@@ -36408,7 +36409,7 @@ snapshots:
[email protected]: {}
- [email protected]:
+ [email protected]:
dependencies:
async-lock: 1.4.1
clean-git-ref: 2.0.1
@@ -38095,7 +38096,7 @@ snapshots:
yargs-parser: 20.2.9
yargs-unparser: 2.0.0
- [email protected]: {}
+ [email protected]: {}
[email protected]([email protected])([email protected]([email protected]))([email protected]):
dependencies:
@@ -38310,7 +38311,7 @@ snapshots:
semver: 7.8.5
tar: 7.5.21
tinyglobby: 0.2.17
- undici: 6.28.0
+ undici: 6.29.0
which: 6.0.1
[email protected]:
@@ -38635,7 +38636,7 @@ snapshots:
mime: 3.0.0
prettier: 2.8.8
tiny-glob: 0.2.9
- undici: 6.28.0
+ undici: 6.29.0
yargs-parser: 21.1.1
[email protected]: {}
@@ -39418,7 +39419,7 @@ snapshots:
[email protected]: {}
- [email protected]:
+ [email protected]:
dependencies:
forwarded: 0.2.0
ipaddr.js: 1.9.1
@@ -39811,9 +39812,9 @@ snapshots:
[email protected]: {}
- [email protected]([email protected])([email protected])([email protected]):
+ [email protected]([email protected])([email protected])([email protected]):
dependencies:
- moment: 2.30.1
+ moment: 2.31.0
prop-types: 15.8.1
react: 18.3.1
@@ -41883,7 +41884,7 @@ snapshots:
[email protected]: {}
- [email protected]: {}
+ [email protected]: {}
[email protected]: {}
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 1c4829f991f..d4c46800da5 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -28,9 +28,12 @@ overrides:
"minimatch@^10": "10.2.1"
"minimatch@^5": "5.1.9"
"minimatch@^4": "5.1.9"
- # CVE-2026-1526, CVE-2026-2229, CVE-2026-1528, CVE-2026-1527, CVE-2026-1525,
CVE-2026-2203, CVE-2026-12151, CVE-2026-9679, CVE-2026-11525, CVE-2026-6733,
CVE-2026-16729, CVE-2026-15157, CVE-2026-16728: Fix security vulnerability in
undici
- # Waiting for @openapi-contrib/openapi-schema-to-json-schema to release
patched version
- "undici": "^6.28.0"
+ # CVE-2026-1526, CVE-2026-2229, CVE-2026-1528, CVE-2026-1527, CVE-2026-1525,
CVE-2026-2203, CVE-2026-12151, CVE-2026-9679, CVE-2026-11525, CVE-2026-6733,
CVE-2026-16729, CVE-2026-15157, CVE-2026-16728,
+ # CVE-2026-19534 (DoS via unrequested WebSocket subprotocol), CVE-2026-85024
(DoS via permessage-deflate decompression),
+ # CVE-2026-18540 (response splitting via retry interceptor): Fix security
vulnerabilities in undici.
+ # Upgraded from ^6.28.0 to ^6.29.0 (first clean same-major release; 6.28.1+
all clean on deps.dev).
+ # Waiting for @openapi-contrib/openapi-schema-to-json-schema to release
patched version.
+ "undici": "^6.29.0"
# CVE-2026-41907: Fix security vulnerability in uuid
# Transitive dependencies ([email protected], [email protected]) still use
[email protected]
"uuid": "^11.1.1"
@@ -41,3 +44,7 @@ overrides:
# All other dependents (axios, superagent, @vscode/vsce, jsdom,
@types/node-fetch) use ^4.x
# which naturally resolves to 4.0.6, so only @cypress/request needs a
targeted override.
"@cypress/request>form-data": "4.0.6"
+ # CVE-2026-90711 (CVSS 9.1): IP spoofing via IPv4-mapped IPv6 trust subnet
in proxy-addr.
+ # [email protected] pins ~2.0.7 and [email protected] pins ^2.0.7 — both ranges allow
2.0.8.
+ # Overriding transitive dependency until express ships proxy-addr >= 2.0.8
natively.
+ "proxy-addr": "2.0.8"
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
