fix(cve): update npm dependencies for 9 CVE fixes by crackcodecamp · Pull Request #8438 · opendatahub-io/odh-dashboard

crackcodecamp · 2026-07-07T10:00:52Z

Summary

Update npm dependencies to fix 19 CVEs across 8 packages, addressing 37 Jira trackers for RHOAI 2.25.9.

Changes (one commit per package)

Package	Before	After	CVEs Fixed	Trackers
axios	1.16.1	>=1.18.1	CVE-2026-42044, 42264, 44486-88, 44492, 44494-96	18
fast-uri	3.1.2	3.1.3	CVE-2026-13676, 6322	4
ws	8.18.3	^8.21.0	CVE-2026-45736, 48779	4
react-router/dom	7.13.0	^7.15.1	CVE-2026-42211, 42342	4
form-data	4.0.4	>=4.0.6	CVE-2026-12143	2
brace-expansion	2.0.2	2.0.3	CVE-2026-13149	2
shell-quote	1.8.3	>=1.8.4	CVE-2026-13311	1
js-cookie	3.0.1	>=3.0.6	CVE-2026-46625	2

All are minor/patch version bumps — no major version changes.

Jira Trackers

axios: RHOAIENG-61548, 61547, 71636, 71635, 68382, 68377, 68368, 68363, 68356, 68351, 68434, 68431, 68376, 68374, 68334, 68330, 68421, 68400
fast-uri: RHOAIENG-72245, 72240, 66376, 66373
ws: RHOAIENG-70807, 70806, 69458, 69455
react-router: RHOAIENG-65899, 65898, 65891, 65890
form-data: RHOAIENG-69222, 69218
brace-expansion: RHOAIENG-72680, 72678
shell-quote: RHOAIENG-71522
js-cookie: RHOAIENG-68085, 68086

Not addressed in this PR

js-yaml (CVE-2026-53550) — override breaks @kubernetes/client-node which depends on js-yaml 3.x (yaml.safeLoad removed in 4.x)
fastify (CVE-2026-33805) — needs major version bump
undici (CVE-2026-12151, 6734, 9697) — depends on fastify changes
Go CVEs (gRPC-Go, golang.org/x/net, etc.) — separate PR for Go module updates

Test plan

Tested locally against live RHOAI 2.25.9 cluster (apps.ag-dash-225-pool-j7dwt.aws.rh-ods.com):

npm run build — frontend + backend compile successfully
npm run test:backend — 17/17 unit tests pass
Cypress e2e application.cy.ts — login and page load pass
Cypress e2e testUserLogin.cy.ts — admin + non-admin login pass (2/2)
Cypress e2e testApplicationLinks.cy.ts — navigation links pass
Cypress e2e testProjectCreation.cy.ts — create/delete projects pass (3/4, 1 flaky OAuth redirect)
Cypress e2e testProjectEditing.cy.ts — passes individually, flaky in batch run (OAuth redirect)
CI pipeline passes

Note: The 2 flaky failures are caused by OAuth redirect inconsistency (browser sometimes lands on cluster URL instead of localhost after auth) — pre-existing test infra issue, not related to dependency changes.

coderabbitai · 2026-07-07T10:03:40Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 3f6ddfe9-975d-4448-bb05-53fa96d11c95

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

dpanshug · 2026-07-24T11:32:49Z

@crackcodecamp pls mention JIRA tickets

PR3MM · 2026-07-24T11:49:54Z

Ran npm audit, few packages still show as vulnerable:

axios — >=1.18.1 is the right target, but root lock is still on 1.16.1. override isn't applying everywhere
fast-uri — needs 3.1.4 for GHSA-v2hh-gcrm-f6hx (3.1.3 still flagged)
brace-expansion — for CVE-2026-13149 please bump to 2.1.2 (2.0.3 is still in the vulnerable range)

rest of the claimed packages look good. deferred ones (js-yaml / fastify / undici) still show up as expected

crackcodecamp · 2026-07-27T10:16:43Z

@dpanshug Added all 37 Jira trackers in the PR description grouped by package:

axios (18): RHOAIENG-61548, 61547, 71636, 71635, 68382, 68377, 68368, 68363, 68356, 68351, 68434, 68431, 68376, 68374, 68334, 68330, 68421, 68400
fast-uri (4): RHOAIENG-72245, 72240, 66376, 66373
ws (4): RHOAIENG-70807, 70806, 69458, 69455
react-router (4): RHOAIENG-65899, 65898, 65891, 65890
form-data (2): RHOAIENG-69222, 69218
brace-expansion (2): RHOAIENG-72680, 72678
shell-quote (1): RHOAIENG-71522
js-cookie (2): RHOAIENG-68085, 68086

crackcodecamp · 2026-07-27T10:26:21Z

Thanks for the review @PR3MM Here's the breakdown:

fast-uri → 3.1.4 — Agreed, will bump. New advisory (GHSA-v2hh-gcrm-f6hx) flags 3.1.3. Trivial patch.

brace-expansion — The audit now shows <=5.0.7 as vulnerable (GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg), which means every published version including 2.1.2 and the latest 5.0.7 is affected. There's no safe version available yet - bumping won't resolve the audit finding. We'll update once upstream publishes a fix.

Root axios 1.16.1 — This is a devOptional dependency (pulled by wait-on and @module-federation/dts-plugin). It's excluded from the production image (npm ci --omit=dev in Dockerfile). The production axios at frontend/node_modules/axios is correctly at 1.18.1. No CVE scanner will flag it in the built image.

codecov · 2026-07-27T11:41:19Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 67.94%. Comparing base (0a61717) to head (5d085b1).
⚠️ Report is 2 commits behind head on stable-2.x.

Additional details and impacted files

@@              Coverage Diff               @@
##           stable-2.x    #8438      +/-   ##
==============================================
- Coverage       67.95%   67.94%   -0.02%     
==============================================
  Files            2238     2238              
  Lines           50822    50822              
  Branches        14243    14243              
==============================================
- Hits            34538    34530       -8     
- Misses          16284    16292       +8

see 4 files with indirect coverage changes

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 96bfc44...5d085b1. Read the comment docs.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

PR3MM · 2026-07-28T12:14:42Z

/lgtm

tested on a 2.25.9 cluster

Fixes CVE-2026-42044, CVE-2026-42264, CVE-2026-44486, CVE-2026-44487, CVE-2026-44488, CVE-2026-44492, CVE-2026-44494, CVE-2026-44495, CVE-2026-44496 Update axios override in root package.json to >=1.18.1 and bump frontend direct dependency from ^1.15.0 to ^1.18.1. Minor version bump only, no breaking changes.

Fixes CVE-2026-13676, CVE-2026-6322 Update fast-uri override from >=3.1.1 to 3.1.3. Patch version bump, no breaking changes.

Fixes CVE-2026-45736, CVE-2026-48779 Update ws dependency and override from ^8.17.1 to ^8.21.0. Minor version bump within 8.x, no breaking changes.

Fixes CVE-2026-42211, CVE-2026-42342 Update react-router and react-router-dom from ^7.6.2 to ^7.15.1 (resolves to 7.18.1). Updated in root overrides, sdk-utils nested overrides, and frontend direct deps. Minor version bump within 7.x.

Fixes CVE-2026-12143 Add form-data override to >=4.0.6, consolidating all instances from 4.0.4/4.0.5/2.5.5 to 4.0.6. Patch version bump, no breaking changes.

Fixes CVE-2026-13149 Add brace-expansion override pinned to 2.0.3. Patch bump from 2.0.2, no breaking changes.

Fixes CVE-2026-13311 Add shell-quote override >=1.8.4 (resolves to 1.9.0). Minor version bump within 1.x, no breaking changes.

Fixes CVE-2026-46625 Add js-cookie override >=3.0.6 (resolves to 3.0.8). Patch version bump within 3.0.x, no breaking changes.

Addresses GHSA-v2hh-gcrm-f6hx which flagged fast-uri 3.1.3 as still vulnerable. Patch bump, no breaking changes.

The global brace-expansion override to 2.0.3 broke nyc/istanbul coverage reporting (brace_expansion_1.expand is not a function). Additionally, npm audit now flags <=5.0.7 meaning no safe version exists yet. Without the override, npm naturally resolves to 1.1.16 (root) and 2.1.2 (nested) — the latest available patches.

dpanshug

/approve

manaswinidas

/approve

openshift-ci · 2026-07-29T12:16:28Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dpanshug, manaswinidas

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [manaswinidas]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

fix(cve): update npm dependencies for 9 CVE fixes (opendatahub-io#8438)

openshift-ci Bot requested review from DaoDaoNoCode and darachcawley July 7, 2026 10:01

openshift-ci Bot added area/backend area/frontend labels Jul 7, 2026

crackcodecamp force-pushed the cve-fixes-stable-2.x branch from 2d5fcad to ec943e4 Compare July 7, 2026 10:20

openshift-ci Bot assigned PR3MM Jul 28, 2026

openshift-ci Bot added the lgtm label Jul 28, 2026

crackcodecamp added 10 commits July 28, 2026 18:59

fix(cve): update fast-uri to 3.1.3

6d56892

Fixes CVE-2026-13676, CVE-2026-6322 Update fast-uri override from >=3.1.1 to 3.1.3. Patch version bump, no breaking changes.

fix(cve): update ws to ^8.21.0

626843b

Fixes CVE-2026-45736, CVE-2026-48779 Update ws dependency and override from ^8.17.1 to ^8.21.0. Minor version bump within 8.x, no breaking changes.

fix(cve): update form-data to >=4.0.6

7c99f58

Fixes CVE-2026-12143 Add form-data override to >=4.0.6, consolidating all instances from 4.0.4/4.0.5/2.5.5 to 4.0.6. Patch version bump, no breaking changes.

fix(cve): update brace-expansion to 2.0.3

7955021

Fixes CVE-2026-13149 Add brace-expansion override pinned to 2.0.3. Patch bump from 2.0.2, no breaking changes.

fix(cve): update shell-quote to >=1.8.4

bb37014

Fixes CVE-2026-13311 Add shell-quote override >=1.8.4 (resolves to 1.9.0). Minor version bump within 1.x, no breaking changes.

fix(cve): update js-cookie to >=3.0.6

7a48a87

Fixes CVE-2026-46625 Add js-cookie override >=3.0.6 (resolves to 3.0.8). Patch version bump within 3.0.x, no breaking changes.

fix(cve): bump fast-uri from 3.1.3 to 3.1.4

23f8c6e

Addresses GHSA-v2hh-gcrm-f6hx which flagged fast-uri 3.1.3 as still vulnerable. Patch bump, no breaking changes.

crackcodecamp force-pushed the cve-fixes-stable-2.x branch from 4c07c26 to 5d085b1 Compare July 28, 2026 13:29

openshift-ci Bot removed the lgtm label Jul 28, 2026

dpanshug approved these changes Jul 29, 2026

View reviewed changes

openshift-ci Bot assigned dpanshug Jul 29, 2026

openshift-ci Bot added the lgtm label Jul 29, 2026

manaswinidas approved these changes Jul 29, 2026

View reviewed changes

openshift-ci Bot assigned manaswinidas Jul 29, 2026

openshift-ci Bot added the approved label Jul 29, 2026

openshift-merge-bot Bot merged commit 7565019 into opendatahub-io:stable-2.x Jul 29, 2026
75 of 77 checks passed

manaswinidas added a commit to red-hat-data-services/odh-dashboard that referenced this pull request Jul 29, 2026

Merge pull request #2245 from opendatahub-io/stable-2.x

2ff1d94

fix(cve): update npm dependencies for 9 CVE fixes (opendatahub-io#8438)

Navigation Menu

Uh oh!

fix(cve): update npm dependencies for 9 CVE fixes - #8438

fix(cve): update npm dependencies for 9 CVE fixes#8438
openshift-merge-bot[bot] merged 10 commits into
opendatahub-io:stable-2.xfrom
crackcodecamp:cve-fixes-stable-2.x

crackcodecamp commented Jul 7, 2026 •

edited by atlassian Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 7, 2026 •

edited

Loading

Review skipped

Uh oh!

dpanshug commented Jul 24, 2026

Uh oh!

PR3MM commented Jul 24, 2026 •

edited

Loading

Uh oh!

crackcodecamp commented Jul 27, 2026 •

edited by atlassian Bot

Loading

Uh oh!

crackcodecamp commented Jul 27, 2026

Uh oh!

codecov Bot commented Jul 27, 2026 •

edited

Loading

Uh oh!

PR3MM commented Jul 28, 2026

Uh oh!

dpanshug left a comment

Uh oh!

manaswinidas left a comment

Uh oh!

openshift-ci Bot commented Jul 29, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

crackcodecamp commented Jul 7, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes (one commit per package)

Jira Trackers

Not addressed in this PR

Test plan

Uh oh!

coderabbitai Bot commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

dpanshug commented Jul 24, 2026

Uh oh!

PR3MM commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

crackcodecamp commented Jul 27, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

crackcodecamp commented Jul 27, 2026

Uh oh!

codecov Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

PR3MM commented Jul 28, 2026

Uh oh!

dpanshug left a comment

Choose a reason for hiding this comment

Uh oh!

manaswinidas left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci Bot commented Jul 29, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

crackcodecamp commented Jul 7, 2026 •

edited by atlassian Bot

Loading

coderabbitai Bot commented Jul 7, 2026 •

edited

Loading

PR3MM commented Jul 24, 2026 •

edited

Loading

crackcodecamp commented Jul 27, 2026 •

edited by atlassian Bot

Loading

codecov Bot commented Jul 27, 2026 •

edited

Loading