CRW-9679: Fix CVE-2025-64756 by updating glob to 10.5.0 #611
Conversation
Updated @vscode/test-cli and @vscode/test-web packages which include the patched glob@10.5.0 version, addressing CVE-2025-64756 (glob CLI command injection vulnerability). Additional changes: - Added TypeScript as dev dependency to che-api, che-port, and che-resource-monitor extensions 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>
|
@sbouchet: This pull request references CRW-9679 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the vulnerability to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Click here to review and test in web IDE: |
&message=Dev%20cluster%20(for%20maintainers)&logo=eclipseche&color=525C86&labelColor=FDB940)
Signed-off-by: Stephane Bouchet <sbouchet@redhat.com>
|
@sbouchet: This pull request references CRW-9679 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the vulnerability to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
sbouchet
requested review from
RomanNikitenko,
azatsarynnyy and
vitaliy-guliy
as code owners
|
Pull Request images published ✨ Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-611-amd64 |
2 participants
What does this PR do?
Updated @vscode/test-cli and @vscode/test-web packages which include the patched glob@10.5.0 version, addressing CVE-2025-64756 (glob CLI command injection vulnerability).
🤖 Generated with Claude Code
What issues does this PR fix?
https://issues.redhat.com/browse/CRW-9679
How to test this PR?
Does this PR contain changes that override default upstream Code-OSS behavior?
git rebasewere added to the .rebase folder