Skip to content

Commit 0bba7fa

Browse files
lholmquistlholmquist
authored
chore(orchestrator): backporting CVE commits to the workspace/orchestrator for 1.8.6 (#2797)
* fix(orchestrator): update axios dependencies (#2767) (#2777) * fix(orchestrator): update axios dependencies (#2767) * chore(orchestator): multiple dependency updates for CVE fixes (#2773) (#2779) * fix: ran yarn up -R ajv. fixes https://access.redhat.com/security/cve/cve-2025-69873 * fix: ran yarn up -R path-to-regexp fixes https://access.redhat.com/security/cve/CVE-2026-4926 * fix: ran yarn up -R lodash fixes: https://access.redhat.com/security/cve/CVE-2026-4800 * squash: add the changeset
1 parent 71af99d commit 0bba7fa

10 files changed

Lines changed: 90 additions & 50 deletions

File tree

‎workspaces/orchestrator/.changeset/lucky-cars-study.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
'@red-hat-developer-hub/backstage-plugin-scaffolder-backend-module-orchestrator': patch
3+
'@red-hat-developer-hub/backstage-plugin-orchestrator-common': patch
4+
'@red-hat-developer-hub/backstage-plugin-orchestrator': patch
5+
---
6+
7+
fix: update axios for CVE-2026-40175

‎workspaces/orchestrator/.changeset/nervous-eels-mate.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
---
2+
'@red-hat-developer-hub/backstage-plugin-orchestrator-form-widgets': patch
3+
'@red-hat-developer-hub/backstage-plugin-orchestrator-form-react': patch
4+
'@red-hat-developer-hub/backstage-plugin-orchestrator-backend': patch
5+
'@red-hat-developer-hub/backstage-plugin-orchestrator': patch
6+
---
7+
8+
fix: updating lodash for cve fixes

‎workspaces/orchestrator/plugins/orchestrator-backend/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@
8484
"express-promise-router": "^4.1.1",
8585
"fs-extra": "^10.1.0",
8686
"isomorphic-git": "^1.23.0",
87-
"lodash": "^4.17.21",
87+
"lodash": "^4.18.1",
8888
"moment": "^2.29.4",
8989
"openapi-backend": "^5.10.5",
9090
"yn": "^5.0.0"

‎workspaces/orchestrator/plugins/orchestrator-common/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@
6161
"@backstage/plugin-permission-common": "^0.9.1",
6262
"@backstage/types": "^1.2.1",
6363
"@severlessworkflow/sdk-typescript": "^3.0.3",
64-
"axios": "^1.11.0",
64+
"axios": "^1.15.0",
6565
"js-yaml": "^4.1.0"
6666
},
6767
"devDependencies": {

‎workspaces/orchestrator/plugins/orchestrator-common/report.api.md‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -172,7 +172,7 @@ export class DefaultApi extends BaseAPI {
172172
// Warning: (tsdoc-escape-right-brace) The "}" character should be escaped using a backslash to avoid confusion with a TSDoc inline tag
173173
// Warning: (tsdoc-malformed-inline-tag) Expecting a TSDoc tag starting with "{@"
174174
// Warning: (tsdoc-undefined-tag) The TSDoc tag "@memberof" is not defined in this configuration
175-
abortWorkflow(instanceId: string, options?: RawAxiosRequestConfig): Promise<AxiosResponse<string, any>>;
175+
abortWorkflow(instanceId: string, options?: RawAxiosRequestConfig): Promise<AxiosResponse<string, any, {}>>;
176176
// Warning: (tsdoc-undefined-tag) The TSDoc tag "@summary" is not defined in this configuration
177177
// Warning: (tsdoc-param-tag-missing-hyphen) The @param block should be followed by a parameter name and then a hyphen
178178
// Warning: (tsdoc-param-tag-with-invalid-type) The @param block should not include a JSDoc-style '{type}'
@@ -184,7 +184,7 @@ export class DefaultApi extends BaseAPI {
184184
// Warning: (tsdoc-escape-right-brace) The "}" character should be escaped using a backslash to avoid confusion with a TSDoc inline tag
185185
// Warning: (tsdoc-malformed-inline-tag) Expecting a TSDoc tag starting with "{@"
186186
// Warning: (tsdoc-undefined-tag) The TSDoc tag "@memberof" is not defined in this configuration
187-
executeWorkflow(workflowId: string, executeWorkflowRequestDTO: ExecuteWorkflowRequestDTO, options?: RawAxiosRequestConfig): Promise<AxiosResponse<ExecuteWorkflowResponseDTO, any>>;
187+
executeWorkflow(workflowId: string, executeWorkflowRequestDTO: ExecuteWorkflowRequestDTO, options?: RawAxiosRequestConfig): Promise<AxiosResponse<ExecuteWorkflowResponseDTO, any, {}>>;
188188
// Warning: (tsdoc-undefined-tag) The TSDoc tag "@summary" is not defined in this configuration
189189
// Warning: (tsdoc-param-tag-missing-hyphen) The @param block should be followed by a parameter name and then a hyphen
190190
// Warning: (tsdoc-param-tag-with-invalid-type) The @param block should not include a JSDoc-style '{type}'
@@ -194,7 +194,7 @@ export class DefaultApi extends BaseAPI {
194194
// Warning: (tsdoc-escape-right-brace) The "}" character should be escaped using a backslash to avoid confusion with a TSDoc inline tag
195195
// Warning: (tsdoc-malformed-inline-tag) Expecting a TSDoc tag starting with "{@"
196196
// Warning: (tsdoc-undefined-tag) The TSDoc tag "@memberof" is not defined in this configuration
197-
getInstanceById(instanceId: string, options?: RawAxiosRequestConfig): Promise<AxiosResponse<ProcessInstanceDTO, any>>;
197+
getInstanceById(instanceId: string, options?: RawAxiosRequestConfig): Promise<AxiosResponse<ProcessInstanceDTO, any, {}>>;
198198
// Warning: (tsdoc-undefined-tag) The TSDoc tag "@summary" is not defined in this configuration
199199
// Warning: (tsdoc-param-tag-missing-hyphen) The @param block should be followed by a parameter name and then a hyphen
200200
// Warning: (tsdoc-param-tag-with-invalid-optional-name) The @param should not include a JSDoc-style optional name; it must not be enclosed in '[ ]' brackets.
@@ -205,7 +205,7 @@ export class DefaultApi extends BaseAPI {
205205
// Warning: (tsdoc-escape-right-brace) The "}" character should be escaped using a backslash to avoid confusion with a TSDoc inline tag
206206
// Warning: (tsdoc-malformed-inline-tag) Expecting a TSDoc tag starting with "{@"
207207
// Warning: (tsdoc-undefined-tag) The TSDoc tag "@memberof" is not defined in this configuration
208-
getInstances(searchRequest?: SearchRequest, options?: RawAxiosRequestConfig): Promise<AxiosResponse<ProcessInstanceListResultDTO, any>>;
208+
getInstances(searchRequest?: SearchRequest, options?: RawAxiosRequestConfig): Promise<AxiosResponse<ProcessInstanceListResultDTO, any, {}>>;
209209
// Warning: (tsdoc-param-tag-missing-hyphen) The @param block should be followed by a parameter name and then a hyphen
210210
// Warning: (tsdoc-param-tag-with-invalid-type) The @param block should not include a JSDoc-style '{type}'
211211
// Warning: (tsdoc-param-tag-missing-hyphen) The @param block should be followed by a parameter name and then a hyphen
@@ -217,7 +217,7 @@ export class DefaultApi extends BaseAPI {
217217
// Warning: (tsdoc-escape-right-brace) The "}" character should be escaped using a backslash to avoid confusion with a TSDoc inline tag
218218
// Warning: (tsdoc-malformed-inline-tag) Expecting a TSDoc tag starting with "{@"
219219
// Warning: (tsdoc-undefined-tag) The TSDoc tag "@memberof" is not defined in this configuration
220-
getWorkflowInputSchemaById(workflowId: string, instanceId?: string, options?: RawAxiosRequestConfig): Promise<AxiosResponse<InputSchemaResponseDTO, any>>;
220+
getWorkflowInputSchemaById(workflowId: string, instanceId?: string, options?: RawAxiosRequestConfig): Promise<AxiosResponse<InputSchemaResponseDTO, any, {}>>;
221221
// Warning: (tsdoc-undefined-tag) The TSDoc tag "@summary" is not defined in this configuration
222222
// Warning: (tsdoc-param-tag-missing-hyphen) The @param block should be followed by a parameter name and then a hyphen
223223
// Warning: (tsdoc-param-tag-with-invalid-type) The @param block should not include a JSDoc-style '{type}'
@@ -230,7 +230,7 @@ export class DefaultApi extends BaseAPI {
230230
// Warning: (tsdoc-escape-right-brace) The "}" character should be escaped using a backslash to avoid confusion with a TSDoc inline tag
231231
// Warning: (tsdoc-malformed-inline-tag) Expecting a TSDoc tag starting with "{@"
232232
// Warning: (tsdoc-undefined-tag) The TSDoc tag "@memberof" is not defined in this configuration
233-
getWorkflowInstances(workflowId: string, searchRequest?: SearchRequest, options?: RawAxiosRequestConfig): Promise<AxiosResponse<ProcessInstanceListResultDTO, any>>;
233+
getWorkflowInstances(workflowId: string, searchRequest?: SearchRequest, options?: RawAxiosRequestConfig): Promise<AxiosResponse<ProcessInstanceListResultDTO, any, {}>>;
234234
// Warning: (tsdoc-param-tag-missing-hyphen) The @param block should be followed by a parameter name and then a hyphen
235235
// Warning: (tsdoc-param-tag-with-invalid-type) The @param block should not include a JSDoc-style '{type}'
236236
// Warning: (tsdoc-param-tag-missing-hyphen) The @param block should be followed by a parameter name and then a hyphen
@@ -239,7 +239,7 @@ export class DefaultApi extends BaseAPI {
239239
// Warning: (tsdoc-escape-right-brace) The "}" character should be escaped using a backslash to avoid confusion with a TSDoc inline tag
240240
// Warning: (tsdoc-malformed-inline-tag) Expecting a TSDoc tag starting with "{@"
241241
// Warning: (tsdoc-undefined-tag) The TSDoc tag "@memberof" is not defined in this configuration
242-
getWorkflowOverviewById(workflowId: string, options?: RawAxiosRequestConfig): Promise<AxiosResponse<WorkflowOverviewDTO, any>>;
242+
getWorkflowOverviewById(workflowId: string, options?: RawAxiosRequestConfig): Promise<AxiosResponse<WorkflowOverviewDTO, any, {}>>;
243243
// Warning: (tsdoc-param-tag-missing-hyphen) The @param block should be followed by a parameter name and then a hyphen
244244
// Warning: (tsdoc-param-tag-with-invalid-type) The @param block should not include a JSDoc-style '{type}'
245245
// Warning: (tsdoc-param-tag-missing-hyphen) The @param block should be followed by a parameter name and then a hyphen
@@ -248,7 +248,7 @@ export class DefaultApi extends BaseAPI {
248248
// Warning: (tsdoc-escape-right-brace) The "}" character should be escaped using a backslash to avoid confusion with a TSDoc inline tag
249249
// Warning: (tsdoc-malformed-inline-tag) Expecting a TSDoc tag starting with "{@"
250250
// Warning: (tsdoc-undefined-tag) The TSDoc tag "@memberof" is not defined in this configuration
251-
getWorkflowSourceById(workflowId: string, options?: RawAxiosRequestConfig): Promise<AxiosResponse<string, any>>;
251+
getWorkflowSourceById(workflowId: string, options?: RawAxiosRequestConfig): Promise<AxiosResponse<string, any, {}>>;
252252
// Warning: (tsdoc-param-tag-missing-hyphen) The @param block should be followed by a parameter name and then a hyphen
253253
// Warning: (tsdoc-param-tag-with-invalid-optional-name) The @param should not include a JSDoc-style optional name; it must not be enclosed in '[ ]' brackets.
254254
// Warning: (tsdoc-param-tag-with-invalid-type) The @param block should not include a JSDoc-style '{type}'
@@ -258,7 +258,7 @@ export class DefaultApi extends BaseAPI {
258258
// Warning: (tsdoc-escape-right-brace) The "}" character should be escaped using a backslash to avoid confusion with a TSDoc inline tag
259259
// Warning: (tsdoc-malformed-inline-tag) Expecting a TSDoc tag starting with "{@"
260260
// Warning: (tsdoc-undefined-tag) The TSDoc tag "@memberof" is not defined in this configuration
261-
getWorkflowsOverview(searchRequest?: SearchRequest, options?: RawAxiosRequestConfig): Promise<AxiosResponse<WorkflowOverviewListResultDTO, any>>;
261+
getWorkflowsOverview(searchRequest?: SearchRequest, options?: RawAxiosRequestConfig): Promise<AxiosResponse<WorkflowOverviewListResultDTO, any, {}>>;
262262
// Warning: (tsdoc-param-tag-missing-hyphen) The @param block should be followed by a parameter name and then a hyphen
263263
// Warning: (tsdoc-param-tag-with-invalid-optional-name) The @param should not include a JSDoc-style optional name; it must not be enclosed in '[ ]' brackets.
264264
// Warning: (tsdoc-param-tag-with-invalid-type) The @param block should not include a JSDoc-style '{type}'
@@ -268,15 +268,15 @@ export class DefaultApi extends BaseAPI {
268268
// Warning: (tsdoc-escape-right-brace) The "}" character should be escaped using a backslash to avoid confusion with a TSDoc inline tag
269269
// Warning: (tsdoc-malformed-inline-tag) Expecting a TSDoc tag starting with "{@"
270270
// Warning: (tsdoc-undefined-tag) The TSDoc tag "@memberof" is not defined in this configuration
271-
getWorkflowsOverviewForEntity(getWorkflowsOverviewForEntityRequest?: GetWorkflowsOverviewForEntityRequest, options?: RawAxiosRequestConfig): Promise<AxiosResponse<WorkflowOverviewListResultDTO, any>>;
271+
getWorkflowsOverviewForEntity(getWorkflowsOverviewForEntityRequest?: GetWorkflowsOverviewForEntityRequest, options?: RawAxiosRequestConfig): Promise<AxiosResponse<WorkflowOverviewListResultDTO, any, {}>>;
272272
// Warning: (tsdoc-undefined-tag) The TSDoc tag "@summary" is not defined in this configuration
273273
// Warning: (tsdoc-param-tag-missing-hyphen) The @param block should be followed by a parameter name and then a hyphen
274274
// Warning: (tsdoc-param-tag-with-invalid-optional-name) The @param should not include a JSDoc-style optional name; it must not be enclosed in '[ ]' brackets.
275275
// Warning: (tsdoc-param-tag-with-invalid-type) The @param block should not include a JSDoc-style '{type}'
276276
// Warning: (tsdoc-escape-right-brace) The "}" character should be escaped using a backslash to avoid confusion with a TSDoc inline tag
277277
// Warning: (tsdoc-malformed-inline-tag) Expecting a TSDoc tag starting with "{@"
278278
// Warning: (tsdoc-undefined-tag) The TSDoc tag "@memberof" is not defined in this configuration
279-
getWorkflowStatuses(options?: RawAxiosRequestConfig): Promise<AxiosResponse<WorkflowRunStatusDTO[], any>>;
279+
getWorkflowStatuses(options?: RawAxiosRequestConfig): Promise<AxiosResponse<WorkflowRunStatusDTO[], any, {}>>;
280280
// Warning: (tsdoc-param-tag-missing-hyphen) The @param block should be followed by a parameter name and then a hyphen
281281
// Warning: (tsdoc-param-tag-with-invalid-type) The @param block should not include a JSDoc-style '{type}'
282282
// Warning: (tsdoc-param-tag-missing-hyphen) The @param block should be followed by a parameter name and then a hyphen
@@ -285,7 +285,7 @@ export class DefaultApi extends BaseAPI {
285285
// Warning: (tsdoc-escape-right-brace) The "}" character should be escaped using a backslash to avoid confusion with a TSDoc inline tag
286286
// Warning: (tsdoc-malformed-inline-tag) Expecting a TSDoc tag starting with "{@"
287287
// Warning: (tsdoc-undefined-tag) The TSDoc tag "@memberof" is not defined in this configuration
288-
pingWorkflowServiceById(workflowId: string, options?: RawAxiosRequestConfig): Promise<AxiosResponse<boolean, any>>;
288+
pingWorkflowServiceById(workflowId: string, options?: RawAxiosRequestConfig): Promise<AxiosResponse<boolean, any, {}>>;
289289
// Warning: (tsdoc-undefined-tag) The TSDoc tag "@summary" is not defined in this configuration
290290
// Warning: (tsdoc-param-tag-missing-hyphen) The @param block should be followed by a parameter name and then a hyphen
291291
// Warning: (tsdoc-param-tag-with-invalid-type) The @param block should not include a JSDoc-style '{type}'
@@ -299,7 +299,7 @@ export class DefaultApi extends BaseAPI {
299299
// Warning: (tsdoc-escape-right-brace) The "}" character should be escaped using a backslash to avoid confusion with a TSDoc inline tag
300300
// Warning: (tsdoc-malformed-inline-tag) Expecting a TSDoc tag starting with "{@"
301301
// Warning: (tsdoc-undefined-tag) The TSDoc tag "@memberof" is not defined in this configuration
302-
retriggerInstance(workflowId: string, instanceId: string, retriggerInstanceRequestDTO: RetriggerInstanceRequestDTO, options?: RawAxiosRequestConfig): Promise<AxiosResponse<object, any>>;
302+
retriggerInstance(workflowId: string, instanceId: string, retriggerInstanceRequestDTO: RetriggerInstanceRequestDTO, options?: RawAxiosRequestConfig): Promise<AxiosResponse<object, any, {}>>;
303303
}
304304

305305
// Warning: (tsdoc-undefined-tag) The TSDoc tag "@export" is not defined in this configuration

‎workspaces/orchestrator/plugins/orchestrator-form-react/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@
4444
"@rjsf/utils": "^5.21.2",
4545
"@rjsf/validator-ajv8": "^5.21.2",
4646
"json-schema-library": "^9.0.0",
47-
"lodash": "^4.17.21",
47+
"lodash": "^4.18.1",
4848
"tss-react": "^4.9.18"
4949
},
5050
"peerDependencies": {

‎workspaces/orchestrator/plugins/orchestrator-form-widgets/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@
6565
"clsx": "^2.1.1",
6666
"json-schema": "^0.4.0",
6767
"jsonata": "^2.0.6",
68-
"lodash": "^4.17.21",
68+
"lodash": "^4.18.1",
6969
"react-use": "^17.2.4",
7070
"tss-react": "^4.9.18"
7171
},

‎workspaces/orchestrator/plugins/orchestrator/package.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -67,9 +67,9 @@
6767
"@red-hat-developer-hub/backstage-plugin-orchestrator-common": "workspace:^",
6868
"@red-hat-developer-hub/backstage-plugin-orchestrator-form-api": "workspace:^",
6969
"@red-hat-developer-hub/backstage-plugin-orchestrator-form-react": "workspace:^",
70-
"axios": "^1.11.0",
70+
"axios": "^1.15.0",
7171
"json-schema": "^0.4.0",
72-
"lodash": "^4.17.21",
72+
"lodash": "^4.18.1",
7373
"moment": "^2.29.4",
7474
"react-json-view": "^1.21.3",
7575
"react-moment": "^1.1.3",

‎workspaces/orchestrator/plugins/scaffolder-backend-module-orchestrator/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@
6464
"@backstage/plugin-scaffolder-node": "^0.11.0",
6565
"@backstage/types": "^1.2.1",
6666
"@red-hat-developer-hub/backstage-plugin-orchestrator-common": "workspace:^",
67-
"axios": "^1.11.0",
67+
"axios": "^1.15.0",
6868
"js-yaml": "^4.1.0"
6969
},
7070
"devDependencies": {

0 commit comments

Comments
 (0)