Skip to content

chore: override tar to ^7.5.19, shell-quote to ^1.9.0, axios to ^1.18.0, brace-expansion to ^5.0.8 #282

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sachinh-amazon merged 2 commits into from
Jul 27, 2026
Merged

chore: override tar to ^7.5.19, shell-quote to ^1.9.0, axios to ^1.18.0, brace-expansion to ^5.0.8 #282

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5377f59
chore: override tar to ^7.5.19, shell-quote to ^1.9.0, axios to ^1.18…
Jul 27, 2026
18c35e5
chore: keep x64 architecture in third-party attribution
Jul 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions LICENSE-THIRD-PARTY
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5716,7 +5716,7 @@ SOFTWARE.
******************************

axios
1.16.1 <https://github.com/axios/axios>
1.18.1 <https://github.com/axios/axios>
# Copyright (c) 2014-present Matt Zabriskie & Collaborators

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
Expand Down Expand Up @@ -9082,7 +9082,7 @@ SOFTWARE.
******************************

shell-quote
1.8.4 <https://github.com/ljharb/shell-quote>
1.10.0 <https://github.com/ljharb/shell-quote>
The MIT License

Copyright (c) 2013 James Halliday (mail@substack.net)
Expand Down Expand Up @@ -9275,7 +9275,7 @@ software or this license, under any kind of legal claim.***
******************************

tar
7.5.16 <https://github.com/isaacs/node-tar>
7.5.22 <https://github.com/isaacs/node-tar>
# Blue Oak Model License

Version 1.0.0
Expand Down
8 changes: 4 additions & 4 deletions build-tools/oss-attribution/oss-attribution-generator/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion build-tools/oss-attribution/oss-attribution-generator/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,6 @@
},
"overrides": {
"minimatch": "^10.2.3",
"brace-expansion": "^5.0.6"
"brace-expansion": "^5.0.8"
}
}
6 changes: 3 additions & 3 deletions overrides/LICENSE-THIRD-PARTY
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5716,7 +5716,7 @@ SOFTWARE.
******************************

axios
1.16.1 <https://github.com/axios/axios>
1.18.1 <https://github.com/axios/axios>
# Copyright (c) 2014-present Matt Zabriskie & Collaborators

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
Expand Down Expand Up @@ -9082,7 +9082,7 @@ SOFTWARE.
******************************

shell-quote
1.8.4 <https://github.com/ljharb/shell-quote>
1.10.0 <https://github.com/ljharb/shell-quote>
The MIT License

Copyright (c) 2013 James Halliday (mail@substack.net)
Expand Down Expand Up @@ -9275,7 +9275,7 @@ software or this license, under any kind of legal claim.***
******************************

tar
7.5.16 <https://github.com/isaacs/node-tar>
7.5.22 <https://github.com/isaacs/node-tar>
# Blue Oak Model License

Version 1.0.0
Expand Down
22 changes: 11 additions & 11 deletions package-lock-overrides/sagemaker.series/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

12 changes: 6 additions & 6 deletions package-lock-overrides/sagemaker.series/remote/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

12 changes: 6 additions & 6 deletions package-lock-overrides/web-embedded-with-terminal.series/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 3 additions & 3 deletions package-lock-overrides/web-embedded-with-terminal.series/remote/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

12 changes: 6 additions & 6 deletions package-lock-overrides/web-embedded.series/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 3 additions & 3 deletions package-lock-overrides/web-embedded.series/remote/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

12 changes: 6 additions & 6 deletions package-lock-overrides/web-server.series/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 3 additions & 3 deletions package-lock-overrides/web-server.series/remote/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

10 changes: 5 additions & 5 deletions patches/common/finding-override-axios.diff
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
Override axios to ^1.15.2.
Remove when upstream Code-OSS updates axios to >= 1.15.2.
Override axios to ^1.18.0.
Remove when upstream Code-OSS updates axios to >= 1.18.0.

@generated
@generator: scripts/patches/apply-override.sh --patch common/finding-override-axios.diff --override 'global:axios=^1.15.2'
@override-package: axios@^1.15.2
@generator: scripts/patches/apply-override.sh --patch common/finding-override-axios.diff --override 'global:axios=^1.18.0'
@override-package: axios@^1.18.0

Index: b/package.json
===================================================================
Expand All @@ -15,7 +15,7 @@ Index: b/package.json
"uuid": "^14.0.0",
- "ip-address": "^10.1.1"
+ "ip-address": "^10.1.1",
+ "axios": "^1.15.2"
+ "axios": "^1.18.0"
},
"repository": {
"type": "git",
13 changes: 6 additions & 7 deletions patches/common/finding-override-shell-quote.diff
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,9 @@
Override shell-quote to ^1.8.4.
Regenerate: npx ts-node build-tools/apply-finding-overrides/apply-finding-overrides.ts apply --patch common/finding-override-shell-quote.diff --override global:shell-quote=^1.8.4 --override remote/package.json@global:shell-quote=^1.8.4
Remove when upstream Code-OSS updates shell-quote to >= 1.8.4.
Override shell-quote to ^1.9.0.
Remove when upstream Code-OSS updates shell-quote to >= 1.9.0.

@generated
@generator: scripts/patches/apply-override.sh --patch common/finding-override-shell-quote.diff --override 'global:shell-quote=^1.8.4' --override 'remote/package.json@global:shell-quote=^1.8.4'
@override-package: shell-quote@^1.8.4
@generator: scripts/patches/apply-override.sh --patch common/finding-override-shell-quote.diff --override 'global:shell-quote=^1.9.0' --override 'remote/package.json@global:shell-quote=^1.9.0'
@override-package: shell-quote@^1.9.0

Index: b/package.json
===================================================================
Expand All @@ -14,7 +13,7 @@ Index: b/package.json
"yaserver": "^0.4.0"
},
"overrides": {
+ "shell-quote": "^1.8.4",
+ "shell-quote": "^1.9.0",
"postcss": "^8.4.31",
"node-gyp-build": "4.8.1",
"serialize-javascript": "^7.0.3",
Expand All @@ -26,7 +25,7 @@ Index: b/remote/package.json
"yazl": "^2.4.3"
},
"overrides": {
+ "shell-quote": "^1.8.4",
+ "shell-quote": "^1.9.0",
"node-gyp-build": "4.8.1",
"ssh2": {
"cpu-features": "0.0.0"
12 changes: 6 additions & 6 deletions patches/common/finding-override-tar.diff
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
Override tar to ^7.5.16 to fix CVE-2026-53655.
Override tar to ^7.5.19.

@generated
@generator: scripts/patches/apply-override.sh --patch common/finding-override-tar.diff --override 'direct:tar=^7.5.16' --override 'direct-dev:tar=^7.5.16' --override 'remote/package.json@global:tar=^7.5.16'
@override-package: tar@^7.5.16
@generator: scripts/patches/apply-override.sh --patch common/finding-override-tar.diff --override 'direct:tar=^7.5.19' --override 'direct-dev:tar=^7.5.19' --override 'remote/package.json@global:tar=^7.5.19'
@override-package: tar@^7.5.19

Index: b/package.json
===================================================================
Expand All @@ -14,7 +14,7 @@ Index: b/package.json
"yauzl": "^3.0.0",
- "yazl": "^2.4.3"
+ "yazl": "^2.4.3",
+ "tar": "^7.5.16"
+ "tar": "^7.5.19"
},
"devDependencies": {
"@playwright/cli": "^0.1.9",
Expand All @@ -23,7 +23,7 @@ Index: b/package.json
"source-map": "0.6.1",
"source-map-support": "^0.5.21",
- "tar": "^7.5.9",
+ "tar": "^7.5.16",
+ "tar": "^7.5.19",
"tsec": "0.2.7",
"tslib": "^2.6.3",
"typescript": "^6.0.0-dev.20260416",
Expand All @@ -37,6 +37,6 @@ Index: b/remote/package.json
"@github/copilot": "^1.0.43",
- "undici": "^7.28.0"
+ "undici": "^7.28.0",
+ "tar": "^7.5.16"
+ "tar": "^7.5.19"
}
}
7 changes: 4 additions & 3 deletions patches/common/finding-override-ws.diff
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
Override ws to ^8.21.0 and nested chrome-remote-interface ws to ^7.5.11 to fix CVE-2026-48779.
Override ws to ^8.21.0 and nested chrome-remote-interface ws to ^7.5.11.
Remove when upstream Code-OSS updates ws to >= 8.21.0.

@generated
@generator: scripts/patches/apply-override.sh --patch common/finding-override-ws.diff --override 'direct:ws=^8.21.0' --override 'remote/package.json@direct:ws=^8.21.0' --override 'nested:chrome-remote-interface:ws=^7.5.11'
Expand All @@ -22,8 +23,8 @@ Index: b/package.json
"follow-redirects": "^1.16.0",
"uuid": "^14.0.0",
"ip-address": "^10.1.1",
- "axios": "^1.15.2"
+ "axios": "^1.15.2",
- "axios": "^1.18.0"
+ "axios": "^1.18.0",
+ "chrome-remote-interface": {
+ "ws": "^7.5.11"
+ }
Expand Down