From f52d8d198a6f276ad6b592bd7ba96a5c307994e6 Mon Sep 17 00:00:00 2001 From: Anastasiia Derendeeva Date: Tue, 6 Oct 2026 12:16:47 +0000 Subject: [PATCH] chore: override undici to ^7.29.1 for CVE fixes --- LICENSE-THIRD-PARTY | 2 +- overrides/LICENSE-THIRD-PARTY | 2 +- .../sagemaker.series/package-lock.json | 8 ++++---- .../sagemaker.series/remote/package-lock.json | 8 ++++---- .../package-lock.json | 8 ++++---- .../remote/package-lock.json | 8 ++++---- .../web-embedded.series/package-lock.json | 8 ++++---- .../remote/package-lock.json | 8 ++++---- .../web-server.series/package-lock.json | 8 ++++---- .../web-server.series/remote/package-lock.json | 8 ++++---- patches/common/finding-override-tar.diff | 2 +- patches/common/finding-override-undici.diff | 18 +++++++++--------- patches/common/finding-override-ws.diff | 4 ++-- 13 files changed, 46 insertions(+), 46 deletions(-) diff --git a/LICENSE-THIRD-PARTY b/LICENSE-THIRD-PARTY index 7c08350..063a107 100644 --- a/LICENSE-THIRD-PARTY +++ b/LICENSE-THIRD-PARTY @@ -6706,7 +6706,7 @@ PERFORMANCE OF THIS SOFTWARE. ****************************** undici -7.29.0 +7.29.1 MIT License Copyright (c) Matteo Collina and Undici contributors diff --git a/overrides/LICENSE-THIRD-PARTY b/overrides/LICENSE-THIRD-PARTY index 7c08350..063a107 100644 --- a/overrides/LICENSE-THIRD-PARTY +++ b/overrides/LICENSE-THIRD-PARTY @@ -6706,7 +6706,7 @@ PERFORMANCE OF THIS SOFTWARE. ****************************** undici -7.29.0 +7.29.1 MIT License Copyright (c) Matteo Collina and Undici contributors diff --git a/package-lock-overrides/sagemaker.series/package-lock.json b/package-lock-overrides/sagemaker.series/package-lock.json index abe251e..95b4e44 100644 --- a/package-lock-overrides/sagemaker.series/package-lock.json +++ b/package-lock-overrides/sagemaker.series/package-lock.json @@ -48,7 +48,7 @@ "node-pty": "^1.1.0-beta33", "open": "^8.4.2", "tas-client-umd": "0.2.0", - "undici": "^7.29.0", + "undici": "^7.29.1", "v8-inspect-profiler": "^0.1.1", "vscode-oniguruma": "1.7.0", "vscode-regexpp": "^3.1.0", @@ -16190,9 +16190,9 @@ "dev": true }, "node_modules/undici": { - "version": "7.29.0", - "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.0.tgz", - "integrity": "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==", + "version": "7.29.1", + "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.1.tgz", + "integrity": "sha512-RYONW2MeafgYlkVOKYKkA/Ag7BmXqgIWCa8t1m0JcxrQg9pI9lEqRhAOruOBCbAohOa/gkCF+iPi9hrgvTzu6Q==", "license": "MIT", "engines": { "node": ">=20.18.1" diff --git a/package-lock-overrides/sagemaker.series/remote/package-lock.json b/package-lock-overrides/sagemaker.series/remote/package-lock.json index 7aa1272..1210984 100644 --- a/package-lock-overrides/sagemaker.series/remote/package-lock.json +++ b/package-lock-overrides/sagemaker.series/remote/package-lock.json @@ -39,7 +39,7 @@ "native-watchdog": "^1.4.1", "node-pty": "^1.1.0-beta33", "tas-client-umd": "0.2.0", - "undici": "^7.29.0", + "undici": "^7.29.1", "vscode-oniguruma": "1.7.0", "vscode-regexpp": "^3.1.0", "vscode-textmate": "9.2.0", @@ -1062,9 +1062,9 @@ } }, "node_modules/undici": { - "version": "7.29.0", - "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.0.tgz", - "integrity": "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==", + "version": "7.29.1", + "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.1.tgz", + "integrity": "sha512-RYONW2MeafgYlkVOKYKkA/Ag7BmXqgIWCa8t1m0JcxrQg9pI9lEqRhAOruOBCbAohOa/gkCF+iPi9hrgvTzu6Q==", "license": "MIT", "engines": { "node": ">=20.18.1" diff --git a/package-lock-overrides/web-embedded-with-terminal.series/package-lock.json b/package-lock-overrides/web-embedded-with-terminal.series/package-lock.json index d9b94cb..2afd766 100644 --- a/package-lock-overrides/web-embedded-with-terminal.series/package-lock.json +++ b/package-lock-overrides/web-embedded-with-terminal.series/package-lock.json @@ -47,7 +47,7 @@ "node-pty": "^1.1.0-beta33", "open": "^8.4.2", "tas-client-umd": "0.2.0", - "undici": "^7.29.0", + "undici": "^7.29.1", "v8-inspect-profiler": "^0.1.1", "vscode-oniguruma": "1.7.0", "vscode-regexpp": "^3.1.0", @@ -16156,9 +16156,9 @@ "dev": true }, "node_modules/undici": { - "version": "7.29.0", - "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.0.tgz", - "integrity": "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==", + "version": "7.29.1", + "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.1.tgz", + "integrity": "sha512-RYONW2MeafgYlkVOKYKkA/Ag7BmXqgIWCa8t1m0JcxrQg9pI9lEqRhAOruOBCbAohOa/gkCF+iPi9hrgvTzu6Q==", "license": "MIT", "engines": { "node": ">=20.18.1" diff --git a/package-lock-overrides/web-embedded-with-terminal.series/remote/package-lock.json b/package-lock-overrides/web-embedded-with-terminal.series/remote/package-lock.json index 4976788..d60a2e5 100644 --- a/package-lock-overrides/web-embedded-with-terminal.series/remote/package-lock.json +++ b/package-lock-overrides/web-embedded-with-terminal.series/remote/package-lock.json @@ -38,7 +38,7 @@ "native-watchdog": "^1.4.1", "node-pty": "^1.1.0-beta33", "tas-client-umd": "0.2.0", - "undici": "^7.29.0", + "undici": "^7.29.1", "vscode-oniguruma": "1.7.0", "vscode-regexpp": "^3.1.0", "vscode-textmate": "9.2.0", @@ -1015,9 +1015,9 @@ } }, "node_modules/undici": { - "version": "7.29.0", - "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.0.tgz", - "integrity": "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==", + "version": "7.29.1", + "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.1.tgz", + "integrity": "sha512-RYONW2MeafgYlkVOKYKkA/Ag7BmXqgIWCa8t1m0JcxrQg9pI9lEqRhAOruOBCbAohOa/gkCF+iPi9hrgvTzu6Q==", "license": "MIT", "engines": { "node": ">=20.18.1" diff --git a/package-lock-overrides/web-embedded.series/package-lock.json b/package-lock-overrides/web-embedded.series/package-lock.json index d9b94cb..2afd766 100644 --- a/package-lock-overrides/web-embedded.series/package-lock.json +++ b/package-lock-overrides/web-embedded.series/package-lock.json @@ -47,7 +47,7 @@ "node-pty": "^1.1.0-beta33", "open": "^8.4.2", "tas-client-umd": "0.2.0", - "undici": "^7.29.0", + "undici": "^7.29.1", "v8-inspect-profiler": "^0.1.1", "vscode-oniguruma": "1.7.0", "vscode-regexpp": "^3.1.0", @@ -16156,9 +16156,9 @@ "dev": true }, "node_modules/undici": { - "version": "7.29.0", - "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.0.tgz", - "integrity": "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==", + "version": "7.29.1", + "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.1.tgz", + "integrity": "sha512-RYONW2MeafgYlkVOKYKkA/Ag7BmXqgIWCa8t1m0JcxrQg9pI9lEqRhAOruOBCbAohOa/gkCF+iPi9hrgvTzu6Q==", "license": "MIT", "engines": { "node": ">=20.18.1" diff --git a/package-lock-overrides/web-embedded.series/remote/package-lock.json b/package-lock-overrides/web-embedded.series/remote/package-lock.json index 4976788..d60a2e5 100644 --- a/package-lock-overrides/web-embedded.series/remote/package-lock.json +++ b/package-lock-overrides/web-embedded.series/remote/package-lock.json @@ -38,7 +38,7 @@ "native-watchdog": "^1.4.1", "node-pty": "^1.1.0-beta33", "tas-client-umd": "0.2.0", - "undici": "^7.29.0", + "undici": "^7.29.1", "vscode-oniguruma": "1.7.0", "vscode-regexpp": "^3.1.0", "vscode-textmate": "9.2.0", @@ -1015,9 +1015,9 @@ } }, "node_modules/undici": { - "version": "7.29.0", - "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.0.tgz", - "integrity": "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==", + "version": "7.29.1", + "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.1.tgz", + "integrity": "sha512-RYONW2MeafgYlkVOKYKkA/Ag7BmXqgIWCa8t1m0JcxrQg9pI9lEqRhAOruOBCbAohOa/gkCF+iPi9hrgvTzu6Q==", "license": "MIT", "engines": { "node": ">=20.18.1" diff --git a/package-lock-overrides/web-server.series/package-lock.json b/package-lock-overrides/web-server.series/package-lock.json index 6a8693f..90f27b0 100644 --- a/package-lock-overrides/web-server.series/package-lock.json +++ b/package-lock-overrides/web-server.series/package-lock.json @@ -48,7 +48,7 @@ "node-pty": "^1.1.0-beta33", "open": "^8.4.2", "tas-client-umd": "0.2.0", - "undici": "^7.29.0", + "undici": "^7.29.1", "v8-inspect-profiler": "^0.1.1", "vscode-oniguruma": "1.7.0", "vscode-regexpp": "^3.1.0", @@ -16207,9 +16207,9 @@ "dev": true }, "node_modules/undici": { - "version": "7.29.0", - "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.0.tgz", - "integrity": "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==", + "version": "7.29.1", + "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.1.tgz", + "integrity": "sha512-RYONW2MeafgYlkVOKYKkA/Ag7BmXqgIWCa8t1m0JcxrQg9pI9lEqRhAOruOBCbAohOa/gkCF+iPi9hrgvTzu6Q==", "license": "MIT", "engines": { "node": ">=20.18.1" diff --git a/package-lock-overrides/web-server.series/remote/package-lock.json b/package-lock-overrides/web-server.series/remote/package-lock.json index 7aa1272..1210984 100644 --- a/package-lock-overrides/web-server.series/remote/package-lock.json +++ b/package-lock-overrides/web-server.series/remote/package-lock.json @@ -39,7 +39,7 @@ "native-watchdog": "^1.4.1", "node-pty": "^1.1.0-beta33", "tas-client-umd": "0.2.0", - "undici": "^7.29.0", + "undici": "^7.29.1", "vscode-oniguruma": "1.7.0", "vscode-regexpp": "^3.1.0", "vscode-textmate": "9.2.0", @@ -1062,9 +1062,9 @@ } }, "node_modules/undici": { - "version": "7.29.0", - "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.0.tgz", - "integrity": "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==", + "version": "7.29.1", + "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.1.tgz", + "integrity": "sha512-RYONW2MeafgYlkVOKYKkA/Ag7BmXqgIWCa8t1m0JcxrQg9pI9lEqRhAOruOBCbAohOa/gkCF+iPi9hrgvTzu6Q==", "license": "MIT", "engines": { "node": ">=20.18.1" diff --git a/patches/common/finding-override-tar.diff b/patches/common/finding-override-tar.diff index 8b84213..98fe180 100644 --- a/patches/common/finding-override-tar.diff +++ b/patches/common/finding-override-tar.diff @@ -20,7 +20,7 @@ Index: b/package.json @@ -243,7 +243,8 @@ "ip-address": "^10.3.1", "shell-quote": "^1.8.4", - "undici": "^7.29.0", + "undici": "^7.29.1", - "ws": "^7.5.11" + "ws": "^7.5.11", + "tar": "^7.5.19" diff --git a/patches/common/finding-override-undici.diff b/patches/common/finding-override-undici.diff index 3784a20..7229545 100644 --- a/patches/common/finding-override-undici.diff +++ b/patches/common/finding-override-undici.diff @@ -1,10 +1,10 @@ -Override undici to ^7.29.0. -Regenerate: scripts/patches/apply-override.sh --patch common/finding-override-undici.diff --override direct:undici=^7.29.0 --override global:undici=^7.29.0 --override remote/package.json@direct:undici=^7.29.0 --override remote/package.json@global:undici=^7.29.0 -Remove when upstream Code-OSS updates undici to >= 7.29.0. +Override undici to ^7.29.1. +Regenerate: scripts/patches/apply-override.sh --patch common/finding-override-undici.diff --override direct:undici=^7.29.1 --override global:undici=^7.29.1 --override remote/package.json@direct:undici=^7.29.1 --override remote/package.json@global:undici=^7.29.1 +Remove when upstream Code-OSS updates undici to >= 7.29.1. @generated -@generator: scripts/patches/apply-override.sh --patch common/finding-override-undici.diff --override 'direct:undici=^7.29.0' --override 'global:undici=^7.29.0' --override 'remote/package.json@direct:undici=^7.29.0' --override 'remote/package.json@global:undici=^7.29.0' -@override-package: undici@^7.29.0 +@generator: scripts/patches/apply-override.sh --patch common/finding-override-undici.diff --override 'direct:undici=^7.29.1' --override 'global:undici=^7.29.1' --override 'remote/package.json@direct:undici=^7.29.1' --override 'remote/package.json@global:undici=^7.29.1' +@override-package: undici@^7.29.1 Index: b/package.json =================================================================== @@ -15,7 +15,7 @@ Index: b/package.json "open": "^8.4.2", "tas-client-umd": "0.2.0", - "undici": "^7.24.0", -+ "undici": "^7.29.0", ++ "undici": "^7.29.1", "v8-inspect-profiler": "^0.1.1", "vscode-oniguruma": "1.7.0", "vscode-regexpp": "^3.1.0", @@ -25,7 +25,7 @@ Index: b/package.json "ip-address": "^10.3.1", - "shell-quote": "^1.8.4" + "shell-quote": "^1.8.4", -+ "undici": "^7.29.0" ++ "undici": "^7.29.1" }, "repository": { "type": "git", @@ -38,7 +38,7 @@ Index: b/remote/package.json "node-pty": "^1.1.0-beta33", "tas-client-umd": "0.2.0", - "undici": "^7.24.0", -+ "undici": "^7.29.0", ++ "undici": "^7.29.1", "vscode-oniguruma": "1.7.0", "vscode-regexpp": "^3.1.0", "vscode-textmate": "9.2.0", @@ -48,6 +48,6 @@ Index: b/remote/package.json "uuid": "14.0.0", - "ip-address": "^10.3.1" + "ip-address": "^10.3.1", -+ "undici": "^7.29.0" ++ "undici": "^7.29.1" } } diff --git a/patches/common/finding-override-ws.diff b/patches/common/finding-override-ws.diff index 4c6ecd9..8274023 100644 --- a/patches/common/finding-override-ws.diff +++ b/patches/common/finding-override-ws.diff @@ -12,8 +12,8 @@ Index: b/package.json "uuid": "14.0.0", "ip-address": "^10.3.1", "shell-quote": "^1.8.4", -- "undici": "^7.29.0" -+ "undici": "^7.29.0", +- "undici": "^7.29.1" ++ "undici": "^7.29.1", + "ws": "^7.5.11" }, "repository": {