OCPBUGS-99418: Bump protobufjs to 7.6.5 to fix CVE-2026-59877, CVE-2026-48712, CVE-2026-41242 by shahsahil264 · Pull Request #16813 · openshift/console

shahsahil264 · 2026-07-23T17:31:39Z

Analysis / Root cause:
The protobufjs package pinned in yarn resolutions at version 7.5.8 is affected by three CVEs:

CVE-2026-59877 (OCPBUGS-99418): DoS via crafted .proto schema (fixed in 7.6.5)
CVE-2026-48712 (OCPBUGS-99529): DoS via uncontrolled recursion (fixed in 7.6.1)
CVE-2026-41242 (OCPBUGS-96734): Arbitrary code execution via injected type fields (fixed in 7.5.5)

Solution description:
Bumps the protobufjs yarn resolution from 7.5.8 to 7.6.5, which includes fixes for all three CVEs. No API changes are expected as this is a patch-level update within the 7.x line.

Screenshots / screen recording:
N/A - dependency version bump only, no visual changes.

Test setup:
No special setup required.

Test cases:

yarn install succeeds
lint-staged pre-commit hook passes
yarn build succeeds (CI)
CI passes

Browser conformance:

Chrome
Firefox
Safari (or Epiphany on Linux)

N/A - no runtime behavior change expected.

Additional info:
This PR fixes three Jira bugs:

Summary by CodeRabbit

Chores
- Updated the bundled Protocol Buffers library to version 7.6.5 to align with the latest available release.
- Maintenance update only; existing end-user workflows should remain unchanged.

openshift-merge-bot · 2026-07-23T17:31:41Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

openshift-ci-robot · 2026-07-23T17:31:46Z

@shahsahil264: This pull request references Jira Issue OCPBUGS-99418, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (5.0.0) matches configured target version for branch (5.0.0)
bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Analysis / Root cause:
The protobufjs package pinned in yarn resolutions at version 7.5.8 is affected by three CVEs:

CVE-2026-59877 (OCPBUGS-99418): DoS via crafted .proto schema (fixed in 7.6.5)

CVE-2026-48712 (OCPBUGS-99529): DoS via uncontrolled recursion (fixed in 7.6.1)

CVE-2026-41242 (OCPBUGS-96734): Arbitrary code execution via injected type fields (fixed in 7.5.5)

Solution description:
Bumps the protobufjs yarn resolution from 7.5.8 to 7.6.5, which includes fixes for all three CVEs. No API changes are expected as this is a patch-level update within the 7.x line.

Screenshots / screen recording:
N/A - dependency version bump only, no visual changes.

Test setup:
No special setup required.

Test cases:

yarn install succeeds

lint-staged pre-commit hook passes

yarn build succeeds (CI)

CI passes

Browser conformance:

Chrome

Firefox

Safari (or Epiphany on Linux)

N/A - no runtime behavior change expected.

Additional info:
This PR fixes three Jira bugs:

https://issues.redhat.com/browse/OCPBUGS-99418

https://issues.redhat.com/browse/OCPBUGS-99529

https://issues.redhat.com/browse/OCPBUGS-96734

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-07-23T17:32:23Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 57075599-4488-4a1c-ada5-6e3cadb0e58b

📥 Commits

Reviewing files that changed from the base of the PR and between 1be40f5 and 753be8d.

⛔ Files ignored due to path filters (1)

frontend/yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (1)

frontend/package.json

🚧 Files skipped from review as they are similar to previous changes (1)

frontend/package.json

Walkthrough

The frontend package resolution for protobufjs changes from version 7.5.8 to 7.6.5.

Changes

Dependency resolution

Layer / File(s)	Summary
Update protobufjs resolution `frontend/package.json`	Updates the `protobufjs` resolution from `7.5.8` to `7.6.5`.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

openshift/console#16812: Also modifies the protobufjs Yarn resolution in frontend/package.json.

Suggested labels: lgtm, verified

Suggested reviewers: fsgreco, leo6leo

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the protobufjs version bump and its CVE-fix purpose.
Description check	✅ Passed	The description includes the required sections and is mostly complete, with only reviewers/assignees missing.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR changes only frontend/package.json and frontend/yarn.lock; no Ginkgo tests or titles were added or edited.
Test Structure And Quality	✅ Passed	No Ginkgo test code changed; PR only updates protobufjs resolution and yarn.lock, so the test-structure criteria are not applicable.
Microshift Test Compatibility	✅ Passed	Only frontend/package.json and yarn.lock changed; no Ginkgo tests were added or modified, so MicroShift compatibility is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PR only updates frontend/package.json and yarn.lock; no new/changed Ginkgo e2e tests or SNO assumptions were added.
Topology-Aware Scheduling Compatibility	✅ Passed	Only frontend/package.json and frontend/yarn.lock changed; no deployment manifests, operator code, or controllers were modified.
Ote Binary Stdout Contract	✅ Passed	PR only bumps protobufjs in package.json/yarn.lock; no process-level stdout code or suite setup changed.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR only bumps protobufjs in frontend/package.json and yarn.lock; no new Ginkgo/e2e tests or networking code were added.
No-Weak-Crypto	✅ Passed	PR only bumps protobufjs resolution and lockfile entries; no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB or custom crypto code added.
Container-Privileges	✅ Passed	The PR only updates frontend/package.json and frontend/yarn.lock; no K8s/container manifest files or privilege settings were changed.
No-Sensitive-Data-In-Logs	✅ Passed	Diff only updates protobufjs in package.json and yarn.lock; no logging or sensitive-data patterns appear.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

openshift-ci-robot · 2026-07-23T17:32:44Z

@shahsahil264: This pull request references Jira Issue OCPBUGS-99418, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (5.0.0) matches configured target version for branch (5.0.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

Analysis / Root cause:
The protobufjs package pinned in yarn resolutions at version 7.5.8 is affected by three CVEs:

CVE-2026-59877 (OCPBUGS-99418): DoS via crafted .proto schema (fixed in 7.6.5)

CVE-2026-48712 (OCPBUGS-99529): DoS via uncontrolled recursion (fixed in 7.6.1)

CVE-2026-41242 (OCPBUGS-96734): Arbitrary code execution via injected type fields (fixed in 7.5.5)

Solution description:
Bumps the protobufjs yarn resolution from 7.5.8 to 7.6.5, which includes fixes for all three CVEs. No API changes are expected as this is a patch-level update within the 7.x line.

Screenshots / screen recording:
N/A - dependency version bump only, no visual changes.

Test setup:
No special setup required.

Test cases:

yarn install succeeds

lint-staged pre-commit hook passes

yarn build succeeds (CI)

CI passes

Browser conformance:

Chrome

Firefox

Safari (or Epiphany on Linux)

N/A - no runtime behavior change expected.

Additional info:
This PR fixes three Jira bugs:

https://issues.redhat.com/browse/OCPBUGS-99418

https://issues.redhat.com/browse/OCPBUGS-99529

https://issues.redhat.com/browse/OCPBUGS-96734

Summary by CodeRabbit

Chores

Updated the bundled Protocol Buffers library to version 7.6.5.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

rhamilto · 2026-07-23T17:44:53Z

/approve
/lgtm
/verified by CI

openshift-ci-robot · 2026-07-23T17:45:06Z

@rhamilto: This PR has been marked as verified by CI.

Details

In response to this:

/approve
/lgtm
/verified by CI

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-merge-bot · 2026-07-23T17:47:11Z

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-gcp-console
/test e2e-playwright

openshift-ci-robot · 2026-07-24T17:10:05Z

@shahsahil264: This pull request references Jira Issue OCPBUGS-99418, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (5.0.0) matches configured target version for branch (5.0.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

Analysis / Root cause:
The protobufjs package pinned in yarn resolutions at version 7.5.8 is affected by three CVEs:

CVE-2026-59877 (OCPBUGS-99418): DoS via crafted .proto schema (fixed in 7.6.5)

CVE-2026-48712 (OCPBUGS-99529): DoS via uncontrolled recursion (fixed in 7.6.1)

CVE-2026-41242 (OCPBUGS-96734): Arbitrary code execution via injected type fields (fixed in 7.5.5)

Solution description:
Bumps the protobufjs yarn resolution from 7.5.8 to 7.6.5, which includes fixes for all three CVEs. No API changes are expected as this is a patch-level update within the 7.x line.

Screenshots / screen recording:
N/A - dependency version bump only, no visual changes.

Test setup:
No special setup required.

Test cases:

yarn install succeeds

lint-staged pre-commit hook passes

yarn build succeeds (CI)

CI passes

Browser conformance:

Chrome

Firefox

Safari (or Epiphany on Linux)

N/A - no runtime behavior change expected.

Additional info:
This PR fixes three Jira bugs:

https://issues.redhat.com/browse/OCPBUGS-99418

https://issues.redhat.com/browse/OCPBUGS-99529

https://issues.redhat.com/browse/OCPBUGS-96734

Summary by CodeRabbit

Chores

Updated the bundled Protocol Buffers library to version 7.6.5 to align with the latest available release.

This maintenance update is not expected to change existing end-user workflows.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

shahsahil264 · 2026-07-24T17:15:24Z

/retest

rhamilto · 2026-07-24T17:17:17Z

/lgtm

openshift-merge-bot · 2026-07-24T17:17:31Z

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-gcp-console
/test e2e-playwright

…26-48712, CVE-2026-41242 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

rhamilto · 2026-07-24T20:24:36Z

/lgtm

openshift-merge-bot · 2026-07-24T20:24:53Z

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-gcp-console
/test e2e-playwright

openshift-ci · 2026-07-24T20:24:55Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rhamilto, shahsahil264

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~frontend/OWNERS~~ [rhamilto]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci Bot requested review from Leo6Leo and fsgreco July 23, 2026 17:32

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Jul 23, 2026

openshift-ci Bot assigned rhamilto Jul 23, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jul 23, 2026

openshift-ci Bot added approved Indicates a PR has been approved by an approver from all required OWNERS files. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Jul 23, 2026

coderabbitai Bot mentioned this pull request Jul 24, 2026

CONSOLE-5434: Replace Popper with PF components #16831

Merged

3 tasks

shahsahil264 force-pushed the OCPBUGS-99418-bump-protobufjs branch from da857ea to 1be40f5 Compare July 24, 2026 17:08

openshift-ci Bot removed the lgtm Indicates that a PR is ready to be merged. label Jul 24, 2026

openshift-ci-robot removed the verified Signifies that the PR passed pre-merge verification criteria label Jul 24, 2026

openshift-ci Bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jul 24, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jul 24, 2026

OCPBUGS-99418: Bump protobufjs to 7.6.5 to fix CVE-2026-59877, CVE-20…

753be8d

…26-48712, CVE-2026-41242 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

shahsahil264 force-pushed the OCPBUGS-99418-bump-protobufjs branch from 1be40f5 to 753be8d Compare July 24, 2026 20:19

openshift-ci Bot removed the lgtm Indicates that a PR is ready to be merged. label Jul 24, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jul 24, 2026

Uh oh!

Conversation

shahsahil264 commented Jul 23, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

openshift-merge-bot Bot commented Jul 23, 2026

Uh oh!

openshift-ci-robot commented Jul 23, 2026

Uh oh!

coderabbitai Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

openshift-ci-robot commented Jul 23, 2026

Summary by CodeRabbit

Uh oh!

rhamilto commented Jul 23, 2026

Uh oh!

openshift-ci-robot commented Jul 23, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 23, 2026

Uh oh!

openshift-ci-robot commented Jul 24, 2026

Summary by CodeRabbit

Uh oh!

shahsahil264 commented Jul 24, 2026

Uh oh!

rhamilto commented Jul 24, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 24, 2026

Uh oh!

rhamilto commented Jul 24, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 24, 2026

Uh oh!

openshift-ci Bot commented Jul 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

shahsahil264 commented Jul 23, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 23, 2026 •

edited

Loading