Fix for OCPBUGS-92073: CVE-2026-44990 by germanparente · Pull Request #16724 · openshift/console

germanparente · 2026-07-07T18:39:44Z

Summary

Bump sanitize-html from ^2.3.2 to ^2.17.4 to fix CVE-2026-44990
CVE-2026-44990 is a stored XSS vulnerability (CVSS 9.3 Critical) in sanitize-html < 2.17.4 where content inside a disallowed <xmp> element can bypass sanitization

References

openshift-merge-bot · 2026-07-07T18:39:47Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

openshift-ci-robot · 2026-07-07T18:39:51Z

@germanparente: This pull request references Jira Issue OCPBUGS-92073, which is invalid:

expected Jira Issue OCPBUGS-92073 to depend on a bug targeting a version in 5.0.0 and in one of the following states: MODIFIED, ON_QA, VERIFIED, but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

Bump sanitize-html from ^2.3.2 to ^2.17.4 to fix CVE-2026-44990

CVE-2026-44990 is a stored XSS vulnerability (CVSS 9.3 Critical) in sanitize-html < 2.17.4 where content inside a disallowed <xmp> element can bypass sanitization

References

NVD - CVE-2026-44990

GHSA-rpr9-rxv7-x643

JIRA: OCPBUGS-92073

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

germanparente · 2026-08-11T10:38:10Z

/jira refresh

openshift-ci-robot · 2026-08-11T10:38:23Z

@germanparente: This pull request references Jira Issue OCPBUGS-92073, which is invalid:

expected dependent Jira Issue OCPBUGS-92088 to be in one of the following states: MODIFIED, ON_QA, VERIFIED, but it is Closed (Obsolete) instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

germanparente · 2026-08-11T10:40:41Z

As this has been fixed in 5.0, check OCPBUGS-92088:

"expected dependent OCPBUGS-92088 to be in one of the following states: MODIFIED, ON_QA, VERIFIED, but it is Closed (Obsolete) instead"

/label jira/skip-dependent-bug-check

openshift-ci-robot · 2026-08-11T10:41:19Z

@germanparente: An error was encountered querying GitHub for users with public email (ocp-sustaining-admins@redhat.com) for bug OCPBUGS-92073 on the Jira server at https://redhat.atlassian.net. No known errors were detected, please see the full error message for details.

Full error message.


Post "http://ghproxy/graphql": dial tcp 172.30.229.2:80: connect: connection refused

Please contact an administrator to resolve this issue, then request a bug refresh with /jira refresh.

Details

In response to this:

Summary

Bump sanitize-html from ^2.3.2 to ^2.17.4 to fix CVE-2026-44990

CVE-2026-44990 is a stored XSS vulnerability (CVSS 9.3 Critical) in sanitize-html < 2.17.4 where content inside a disallowed <xmp> element can bypass sanitization

References

NVD - CVE-2026-44990

GHSA-rpr9-rxv7-x643

JIRA: OCPBUGS-92073

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

germanparente · 2026-08-11T10:41:28Z

/jira refresh

openshift-ci-robot · 2026-08-11T10:41:38Z

@germanparente: An error was encountered querying GitHub for users with public email (ocp-sustaining-admins@redhat.com) for bug OCPBUGS-92073 on the Jira server at https://redhat.atlassian.net. No known errors were detected, please see the full error message for details.

Full error message.


Post "http://ghproxy/graphql": dial tcp 172.30.229.2:80: connect: connection refused

Please contact an administrator to resolve this issue, then request a bug refresh with /jira refresh.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

jhadvig · 2026-08-14T13:59:47Z

/retest

germanparente · 2026-08-18T19:33:24Z

/test frontend

germanparente · 2026-08-18T19:35:23Z

/label backport-risk-assessed

germanparente · 2026-08-19T06:06:28Z

/test frontend

germanparente · 2026-08-19T06:21:29Z

/test frontend

germanparente · 2026-08-19T06:45:45Z

frontend test failure assessment

Not related to this PR.

This PR only modifies frontend/package.json and frontend/yarn.lock to fix CVE-2026-44990. It does not change any application code, test code, or build configuration.

Failure details

The frontend test failed due to a husky permissions error in the CI container environment:

EPERM: operation not permitted, copyfile → .husky/_/husky.sh

This is a CI infrastructure issue — husky's postinstall hook failed to copy files into .husky/_/ due to filesystem permissions in the build container. All PatternFly dependency resolution checks passed with "No issues detected".

/retest should resolve this.

germanparente · 2026-08-19T06:57:55Z

from former assessment,

/override ci/prow/frontend

openshift-ci · 2026-08-19T06:58:02Z

@germanparente: Overrode contexts on behalf of germanparente: ci/prow/frontend

Details

In response to this:

from former assessment,

/override ci/prow/frontend

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

jkaurredhat · 2026-08-19T16:07:30Z

/lgtm

Skip husky installation when OPENSHIFT_CI is set to avoid EPERM errors in the CI container environment during yarn postinstall. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

logonoff · 2026-08-19T17:10:05Z

/lgtm
/verified by CI

openshift-ci-robot · 2026-08-19T17:10:18Z

@logonoff: This PR has been marked as verified by CI.

Details

In response to this:

/lgtm
/verified by CI

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-merge-bot · 2026-08-19T17:10:23Z

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-gcp-console

germanparente · 2026-08-19T18:38:45Z

/test frontend

openshift-merge-bot · 2026-08-19T20:51:08Z

/retest-required

Remaining retests: 0 against base HEAD 784dccd and 2 for PR HEAD 1c4a540 in total

openshift-merge-bot · 2026-08-20T01:43:14Z

/retest-required

Remaining retests: 0 against base HEAD 28141c4 and 1 for PR HEAD 1c4a540 in total

germanparente · 2026-08-20T02:18:24Z

/test frontend

logonoff · 2026-08-20T12:40:02Z

/lgtm cancel
/label tide/merge-method-squash

fix this by running yarn dedupe and committing the changes

Consolidate duplicate dayjs entries (1.10.7 → 1.11.21). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

logonoff · 2026-08-20T13:38:51Z

/lgtm

openshift-merge-bot · 2026-08-20T13:41:03Z

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-gcp-console

openshift-ci · 2026-08-20T13:41:30Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: germanparente, jkaurredhat, logonoff

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~frontend/OWNERS~~ [logonoff]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

germanparente · 2026-08-20T16:58:28Z

/test e2e-gcp-console

germanparente · 2026-08-20T22:16:37Z

/verified by CI

openshift-ci-robot · 2026-08-20T22:16:49Z

@germanparente: This PR has been marked as verified by CI.

Details

In response to this:

/verified by CI

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2026-08-20T22:56:35Z

@germanparente: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci-robot · 2026-08-20T23:01:33Z

@germanparente: Jira Issue Verification Checks: Jira Issue OCPBUGS-92073
✔️ This pull request was pre-merge verified.
✔️ All associated pull requests have merged.
✔️ All associated, merged pull requests were pre-merge verified.

Jira Issue OCPBUGS-92073 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓

Details

In response to this:

Summary

Bump sanitize-html from ^2.3.2 to ^2.17.4 to fix CVE-2026-44990

CVE-2026-44990 is a stored XSS vulnerability (CVSS 9.3 Critical) in sanitize-html < 2.17.4 where content inside a disallowed <xmp> element can bypass sanitization

References

NVD - CVE-2026-44990

GHSA-rpr9-rxv7-x643

JIRA: OCPBUGS-92073

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot added jira/severity-important Referenced Jira bug's severity is important for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. labels Jul 7, 2026

openshift-ci-robot added the jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. label Jul 7, 2026

openshift-ci Bot requested review from jhadvig and rhamilto July 7, 2026 18:40

openshift-ci Bot added the jira/skip-dependent-bug-check Indicates that the referenced Jira bug does not require a dependent bug. label Aug 11, 2026

openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Aug 11, 2026

Fix for OCPBUGS-92073: CVE-2026-44990

c71c75e

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

germanparente force-pushed the fix-CVE-2026-44990-release-4.22 branch from eab6827 to c71c75e Compare August 11, 2026 10:43

openshift-ci Bot added the backport-risk-assessed Indicates a PR to a release branch has been evaluated and considered safe to accept. label Aug 18, 2026

openshift-ci Bot assigned sanketpathak Aug 18, 2026

openshift-ci Bot assigned jkaurredhat Aug 19, 2026

OCPBUGS-92073: Fix prepare-husky script to skip in CI

1c4a540

Skip husky installation when OPENSHIFT_CI is set to avoid EPERM errors in the CI container environment during yarn postinstall. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

openshift-ci Bot removed the lgtm Indicates that a PR is ready to be merged. label Aug 19, 2026

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Aug 19, 2026

openshift-ci Bot assigned logonoff Aug 19, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Aug 19, 2026

openshift-ci Bot added tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges. and removed lgtm Indicates that a PR is ready to be merged. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Aug 20, 2026

OCPBUGS-92073: Deduplicate yarn.lock

8937a5a

Consolidate duplicate dayjs entries (1.10.7 → 1.11.21). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

openshift-ci-robot removed the verified Signifies that the PR passed pre-merge verification criteria label Aug 20, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Aug 20, 2026

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 20, 2026

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Aug 20, 2026

openshift-merge-bot Bot merged commit 537a21f into openshift:release-4.22 Aug 20, 2026
8 checks passed

Uh oh!

Conversation

germanparente commented Jul 7, 2026

Summary

References

Uh oh!

openshift-merge-bot Bot commented Jul 7, 2026

Uh oh!

openshift-ci-robot commented Jul 7, 2026

Summary

References

Uh oh!

germanparente commented Aug 11, 2026

Uh oh!

openshift-ci-robot commented Aug 11, 2026

Uh oh!

germanparente commented Aug 11, 2026

Uh oh!

openshift-ci-robot commented Aug 11, 2026

Summary

References

Uh oh!

germanparente commented Aug 11, 2026

Uh oh!

openshift-ci-robot commented Aug 11, 2026

Uh oh!

jhadvig commented Aug 14, 2026

Uh oh!

germanparente commented Aug 18, 2026

Uh oh!

germanparente commented Aug 18, 2026

Uh oh!

germanparente commented Aug 19, 2026

Uh oh!

germanparente commented Aug 19, 2026

Uh oh!

germanparente commented Aug 19, 2026

frontend test failure assessment

Failure details

Uh oh!

germanparente commented Aug 19, 2026

Uh oh!

openshift-ci Bot commented Aug 19, 2026

Uh oh!

jkaurredhat commented Aug 19, 2026

Uh oh!

logonoff commented Aug 19, 2026

Uh oh!

openshift-ci-robot commented Aug 19, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 19, 2026

Uh oh!

germanparente commented Aug 19, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 19, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 20, 2026

Uh oh!

germanparente commented Aug 20, 2026

Uh oh!

logonoff commented Aug 20, 2026

Uh oh!

logonoff commented Aug 20, 2026

Uh oh!

openshift-merge-bot Bot commented Aug 20, 2026

Uh oh!

openshift-ci Bot commented Aug 20, 2026

Uh oh!

germanparente commented Aug 20, 2026

Uh oh!

germanparente commented Aug 20, 2026

Uh oh!

openshift-ci-robot commented Aug 20, 2026

Uh oh!

openshift-ci Bot commented Aug 20, 2026

Uh oh!

Uh oh!

openshift-ci-robot commented Aug 20, 2026

Summary

References