[release-4.13] OCPBUGS-88410 OCPBUGS-88442: CVE-2026-44486 openshift4/ose-console: Axios: Information disclosure of proxy credentials via HTTP redirects

[rhdmalone]

OCPBUGS-88410 requires an Axios bump to >= 0.32.0
Previously, a bump of Axios to 0.31.1 had been done using that patch is not sufficient

Therefore, the patch has been updated as below using information from Claude.

NB: Note that the best way to view the new patch is to view the file in its entirety:
https://github.com/rhdmalone/console/blob/831fbc5425326b2dfa7e8c37ee30701744bc6279/frontend/.yarn/patches/axios-npm-0.33.0-023deda7e4.patch

On release-4.13 you still need the TypeScript patch: the branch uses TypeScript 3.8.3, and axios 0.33.0 still uses Lowercase<> / key remapping (as) in MethodsHeaders, which need TS 4.1+. So bump the package and re-create the Yarn patch against 0.33.0.

Recommended (Yarn 4) flow
From frontend/:

1. Point deps at unpatched 0.33.0 temporarily

In frontend/package.json:

Dependency:
"axios": "0.33.0"
Resolution (replace the patched 0.31.1 line):
"axios@npm:^0.21.1": "0.33.0"

2. Install and create a patch workspace:
   cd frontend
   yarn install
   yarn patch axios@npm:0.33.0
   Yarn prints a temp folder path.

3. Apply the same TypeScript fix in that folder’s index.d.ts

Replace:

type MethodsHeaders = {
[Key in Method as Lowercase]: AxiosHeaders;
};
with (same as your current patch):

type LowercaseMethod =
| 'get' | 'delete' | 'head' | 'options' | 'post'
| 'put' | 'patch' | 'purge' | 'link' | 'unlink';
type MethodsHeaders = {
[Key in LowercaseMethod]?: AxiosHeaders;
};
4. Commit the patch

yarn patch-commit -s
That writes a new file under frontend/.yarn/patches/ (e.g. axios-npm-0.33.0-….patch) and updates package.json to use patch:axios@npm%3A0.33.0#~/.yarn/patches/....

5. Align the resolution with the new patch

Set:

"axios@npm:^0.21.1": "patch:axios@npm%3A0.33.0#~/.yarn/patches/"
(use the exact string Yarn put on the "axios" dependency)

Then:

yarn install
6. Cleanup

Remove the old patch:
frontend/.yarn/patches/axios-npm-0.31.1-0574a0de7d.patch
Confirm yarn.lock shows axios@patch:…0.33.0… and version 0.33.0
Spot-check TypeScript/build (yarn lint/tsc or your usual console build)
What not to do
Don’t only edit package.json to 0.33.0 without regenerating the patch: the old 0.31.1 patch path won’t apply cleanly, and unpatched 0.33.0 will break under TS 3.8.3.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@rhdmalone: This pull request references Jira Issue OCPBUGS-88410, which is invalid:

• expected dependent Jira Issue OCPBUGS-88422 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is ASSIGNED instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

OCPBUGS-88410 requires an Axios bump to >= 0.32.0
Previously, a bump of Axios to 0.31.1 had been done using a patch but this is not sufficient
Therefore, the patch has been updated as follows using information from Claude:

On release-4.13 you still need the TypeScript patch: the branch uses TypeScript 3.8.3, and axios 0.33.0 still uses Lowercase<> / key remapping (as) in MethodsHeaders, which need TS 4.1+. So bump the package and re-create the Yarn patch against 0.33.0.

Recommended (Yarn 4) flow
From frontend/:

1. Point deps at unpatched 0.33.0 temporarily

In frontend/package.json:

Dependency:
"axios": "0.33.0"
Resolution (replace the patched 0.31.1 line):
"axios@npm:^0.21.1": "0.33.0"

2. Install and create a patch workspace:
   cd frontend
   yarn install
   yarn patch axios@npm:0.33.0
   Yarn prints a temp folder path.

3. Apply the same TypeScript fix in that folder’s index.d.ts

Replace:

type MethodsHeaders = {
[Key in Method as Lowercase]: AxiosHeaders;
};
with (same as your current patch):

type LowercaseMethod =
| 'get' | 'delete' | 'head' | 'options' | 'post'
| 'put' | 'patch' | 'purge' | 'link' | 'unlink';
type MethodsHeaders = {
[Key in LowercaseMethod]?: AxiosHeaders;
};
4. Commit the patch

yarn patch-commit -s
That writes a new file under frontend/.yarn/patches/ (e.g. axios-npm-0.33.0-….patch) and updates package.json to use patch:axios@npm%3A0.33.0#~/.yarn/patches/....

5. Align the resolution with the new patch

Set:

"axios@npm:^0.21.1": "patch:axios@npm%3A0.33.0#~/.yarn/patches/"
(use the exact string Yarn put on the "axios" dependency)

Then:

yarn install
6. Cleanup

Remove the old patch:
frontend/.yarn/patches/axios-npm-0.31.1-0574a0de7d.patch
Confirm yarn.lock shows axios@patch:…0.33.0… and version 0.33.0
Spot-check TypeScript/build (yarn lint/tsc or your usual console build)
What not to do
Don’t only edit package.json to 0.33.0 without regenerating the patch: the old 0.31.1 patch path won’t apply cleanly, and unpatched 0.33.0 will break under TS 3.8.3.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 4e3fa481-1018-4789-a775-a46456a3b7fb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: rhdmalone
Once this PR has been reviewed and has the lgtm label, please assign logonoff for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• frontend/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[rhdmalone]

Comment on failing backend test from Claude:
`Backend failure is a flake — unrelated to the axios bump. No code change needed; retest.

Root cause
pkg/helm/actions TestMain failed because ChartMuseum was not ready when uploadChartsWithoutTls.sh tried to upload charts:

Starting ChartMuseum {"host": "0.0.0.0", "port": 9181}
curl: (7) Failed to connect to localhost port 9181: Connection refused
panic: Error waiting program :./testdata/uploadChartsWithoutTls.sh::exit status 7
FAIL github.com/openshift/console/pkg/helm/actions 21.224s
Classic readiness race: curl hit :9181 immediately after ChartMuseum logged “Starting”, before the listener was accepting connections.

Relation to PR #16779
None. The PR only changes frontend axios (0.33.0 + TS patch, package.json, yarn.lock). Backend Go tests do not use axios.

Next step
On the PR, comment:

/test backend`

[rhdmalone]

/test backend

[rhdmalone]

/test backend

[rhdmalone]

backend test has failed again
Comment from Claude:
Starting ChartMuseum {"host": "0.0.0.0", "port": 9181}
curl: (7) Failed to connect to localhost port 9181: Connection refused
panic: Error waiting program :./testdata/uploadChartsWithoutTls.sh::exit status 7
FAIL github.com/openshift/console/pkg/helm/actions 21.861s
...
This is a known intermittent helm test setup issue on 4.13, not a regression from your CVE bump.

[rhdmalone]

/test backend

[rhdmalone]

/test backend

[rhdmalone]

/test backend

[rhdmalone]

/test backend

[rhdmalone]

/test backend

[openshift-ci]

@rhdmalone: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[rhdmalone]

/verified by CI

[openshift-ci-robot]

@rhdmalone: This PR has been marked as verified by CI.

Details

In response to this:

/verified by CI

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@rhdmalone: This pull request references Jira Issue OCPBUGS-88410, which is invalid:

• expected dependent Jira Issue OCPBUGS-88422 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is POST instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

This pull request references Jira Issue OCPBUGS-88442, which is invalid:

• expected dependent Jira Issue OCPBUGS-88440 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is ASSIGNED instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

OCPBUGS-88410 requires an Axios bump to >= 0.32.0
Previously, a bump of Axios to 0.31.1 had been done using that patch is not sufficient

Therefore, the patch has been updated as below using information from Claude.

NB: Note that the best way to view the new patch is to view the file in its entirety:
https://github.com/rhdmalone/console/blob/831fbc5425326b2dfa7e8c37ee30701744bc6279/frontend/.yarn/patches/axios-npm-0.33.0-023deda7e4.patch

On release-4.13 you still need the TypeScript patch: the branch uses TypeScript 3.8.3, and axios 0.33.0 still uses Lowercase<> / key remapping (as) in MethodsHeaders, which need TS 4.1+. So bump the package and re-create the Yarn patch against 0.33.0.

Recommended (Yarn 4) flow
From frontend/:

1. Point deps at unpatched 0.33.0 temporarily

In frontend/package.json:

Dependency:
"axios": "0.33.0"
Resolution (replace the patched 0.31.1 line):
"axios@npm:^0.21.1": "0.33.0"

2. Install and create a patch workspace:
   cd frontend
   yarn install
   yarn patch axios@npm:0.33.0
   Yarn prints a temp folder path.

3. Apply the same TypeScript fix in that folder’s index.d.ts

Replace:

type MethodsHeaders = {
[Key in Method as Lowercase]: AxiosHeaders;
};
with (same as your current patch):

type LowercaseMethod =
| 'get' | 'delete' | 'head' | 'options' | 'post'
| 'put' | 'patch' | 'purge' | 'link' | 'unlink';
type MethodsHeaders = {
[Key in LowercaseMethod]?: AxiosHeaders;
};
4. Commit the patch

yarn patch-commit -s
That writes a new file under frontend/.yarn/patches/ (e.g. axios-npm-0.33.0-….patch) and updates package.json to use patch:axios@npm%3A0.33.0#~/.yarn/patches/....

5. Align the resolution with the new patch

Set:

"axios@npm:^0.21.1": "patch:axios@npm%3A0.33.0#~/.yarn/patches/"
(use the exact string Yarn put on the "axios" dependency)

Then:

yarn install
6. Cleanup

Remove the old patch:
frontend/.yarn/patches/axios-npm-0.31.1-0574a0de7d.patch
Confirm yarn.lock shows axios@patch:…0.33.0… and version 0.33.0
Spot-check TypeScript/build (yarn lint/tsc or your usual console build)
What not to do
Don’t only edit package.json to 0.33.0 without regenerating the patch: the old 0.31.1 patch path won’t apply cleanly, and unpatched 0.33.0 will break under TS 3.8.3.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.