[Maintainence] CVE fixes for 2.19.4

changelogs/fragments/10822.yml

@@ -0,0 +1,2 @@
+chore:
+- CVE Fixed for 2.19, Update Webpack to support jspdf upgrade ([#10822](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/10822))

package.json

@@ -39,7 +39,7 @@
   "author": "opensearch-project",
   "scripts": {
     "preinstall": "scripts/use_node ./preinstall_check",
-    "postinstall": "scripts/use_node scripts/postinstall",
+    "postinstall": "scripts/use_node scripts/postinstall && patch-package",
     "osd": "scripts/use_node scripts/osd",
     "opensearch": "scripts/use_node scripts/opensearch",
     "test": "grunt test",
@@ -135,7 +135,11 @@
     "**/watchpack-chokidar2/chokidar": "^3.5.3",
     "**/eslint-plugin-mocha-next/mocha": "npm:mocha@^10.1.0",
     "**/xml2js": "^0.5.0",
-    "**/yaml": "^2.2.2"
+    "**/yaml": "^2.2.2",
+    "**/cipher-base": "^1.0.6",
+    "**/pbkdf2": "^3.1.3",
+    "**/axios": "1.12.2",
+    "**/sha.js": "^2.4.12"
   },
   "workspaces": {
     "packages": [
@@ -173,6 +177,7 @@
     "@hapi/podium": "^4.1.3",
     "@hapi/vision": "^6.1.0",
     "@hapi/wreck": "^17.1.0",
+    "@modelcontextprotocol/sdk": "^1.18.0",
     "@opensearch-dashboards-test/opensearch-dashboards-test-library": "https://github.com/opensearch-project/opensearch-dashboards-test-library/archive/refs/tags/1.0.6.tar.gz",
     "@opensearch-project/opensearch": "^1.1.0",
     "@opensearch-project/opensearch-next": "npm:@opensearch-project/opensearch@^2.13.0",
@@ -467,6 +472,7 @@
     "node-stream-zip": "^1.15.0",
     "normalize-path": "^3.0.0",
     "nyc": "^15.1.0",
+    "patch-package": "^8.0.1",
     "pixelmatch": "^5.1.0",
     "pngjs": "^3.4.0",
     "postcss": "^8.4.5",

packages/osd-optimizer/src/worker/webpack.config.ts

@@ -266,6 +266,22 @@ export function getWebpackConfig(bundle: Bundle, bundleRefs: BundleRefs, worker:
             },
           },
         },
+        {
+          test: /\.m?js$/,
+          include: [/node_modules[\\/]fast-png/, /node_modules[\\/]iobuffer/],
+          use: {
+            loader: 'babel-loader',
+            options: {
+              presets: [BABEL_PRESET_PATH],
+              plugins: [
+                '@babel/plugin-transform-class-properties',
+                '@babel/plugin-transform-class-static-block',
+                '@babel/plugin-transform-private-methods',
+                '@babel/plugin-transform-private-property-in-object',
+              ],
+            },
+          },
+        },
       ],
     },
 

packages/osd-stylelint-plugin-stylelint/yarn.lock

@@ -0,0 +1 @@
+../../yarn.lock

packages/osd-test/src/failed_tests_reporter/github_api.ts

@@ -227,7 +227,13 @@ export class GithubApi {
     }
 
     try {
-      return await this.x.request<T>(options);
+      const response = await this.x.request<T>(options);
+      return {
+        status: response.status,
+        statusText: response.statusText,
+        headers: response.headers as Record<string, string | string[] | undefined>,
+        data: response.data,
+      };
     } catch (error) {
       const unableToReachGithub = isAxiosRequestError(error);
       const githubApiFailed = isAxiosResponseError(error) && error.response.status >= 500;

patches/axios+1.12.2.patch

@@ -0,0 +1,13 @@
+diff --git a/node_modules/axios/index.d.ts b/node_modules/axios/index.d.ts
+index 554140e..f19e682 100644
+--- a/node_modules/axios/index.d.ts
++++ b/node_modules/axios/index.d.ts
+@@ -425,7 +425,7 @@ export class AxiosError<T = unknown, D = any> extends Error {
+   isAxiosError: boolean;
+   status?: number;
+   toJSON: () => object;
+-  cause?: unknown;
++  cause?: Error | undefined;
+   event?: BrowserProgressEvent;
+   static from<T = unknown, D = any>(
+     error: Error | unknown,

src/core/server/rendering/rendering_service.tsx

@@ -36,8 +36,6 @@ import { Agent as HttpsAgent } from 'https';
 import { themeVersionValueMap, themeTagDetailMap, ThemeTag } from '@osd/ui-shared-deps';
 
 import Axios from 'axios';
-// @ts-expect-error untyped internal module used to prevent axios from using xhr adapter in tests
-import AxiosHttpAdapter from 'axios/lib/adapters/http';
 import { UiPlugins } from '../plugins';
 import { CoreContext } from '../core_context';
 import { Template } from './views';
@@ -406,7 +404,6 @@ export class RenderingService {
     }
     return await Axios.get(url, {
       httpsAgent: this.httpsAgent,
-      adapter: AxiosHttpAdapter,
       maxRedirects: 0,
     })
       .then(() => {

src/dev/build/lib/download.ts

@@ -36,10 +36,6 @@ import { createHash } from 'crypto';
 import Axios from 'axios';
 import { ToolingLog } from '@osd/dev-utils';
 
-// https://github.com/axios/axios/tree/ffea03453f77a8176c51554d5f6c3c6829294649/lib/adapters
-// @ts-expect-error untyped internal module used to prevent axios from using xhr adapter in tests
-import AxiosHttpAdapter from 'axios/lib/adapters/http';
-
 import { mkdirp } from './fs';
 
 function tryUnlink(path: string) {
@@ -77,7 +73,6 @@ export async function download(options: DownloadOptions): Promise<void> {
     const response = await Axios.request({
       url,
       responseType: 'stream',
-      adapter: AxiosHttpAdapter,
     });
 
     if (response.status !== 200) {