[Maintainence] CVE fixes for 2.19.4

changelogs/fragments/10822.yml

@@ -0,0 +1,2 @@
+chore:
+- CVE Fixed for 2.19, Update Webpack to support jspdf upgrade ([#10822](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/10822))

package.json

@@ -39,7 +39,7 @@
   "author": "opensearch-project",
   "scripts": {
     "preinstall": "scripts/use_node ./preinstall_check",
-    "postinstall": "scripts/use_node scripts/postinstall",
+    "postinstall": "scripts/use_node scripts/postinstall && patch-package",
     "osd": "scripts/use_node scripts/osd",
     "opensearch": "scripts/use_node scripts/opensearch",
     "test": "grunt test",
@@ -135,7 +135,11 @@
     "**/watchpack-chokidar2/chokidar": "^3.5.3",
     "**/eslint-plugin-mocha-next/mocha": "npm:mocha@^10.1.0",
     "**/xml2js": "^0.5.0",
-    "**/yaml": "^2.2.2"
+    "**/yaml": "^2.2.2",
+    "**/cipher-base": "^1.0.5",
+    "**/pbkdf2": "^3.1.3",
+    "**/axios": "^1.12.0",
+    "**/sha.js": "^2.4.12"
   },
   "workspaces": {
     "packages": [
@@ -173,6 +177,7 @@
     "@hapi/podium": "^4.1.3",
     "@hapi/vision": "^6.1.0",
     "@hapi/wreck": "^17.1.0",
+    "@modelcontextprotocol/sdk": "^1.18.0",
     "@opensearch-dashboards-test/opensearch-dashboards-test-library": "https://github.com/opensearch-project/opensearch-dashboards-test-library/archive/refs/tags/1.0.6.tar.gz",
     "@opensearch-project/opensearch": "^1.1.0",
     "@opensearch-project/opensearch-next": "npm:@opensearch-project/opensearch@^2.13.0",
@@ -467,6 +472,7 @@
     "node-stream-zip": "^1.15.0",
     "normalize-path": "^3.0.0",
     "nyc": "^15.1.0",
+    "patch-package": "^8.0.1",
     "pixelmatch": "^5.1.0",
     "pngjs": "^3.4.0",
     "postcss": "^8.4.5",

packages/osd-optimizer/src/worker/webpack.config.ts

@@ -266,6 +266,22 @@ export function getWebpackConfig(bundle: Bundle, bundleRefs: BundleRefs, worker:
             },
           },
         },
+        {
+          test: /\.m?js$/,
+          include: [/node_modules[\\/]fast-png/, /node_modules[\\/]iobuffer/],
+          use: {
+            loader: 'babel-loader',
+            options: {
+              presets: [BABEL_PRESET_PATH],
+              plugins: [
+                '@babel/plugin-transform-class-properties',
+                '@babel/plugin-transform-class-static-block',
+                '@babel/plugin-transform-private-methods',
+                '@babel/plugin-transform-private-property-in-object',
+              ],
+            },
+          },
+        },
       ],
     },
 

packages/osd-test/src/failed_tests_reporter/github_api.ts

@@ -227,7 +227,13 @@ export class GithubApi {
     }
 
     try {
-      return await this.x.request<T>(options);
+      const response = await this.x.request<T>(options);
+      return {
+        status: response.status,
+        statusText: response.statusText,
+        headers: response.headers as Record<string, string | string[] | undefined>,
+        data: response.data,
+      };
     } catch (error) {
       const unableToReachGithub = isAxiosRequestError(error);
       const githubApiFailed = isAxiosResponseError(error) && error.response.status >= 500;

patches/axios+1.13.1.patch

@@ -0,0 +1,13 @@
+diff --git a/node_modules/axios/index.d.ts b/node_modules/axios/index.d.ts
+index 554140e..f19e682 100644
+--- a/node_modules/axios/index.d.ts
++++ b/node_modules/axios/index.d.ts
+@@ -429,7 +429,7 @@ export class AxiosError<T = unknown, D = any> extends Error {
+   isAxiosError: boolean;
+   status?: number;
+   toJSON: () => object;
+-  cause?: unknown;
++  cause?: Error | undefined;
+   event?: BrowserProgressEvent;
+   static from<T = unknown, D = any>(
+     error: Error | unknown,