SRVKP-12864, SRVKP-12640, SRVKP-12806, SRVKP-12824: cve fix - adding resolution for js-yaml and lock file refresh for node tar, fast-uri

[arvindk-softwaredev]

Type of Change

• Bug fix
• New feature
• Refactoring
• Migration
• CVE Fix

Summary

cve fix - adding resolution for js-yaml
lock file refresh for node tar, fast-uri is done as part of automated PR

Screen Recordings / Screenshot

yarn why

yarn test

yarn build

UI sanity

SRVKP-12864-UI_Sanity.mov

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci-robot]

@arvindk-softwaredev: This pull request references SRVKP-12864 which is a valid jira issue.

This pull request references SRVKP-12640 which is a valid jira issue.

This pull request references SRVKP-12806 which is a valid jira issue.

This pull request references SRVKP-12824 which is a valid jira issue.

Details

In response to this:

Type of Change

• Bug fix
• New feature
• Refactoring
• Migration
• CVE Fix

Summary

cve fix - adding resolution for js-yaml
lock file refresh for node tar, fast-uri is done in

Screen Recordings / Screenshot

yarn why

yarn test

yarn build

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[qodo-code-review]

PR Reviewer Guide 🔍

Warning

/review is deprecated. Use /agentic_review instead (removal date not yet scheduled).

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 1 🔵⚪⚪⚪⚪

🧪 No relevant tests

🔒 Security concerns Potential incomplete CVE remediation: the narrowly scoped js-yaml resolution selectors may leave vulnerable transitive dependency descriptors unaffected. Confirm the resulting lockfile contains no vulnerable js-yaml versions.

⚡ Recommended focus areas for review Incomplete Resolution The js-yaml resolutions target only dependencies whose requested descriptors exactly match 4.1.0 or 4.2.0. Validate that all vulnerable transitive descriptors, including ranges such as ^4.1.0, are overridden; otherwise vulnerable versions may remain installed. "js-yaml@4.1.0": "4.3.0", "js-yaml@4.2.0": "4.3.0" Missing Lockfile Dependency resolutions were changed without a corresponding lockfile update in this diff. Verify that immutable or frozen installs accept the manifest and that the committed dependency graph actually resolves all targeted packages to the patched versions. "protobufjs": "^7.5.5", "js-yaml@4.1.0": "4.3.0", "js-yaml@4.2.0": "4.3.0"

[anwesha-palit-redhat]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: anwesha-palit-redhat, arvindk-softwaredev

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [anwesha-palit-redhat,arvindk-softwaredev]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment