SRVKP-12642,SRVKP-12660,SRVKP-12814,SRVKP-12850: added resolutions for js-yaml and protobufjs

[anwesha-palit-redhat]

Type of Change

• Bug fix
• New feature
• Refactoring
• Migration
• CVE Fix

Summary

Patches: Upgrade to fast-uri 3.1.3 for the 3.x line or 4.0.1 for the 4.x line.
protobufjs: This vulnerability is fixed in 7.5.8 and 8.2.0.
node-tar: This issue is fixed in version 7.5.19.
js-yaml: This issue is fixed in versions 3.15.0 and 4.3.0.

Screen Recordings

yarn why

yarn test

yarn build

Screen Recordings for sanity in OCP 4.18

Screen.Recording.2026-07-28.at.16.12.12.mov

sanity-1.mov

sanity2.mov

[openshift-ci-robot]

@anwesha-palit-redhat: This pull request references SRVKP-12642 which is a valid jira issue.

This pull request references SRVKP-12660 which is a valid jira issue.

This pull request references SRVKP-12814 which is a valid jira issue.

This pull request references SRVKP-12850 which is a valid jira issue.

Details

In response to this:

Type of Change

• Bug fix
• New feature
• Refactoring
• Migration
• CVE Fix

Summary

Screen Recordings

yarn why

yarn test

yarn build

Screen Recordings for sanity in OCP 4.18

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[qodo-code-review]

PR Reviewer Guide 🔍

Warning

/review is deprecated. Use /agentic_review instead (removal date not yet scheduled).

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Lockfile Missing The dependency resolutions changed without a corresponding lockfile update. If CI uses an immutable or frozen install, it may fail; otherwise, the vulnerable locked versions may remain in use. Regenerate and commit the lockfile, then verify the resolved versions. "protobufjs": "^7.5.8", "js-yaml@^4.0.0": "4.3.0", "js-yaml@4.1.0": "4.3.0", "js-yaml@4.2.0": "4.3.0"

[arvindk-softwaredev]

/lgtm

[arvindk-softwaredev]

/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by: anwesha-palit-redhat, arvindk-softwaredev

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment