[release-v1.22.x] chore: refactor applyParentUpgrade, correct applyResolutions orderfix and use exact-version resolution entries and discover historical descriptors

[openshift-cherrypick-robot]

This is an automated cherry-pick of #1414

/assign anwesha-palit-redhat

[qodo-code-review]

PR Reviewer Guide 🔍

Warning

/review is deprecated. Use /agentic_review instead (removal date not yet scheduled).

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 3 🔵🔵🔵⚪⚪

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Range Coverage Exact-version entries do not match range-based dependency descriptors. Removing the range resolution can leave vulnerable copies installed even when an exact-version entry is generated. Validate the generated entries against the descriptors in the lockfile. for (const [, versions] of byMajor) { const fix = getFixForVersion(versions[0], fixedVersions); if (!fix) continue; const vulnerable = versions.filter((v) => !isVersionSatisfied(v, fix)); if (vulnerable.length === 0) continue; for (const v of vulnerable) { entries[`${pkg}@${v}`] = fix; } Override Loss This deletes every existing resolution for the package, including range-based or manually maintained overrides that the new entries do not replace. Preserve entries that are still needed before rewriting package.json. const existing = pj.resolutions ?? {}; for (const key of Object.keys(existing)) { if (key.startsWith(`${pkg}@`)) { delete existing[key]; } } pj.resolutions = { ...existing, ...entries };

[qodo-code-review]

Important

The /generate_labels command by Qodo is sunsetting on the 1st of October 2026 and will no longer be available. We recommend switching to the latest Qodo review capabilities. Learn more

[anwesha-palit-redhat]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: anwesha-palit-redhat, openshift-cherrypick-robot

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [anwesha-palit-redhat]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment