[release-v1.15.x] chore: refactor applyParentUpgrade, correct applyResolutions orderfix and use exact-version resolution entries and discover historical descriptors

[openshift-cherrypick-robot]

This is an automated cherry-pick of #1414

/assign anwesha-palit-redhat

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: openshift-cherrypick-robot
Once this PR has been reviewed and has the lgtm label, please assign pratap0007 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[qodo-code-review]

PR Reviewer Guide 🔍

Warning

/review is deprecated. Use /agentic_review instead (removal date not yet scheduled).

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 3 🔵🔵🔵⚪⚪

🧪 No relevant tests

🔒 Security concerns Incomplete CVE remediation: Unmatched exact-version resolutions or an empty parent-upgrade fallback can leave vulnerable dependency versions installed despite the attempted fix.

⚡ Recommended focus areas for review Unmatched Resolutions Exact-version resolution keys may not match dependencies declared with ranges such as pkg@^1.2.0. Removing the range-based entries could leave vulnerable transitive copies installed; validate the generated keys against actual Yarn dependency descriptors. for (const v of vulnerable) { entries[`${pkg}@${v}`] = fix; Empty Fallback If re-analysis returns an empty resolutionEntries object, ?? selects it instead of the original entries. The fallback then removes existing resolutions and installs without replacements. Check for nonempty entries before applying the fallback. return applyResolutions( pkg, recheck.resolutionEntries ?? resolutionEntries, );

[qodo-code-review]

Important

The /generate_labels command by Qodo is sunsetting on the 1st of October 2026 and will no longer be available. We recommend switching to the latest Qodo review capabilities. Learn more