Skip to content

SRVKP-14560,SRVKP-14568,SRVKP-14131,SRVKP-14212: Fix vulnerable dependencies on release-v1.22.x - #1421

Merged
openshift-merge-bot[bot] merged 1 commit into
release-v1.22.xfrom
auto/cve/fix-release-v1.22.x
Oct 5, 2026
Merged

SRVKP-14560,SRVKP-14568,SRVKP-14131,SRVKP-14212: Fix vulnerable dependencies on release-v1.22.x#1421
openshift-merge-bot[bot] merged 1 commit into
release-v1.22.xfrom
auto/cve/fix-release-v1.22.x

Conversation

@github-actions

@github-actions github-actions Bot commented Oct 5, 2026

Copy link
Copy Markdown

CVE Remediation Report

Generated: 2026-10-05T12:41:24.579Z

Release branch: release-v1.22.x

Overall status

✅ All packages remediated and verified

Summary

Package Fixed version(s) Strategy Verified
colord 2.9.4 ✅ Already remediated ✅ Verified
js-yaml 3.15.2, 4.3.2 📌 Yarn resolution pinned ✅ Verified
qs 6.16.0 ✅ Already remediated ✅ Verified
source-map-js 1.2.2 ✅ Already remediated ✅ Verified

Package details

1. colord

Field Value
Fixed version(s) 2.9.4
Strategy ✅ Already remediated
Reason All 1 installed copy/copies satisfy fix versions
Action taken No changes required (already remediated)
Verification ✅ Verified
Verification detail Verified: all installed copies satisfy fixed versions (All 1 installed copy/copies satisfy fix versions)
📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
└─┬ stylelint@16.12.0 invalid: "^15.3.0" from node_modules/stylelint-config-standard
  └── colord@2.10.0

Before — yarn why 

└─ stylelint@npm:16.12.0
   └─ colord@npm:2.10.0 (via npm:^2.9.3)

After — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
└─┬ stylelint@16.12.0 invalid: "^15.3.0" from node_modules/stylelint-config-standard
  └── colord@2.10.0

After — yarn why 

└─ stylelint@npm:16.12.0
   └─ colord@npm:2.10.0 (via npm:^2.9.3)

2. js-yaml

Field Value
Fixed version(s) 3.15.2, 4.3.2
Strategy 📌 Yarn resolution pinned
Reason Transitive dependency; no parent upgrade resolves it — use resolutions as last resort
Action taken Updated resolutions: {"js-yaml@4.3.0":"4.3.2","js-yaml@4.1.0":"4.3.2","js-yaml@4.2.0":"4.3.2"}
Verification ✅ Verified
Verification detail Verified: all installed copies satisfy fixed versions (All 2 installed copy/copies satisfy fix versions)
📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ babel-jest@29.7.0
│ └─┬ babel-plugin-istanbul@6.1.1
│   └─┬ @istanbuljs/load-nyc-config@1.1.0
│     └── js-yaml@3.15.2
├─┬ eslint@8.57.1 invalid: "^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0" from node_modules/eslint-plugin-react-hooks
│ ├─┬ @eslint/eslintrc@2.1.4
│ │ └── js-yaml@4.3.2 deduped
│ └── js-yaml@4.3.2
├─┬ i18next-parser@3.11.0
│ └── js-yaml@4.3.0 invalid: "4.1.0" from node_modules/i18next-parser
├─┬ openapi-typescript@7.13.0
│ └─┬ @redocly/openapi-core@1.34.20
│   └── js-yaml@4.3.2 deduped
└─┬ stylelint@16.12.0 invalid: "^15.3.0" from node_modules/stylelint-config-standard
  └─┬ cosmiconfig@9.0.2
    └── js-yaml@4.3.2 deduped

Before — yarn why 

├─ @eslint/eslintrc@npm:2.1.4
│  └─ js-yaml@npm:4.3.2 (via npm:^4.1.0)
│
├─ @istanbuljs/load-nyc-config@npm:1.1.0
│  └─ js-yaml@npm:3.15.2 (via npm:^3.13.1)
│
├─ @redocly/openapi-core@npm:1.34.20
│  └─ js-yaml@npm:4.3.2 (via npm:4.3.2)
│
├─ cosmiconfig@npm:9.0.2
│  └─ js-yaml@npm:4.3.2 (via npm:^4.1.0)
│
├─ cosmiconfig@npm:9.0.2 [0d1dc]
│  └─ js-yaml@npm:4.3.2 (via npm:^4.1.0)
│
├─ eslint@npm:8.57.1
│  └─ js-yaml@npm:4.3.2 (via npm:^4.1.0)
│
└─ i18next-parser@npm:3.11.0
   └─ js-yaml@npm:4.3.0 (via npm:4.3.0)

After — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ babel-jest@29.7.0
│ └─┬ babel-plugin-istanbul@6.1.1
│   └─┬ @istanbuljs/load-nyc-config@1.1.0
│     └── js-yaml@3.15.2
├─┬ eslint@8.57.1 invalid: "^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0" from node_modules/eslint-plugin-react-hooks
│ ├─┬ @eslint/eslintrc@2.1.4
│ │ └── js-yaml@4.3.2 deduped invalid: "4.1.0" from node_modules/i18next-parser
│ └── js-yaml@4.3.2 invalid: "4.1.0" from node_modules/i18next-parser
├─┬ i18next-parser@3.11.0
│ └── js-yaml@4.3.2 deduped invalid: "4.1.0" from node_modules/i18next-parser
├─┬ openapi-typescript@7.13.0
│ └─┬ @redocly/openapi-core@1.34.20
│   └── js-yaml@4.3.2 deduped invalid: "4.1.0" from node_modules/i18next-parser
└─┬ stylelint@16.12.0 invalid: "^15.3.0" from node_modules/stylelint-config-standard
  └─┬ cosmiconfig@9.0.2
    └── js-yaml@4.3.2 deduped invalid: "4.1.0" from node_modules/i18next-parser

After — yarn why 

├─ @eslint/eslintrc@npm:2.1.4
│  └─ js-yaml@npm:4.3.2 (via npm:^4.1.0)
│
├─ @istanbuljs/load-nyc-config@npm:1.1.0
│  └─ js-yaml@npm:3.15.2 (via npm:^3.13.1)
│
├─ @redocly/openapi-core@npm:1.34.20
│  └─ js-yaml@npm:4.3.2 (via npm:4.3.2)
│
├─ cosmiconfig@npm:9.0.2
│  └─ js-yaml@npm:4.3.2 (via npm:^4.1.0)
│
├─ cosmiconfig@npm:9.0.2 [0d1dc]
│  └─ js-yaml@npm:4.3.2 (via npm:^4.1.0)
│
├─ eslint@npm:8.57.1
│  └─ js-yaml@npm:4.3.2 (via npm:^4.1.0)
│
└─ i18next-parser@npm:3.11.0
   └─ js-yaml@npm:4.3.2 (via npm:4.3.2)

3. qs

Field Value
Fixed version(s) 6.16.0
Strategy ✅ Already remediated
Reason All 1 installed copy/copies satisfy fix versions
Action taken No changes required (already remediated)
Verification ✅ Verified
Verification detail Verified: all installed copies satisfy fixed versions (All 1 installed copy/copies satisfy fix versions)
📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ @gitbeaker/core@43.8.0
│ ├─┬ @gitbeaker/requester-utils@43.8.0
│ │ └── qs@6.16.0 deduped
│ └── qs@6.16.0
├─┬ url@0.11.4
│ └── qs@6.16.0 deduped
└─┬ webpack-dev-server@5.2.6
  └─┬ express@4.22.3
    ├─┬ body-parser@1.20.8
    │ └── qs@6.16.0 deduped
    └── qs@6.16.0 deduped

Before — yarn why 

├─ @gitbeaker/core@npm:43.8.0
│  └─ qs@npm:6.16.0 (via npm:^6.14.0)
│
├─ @gitbeaker/requester-utils@npm:43.8.0
│  └─ qs@npm:6.16.0 (via npm:^6.14.0)
│
├─ body-parser@npm:1.20.8
│  └─ qs@npm:6.16.0 (via npm:~6.16.0)
│
├─ express@npm:4.22.3
│  └─ qs@npm:6.16.0 (via npm:~6.16.0)
│
└─ url@npm:0.11.4
   └─ qs@npm:6.16.0 (via npm:^6.12.3)

After — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ @gitbeaker/core@43.8.0
│ ├─┬ @gitbeaker/requester-utils@43.8.0
│ │ └── qs@6.16.0 deduped
│ └── qs@6.16.0
├─┬ url@0.11.4
│ └── qs@6.16.0 deduped
└─┬ webpack-dev-server@5.2.6
  └─┬ express@4.22.3
    ├─┬ body-parser@1.20.8
    │ └── qs@6.16.0 deduped
    └── qs@6.16.0 deduped

After — yarn why 

├─ @gitbeaker/core@npm:43.8.0
│  └─ qs@npm:6.16.0 (via npm:^6.14.0)
│
├─ @gitbeaker/requester-utils@npm:43.8.0
│  └─ qs@npm:6.16.0 (via npm:^6.14.0)
│
├─ body-parser@npm:1.20.8
│  └─ qs@npm:6.16.0 (via npm:~6.16.0)
│
├─ express@npm:4.22.3
│  └─ qs@npm:6.16.0 (via npm:~6.16.0)
│
└─ url@npm:0.11.4
   └─ qs@npm:6.16.0 (via npm:^6.12.3)

4. source-map-js

Field Value
Fixed version(s) 1.2.2
Strategy ✅ Already remediated
Reason All 1 installed copy/copies satisfy fix versions
Action taken No changes required (already remediated)
Verification ✅ Verified
Verification detail Verified: all installed copies satisfy fixed versions (All 1 installed copy/copies satisfy fix versions)
📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ css-loader@6.11.0
│ └─┬ postcss@8.5.29
│   └── source-map-js@1.2.2 deduped
├─┬ sass@1.105.1
│ └── source-map-js@1.2.2
└─┬ stylelint@16.12.0 invalid: "^15.3.0" from node_modules/stylelint-config-standard
  └─┬ css-tree@3.2.1
    └── source-map-js@1.2.2 deduped

Before — yarn why 

├─ css-tree@npm:3.2.1
│  └─ source-map-js@npm:1.2.2 (via npm:^1.2.1)
│
├─ postcss@npm:8.5.29
│  └─ source-map-js@npm:1.2.2 (via npm:^1.2.2)
│
└─ sass@npm:1.105.1
   └─ source-map-js@npm:1.2.2 (via npm:>=0.6.2 <2.0.0)

After — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ css-loader@6.11.0
│ └─┬ postcss@8.5.29
│   └── source-map-js@1.2.2 deduped
├─┬ sass@1.105.1
│ └── source-map-js@1.2.2
└─┬ stylelint@16.12.0 invalid: "^15.3.0" from node_modules/stylelint-config-standard
  └─┬ css-tree@3.2.1
    └── source-map-js@1.2.2 deduped

After — yarn why 

├─ css-tree@npm:3.2.1
│  └─ source-map-js@npm:1.2.2 (via npm:^1.2.1)
│
├─ postcss@npm:8.5.29
│  └─ source-map-js@npm:1.2.2 (via npm:^1.2.2)
│
└─ sass@npm:1.105.1
   └─ source-map-js@npm:1.2.2 (via npm:>=0.6.2 <2.0.0)

Report generated by audit-report.ts. Artifacts in cve-artifacts/.

@openshift-ci

openshift-ci Bot commented Oct 5, 2026

Copy link
Copy Markdown
Contributor

Hi @github-actions[bot]. Thanks for your PR.

I'm waiting for a openshift-pipelines member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@anwesha-palit-redhat
anwesha-palit-redhat requested review from ankrsinha and removed request for anwesha-palit-redhat and pratap0007 October 5, 2026 12:53
ankrsinha
ankrsinha approved these changes Oct 5, 2026
View reviewed changes

@ankrsinha ankrsinha left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@openshift-ci openshift-ci Bot added the lgtm Looks Good to Me Label label Oct 5, 2026
anwesha-palit-redhat
anwesha-palit-redhat approved these changes Oct 5, 2026
View reviewed changes

@anwesha-palit-redhat anwesha-palit-redhat left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@openshift-ci

openshift-ci Bot commented Oct 5, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ankrsinha, anwesha-palit-redhat, github-actions[bot]

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:
  • OWNERS [anwesha-palit-redhat]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved Label for Approved PRs label Oct 5, 2026
@anwesha-palit-redhat anwesha-palit-redhat added jira/valid-reference and removed approved Label for Approved PRs labels Oct 5, 2026
@anwesha-palit-redhat anwesha-palit-redhat changed the title chore: Fix vulnerable dependencies on release-v1.22.x SRVKP-14560,SRVKP-14568: Fix vulnerable dependencies on release-v1.22.x Oct 5, 2026
@openshift-ci-robot

openshift-ci-robot commented Oct 5, 2026 •
edited by openshift-ci Bot
Loading

Copy link
Copy Markdown
Collaborator

@github-actions[bot]: This pull request references SRVKP-14560 which is a valid jira issue.

This pull request references SRVKP-14568 which is a valid jira issue.

Details

In response to this:

CVE Remediation Report

Generated: 2026-10-05T12:41:24.579Z

Release branch: release-v1.22.x

Overall status

✅ All packages remediated and verified

Summary

Package Fixed version(s) Strategy Verified
colord 2.9.4 ✅ Already remediated ✅ Verified
js-yaml 3.15.2, 4.3.2 📌 Yarn resolution pinned ✅ Verified
qs 6.16.0 ✅ Already remediated ✅ Verified
source-map-js 1.2.2 ✅ Already remediated ✅ Verified

Package details

1. colord

Field Value
Fixed version(s) 2.9.4
Strategy ✅ Already remediated
Reason All 1 installed copy/copies satisfy fix versions
Action taken No changes required (already remediated)
Verification ✅ Verified
Verification detail Verified: all installed copies satisfy fixed versions (All 1 installed copy/copies satisfy fix versions)
📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
└─┬ stylelint@16.12.0 invalid: "^15.3.0" from node_modules/stylelint-config-standard
 └── colord@2.10.0

Before — yarn why 

└─ stylelint@npm:16.12.0
  └─ colord@npm:2.10.0 (via npm:^2.9.3)

After — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
└─┬ stylelint@16.12.0 invalid: "^15.3.0" from node_modules/stylelint-config-standard
 └── colord@2.10.0

After — yarn why 

└─ stylelint@npm:16.12.0
  └─ colord@npm:2.10.0 (via npm:^2.9.3)

2. js-yaml

Field Value
Fixed version(s) 3.15.2, 4.3.2
Strategy 📌 Yarn resolution pinned
Reason Transitive dependency; no parent upgrade resolves it — use resolutions as last resort
Action taken Updated resolutions: {"js-yaml@4.3.0":"4.3.2","js-yaml@4.1.0":"4.3.2","js-yaml@4.2.0":"4.3.2"}
Verification ✅ Verified
Verification detail Verified: all installed copies satisfy fixed versions (All 2 installed copy/copies satisfy fix versions)
📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ babel-jest@29.7.0
│ └─┬ babel-plugin-istanbul@6.1.1
│   └─┬ @istanbuljs/load-nyc-config@1.1.0
│     └── js-yaml@3.15.2
├─┬ eslint@8.57.1 invalid: "^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0" from node_modules/eslint-plugin-react-hooks
│ ├─┬ @eslint/eslintrc@2.1.4
│ │ └── js-yaml@4.3.2 deduped
│ └── js-yaml@4.3.2
├─┬ i18next-parser@3.11.0
│ └── js-yaml@4.3.0 invalid: "4.1.0" from node_modules/i18next-parser
├─┬ openapi-typescript@7.13.0
│ └─┬ @redocly/openapi-core@1.34.20
│   └── js-yaml@4.3.2 deduped
└─┬ stylelint@16.12.0 invalid: "^15.3.0" from node_modules/stylelint-config-standard
 └─┬ cosmiconfig@9.0.2
   └── js-yaml@4.3.2 deduped

Before — yarn why 

├─ @eslint/eslintrc@npm:2.1.4
│  └─ js-yaml@npm:4.3.2 (via npm:^4.1.0)
│
├─ @istanbuljs/load-nyc-config@npm:1.1.0
│  └─ js-yaml@npm:3.15.2 (via npm:^3.13.1)
│
├─ @redocly/openapi-core@npm:1.34.20
│  └─ js-yaml@npm:4.3.2 (via npm:4.3.2)
│
├─ cosmiconfig@npm:9.0.2
│  └─ js-yaml@npm:4.3.2 (via npm:^4.1.0)
│
├─ cosmiconfig@npm:9.0.2 [0d1dc]
│  └─ js-yaml@npm:4.3.2 (via npm:^4.1.0)
│
├─ eslint@npm:8.57.1
│  └─ js-yaml@npm:4.3.2 (via npm:^4.1.0)
│
└─ i18next-parser@npm:3.11.0
  └─ js-yaml@npm:4.3.0 (via npm:4.3.0)

After — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ babel-jest@29.7.0
│ └─┬ babel-plugin-istanbul@6.1.1
│   └─┬ @istanbuljs/load-nyc-config@1.1.0
│     └── js-yaml@3.15.2
├─┬ eslint@8.57.1 invalid: "^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0" from node_modules/eslint-plugin-react-hooks
│ ├─┬ @eslint/eslintrc@2.1.4
│ │ └── js-yaml@4.3.2 deduped invalid: "4.1.0" from node_modules/i18next-parser
│ └── js-yaml@4.3.2 invalid: "4.1.0" from node_modules/i18next-parser
├─┬ i18next-parser@3.11.0
│ └── js-yaml@4.3.2 deduped invalid: "4.1.0" from node_modules/i18next-parser
├─┬ openapi-typescript@7.13.0
│ └─┬ @redocly/openapi-core@1.34.20
│   └── js-yaml@4.3.2 deduped invalid: "4.1.0" from node_modules/i18next-parser
└─┬ stylelint@16.12.0 invalid: "^15.3.0" from node_modules/stylelint-config-standard
 └─┬ cosmiconfig@9.0.2
   └── js-yaml@4.3.2 deduped invalid: "4.1.0" from node_modules/i18next-parser

After — yarn why 

├─ @eslint/eslintrc@npm:2.1.4
│  └─ js-yaml@npm:4.3.2 (via npm:^4.1.0)
│
├─ @istanbuljs/load-nyc-config@npm:1.1.0
│  └─ js-yaml@npm:3.15.2 (via npm:^3.13.1)
│
├─ @redocly/openapi-core@npm:1.34.20
│  └─ js-yaml@npm:4.3.2 (via npm:4.3.2)
│
├─ cosmiconfig@npm:9.0.2
│  └─ js-yaml@npm:4.3.2 (via npm:^4.1.0)
│
├─ cosmiconfig@npm:9.0.2 [0d1dc]
│  └─ js-yaml@npm:4.3.2 (via npm:^4.1.0)
│
├─ eslint@npm:8.57.1
│  └─ js-yaml@npm:4.3.2 (via npm:^4.1.0)
│
└─ i18next-parser@npm:3.11.0
  └─ js-yaml@npm:4.3.2 (via npm:4.3.2)

3. qs

Field Value
Fixed version(s) 6.16.0
Strategy ✅ Already remediated
Reason All 1 installed copy/copies satisfy fix versions
Action taken No changes required (already remediated)
Verification ✅ Verified
Verification detail Verified: all installed copies satisfy fixed versions (All 1 installed copy/copies satisfy fix versions)
📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ @gitbeaker/core@43.8.0
│ ├─┬ @gitbeaker/requester-utils@43.8.0
│ │ └── qs@6.16.0 deduped
│ └── qs@6.16.0
├─┬ url@0.11.4
│ └── qs@6.16.0 deduped
└─┬ webpack-dev-server@5.2.6
 └─┬ express@4.22.3
   ├─┬ body-parser@1.20.8
   │ └── qs@6.16.0 deduped
   └── qs@6.16.0 deduped

Before — yarn why 

├─ @gitbeaker/core@npm:43.8.0
│  └─ qs@npm:6.16.0 (via npm:^6.14.0)
│
├─ @gitbeaker/requester-utils@npm:43.8.0
│  └─ qs@npm:6.16.0 (via npm:^6.14.0)
│
├─ body-parser@npm:1.20.8
│  └─ qs@npm:6.16.0 (via npm:~6.16.0)
│
├─ express@npm:4.22.3
│  └─ qs@npm:6.16.0 (via npm:~6.16.0)
│
└─ url@npm:0.11.4
  └─ qs@npm:6.16.0 (via npm:^6.12.3)

After — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ @gitbeaker/core@43.8.0
│ ├─┬ @gitbeaker/requester-utils@43.8.0
│ │ └── qs@6.16.0 deduped
│ └── qs@6.16.0
├─┬ url@0.11.4
│ └── qs@6.16.0 deduped
└─┬ webpack-dev-server@5.2.6
 └─┬ express@4.22.3
   ├─┬ body-parser@1.20.8
   │ └── qs@6.16.0 deduped
   └── qs@6.16.0 deduped

After — yarn why 

├─ @gitbeaker/core@npm:43.8.0
│  └─ qs@npm:6.16.0 (via npm:^6.14.0)
│
├─ @gitbeaker/requester-utils@npm:43.8.0
│  └─ qs@npm:6.16.0 (via npm:^6.14.0)
│
├─ body-parser@npm:1.20.8
│  └─ qs@npm:6.16.0 (via npm:~6.16.0)
│
├─ express@npm:4.22.3
│  └─ qs@npm:6.16.0 (via npm:~6.16.0)
│
└─ url@npm:0.11.4
  └─ qs@npm:6.16.0 (via npm:^6.12.3)

4. source-map-js

Field Value
Fixed version(s) 1.2.2
Strategy ✅ Already remediated
Reason All 1 installed copy/copies satisfy fix versions
Action taken No changes required (already remediated)
Verification ✅ Verified
Verification detail Verified: all installed copies satisfy fixed versions (All 1 installed copy/copies satisfy fix versions)
📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ css-loader@6.11.0
│ └─┬ postcss@8.5.29
│   └── source-map-js@1.2.2 deduped
├─┬ sass@1.105.1
│ └── source-map-js@1.2.2
└─┬ stylelint@16.12.0 invalid: "^15.3.0" from node_modules/stylelint-config-standard
 └─┬ css-tree@3.2.1
   └── source-map-js@1.2.2 deduped

Before — yarn why 

├─ css-tree@npm:3.2.1
│  └─ source-map-js@npm:1.2.2 (via npm:^1.2.1)
│
├─ postcss@npm:8.5.29
│  └─ source-map-js@npm:1.2.2 (via npm:^1.2.2)
│
└─ sass@npm:1.105.1
  └─ source-map-js@npm:1.2.2 (via npm:>=0.6.2 <2.0.0)

After — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ css-loader@6.11.0
│ └─┬ postcss@8.5.29
│   └── source-map-js@1.2.2 deduped
├─┬ sass@1.105.1
│ └── source-map-js@1.2.2
└─┬ stylelint@16.12.0 invalid: "^15.3.0" from node_modules/stylelint-config-standard
 └─┬ css-tree@3.2.1
   └── source-map-js@1.2.2 deduped

After — yarn why 

├─ css-tree@npm:3.2.1
│  └─ source-map-js@npm:1.2.2 (via npm:^1.2.1)
│
├─ postcss@npm:8.5.29
│  └─ source-map-js@npm:1.2.2 (via npm:^1.2.2)
│
└─ sass@npm:1.105.1
  └─ source-map-js@npm:1.2.2 (via npm:>=0.6.2 <2.0.0)

Report generated by audit-report.ts. Artifacts in cve-artifacts/.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@ankrsinha ankrsinha changed the title SRVKP-14560,SRVKP-14568: Fix vulnerable dependencies on release-v1.22.x SRVKP-14560,SRVKP-14568,SRVKP-14131,SRVKP-14212: Fix vulnerable dependencies on release-v1.22.x Oct 5, 2026
@openshift-ci-robot

openshift-ci-robot commented Oct 5, 2026 •
edited by openshift-ci Bot
Loading

Copy link
Copy Markdown
Collaborator

@github-actions[bot]: This pull request references SRVKP-14560 which is a valid jira issue.

This pull request references SRVKP-14568 which is a valid jira issue.

This pull request references SRVKP-14131 which is a valid jira issue.

This pull request references SRVKP-14212 which is a valid jira issue.

Details

In response to this:

CVE Remediation Report

Generated: 2026-10-05T12:41:24.579Z

Release branch: release-v1.22.x

Overall status

✅ All packages remediated and verified

Summary

Package Fixed version(s) Strategy Verified
colord 2.9.4 ✅ Already remediated ✅ Verified
js-yaml 3.15.2, 4.3.2 📌 Yarn resolution pinned ✅ Verified
qs 6.16.0 ✅ Already remediated ✅ Verified
source-map-js 1.2.2 ✅ Already remediated ✅ Verified

Package details

1. colord

Field Value
Fixed version(s) 2.9.4
Strategy ✅ Already remediated
Reason All 1 installed copy/copies satisfy fix versions
Action taken No changes required (already remediated)
Verification ✅ Verified
Verification detail Verified: all installed copies satisfy fixed versions (All 1 installed copy/copies satisfy fix versions)
📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
└─┬ stylelint@16.12.0 invalid: "^15.3.0" from node_modules/stylelint-config-standard
 └── colord@2.10.0

Before — yarn why 

└─ stylelint@npm:16.12.0
  └─ colord@npm:2.10.0 (via npm:^2.9.3)

After — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
└─┬ stylelint@16.12.0 invalid: "^15.3.0" from node_modules/stylelint-config-standard
 └── colord@2.10.0

After — yarn why 

└─ stylelint@npm:16.12.0
  └─ colord@npm:2.10.0 (via npm:^2.9.3)

2. js-yaml

Field Value
Fixed version(s) 3.15.2, 4.3.2
Strategy 📌 Yarn resolution pinned
Reason Transitive dependency; no parent upgrade resolves it — use resolutions as last resort
Action taken Updated resolutions: {"js-yaml@4.3.0":"4.3.2","js-yaml@4.1.0":"4.3.2","js-yaml@4.2.0":"4.3.2"}
Verification ✅ Verified
Verification detail Verified: all installed copies satisfy fixed versions (All 2 installed copy/copies satisfy fix versions)
📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ babel-jest@29.7.0
│ └─┬ babel-plugin-istanbul@6.1.1
│   └─┬ @istanbuljs/load-nyc-config@1.1.0
│     └── js-yaml@3.15.2
├─┬ eslint@8.57.1 invalid: "^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0" from node_modules/eslint-plugin-react-hooks
│ ├─┬ @eslint/eslintrc@2.1.4
│ │ └── js-yaml@4.3.2 deduped
│ └── js-yaml@4.3.2
├─┬ i18next-parser@3.11.0
│ └── js-yaml@4.3.0 invalid: "4.1.0" from node_modules/i18next-parser
├─┬ openapi-typescript@7.13.0
│ └─┬ @redocly/openapi-core@1.34.20
│   └── js-yaml@4.3.2 deduped
└─┬ stylelint@16.12.0 invalid: "^15.3.0" from node_modules/stylelint-config-standard
 └─┬ cosmiconfig@9.0.2
   └── js-yaml@4.3.2 deduped

Before — yarn why 

├─ @eslint/eslintrc@npm:2.1.4
│  └─ js-yaml@npm:4.3.2 (via npm:^4.1.0)
│
├─ @istanbuljs/load-nyc-config@npm:1.1.0
│  └─ js-yaml@npm:3.15.2 (via npm:^3.13.1)
│
├─ @redocly/openapi-core@npm:1.34.20
│  └─ js-yaml@npm:4.3.2 (via npm:4.3.2)
│
├─ cosmiconfig@npm:9.0.2
│  └─ js-yaml@npm:4.3.2 (via npm:^4.1.0)
│
├─ cosmiconfig@npm:9.0.2 [0d1dc]
│  └─ js-yaml@npm:4.3.2 (via npm:^4.1.0)
│
├─ eslint@npm:8.57.1
│  └─ js-yaml@npm:4.3.2 (via npm:^4.1.0)
│
└─ i18next-parser@npm:3.11.0
  └─ js-yaml@npm:4.3.0 (via npm:4.3.0)

After — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ babel-jest@29.7.0
│ └─┬ babel-plugin-istanbul@6.1.1
│   └─┬ @istanbuljs/load-nyc-config@1.1.0
│     └── js-yaml@3.15.2
├─┬ eslint@8.57.1 invalid: "^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0" from node_modules/eslint-plugin-react-hooks
│ ├─┬ @eslint/eslintrc@2.1.4
│ │ └── js-yaml@4.3.2 deduped invalid: "4.1.0" from node_modules/i18next-parser
│ └── js-yaml@4.3.2 invalid: "4.1.0" from node_modules/i18next-parser
├─┬ i18next-parser@3.11.0
│ └── js-yaml@4.3.2 deduped invalid: "4.1.0" from node_modules/i18next-parser
├─┬ openapi-typescript@7.13.0
│ └─┬ @redocly/openapi-core@1.34.20
│   └── js-yaml@4.3.2 deduped invalid: "4.1.0" from node_modules/i18next-parser
└─┬ stylelint@16.12.0 invalid: "^15.3.0" from node_modules/stylelint-config-standard
 └─┬ cosmiconfig@9.0.2
   └── js-yaml@4.3.2 deduped invalid: "4.1.0" from node_modules/i18next-parser

After — yarn why 

├─ @eslint/eslintrc@npm:2.1.4
│  └─ js-yaml@npm:4.3.2 (via npm:^4.1.0)
│
├─ @istanbuljs/load-nyc-config@npm:1.1.0
│  └─ js-yaml@npm:3.15.2 (via npm:^3.13.1)
│
├─ @redocly/openapi-core@npm:1.34.20
│  └─ js-yaml@npm:4.3.2 (via npm:4.3.2)
│
├─ cosmiconfig@npm:9.0.2
│  └─ js-yaml@npm:4.3.2 (via npm:^4.1.0)
│
├─ cosmiconfig@npm:9.0.2 [0d1dc]
│  └─ js-yaml@npm:4.3.2 (via npm:^4.1.0)
│
├─ eslint@npm:8.57.1
│  └─ js-yaml@npm:4.3.2 (via npm:^4.1.0)
│
└─ i18next-parser@npm:3.11.0
  └─ js-yaml@npm:4.3.2 (via npm:4.3.2)

3. qs

Field Value
Fixed version(s) 6.16.0
Strategy ✅ Already remediated
Reason All 1 installed copy/copies satisfy fix versions
Action taken No changes required (already remediated)
Verification ✅ Verified
Verification detail Verified: all installed copies satisfy fixed versions (All 1 installed copy/copies satisfy fix versions)
📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ @gitbeaker/core@43.8.0
│ ├─┬ @gitbeaker/requester-utils@43.8.0
│ │ └── qs@6.16.0 deduped
│ └── qs@6.16.0
├─┬ url@0.11.4
│ └── qs@6.16.0 deduped
└─┬ webpack-dev-server@5.2.6
 └─┬ express@4.22.3
   ├─┬ body-parser@1.20.8
   │ └── qs@6.16.0 deduped
   └── qs@6.16.0 deduped

Before — yarn why 

├─ @gitbeaker/core@npm:43.8.0
│  └─ qs@npm:6.16.0 (via npm:^6.14.0)
│
├─ @gitbeaker/requester-utils@npm:43.8.0
│  └─ qs@npm:6.16.0 (via npm:^6.14.0)
│
├─ body-parser@npm:1.20.8
│  └─ qs@npm:6.16.0 (via npm:~6.16.0)
│
├─ express@npm:4.22.3
│  └─ qs@npm:6.16.0 (via npm:~6.16.0)
│
└─ url@npm:0.11.4
  └─ qs@npm:6.16.0 (via npm:^6.12.3)

After — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ @gitbeaker/core@43.8.0
│ ├─┬ @gitbeaker/requester-utils@43.8.0
│ │ └── qs@6.16.0 deduped
│ └── qs@6.16.0
├─┬ url@0.11.4
│ └── qs@6.16.0 deduped
└─┬ webpack-dev-server@5.2.6
 └─┬ express@4.22.3
   ├─┬ body-parser@1.20.8
   │ └── qs@6.16.0 deduped
   └── qs@6.16.0 deduped

After — yarn why 

├─ @gitbeaker/core@npm:43.8.0
│  └─ qs@npm:6.16.0 (via npm:^6.14.0)
│
├─ @gitbeaker/requester-utils@npm:43.8.0
│  └─ qs@npm:6.16.0 (via npm:^6.14.0)
│
├─ body-parser@npm:1.20.8
│  └─ qs@npm:6.16.0 (via npm:~6.16.0)
│
├─ express@npm:4.22.3
│  └─ qs@npm:6.16.0 (via npm:~6.16.0)
│
└─ url@npm:0.11.4
  └─ qs@npm:6.16.0 (via npm:^6.12.3)

4. source-map-js

Field Value
Fixed version(s) 1.2.2
Strategy ✅ Already remediated
Reason All 1 installed copy/copies satisfy fix versions
Action taken No changes required (already remediated)
Verification ✅ Verified
Verification detail Verified: all installed copies satisfy fixed versions (All 1 installed copy/copies satisfy fix versions)
📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ css-loader@6.11.0
│ └─┬ postcss@8.5.29
│   └── source-map-js@1.2.2 deduped
├─┬ sass@1.105.1
│ └── source-map-js@1.2.2
└─┬ stylelint@16.12.0 invalid: "^15.3.0" from node_modules/stylelint-config-standard
 └─┬ css-tree@3.2.1
   └── source-map-js@1.2.2 deduped

Before — yarn why 

├─ css-tree@npm:3.2.1
│  └─ source-map-js@npm:1.2.2 (via npm:^1.2.1)
│
├─ postcss@npm:8.5.29
│  └─ source-map-js@npm:1.2.2 (via npm:^1.2.2)
│
└─ sass@npm:1.105.1
  └─ source-map-js@npm:1.2.2 (via npm:>=0.6.2 <2.0.0)

After — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ css-loader@6.11.0
│ └─┬ postcss@8.5.29
│   └── source-map-js@1.2.2 deduped
├─┬ sass@1.105.1
│ └── source-map-js@1.2.2
└─┬ stylelint@16.12.0 invalid: "^15.3.0" from node_modules/stylelint-config-standard
 └─┬ css-tree@3.2.1
   └── source-map-js@1.2.2 deduped

After — yarn why 

├─ css-tree@npm:3.2.1
│  └─ source-map-js@npm:1.2.2 (via npm:^1.2.1)
│
├─ postcss@npm:8.5.29
│  └─ source-map-js@npm:1.2.2 (via npm:^1.2.2)
│
└─ sass@npm:1.105.1
  └─ source-map-js@npm:1.2.2 (via npm:>=0.6.2 <2.0.0)

Report generated by audit-report.ts. Artifacts in cve-artifacts/.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@anwesha-palit-redhat anwesha-palit-redhat added the approved Label for Approved PRs label Oct 5, 2026
@openshift-merge-bot
openshift-merge-bot Bot merged commit 1afce62 into release-v1.22.x Oct 5, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ankrsinha ankrsinha ankrsinha approved these changes
@anwesha-palit-redhat anwesha-palit-redhat anwesha-palit-redhat approved these changes

Assignees

@ankrsinha ankrsinha

@anwesha-palit-redhat anwesha-palit-redhat

Labels

approved Label for Approved PRs jira/valid-reference lgtm Looks Good to Me Label needs-ok-to-test

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@openshift-ci-robot @ankrsinha @anwesha-palit-redhat