chore: Fix vulnerable dependencies on release-v1.15.x

[github-actions]

CVE Remediation Report

Generated: 2026-10-06T09:26:33.945Z

Release branch: release-v1.15.x

Overall status

❌ One or more packages failed verification

Summary

Package	Fixed version(s)	Strategy	Verified
immutable	4.3.9, 5.1.8	⚠️ Manual triage required	⚠️ Triage needed
qs	6.16.0	🔧 Parent upgrade	❌ Failed

Package details

1. immutable

Field	Value
Fixed version(s)	4.3.9, 5.1.8
Strategy	⚠️ Manual triage required
Reason	No same-major fix for installed major(s) [3] — available fixes cover major(s) [4, 5]; cross-major resolution would break semver contracts — needs manual triage
Action taken	Skipped — triage needed (cannot auto-remediate)
Verification	⚠️ Triage needed
Verification detail	Skipped verification — package requires triage

Action required: This package could not be auto-remediated.
Review the analysis artifact and apply a fix manually before closing this ticket.

📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ @openshift-console/dynamic-plugin-sdk@1.4.0
│ └── immutable@3.8.4
├─┬ @openshift/dynamic-plugin-sdk-utils@4.1.0
│ └── immutable@3.8.4 deduped
└─┬ sass@1.105.1
  └── immutable@5.1.9

Before — yarn why

├─ @openshift-console/dynamic-plugin-sdk@npm:1.4.0
│  └─ immutable@npm:3.8.4 (via npm:3.x)
│
├─ @openshift/dynamic-plugin-sdk-utils@npm:4.1.0
│  └─ immutable@npm:3.8.4 (via npm:^3.8.2)
│
├─ @openshift/dynamic-plugin-sdk-utils@npm:4.1.0 [def00]
│  └─ immutable@npm:3.8.4 (via npm:^3.8.2)
│
└─ sass@npm:1.105.1
   └─ immutable@npm:5.1.9 (via npm:^5.1.5)

2. qs

Field	Value
Fixed version(s)	6.16.0
Strategy	🔧 Parent upgrade
Reason	Upgrading a direct parent pulls in the fix: url@0.11.4 (pulls qs@^6.12.3, satisfies 6.16.0)
Action taken	Updated resolutions: {"qs@6.14.2":"6.16.0"} [WARNINGS: ⚠ Vulnerable copy remains: qs@6.14.2 (expected >= 6.16.0)]
Verification	❌ Failed
Verification detail	Verification failed: strategy=parent-upgrade — Upgrading a direct parent pulls in the fix: url@0.11.4 (pulls qs@^6.12.3, satisfies 6.16.0)

📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ cypress@13.17.0 invalid: "^3 || ^4 || ^5 || ^6" from node_modules/cypress-axe
│ └─┬ @cypress/request@3.0.10
│   └── qs@6.14.2
├─┬ url@0.11.4
│ └── qs@6.16.0
└─┬ webpack-dev-server@5.2.6
  └─┬ express@4.22.3
    ├─┬ body-parser@1.20.8
    │ └── qs@6.16.0 deduped
    └── qs@6.16.0 deduped

Before — yarn why

├─ @cypress/request@npm:3.0.10
│  └─ qs@npm:6.14.2 (via npm:~6.14.1)
│
├─ body-parser@npm:1.20.8
│  └─ qs@npm:6.16.0 (via npm:~6.16.0)
│
├─ express@npm:4.22.3
│  └─ qs@npm:6.16.0 (via npm:~6.16.0)
│
└─ url@npm:0.11.4
   └─ qs@npm:6.16.0 (via npm:^6.12.3)

After — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ cypress@13.17.0 invalid: "^3 || ^4 || ^5 || ^6" from node_modules/cypress-axe
│ └─┬ @cypress/request@3.0.10
│   └── qs@6.14.2
├─┬ url@0.11.4
│ └── qs@6.16.0
└─┬ webpack-dev-server@5.2.6
  └─┬ express@4.22.3
    ├─┬ body-parser@1.20.8
    │ └── qs@6.16.0 deduped
    └── qs@6.16.0 deduped

After — yarn why

├─ @cypress/request@npm:3.0.10
│  └─ qs@npm:6.14.2 (via npm:~6.14.1)
│
├─ body-parser@npm:1.20.8
│  └─ qs@npm:6.16.0 (via npm:~6.16.0)
│
├─ express@npm:4.22.3
│  └─ qs@npm:6.16.0 (via npm:~6.16.0)
│
└─ url@npm:0.11.4
   └─ qs@npm:6.16.0 (via npm:^6.12.3)

---

Report generated by audit-report.ts. Artifacts in cve-artifacts/.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: github-actions[bot]
Once this PR has been reviewed and has the lgtm label, please assign anwesha-palit-redhat for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

Hi @github-actions[bot]. Thanks for your PR.

I'm waiting for a openshift-pipelines member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.