RHIDP-16111: fix quickstart cves

[kim-tsao]

Hey, I just made a Pull Request!

Fixes: https://redhat.atlassian.net/browse/RHIDP-16111

• Updates CVEs in main that were previous fixed in Z streams.
• Fixed some moderates intended for next release.
• Prioritized updates on prod dependencies and dev deps (which will show up in SBOMs). Ignored anything from local harnesses (app, app-legacy, backend)

• fast-xml-parser: Ran a yarn up -R on the various @aws-sdk clients to bump the transitive deps
• react-router: yarn up -R react-router-dom to bump transitive dep
• axios: yarn up -R axios. Fixed everywhere except for repo-tools which is a dev dep
• form-data: yarn up -R form-data
• minimatch: yarn up -R minimatch
• js-yaml: yarn up -R js-yaml
• js-cookie: `yarn up -R @react-hookz/web and react-use" to bump transitive dep
• undici: yarn up -R undici. Fixed everywhere except for dev deps

✔️ Checklist

• A changeset describing the change and affected packages. (more info)
• Added or Updated documentation
• Tests for new functionality and regression tests for bug fixes
• Screenshots attached (for UI changes)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 58.52%. Comparing base (258cfc7) to head (a0c0edd).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4244   +/-   ##
=======================================
  Coverage   58.52%   58.52%           
=======================================
  Files        2447     2447           
  Lines       97252    97252           
  Branches    26994    26994           
=======================================
  Hits        56913    56913           
  Misses      40146    40146           
  Partials      193      193           

Flag	Coverage Δ		*Carryforward flag
adoption-insights	84.55% <ø> (ø)		Carriedforward from 258cfc7
ai-integrations	69.76% <ø> (ø)		Carriedforward from 258cfc7
app-defaults	69.79% <ø> (ø)		Carriedforward from 258cfc7
augment	46.67% <ø> (ø)		Carriedforward from 258cfc7
boost	77.63% <ø> (ø)		Carriedforward from 258cfc7
bulk-import	72.79% <ø> (ø)		Carriedforward from 258cfc7
cost-management	13.55% <ø> (ø)		Carriedforward from 258cfc7
dcm	67.21% <ø> (ø)		Carriedforward from 258cfc7
extensions	56.59% <ø> (ø)		Carriedforward from 258cfc7
global-floating-action-button	71.18% <ø> (ø)		Carriedforward from 258cfc7
global-header	66.50% <ø> (ø)		Carriedforward from 258cfc7
homepage	47.59% <ø> (ø)		Carriedforward from 258cfc7
install-dynamic-plugins	59.95% <ø> (ø)		Carriedforward from 258cfc7
intelligent-assistant	75.24% <ø> (ø)		Carriedforward from 258cfc7
konflux	91.98% <ø> (ø)		Carriedforward from 258cfc7
lightspeed	69.02% <ø> (ø)		Carriedforward from 258cfc7
mcp-integrations	83.40% <ø> (ø)		Carriedforward from 258cfc7
orchestrator	68.10% <ø> (ø)		Carriedforward from 258cfc7
quickstart	63.74% <ø> (ø)
sandbox	79.56% <ø> (ø)		Carriedforward from 258cfc7
scorecard	86.23% <ø> (ø)		Carriedforward from 258cfc7
theme	88.77% <ø> (ø)		Carriedforward from 258cfc7
translations	5.12% <ø> (ø)		Carriedforward from 258cfc7
x2a	79.20% <ø> (ø)		Carriedforward from 258cfc7

*This pull request uses carry forward flags. Click here to find out more.

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 258cfc7...a0c0edd. Read the comment docs.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rhdh-qodo-merge]

PR Summary by Qodo

Fix Quickstart CVEs via dependency bumps in yarn.lock

🐞 Bug fix ⚙️ Configuration changes 🕐 20-40 Minutes

AI Description

• Bump vulnerable Quickstart dependencies to remediate RHIDP-16111 CVEs.
• Refresh transitive trees for AWS SDK, axios, undici, minimatch, and XML parsing.
• Update routing and cookie/yaml packages to pick up security patches.

Diagram

graph TD
  A["Quickstart workspace"] --> B["workspaces/quickstart/yarn.lock"] --> C["Yarn resolver"] --> D["npm registry"] --> E["Updated dependency graph"] --> F["Quickstart build/runtime"]
  G["CVE scanner"] --> B

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Use Yarn resolutions/overrides for targeted transitive pinning

• ➕ Smaller diff; avoids broad upgrades (especially large AWS SDK/Smithy churn)
• ➕ Can quickly force patched versions when upstream ranges lag
• ➖ Can mask dependency incompatibilities until runtime
• ➖ Creates ongoing maintenance burden when upstream versions change

2. Automate dependency/CVE remediation via Renovate or Dependabot

• ➕ Continuous, incremental upgrades reduce large lockfile jumps
• ➕ Standardizes security update workflow and review cadence
• ➖ Requires configuration and ongoing triage of PR volume
• ➖ Still may produce large lockfile diffs for monorepos

3. Temporary patching (patch-package) for emergency CVEs

• ➕ Fast mitigation when no safe upgrade path exists
• ➖ Not a long-term solution; patches can break on reinstall/upgrade
• ➖ Harder to audit and can diverge from upstream fixes

Recommendation: Proceed with the PR’s approach (upgrading packages and regenerating the lockfile) as the most durable remediation path for CVEs. Prefer avoiding long-lived resolutions/patches unless an upgrade is blocked; consider a follow-up to enable automated dependency update tooling to keep future CVE fixes smaller and more frequent.

Files changed (1) +418 / -1252

Other (1) +418 / -1252

yarn.lockRegenerate lockfile to pull patched versions for CVE remediation +418/-1252

Regenerate lockfile to pull patched versions for CVE remediation

• Updates resolved versions across several vulnerable dependency families, including AWS SDK/Smithy packages, fast-xml-parser and related XML helpers, axios and its transitive dependencies (form-data, follow-redirects, proxy-from-env), react-router-dom/@remix-run/router, js-yaml, js-cookie, minimatch/brace-expansion, and undici. Adds new transitive packages introduced by upgrades (e.g., @aws-sdk/checksums, fast-xml-builder, @nodable/entities, is-unsafe, xml-naming).

workspaces/quickstart/yarn.lock

[rhdh-qodo-merge]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can reply 'qodo' on any finding to push back, ask questions, or dig deeper

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[its-mitesh-kumar]

/lgtm