fix global-header cves

[kim-tsao]

Hey, I just made a Pull Request!

Fixes https://redhat.atlassian.net/browse/RHIDP-16115

• Updates CVEs in main that were previous fixed in Z streams.
• Fixed some moderates intended for next release.
• Prioritized updates on prod dependencies and dev deps (which will show up in SBOMs). Ignored anything from local harnesses (app, app-legacy, backend)

• fast-xml-parser: Ran a yarn up -R on the various @aws-sdk clients to bump the transitive deps
• tar-fs: yarn up -R dockerode to update transitive dep
• axios: yarn up -R axios. Fixed everywhere except workspace repo-tools which is a dev dep
• minimatch: yarn up -R minimatch. Fixed everywhere except workspace repo-tools which is a dev dep
• path-to-regexp: yarn up -R path-to-regexp
• js-cookie: yarn up -R react-use to bump transitive dep
• js-yaml: yarn up -R js-yaml
• multer: yarn up -R multer
• jws: yarn up -R jws
• react-router: yarn up -R react-router-dom to bump transitive dep, yarn up -R react-router

✔️ Checklist

• A changeset describing the change and affected packages. (more info)
• Added or Updated documentation
• Tests for new functionality and regression tests for bug fixes
• Screenshots attached (for UI changes)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 58.52%. Comparing base (258cfc7) to head (4779cbd).
⚠️ Report is 4 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4248   +/-   ##
=======================================
  Coverage   58.52%   58.52%           
=======================================
  Files        2447     2447           
  Lines       97252    97252           
  Branches    26994    26994           
=======================================
  Hits        56913    56913           
- Misses      40146    40147    +1     
+ Partials      193      192    -1     

Flag	Coverage Δ		*Carryforward flag
adoption-insights	84.55% <ø> (ø)		Carriedforward from 6af398f
ai-integrations	69.76% <ø> (ø)		Carriedforward from 6af398f
app-defaults	69.79% <ø> (ø)		Carriedforward from 6af398f
augment	46.67% <ø> (ø)		Carriedforward from 6af398f
boost	77.63% <ø> (ø)		Carriedforward from 6af398f
bulk-import	72.79% <ø> (ø)		Carriedforward from 6af398f
cost-management	13.55% <ø> (ø)		Carriedforward from 6af398f
dcm	67.21% <ø> (ø)		Carriedforward from 6af398f
extensions	56.59% <ø> (ø)		Carriedforward from 6af398f
global-floating-action-button	71.18% <ø> (ø)		Carriedforward from 6af398f
global-header	66.50% <ø> (ø)
homepage	47.59% <ø> (ø)		Carriedforward from 6af398f
install-dynamic-plugins	59.95% <ø> (ø)		Carriedforward from 6af398f
intelligent-assistant	75.24% <ø> (ø)		Carriedforward from 6af398f
konflux	91.98% <ø> (ø)		Carriedforward from 6af398f
lightspeed	69.02% <ø> (ø)		Carriedforward from 6af398f
mcp-integrations	83.40% <ø> (ø)		Carriedforward from 6af398f
orchestrator	68.10% <ø> (ø)		Carriedforward from 6af398f
quickstart	63.74% <ø> (ø)		Carriedforward from 6af398f
sandbox	79.56% <ø> (ø)		Carriedforward from 6af398f
scorecard	86.23% <ø> (ø)		Carriedforward from 6af398f
theme	88.77% <ø> (ø)		Carriedforward from 6af398f
translations	5.12% <ø> (ø)		Carriedforward from 6af398f
x2a	79.20% <ø> (ø)		Carriedforward from 6af398f

*This pull request uses carry forward flags. Click here to find out more.

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 258cfc7...4779cbd. Read the comment docs.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rhdh-qodo-merge]

PR Summary by Qodo

Fix global-header dependency CVEs via lockfile refresh

🐞 Bug fix ⚙️ Configuration changes 🕐 40+ Minutes

AI Description

• Update global-header dependency tree to remediate reported CVEs (prod + SBOM-visible dev deps).
• Bump AWS SDK/Smithy and other transitive chains via recursive upgrades.
• Upgrade vulnerable packages (axios, tar-fs/dockerode, minimatch, js-yaml, multer, jws,
 react-router).

Diagram

graph TD
  GH["Global-header workspace"] --> LOCK["workspaces/global-header/yarn.lock"] --> DEPS["Pinned dependency set"]
  DEPS --> AWS["AWS SDK + Smithy"]
  DEPS --> NET["HTTP stack (axios)"]
  DEPS --> DOCKER["dockerode + tar-fs"]
  DEPS --> ROUTER["react-router stack"]
  LOCK --> SCAN{{"CVE/SBOM scanners"}}

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Use targeted Yarn resolutions/overrides only

• ➕ Minimizes dependency graph churn while silencing specific CVEs
• ➕ Lower risk of behavioral changes from major/minor upgrades
• ➖ Can mask underlying outdated parents and accumulate technical debt
• ➖ May be brittle across workspaces and future upgrades

2. Automate via Renovate/Dependabot with grouped security PRs

• ➕ Creates smaller, reviewable upgrade batches with consistent cadence
• ➕ Often comes with auto-generated changelogs and CVE context
• ➖ Still needs initial cleanup for existing CVE backlog
• ➖ May require repo-specific tuning to avoid PR noise

Recommendation: Given the CVE-driven goal, the current approach (upgrading the parent packages that pull vulnerable transitive deps and regenerating yarn.lock) is the most robust long-term fix. Prefer this over adding broad lockfile resolutions unless a CVE cannot be remediated without an ecosystem-breaking bump; in that case, use a temporary resolution with a follow-up ticket to remove it.

Files changed (1) +450 / -1259

Other (1) +450 / -1259

yarn.lockRefresh lockfile to pull patched dependency versions +450/-1259

Refresh lockfile to pull patched dependency versions

• Updates the resolved dependency graph to remediate multiple CVEs by bumping direct and transitive packages. Notable bumps include axios (to 1.19.0), dockerode/tar-fs chain, minimatch across major lines, js-yaml, multer, jws/jwa, react-router(+@remix-run/router), and a broad AWS SDK/Smithy refresh; also updates google-cloud/storage and fast-xml-parser transitive chains.

workspaces/global-header/yarn.lock

[rhdh-qodo-merge]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 🔗 Cross-repo conflicts (1) 📜 Skill insights (0)

1. Downstream pin blocks CVE fixes 🔗 Cross-repo conflict ☼ Reliability

Description

This PR updates dependency resolutions in the Global Header workspace yarn.lock, but
redhat-developer/rhdh pins @red-hat-developer-hub/backstage-plugin-global-header to 1.21.5, so RHDH
won’t consume these dependency updates until a new plugin release is published and the RHDH
wrapper/overlay references are bumped.

Code

workspaces/global-header/yarn.lock[R22496-22499]

+"js-cookie@npm:^3.0.0":
+  version: 3.0.8
+  resolution: "js-cookie@npm:3.0.8"
+  checksum: 10c0/421912a4a55535bda32b3059835864e1182c3af5b4516df00a060edc1fa5a53d38bb8d5a91d5d305e396206f4fd11e829f17850aa5aa8164118c04d8ebf1ff5d

Relevance

●●● Strong

Team often requires version bump/changeset so downstream pinned wrappers can consume dependency/CVE
updates.

PR-#4202

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The PR changes the Global Header workspace’s locked dependency versions (example: js-cookie is now
locked at v3). RHDH consumes Global Header through a wrapper that hard-pins the plugin package
version, and its e2e harness references a specific OCI overlay tag, so downstream won’t see these
changes until a new plugin version is released and those pins are updated.

workspaces/global-header/yarn.lock[22496-22499]
workspaces/global-header/plugins/global-header/package.json[1-5]
External repo: redhat-developer/rhdh, dynamic-plugins/wrappers/red-hat-developer-hub-backstage-plugin-global-header/package.json [30-33]
External repo: redhat-developer/rhdh, e2e-tests/local-harness/dynamic-plugins.yaml [47-58]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The PR updates `workspaces/global-header/yarn.lock` dependency resolutions (CVE remediation), but downstream `rhdh` currently pins the Global Header plugin to a specific released version, so these updates won’t be picked up automatically.

## Issue Context
RHDH consumes Global Header via its dynamic-plugin wrapper and (in e2e harness) via an OCI overlay tag. To actually deliver the CVE fixes into RHDH builds/SBOMs, you need a coordinated release + downstream version bump/rebuild.

## Fix Focus Areas
- workspaces/global-header/yarn.lock[22496-22499]
- workspaces/global-header/plugins/global-header/package.json[1-5]
- (follow-up in redhat-developer/rhdh) dynamic-plugins/wrappers/red-hat-developer-hub-backstage-plugin-global-header/package.json[30-33]
- (follow-up in redhat-developer/rhdh) e2e-tests/local-harness/dynamic-plugins.yaml[47-58]

## Suggested remediation steps
1. Cut/publish a new release of `@red-hat-developer-hub/backstage-plugin-global-header` that includes these dependency resolution updates (typically via changeset/version bump as required by this repo’s release process).
2. Open a coordinated PR in `redhat-developer/rhdh` to bump the wrapper dependency from `1.21.5` to the newly released version.
3. Rebuild/update any referenced overlay images/tags used by tests (e.g., the `1.21.6` overlay reference) to ensure CI and runtime use the remediated dependency set.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context used

⚠️ Tickets: not configured — ticket URL found in PR but could not be fetched — check ticket provider credentials

✅ Compliance rules (platform): 11 rules

✅ Cross-repo context

  Explored: repo: redhat-developer/rhdh (sha: 820e6260)

  Explored: repo: redhat-developer/rhdh-operator (sha: a425373c)

  Explored: repo: redhat-developer/rhdh-local (sha: a1776caa)

  Not relevant to this PR: redhat-developer/rhdh-chart

Tip of the day

💡 Did you know, you can reply 'qodo' on any finding to push back, ask questions, or dig deeper

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[its-mitesh-kumar]

/lgtm