Skip to content

SRVKP-13229: chore: Fix vulnerable dependencies on release-v1.15.x - #1321

Merged
openshift-merge-bot[bot] merged 1 commit into
release-v1.15.xfrom
auto/cve/fix-release-v1.15.x
Sep 1, 2026
Merged

SRVKP-13229: chore: Fix vulnerable dependencies on release-v1.15.x#1321
openshift-merge-bot[bot] merged 1 commit into
release-v1.15.xfrom
auto/cve/fix-release-v1.15.x

Conversation

@github-actions

@github-actions github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown

CVE Remediation Report

Generated: 2026-09-01T07:18:21.562Z

Release branch: release-v1.15.x

Overall status

❌ One or more packages failed verification

Summary

Package Fixed version(s) Strategy Verified
fast-uri 2.4.5, 3.1.6, 4.1.3 ✅ Already remediated ✅ Verified
extract-zip 2.0.1 ✅ Already remediated ✅ Verified
webpack-dev-middleware 5.3.4, 6.1.2, 7.1.0 ✅ Already remediated ✅ Verified
postcss 8.5.12 ✅ Already remediated ✅ Verified
undici 6.24.0, 7.24.0 ⚠️ Manual triage required ⚠️ Triage needed
js-yaml 5.2.2 ⚠️ Manual triage required ⚠️ Triage needed
lodash 4.18.0 🔧 Parent upgrade ❌ Failed

Package details

1. fast-uri

Field Value
Fixed version(s) 2.4.5, 3.1.6, 4.1.3
Strategy ✅ Already remediated
Reason All 1 installed copy/copies satisfy fix versions
Action taken No changes required (already remediated)
Verification ✅ Verified
Verification detail Verified: all installed copies satisfy fixed versions (All 1 installed copy/copies satisfy fix versions)
📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ copy-webpack-plugin@13.0.1
│ └─┬ schema-utils@4.3.3
│   └─┬ ajv@8.20.0
│     └── fast-uri@3.1.6
└─┬ stylelint@16.12.0 invalid: "^15.3.0" from node_modules/stylelint-config-standard
  └─┬ table@6.9.0
    └─┬ ajv@8.20.0
      └── fast-uri@3.1.6 deduped

Before — yarn why 

└─ ajv@npm:8.20.0
   └─ fast-uri@npm:3.1.6 (via npm:^3.1.1)

After — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ copy-webpack-plugin@13.0.1
│ └─┬ schema-utils@4.3.3
│   └─┬ ajv@8.20.0
│     └── fast-uri@3.1.6
└─┬ stylelint@16.12.0 invalid: "^15.3.0" from node_modules/stylelint-config-standard
  └─┬ table@6.9.0
    └─┬ ajv@8.20.0
      └── fast-uri@3.1.6 deduped

After — yarn why 

└─ ajv@npm:8.20.0
   └─ fast-uri@npm:3.1.6 (via npm:^3.1.1)

2. extract-zip

Field Value
Fixed version(s) 2.0.1
Strategy ✅ Already remediated
Reason All 1 installed copy/copies satisfy fix versions
Action taken No changes required (already remediated)
Verification ✅ Verified
Verification detail Verified: all installed copies satisfy fixed versions (All 1 installed copy/copies satisfy fix versions)
📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
└─┬ cypress@13.17.0 invalid: "^3 || ^4 || ^5 || ^6" from node_modules/cypress-axe
  └── extract-zip@2.0.1

Before — yarn why 

└─ cypress@npm:13.17.0
   └─ extract-zip@npm:2.0.1 (via npm:2.0.1)

After — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
└─┬ cypress@13.17.0 invalid: "^3 || ^4 || ^5 || ^6" from node_modules/cypress-axe
  └── extract-zip@2.0.1

After — yarn why 

└─ cypress@npm:13.17.0
   └─ extract-zip@npm:2.0.1 (via npm:2.0.1)

3. webpack-dev-middleware

Field Value
Fixed version(s) 5.3.4, 6.1.2, 7.1.0
Strategy ✅ Already remediated
Reason All 1 installed copy/copies satisfy fix versions
Action taken No changes required (already remediated)
Verification ✅ Verified
Verification detail Verified: all installed copies satisfy fixed versions (All 1 installed copy/copies satisfy fix versions)
📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
└─┬ webpack-dev-server@5.2.6
  └── webpack-dev-middleware@7.4.5

Before — yarn why 

├─ webpack-dev-server@npm:5.2.6
│  └─ webpack-dev-middleware@npm:7.4.5 (via npm:^7.4.2)
│
└─ webpack-dev-server@npm:5.2.6 [def00]
   └─ webpack-dev-middleware@npm:7.4.5 [3f729] (via npm:^7.4.2 [3f729])

After — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
└─┬ webpack-dev-server@5.2.6
  └── webpack-dev-middleware@7.4.5

After — yarn why 

├─ webpack-dev-server@npm:5.2.6
│  └─ webpack-dev-middleware@npm:7.4.5 (via npm:^7.4.2)
│
└─ webpack-dev-server@npm:5.2.6 [def00]
   └─ webpack-dev-middleware@npm:7.4.5 [3f729] (via npm:^7.4.2 [3f729])

4. postcss

Field Value
Fixed version(s) 8.5.12
Strategy ✅ Already remediated
Reason All 1 installed copy/copies satisfy fix versions
Action taken No changes required (already remediated)
Verification ✅ Verified
Verification detail Verified: all installed copies satisfy fixed versions (All 1 installed copy/copies satisfy fix versions)
📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ css-loader@6.11.0
│ ├─┬ icss-utils@5.1.0
│ │ └── postcss@8.5.26 deduped
│ ├─┬ postcss-modules-extract-imports@3.1.0
│ │ └── postcss@8.5.26 deduped
│ ├─┬ postcss-modules-local-by-default@4.2.0
│ │ └── postcss@8.5.26 deduped
│ ├─┬ postcss-modules-scope@3.2.1
│ │ └── postcss@8.5.26 deduped
│ ├─┬ postcss-modules-values@4.0.0
│ │ └── postcss@8.5.26 deduped
│ └── postcss@8.5.26
├─┬ resolve-url-loader@5.0.0
│ └── postcss@8.5.26 deduped
└─┬ stylelint@16.12.0 invalid: "^15.3.0" from node_modules/stylelint-config-standard
  ├─┬ postcss-safe-parser@7.0.1
  │ └── postcss@8.5.26 deduped
  └── postcss@8.5.26 deduped

Before — yarn why 

├─ css-loader@npm:6.11.0
│  └─ postcss@npm:8.5.26 (via npm:^8.4.33)
│
├─ css-loader@npm:6.11.0 [def00]
│  └─ postcss@npm:8.5.26 (via npm:^8.4.33)
│
├─ resolve-url-loader@npm:5.0.0
│  └─ postcss@npm:8.5.26 (via npm:^8.2.14)
│
└─ stylelint@npm:16.12.0
   └─ postcss@npm:8.5.26 (via npm:^8.4.49)

After — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ css-loader@6.11.0
│ ├─┬ icss-utils@5.1.0
│ │ └── postcss@8.5.26 deduped
│ ├─┬ postcss-modules-extract-imports@3.1.0
│ │ └── postcss@8.5.26 deduped
│ ├─┬ postcss-modules-local-by-default@4.2.0
│ │ └── postcss@8.5.26 deduped
│ ├─┬ postcss-modules-scope@3.2.1
│ │ └── postcss@8.5.26 deduped
│ ├─┬ postcss-modules-values@4.0.0
│ │ └── postcss@8.5.26 deduped
│ └── postcss@8.5.26
├─┬ resolve-url-loader@5.0.0
│ └── postcss@8.5.26 deduped
└─┬ stylelint@16.12.0 invalid: "^15.3.0" from node_modules/stylelint-config-standard
  ├─┬ postcss-safe-parser@7.0.1
  │ └── postcss@8.5.26 deduped
  └── postcss@8.5.26 deduped

After — yarn why 

├─ css-loader@npm:6.11.0
│  └─ postcss@npm:8.5.26 (via npm:^8.4.33)
│
├─ css-loader@npm:6.11.0 [def00]
│  └─ postcss@npm:8.5.26 (via npm:^8.4.33)
│
├─ resolve-url-loader@npm:5.0.0
│  └─ postcss@npm:8.5.26 (via npm:^8.2.14)
│
└─ stylelint@npm:16.12.0
   └─ postcss@npm:8.5.26 (via npm:^8.4.49)

5. undici

Field Value
Fixed version(s) 6.24.0, 7.24.0
Strategy ⚠️ Manual triage required
Reason No same-major fix for installed major(s) [8] — available fixes cover major(s) [6, 7]; cross-major resolution would break semver contracts — needs manual triage
Action taken Skipped — triage needed (cannot auto-remediate)
Verification ⚠️ Triage needed
Verification detail Skipped verification — package requires triage

Action required: This package could not be auto-remediated.
Review the analysis artifact and apply a fix manually before closing this ticket.

📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ i18next-parser@3.11.0
│ └─┬ cheerio@1.2.0
│   └── undici@7.29.0
└─┬ node-gyp@13.0.2 extraneous
  └── undici@8.10.1 extraneous

Before — yarn why 

├─ cheerio@npm:1.2.0
│  └─ undici@npm:7.29.0 (via npm:^7.19.0)
│
└─ node-gyp@npm:13.0.2
   └─ undici@npm:8.10.1 (via npm:^8.4.1)

6. js-yaml

Field Value
Fixed version(s) 5.2.2
Strategy ⚠️ Manual triage required
Reason No same-major fix for installed major(s) [3, 4] — available fixes cover major(s) [5]; cross-major resolution would break semver contracts — needs manual triage
Action taken Skipped — triage needed (cannot auto-remediate)
Verification ⚠️ Triage needed
Verification detail Skipped verification — package requires triage

Action required: This package could not be auto-remediated.
Review the analysis artifact and apply a fix manually before closing this ticket.

📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ eslint@8.57.1
│ ├─┬ @eslint/eslintrc@2.1.4
│ │ └── js-yaml@4.3.2 deduped
│ └── js-yaml@4.3.2
├─┬ i18next-parser@3.11.0
│ └── js-yaml@4.3.0 invalid: "4.1.0" from node_modules/i18next-parser
├─┬ openapi-typescript@7.13.0
│ └─┬ @redocly/openapi-core@1.34.19
│   └── js-yaml@4.3.1
├─┬ stylelint@16.12.0 invalid: "^15.3.0" from node_modules/stylelint-config-standard
│ └─┬ cosmiconfig@9.0.2
│   └── js-yaml@4.3.2 deduped
└─┬ ts-jest@29.4.12
  └─┬ @jest/transform@30.0.0-alpha.7 invalid: "^29.0.0 || ^30.0.0" from node_modules/ts-jest
    └─┬ babel-plugin-istanbul@7.0.1
      └─┬ @istanbuljs/load-nyc-config@1.1.0
        └── js-yaml@3.15.2

Before — yarn why 

├─ @eslint/eslintrc@npm:2.1.4
│  └─ js-yaml@npm:4.3.2 (via npm:^4.1.0)
│
├─ @istanbuljs/load-nyc-config@npm:1.1.0
│  └─ js-yaml@npm:3.15.2 (via npm:^3.13.1)
│
├─ @redocly/openapi-core@npm:1.34.19
│  └─ js-yaml@npm:4.3.1 (via npm:4.3.1)
│
├─ cosmiconfig@npm:9.0.2
│  └─ js-yaml@npm:4.3.2 (via npm:^4.1.0)
│
├─ cosmiconfig@npm:9.0.2 [0d1dc]
│  └─ js-yaml@npm:4.3.2 (via npm:^4.1.0)
│
├─ eslint@npm:8.57.1
│  └─ js-yaml@npm:4.3.2 (via npm:^4.1.0)
│
└─ i18next-parser@npm:3.11.0
   └─ js-yaml@npm:4.3.0 (via npm:4.3.0)

7. lodash

Field Value
Fixed version(s) 4.18.0
Strategy 🔧 Parent upgrade
Reason Upgrading a direct parent pulls in the fix: @cypress/webpack-preprocessor@8.0.0 (pulls lodash@^4.17.20, satisfies 4.18.0); cypress@15.21.1 (pulls lodash@^4.17.23, satisfies 4.18.0); @openshift/dynamic-plugin-sdk@9.1.0 (pulls lodash@^4.17.23, satisfies 4.18.0); @openshift/dynamic-plugin-sdk-utils@5.0.3 (pulls lodash@^4.17.23, satisfies 4.18.0); @patternfly/react-charts@8.6.1 (pulls lodash@^4.17.23, satisfies 4.18.0); cypress-multi-reporters@2.0.5 (pulls lodash@^4.17.21, satisfies 4.18.0); formik@2.4.9 (pulls lodash@^4.17.21, satisfies 4.18.0)
Action taken Ran yarn up @cypress/webpack-preprocessor@8.0.0 (@cypress/webpack-preprocessor@8.0.0 (pulls lodash@^4.17.20, satisfies 4.18.0))
Verification ❌ Failed
Verification detail Verification failed: strategy=parent-upgrade — Upgrading a direct parent pulls in the fix: @cypress/webpack-preprocessor@8.0.0 (pulls lodash@^4.17.20, satisfies 4.18.0); cypress@15.21.1 (pulls lodash@^4.17.23, satisfies 4.18.0); @openshift/dynamic-plugin-sdk@9.1.0 (pulls lodash@^4.17.23, satisfies 4.18.0); @openshift/dynamic-plugin-sdk-utils@5.0.3 (pulls lodash@^4.17.23, satisfies 4.18.0); @patternfly/react-charts@8.6.1 (pulls lodash@^4.17.23, satisfies 4.18.0); cypress-multi-reporters@2.0.5 (pulls lodash@^4.17.21, satisfies 4.18.0); formik@2.4.9 (pulls lodash@^4.17.21, satisfies 4.18.0)
📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ @cypress/webpack-preprocessor@5.17.1
│ └── lodash@4.17.23 invalid: "4.17.21" from node_modules/gherkin-lint
├─┬ @openshift-console/dynamic-plugin-sdk-webpack@1.1.1
│ ├─┬ @openshift/dynamic-plugin-sdk-webpack@4.1.0
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ └── lodash@4.17.23 deduped
├─┬ @openshift-console/dynamic-plugin-sdk@1.4.0
│ └── lodash@4.17.23 deduped
├─┬ @openshift/dynamic-plugin-sdk-utils@4.1.0
│ └── lodash@4.17.23 deduped
├─┬ @openshift/dynamic-plugin-sdk@4.0.0
│ ├── lodash@4.17.23 deduped
│ └─┬ yup@0.32.11
│   └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
├─┬ @patternfly/react-charts@7.2.2
│ ├── lodash@4.17.23 deduped
│ ├─┬ victory-area@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-axis@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-bar@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-box-plot@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-chart@36.9.2
│ │ ├── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ │ ├─┬ victory-polar-axis@36.9.2
│ │ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ │ └─┬ victory-shared-events@36.9.2
│ │   └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-core@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-create-container@36.9.2
│ │ ├── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ │ ├─┬ victory-brush-container@36.9.2
│ │ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ │ └─┬ victory-selection-container@36.9.2
│ │   └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-cursor-container@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-group@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-legend@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-line@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-pie@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-scatter@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-stack@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-tooltip@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-voronoi-container@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ └─┬ victory-zoom-container@36.9.2
│   └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
├─┬ @patternfly/react-component-groups@5.5.8
│ └─┬ @patternfly/react-table@5.4.16
│   └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
├─┬ @patternfly/react-table@5.2.1
│ └── lodash@4.17.23 deduped
├─┬ @patternfly/react-topology@5.2.1
│ ├─┬ dagre@0.8.2
│ │ ├─┬ graphlib@2.1.8
│ │ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ └── lodash@4.17.23 deduped
├─┬ cypress-multi-reporters@1.6.4
│ └── lodash@4.17.23 deduped
├─┬ cypress@13.17.0 invalid: "^3 || ^4 || ^5 || ^6" from node_modules/cypress-axe
│ └── lodash@4.17.23 deduped
├─┬ formik@2.0.3
│ └── lodash@4.17.23 deduped
└─┬ gherkin-lint@4.2.4
  └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint

Before — yarn why 

├─ @cypress/webpack-preprocessor@npm:5.17.1
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @cypress/webpack-preprocessor@npm:5.17.1 [def00]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @openshift-console/dynamic-plugin-sdk-webpack@npm:1.1.1
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @openshift-console/dynamic-plugin-sdk-webpack@npm:1.1.1 [def00]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @openshift-console/dynamic-plugin-sdk@npm:1.4.0
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @openshift/dynamic-plugin-sdk-utils@npm:4.1.0
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @openshift/dynamic-plugin-sdk-utils@npm:4.1.0 [def00]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @openshift/dynamic-plugin-sdk-webpack@npm:4.1.0
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @openshift/dynamic-plugin-sdk-webpack@npm:4.1.0 [fe5fa]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @openshift/dynamic-plugin-sdk@npm:4.0.0
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @openshift/dynamic-plugin-sdk@npm:4.0.0 [def00]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @patternfly/react-charts@npm:7.2.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @patternfly/react-charts@npm:7.2.2 [def00]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @patternfly/react-table@npm:5.2.1
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @patternfly/react-table@npm:5.4.16
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @patternfly/react-table@npm:5.4.16 [286ce]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @patternfly/react-table@npm:5.2.1 [def00]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @patternfly/react-topology@npm:5.2.1
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @patternfly/react-topology@npm:5.2.1 [def00]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ cypress-multi-reporters@npm:1.6.4
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ cypress-multi-reporters@npm:1.6.4 [def00]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ cypress@npm:13.17.0
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ dagre@npm:0.8.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ formik@npm:2.0.3
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ formik@npm:2.0.3 [def00]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ gherkin-lint@npm:4.2.4
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ graphlib@npm:2.1.8
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-area@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-area@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-axis@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-axis@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-bar@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-bar@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-box-plot@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-box-plot@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-brush-container@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-brush-container@npm:36.9.2 [34e9a]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-chart@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-chart@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-core@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-core@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-create-container@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-create-container@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-cursor-container@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-cursor-container@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-group@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-group@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-legend@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-legend@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-line@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-line@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-pie@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-pie@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-polar-axis@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-polar-axis@npm:36.9.2 [589df]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-scatter@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-scatter@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-selection-container@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-selection-container@npm:36.9.2 [34e9a]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-shared-events@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-shared-events@npm:36.9.2 [589df]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-stack@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-stack@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-tooltip@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-tooltip@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-voronoi-container@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-voronoi-container@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-zoom-container@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-zoom-container@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
└─ yup@npm:0.32.11
   └─ lodash@npm:4.17.23 (via npm:4.17.23)

After — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ @cypress/webpack-preprocessor@8.0.0
│ └── lodash@4.17.23 invalid: "4.17.21" from node_modules/gherkin-lint
├─┬ @openshift-console/dynamic-plugin-sdk-webpack@1.1.1
│ ├─┬ @openshift/dynamic-plugin-sdk-webpack@4.1.0
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ └── lodash@4.17.23 deduped
├─┬ @openshift-console/dynamic-plugin-sdk@1.4.0
│ └── lodash@4.17.23 deduped
├─┬ @openshift/dynamic-plugin-sdk-utils@4.1.0
│ └── lodash@4.17.23 deduped
├─┬ @openshift/dynamic-plugin-sdk@4.0.0
│ ├── lodash@4.17.23 deduped
│ └─┬ yup@0.32.11
│   └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
├─┬ @patternfly/react-charts@7.2.2
│ ├── lodash@4.17.23 deduped
│ ├─┬ victory-area@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-axis@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-bar@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-box-plot@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-chart@36.9.2
│ │ ├── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ │ ├─┬ victory-polar-axis@36.9.2
│ │ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ │ └─┬ victory-shared-events@36.9.2
│ │   └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-core@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-create-container@36.9.2
│ │ ├── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ │ ├─┬ victory-brush-container@36.9.2
│ │ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ │ └─┬ victory-selection-container@36.9.2
│ │   └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-cursor-container@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-group@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-legend@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-line@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-pie@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-scatter@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-stack@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-tooltip@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-voronoi-container@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ └─┬ victory-zoom-container@36.9.2
│   └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
├─┬ @patternfly/react-component-groups@5.5.8
│ └─┬ @patternfly/react-table@5.4.16
│   └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
├─┬ @patternfly/react-table@5.2.1
│ └── lodash@4.17.23 deduped
├─┬ @patternfly/react-topology@5.2.1
│ ├─┬ dagre@0.8.2
│ │ ├─┬ graphlib@2.1.8
│ │ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ └── lodash@4.17.23 deduped
├─┬ cypress-multi-reporters@1.6.4
│ └── lodash@4.17.23 deduped
├─┬ cypress@13.17.0 invalid: "^3 || ^4 || ^5 || ^6" from node_modules/cypress-axe
│ └── lodash@4.17.23 deduped
├─┬ formik@2.0.3
│ └── lodash@4.17.23 deduped
└─┬ gherkin-lint@4.2.4
  └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint

After — yarn why 

├─ @cypress/webpack-preprocessor@npm:8.0.0
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @cypress/webpack-preprocessor@npm:8.0.0 [def00]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @openshift-console/dynamic-plugin-sdk-webpack@npm:1.1.1
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @openshift-console/dynamic-plugin-sdk-webpack@npm:1.1.1 [def00]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @openshift-console/dynamic-plugin-sdk@npm:1.4.0
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @openshift/dynamic-plugin-sdk-utils@npm:4.1.0
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @openshift/dynamic-plugin-sdk-utils@npm:4.1.0 [def00]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @openshift/dynamic-plugin-sdk-webpack@npm:4.1.0
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @openshift/dynamic-plugin-sdk-webpack@npm:4.1.0 [fe5fa]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @openshift/dynamic-plugin-sdk@npm:4.0.0
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @openshift/dynamic-plugin-sdk@npm:4.0.0 [def00]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @patternfly/react-charts@npm:7.2.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @patternfly/react-charts@npm:7.2.2 [def00]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @patternfly/react-table@npm:5.2.1
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @patternfly/react-table@npm:5.4.16
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @patternfly/react-table@npm:5.4.16 [286ce]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @patternfly/react-table@npm:5.2.1 [def00]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @patternfly/react-topology@npm:5.2.1
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @patternfly/react-topology@npm:5.2.1 [def00]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ cypress-multi-reporters@npm:1.6.4
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ cypress-multi-reporters@npm:1.6.4 [def00]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ cypress@npm:13.17.0
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ dagre@npm:0.8.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ formik@npm:2.0.3
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ formik@npm:2.0.3 [def00]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ gherkin-lint@npm:4.2.4
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ graphlib@npm:2.1.8
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-area@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-area@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-axis@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-axis@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-bar@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-bar@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-box-plot@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-box-plot@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-brush-container@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-brush-container@npm:36.9.2 [34e9a]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-chart@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-chart@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-core@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-core@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-create-container@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-create-container@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-cursor-container@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-cursor-container@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-group@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-group@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-legend@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-legend@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-line@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-line@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-pie@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-pie@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-polar-axis@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-polar-axis@npm:36.9.2 [589df]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-scatter@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-scatter@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-selection-container@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-selection-container@npm:36.9.2 [34e9a]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-shared-events@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-shared-events@npm:36.9.2 [589df]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-stack@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-stack@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-tooltip@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-tooltip@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-voronoi-container@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-voronoi-container@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-zoom-container@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-zoom-container@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
└─ yup@npm:0.32.11
   └─ lodash@npm:4.17.23 (via npm:4.17.23)

Report generated by audit-report.ts. Artifacts in cve-artifacts/.

@openshift-ci

openshift-ci Bot commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

Hi @github-actions[bot]. Thanks for your PR.

I'm waiting for a openshift-pipelines member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

anwesha-palit-redhat
anwesha-palit-redhat approved these changes Sep 1, 2026
View reviewed changes

@anwesha-palit-redhat anwesha-palit-redhat left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@openshift-ci openshift-ci Bot added the lgtm Looks Good to Me Label label Sep 1, 2026
@openshift-ci

openshift-ci Bot commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: anwesha-palit-redhat, github-actions[bot]

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:
  • OWNERS [anwesha-palit-redhat]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved Label for Approved PRs label Sep 1, 2026
@arvindk-softwaredev arvindk-softwaredev changed the title chore: Fix vulnerable dependencies on release-v1.15.x SRVKP-13229: chore: Fix vulnerable dependencies on release-v1.15.x Sep 1, 2026
@openshift-ci-robot

openshift-ci-robot commented Sep 1, 2026 •
edited by openshift-ci Bot
Loading

Copy link
Copy Markdown
Collaborator

@github-actions[bot]: This pull request references SRVKP-13229 which is a valid jira issue.

Details

In response to this:

CVE Remediation Report

Generated: 2026-09-01T07:18:21.562Z

Release branch: release-v1.15.x

Overall status

❌ One or more packages failed verification

Summary

Package Fixed version(s) Strategy Verified
fast-uri 2.4.5, 3.1.6, 4.1.3 ✅ Already remediated ✅ Verified
extract-zip 2.0.1 ✅ Already remediated ✅ Verified
webpack-dev-middleware 5.3.4, 6.1.2, 7.1.0 ✅ Already remediated ✅ Verified
postcss 8.5.12 ✅ Already remediated ✅ Verified
undici 6.24.0, 7.24.0 ⚠️ Manual triage required ⚠️ Triage needed
js-yaml 5.2.2 ⚠️ Manual triage required ⚠️ Triage needed
lodash 4.18.0 🔧 Parent upgrade ❌ Failed

Package details

1. fast-uri

Field Value
Fixed version(s) 2.4.5, 3.1.6, 4.1.3
Strategy ✅ Already remediated
Reason All 1 installed copy/copies satisfy fix versions
Action taken No changes required (already remediated)
Verification ✅ Verified
Verification detail Verified: all installed copies satisfy fixed versions (All 1 installed copy/copies satisfy fix versions)
📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ copy-webpack-plugin@13.0.1
│ └─┬ schema-utils@4.3.3
│   └─┬ ajv@8.20.0
│     └── fast-uri@3.1.6
└─┬ stylelint@16.12.0 invalid: "^15.3.0" from node_modules/stylelint-config-standard
 └─┬ table@6.9.0
   └─┬ ajv@8.20.0
     └── fast-uri@3.1.6 deduped

Before — yarn why 

└─ ajv@npm:8.20.0
  └─ fast-uri@npm:3.1.6 (via npm:^3.1.1)

After — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ copy-webpack-plugin@13.0.1
│ └─┬ schema-utils@4.3.3
│   └─┬ ajv@8.20.0
│     └── fast-uri@3.1.6
└─┬ stylelint@16.12.0 invalid: "^15.3.0" from node_modules/stylelint-config-standard
 └─┬ table@6.9.0
   └─┬ ajv@8.20.0
     └── fast-uri@3.1.6 deduped

After — yarn why 

└─ ajv@npm:8.20.0
  └─ fast-uri@npm:3.1.6 (via npm:^3.1.1)

2. extract-zip

Field Value
Fixed version(s) 2.0.1
Strategy ✅ Already remediated
Reason All 1 installed copy/copies satisfy fix versions
Action taken No changes required (already remediated)
Verification ✅ Verified
Verification detail Verified: all installed copies satisfy fixed versions (All 1 installed copy/copies satisfy fix versions)
📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
└─┬ cypress@13.17.0 invalid: "^3 || ^4 || ^5 || ^6" from node_modules/cypress-axe
 └── extract-zip@2.0.1

Before — yarn why 

└─ cypress@npm:13.17.0
  └─ extract-zip@npm:2.0.1 (via npm:2.0.1)

After — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
└─┬ cypress@13.17.0 invalid: "^3 || ^4 || ^5 || ^6" from node_modules/cypress-axe
 └── extract-zip@2.0.1

After — yarn why 

└─ cypress@npm:13.17.0
  └─ extract-zip@npm:2.0.1 (via npm:2.0.1)

3. webpack-dev-middleware

Field Value
Fixed version(s) 5.3.4, 6.1.2, 7.1.0
Strategy ✅ Already remediated
Reason All 1 installed copy/copies satisfy fix versions
Action taken No changes required (already remediated)
Verification ✅ Verified
Verification detail Verified: all installed copies satisfy fixed versions (All 1 installed copy/copies satisfy fix versions)
📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
└─┬ webpack-dev-server@5.2.6
 └── webpack-dev-middleware@7.4.5

Before — yarn why 

├─ webpack-dev-server@npm:5.2.6
│  └─ webpack-dev-middleware@npm:7.4.5 (via npm:^7.4.2)
│
└─ webpack-dev-server@npm:5.2.6 [def00]
  └─ webpack-dev-middleware@npm:7.4.5 [3f729] (via npm:^7.4.2 [3f729])

After — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
└─┬ webpack-dev-server@5.2.6
 └── webpack-dev-middleware@7.4.5

After — yarn why 

├─ webpack-dev-server@npm:5.2.6
│  └─ webpack-dev-middleware@npm:7.4.5 (via npm:^7.4.2)
│
└─ webpack-dev-server@npm:5.2.6 [def00]
  └─ webpack-dev-middleware@npm:7.4.5 [3f729] (via npm:^7.4.2 [3f729])

4. postcss

Field Value
Fixed version(s) 8.5.12
Strategy ✅ Already remediated
Reason All 1 installed copy/copies satisfy fix versions
Action taken No changes required (already remediated)
Verification ✅ Verified
Verification detail Verified: all installed copies satisfy fixed versions (All 1 installed copy/copies satisfy fix versions)
📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ css-loader@6.11.0
│ ├─┬ icss-utils@5.1.0
│ │ └── postcss@8.5.26 deduped
│ ├─┬ postcss-modules-extract-imports@3.1.0
│ │ └── postcss@8.5.26 deduped
│ ├─┬ postcss-modules-local-by-default@4.2.0
│ │ └── postcss@8.5.26 deduped
│ ├─┬ postcss-modules-scope@3.2.1
│ │ └── postcss@8.5.26 deduped
│ ├─┬ postcss-modules-values@4.0.0
│ │ └── postcss@8.5.26 deduped
│ └── postcss@8.5.26
├─┬ resolve-url-loader@5.0.0
│ └── postcss@8.5.26 deduped
└─┬ stylelint@16.12.0 invalid: "^15.3.0" from node_modules/stylelint-config-standard
 ├─┬ postcss-safe-parser@7.0.1
 │ └── postcss@8.5.26 deduped
 └── postcss@8.5.26 deduped

Before — yarn why 

├─ css-loader@npm:6.11.0
│  └─ postcss@npm:8.5.26 (via npm:^8.4.33)
│
├─ css-loader@npm:6.11.0 [def00]
│  └─ postcss@npm:8.5.26 (via npm:^8.4.33)
│
├─ resolve-url-loader@npm:5.0.0
│  └─ postcss@npm:8.5.26 (via npm:^8.2.14)
│
└─ stylelint@npm:16.12.0
  └─ postcss@npm:8.5.26 (via npm:^8.4.49)

After — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ css-loader@6.11.0
│ ├─┬ icss-utils@5.1.0
│ │ └── postcss@8.5.26 deduped
│ ├─┬ postcss-modules-extract-imports@3.1.0
│ │ └── postcss@8.5.26 deduped
│ ├─┬ postcss-modules-local-by-default@4.2.0
│ │ └── postcss@8.5.26 deduped
│ ├─┬ postcss-modules-scope@3.2.1
│ │ └── postcss@8.5.26 deduped
│ ├─┬ postcss-modules-values@4.0.0
│ │ └── postcss@8.5.26 deduped
│ └── postcss@8.5.26
├─┬ resolve-url-loader@5.0.0
│ └── postcss@8.5.26 deduped
└─┬ stylelint@16.12.0 invalid: "^15.3.0" from node_modules/stylelint-config-standard
 ├─┬ postcss-safe-parser@7.0.1
 │ └── postcss@8.5.26 deduped
 └── postcss@8.5.26 deduped

After — yarn why 

├─ css-loader@npm:6.11.0
│  └─ postcss@npm:8.5.26 (via npm:^8.4.33)
│
├─ css-loader@npm:6.11.0 [def00]
│  └─ postcss@npm:8.5.26 (via npm:^8.4.33)
│
├─ resolve-url-loader@npm:5.0.0
│  └─ postcss@npm:8.5.26 (via npm:^8.2.14)
│
└─ stylelint@npm:16.12.0
  └─ postcss@npm:8.5.26 (via npm:^8.4.49)

5. undici

Field Value
Fixed version(s) 6.24.0, 7.24.0
Strategy ⚠️ Manual triage required
Reason No same-major fix for installed major(s) [8] — available fixes cover major(s) [6, 7]; cross-major resolution would break semver contracts — needs manual triage
Action taken Skipped — triage needed (cannot auto-remediate)
Verification ⚠️ Triage needed
Verification detail Skipped verification — package requires triage

Action required: This package could not be auto-remediated.
Review the analysis artifact and apply a fix manually before closing this ticket.

📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ i18next-parser@3.11.0
│ └─┬ cheerio@1.2.0
│   └── undici@7.29.0
└─┬ node-gyp@13.0.2 extraneous
 └── undici@8.10.1 extraneous

Before — yarn why 

├─ cheerio@npm:1.2.0
│  └─ undici@npm:7.29.0 (via npm:^7.19.0)
│
└─ node-gyp@npm:13.0.2
  └─ undici@npm:8.10.1 (via npm:^8.4.1)

6. js-yaml

Field Value
Fixed version(s) 5.2.2
Strategy ⚠️ Manual triage required
Reason No same-major fix for installed major(s) [3, 4] — available fixes cover major(s) [5]; cross-major resolution would break semver contracts — needs manual triage
Action taken Skipped — triage needed (cannot auto-remediate)
Verification ⚠️ Triage needed
Verification detail Skipped verification — package requires triage

Action required: This package could not be auto-remediated.
Review the analysis artifact and apply a fix manually before closing this ticket.

📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ eslint@8.57.1
│ ├─┬ @eslint/eslintrc@2.1.4
│ │ └── js-yaml@4.3.2 deduped
│ └── js-yaml@4.3.2
├─┬ i18next-parser@3.11.0
│ └── js-yaml@4.3.0 invalid: "4.1.0" from node_modules/i18next-parser
├─┬ openapi-typescript@7.13.0
│ └─┬ @redocly/openapi-core@1.34.19
│   └── js-yaml@4.3.1
├─┬ stylelint@16.12.0 invalid: "^15.3.0" from node_modules/stylelint-config-standard
│ └─┬ cosmiconfig@9.0.2
│   └── js-yaml@4.3.2 deduped
└─┬ ts-jest@29.4.12
 └─┬ @jest/transform@30.0.0-alpha.7 invalid: "^29.0.0 || ^30.0.0" from node_modules/ts-jest
   └─┬ babel-plugin-istanbul@7.0.1
     └─┬ @istanbuljs/load-nyc-config@1.1.0
       └── js-yaml@3.15.2

Before — yarn why 

├─ @eslint/eslintrc@npm:2.1.4
│  └─ js-yaml@npm:4.3.2 (via npm:^4.1.0)
│
├─ @istanbuljs/load-nyc-config@npm:1.1.0
│  └─ js-yaml@npm:3.15.2 (via npm:^3.13.1)
│
├─ @redocly/openapi-core@npm:1.34.19
│  └─ js-yaml@npm:4.3.1 (via npm:4.3.1)
│
├─ cosmiconfig@npm:9.0.2
│  └─ js-yaml@npm:4.3.2 (via npm:^4.1.0)
│
├─ cosmiconfig@npm:9.0.2 [0d1dc]
│  └─ js-yaml@npm:4.3.2 (via npm:^4.1.0)
│
├─ eslint@npm:8.57.1
│  └─ js-yaml@npm:4.3.2 (via npm:^4.1.0)
│
└─ i18next-parser@npm:3.11.0
  └─ js-yaml@npm:4.3.0 (via npm:4.3.0)

7. lodash

Field Value
Fixed version(s) 4.18.0
Strategy 🔧 Parent upgrade
Reason Upgrading a direct parent pulls in the fix: @cypress/webpack-preprocessor@8.0.0 (pulls lodash@^4.17.20, satisfies 4.18.0); cypress@15.21.1 (pulls lodash@^4.17.23, satisfies 4.18.0); @openshift/dynamic-plugin-sdk@9.1.0 (pulls lodash@^4.17.23, satisfies 4.18.0); @openshift/dynamic-plugin-sdk-utils@5.0.3 (pulls lodash@^4.17.23, satisfies 4.18.0); @patternfly/react-charts@8.6.1 (pulls lodash@^4.17.23, satisfies 4.18.0); cypress-multi-reporters@2.0.5 (pulls lodash@^4.17.21, satisfies 4.18.0); formik@2.4.9 (pulls lodash@^4.17.21, satisfies 4.18.0)
Action taken Ran yarn up @cypress/webpack-preprocessor@8.0.0 (@cypress/webpack-preprocessor@8.0.0 (pulls lodash@^4.17.20, satisfies 4.18.0))
Verification ❌ Failed
Verification detail Verification failed: strategy=parent-upgrade — Upgrading a direct parent pulls in the fix: @cypress/webpack-preprocessor@8.0.0 (pulls lodash@^4.17.20, satisfies 4.18.0); cypress@15.21.1 (pulls lodash@^4.17.23, satisfies 4.18.0); @openshift/dynamic-plugin-sdk@9.1.0 (pulls lodash@^4.17.23, satisfies 4.18.0); @openshift/dynamic-plugin-sdk-utils@5.0.3 (pulls lodash@^4.17.23, satisfies 4.18.0); @patternfly/react-charts@8.6.1 (pulls lodash@^4.17.23, satisfies 4.18.0); cypress-multi-reporters@2.0.5 (pulls lodash@^4.17.21, satisfies 4.18.0); formik@2.4.9 (pulls lodash@^4.17.21, satisfies 4.18.0)
📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ @cypress/webpack-preprocessor@5.17.1
│ └── lodash@4.17.23 invalid: "4.17.21" from node_modules/gherkin-lint
├─┬ @openshift-console/dynamic-plugin-sdk-webpack@1.1.1
│ ├─┬ @openshift/dynamic-plugin-sdk-webpack@4.1.0
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ └── lodash@4.17.23 deduped
├─┬ @openshift-console/dynamic-plugin-sdk@1.4.0
│ └── lodash@4.17.23 deduped
├─┬ @openshift/dynamic-plugin-sdk-utils@4.1.0
│ └── lodash@4.17.23 deduped
├─┬ @openshift/dynamic-plugin-sdk@4.0.0
│ ├── lodash@4.17.23 deduped
│ └─┬ yup@0.32.11
│   └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
├─┬ @patternfly/react-charts@7.2.2
│ ├── lodash@4.17.23 deduped
│ ├─┬ victory-area@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-axis@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-bar@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-box-plot@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-chart@36.9.2
│ │ ├── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ │ ├─┬ victory-polar-axis@36.9.2
│ │ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ │ └─┬ victory-shared-events@36.9.2
│ │   └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-core@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-create-container@36.9.2
│ │ ├── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ │ ├─┬ victory-brush-container@36.9.2
│ │ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ │ └─┬ victory-selection-container@36.9.2
│ │   └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-cursor-container@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-group@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-legend@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-line@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-pie@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-scatter@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-stack@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-tooltip@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-voronoi-container@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ └─┬ victory-zoom-container@36.9.2
│   └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
├─┬ @patternfly/react-component-groups@5.5.8
│ └─┬ @patternfly/react-table@5.4.16
│   └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
├─┬ @patternfly/react-table@5.2.1
│ └── lodash@4.17.23 deduped
├─┬ @patternfly/react-topology@5.2.1
│ ├─┬ dagre@0.8.2
│ │ ├─┬ graphlib@2.1.8
│ │ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ └── lodash@4.17.23 deduped
├─┬ cypress-multi-reporters@1.6.4
│ └── lodash@4.17.23 deduped
├─┬ cypress@13.17.0 invalid: "^3 || ^4 || ^5 || ^6" from node_modules/cypress-axe
│ └── lodash@4.17.23 deduped
├─┬ formik@2.0.3
│ └── lodash@4.17.23 deduped
└─┬ gherkin-lint@4.2.4
 └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint

Before — yarn why 

├─ @cypress/webpack-preprocessor@npm:5.17.1
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @cypress/webpack-preprocessor@npm:5.17.1 [def00]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @openshift-console/dynamic-plugin-sdk-webpack@npm:1.1.1
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @openshift-console/dynamic-plugin-sdk-webpack@npm:1.1.1 [def00]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @openshift-console/dynamic-plugin-sdk@npm:1.4.0
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @openshift/dynamic-plugin-sdk-utils@npm:4.1.0
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @openshift/dynamic-plugin-sdk-utils@npm:4.1.0 [def00]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @openshift/dynamic-plugin-sdk-webpack@npm:4.1.0
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @openshift/dynamic-plugin-sdk-webpack@npm:4.1.0 [fe5fa]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @openshift/dynamic-plugin-sdk@npm:4.0.0
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @openshift/dynamic-plugin-sdk@npm:4.0.0 [def00]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @patternfly/react-charts@npm:7.2.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @patternfly/react-charts@npm:7.2.2 [def00]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @patternfly/react-table@npm:5.2.1
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @patternfly/react-table@npm:5.4.16
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @patternfly/react-table@npm:5.4.16 [286ce]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @patternfly/react-table@npm:5.2.1 [def00]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @patternfly/react-topology@npm:5.2.1
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @patternfly/react-topology@npm:5.2.1 [def00]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ cypress-multi-reporters@npm:1.6.4
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ cypress-multi-reporters@npm:1.6.4 [def00]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ cypress@npm:13.17.0
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ dagre@npm:0.8.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ formik@npm:2.0.3
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ formik@npm:2.0.3 [def00]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ gherkin-lint@npm:4.2.4
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ graphlib@npm:2.1.8
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-area@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-area@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-axis@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-axis@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-bar@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-bar@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-box-plot@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-box-plot@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-brush-container@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-brush-container@npm:36.9.2 [34e9a]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-chart@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-chart@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-core@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-core@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-create-container@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-create-container@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-cursor-container@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-cursor-container@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-group@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-group@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-legend@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-legend@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-line@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-line@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-pie@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-pie@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-polar-axis@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-polar-axis@npm:36.9.2 [589df]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-scatter@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-scatter@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-selection-container@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-selection-container@npm:36.9.2 [34e9a]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-shared-events@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-shared-events@npm:36.9.2 [589df]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-stack@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-stack@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-tooltip@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-tooltip@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-voronoi-container@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-voronoi-container@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-zoom-container@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-zoom-container@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
└─ yup@npm:0.32.11
  └─ lodash@npm:4.17.23 (via npm:4.17.23)

After — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ @cypress/webpack-preprocessor@8.0.0
│ └── lodash@4.17.23 invalid: "4.17.21" from node_modules/gherkin-lint
├─┬ @openshift-console/dynamic-plugin-sdk-webpack@1.1.1
│ ├─┬ @openshift/dynamic-plugin-sdk-webpack@4.1.0
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ └── lodash@4.17.23 deduped
├─┬ @openshift-console/dynamic-plugin-sdk@1.4.0
│ └── lodash@4.17.23 deduped
├─┬ @openshift/dynamic-plugin-sdk-utils@4.1.0
│ └── lodash@4.17.23 deduped
├─┬ @openshift/dynamic-plugin-sdk@4.0.0
│ ├── lodash@4.17.23 deduped
│ └─┬ yup@0.32.11
│   └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
├─┬ @patternfly/react-charts@7.2.2
│ ├── lodash@4.17.23 deduped
│ ├─┬ victory-area@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-axis@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-bar@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-box-plot@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-chart@36.9.2
│ │ ├── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ │ ├─┬ victory-polar-axis@36.9.2
│ │ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ │ └─┬ victory-shared-events@36.9.2
│ │   └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-core@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-create-container@36.9.2
│ │ ├── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ │ ├─┬ victory-brush-container@36.9.2
│ │ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ │ └─┬ victory-selection-container@36.9.2
│ │   └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-cursor-container@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-group@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-legend@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-line@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-pie@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-scatter@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-stack@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-tooltip@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ ├─┬ victory-voronoi-container@36.9.2
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ └─┬ victory-zoom-container@36.9.2
│   └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
├─┬ @patternfly/react-component-groups@5.5.8
│ └─┬ @patternfly/react-table@5.4.16
│   └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
├─┬ @patternfly/react-table@5.2.1
│ └── lodash@4.17.23 deduped
├─┬ @patternfly/react-topology@5.2.1
│ ├─┬ dagre@0.8.2
│ │ ├─┬ graphlib@2.1.8
│ │ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ │ └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint
│ └── lodash@4.17.23 deduped
├─┬ cypress-multi-reporters@1.6.4
│ └── lodash@4.17.23 deduped
├─┬ cypress@13.17.0 invalid: "^3 || ^4 || ^5 || ^6" from node_modules/cypress-axe
│ └── lodash@4.17.23 deduped
├─┬ formik@2.0.3
│ └── lodash@4.17.23 deduped
└─┬ gherkin-lint@4.2.4
 └── lodash@4.17.23 deduped invalid: "4.17.21" from node_modules/gherkin-lint

After — yarn why 

├─ @cypress/webpack-preprocessor@npm:8.0.0
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @cypress/webpack-preprocessor@npm:8.0.0 [def00]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @openshift-console/dynamic-plugin-sdk-webpack@npm:1.1.1
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @openshift-console/dynamic-plugin-sdk-webpack@npm:1.1.1 [def00]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @openshift-console/dynamic-plugin-sdk@npm:1.4.0
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @openshift/dynamic-plugin-sdk-utils@npm:4.1.0
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @openshift/dynamic-plugin-sdk-utils@npm:4.1.0 [def00]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @openshift/dynamic-plugin-sdk-webpack@npm:4.1.0
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @openshift/dynamic-plugin-sdk-webpack@npm:4.1.0 [fe5fa]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @openshift/dynamic-plugin-sdk@npm:4.0.0
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @openshift/dynamic-plugin-sdk@npm:4.0.0 [def00]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @patternfly/react-charts@npm:7.2.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @patternfly/react-charts@npm:7.2.2 [def00]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @patternfly/react-table@npm:5.2.1
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @patternfly/react-table@npm:5.4.16
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @patternfly/react-table@npm:5.4.16 [286ce]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @patternfly/react-table@npm:5.2.1 [def00]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @patternfly/react-topology@npm:5.2.1
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ @patternfly/react-topology@npm:5.2.1 [def00]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ cypress-multi-reporters@npm:1.6.4
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ cypress-multi-reporters@npm:1.6.4 [def00]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ cypress@npm:13.17.0
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ dagre@npm:0.8.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ formik@npm:2.0.3
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ formik@npm:2.0.3 [def00]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ gherkin-lint@npm:4.2.4
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ graphlib@npm:2.1.8
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-area@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-area@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-axis@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-axis@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-bar@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-bar@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-box-plot@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-box-plot@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-brush-container@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-brush-container@npm:36.9.2 [34e9a]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-chart@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-chart@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-core@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-core@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-create-container@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-create-container@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-cursor-container@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-cursor-container@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-group@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-group@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-legend@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-legend@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-line@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-line@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-pie@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-pie@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-polar-axis@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-polar-axis@npm:36.9.2 [589df]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-scatter@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-scatter@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-selection-container@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-selection-container@npm:36.9.2 [34e9a]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-shared-events@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-shared-events@npm:36.9.2 [589df]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-stack@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-stack@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-tooltip@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-tooltip@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-voronoi-container@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-voronoi-container@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-zoom-container@npm:36.9.2
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
├─ victory-zoom-container@npm:36.9.2 [209ad]
│  └─ lodash@npm:4.17.23 (via npm:4.17.23)
│
└─ yup@npm:0.32.11
  └─ lodash@npm:4.17.23 (via npm:4.17.23)

Report generated by audit-report.ts. Artifacts in cve-artifacts/.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-merge-bot
openshift-merge-bot Bot merged commit e450f82 into release-v1.15.x Sep 1, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@anwesha-palit-redhat anwesha-palit-redhat anwesha-palit-redhat approved these changes

Assignees

@anwesha-palit-redhat anwesha-palit-redhat

Labels

approved Label for Approved PRs jira/valid-reference lgtm Looks Good to Me Label needs-ok-to-test

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@openshift-ci-robot @anwesha-palit-redhat