chore: Fix vulnerable dependencies on release-v1.24.x by github-actions[bot] · Pull Request #1323 · openshift-pipelines/console-plugin

github-actions · 2026-09-01T07:21:02Z

CVE Remediation Report

Generated: 2026-09-01T07:20:58.311Z

Release branch: release-v1.24.x

Overall status

❌ One or more packages failed verification

Summary

Package	Fixed version(s)	Strategy	Verified
`brace-expansion`	1.1.18, 2.1.4, 3.0.6, 5.0.9	✅ Already remediated	✅ Verified
`nanoid`	3.3.12, 5.1.11	✅ Already remediated	✅ Verified
`browserslist`	4.28.7	✅ Already remediated	✅ Verified
`tar`	7.5.21	✅ Already remediated	✅ Verified
`js-yaml`	5.2.2	⚠️ Manual triage required	⚠️ Triage needed
`baseline-browser-mapping`	2.11.0	✅ Already remediated	✅ Verified
`lodash`	4.18.0	✅ Already remediated	✅ Verified
`linkify-it`	5.0.2	✅ Already remediated	✅ Verified
`fast-uri`	2.4.5, 3.1.6, 4.1.3	✅ Already remediated	✅ Verified
`extract-zip`	2.0.1	✅ Already remediated	✅ Verified
`webpack-dev-middleware`	5.3.4, 6.1.2, 7.1.0	✅ Already remediated	✅ Verified
`postcss`	8.5.19	✅ Already remediated	✅ Verified
`undici`	6.24.0, 7.24.0	⚠️ Manual triage required	⚠️ Triage needed

Package details

1. `brace-expansion`

Field	Value
Fixed version(s)	1.1.18, 2.1.4, 3.0.6, 5.0.9
Strategy	✅ Already remediated
Reason	All 3 installed copy/copies satisfy fix versions
Action taken	No changes required (already remediated)
Verification	✅ Verified
Verification detail	Verified: all installed copies satisfy fixed versions (All 3 installed copy/copies satisfy fix versions)

📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ eslint-plugin-react@7.37.5
│ └─┬ minimatch@3.1.5
│   └── brace-expansion@1.1.18
├─┬ i18next-parser@9.4.0
│ └─┬ broccoli-plugin@4.0.7
│   └─┬ quick-temp@0.1.9
│     └─┬ rimraf@5.0.10
│       └─┬ glob@10.5.0
│         └─┬ minimatch@9.0.9
│           └── brace-expansion@2.1.4 deduped
├─┬ jest-cli@30.5.0
│ ├─┬ @jest/core@30.5.0
│ │ ├─┬ @jest/reporters@30.5.0
│ │ │ └─┬ glob@13.0.6
│ │ │   └─┬ minimatch@10.2.6
│ │ │     └── brace-expansion@5.0.9
│ │ ├─┬ jest-config@30.5.0
│ │ │ ├─┬ babel-jest@30.5.0
│ │ │ │ └─┬ babel-plugin-istanbul@8.0.2
│ │ │ │   └─┬ test-exclude@7.0.2
│ │ │ │     └─┬ glob@10.5.0
│ │ │ │       └─┬ minimatch@9.0.9
│ │ │ │         └── brace-expansion@2.1.4 deduped
│ │ │ └─┬ glob@13.0.6
│ │ │   └─┬ minimatch@10.2.6
│ │ │     └── brace-expansion@5.0.9
│ │ └─┬ jest-runtime@30.5.0
│ │   └─┬ glob@13.0.6
│ │     └─┬ minimatch@10.2.6
│ │       └── brace-expansion@5.0.9
│ └─┬ jest-config@30.5.0
│   ├─┬ babel-jest@30.5.0
│   │ └─┬ babel-plugin-istanbul@8.0.2
│   │   └─┬ test-exclude@7.0.2
│   │     └─┬ glob@10.5.0
│   │       └─┬ minimatch@9.0.9
│   │         └── brace-expansion@2.1.4 deduped
│   └─┬ glob@13.0.6
│     └─┬ minimatch@10.2.6
│       └── brace-expansion@5.0.9
├─┬ openapi-typescript@7.13.0
│ └─┬ @redocly/openapi-core@1.34.19
│   └─┬ minimatch@5.1.9
│     └── brace-expansion@2.1.4
└─┬ ts-jest@29.4.12
  └─┬ @jest/transform@30.5.0
    └─┬ babel-plugin-istanbul@8.0.2
      └─┬ test-exclude@7.0.2
        ├─┬ glob@10.5.0
        │ └─┬ minimatch@9.0.9
        │   └── brace-expansion@2.1.4 deduped
        └─┬ minimatch@10.2.6
          └── brace-expansion@5.0.9

Before — yarn why

├─ minimatch@npm:10.2.6
│  └─ brace-expansion@npm:5.0.9 (via npm:^5.0.8)
│
├─ minimatch@npm:3.1.5
│  └─ brace-expansion@npm:1.1.18 (via npm:^1.1.7)
│
├─ minimatch@npm:5.1.9
│  └─ brace-expansion@npm:2.1.4 (via npm:^2.0.1)
│
└─ minimatch@npm:9.0.9
   └─ brace-expansion@npm:2.1.4 (via npm:^2.0.2)

After — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ eslint-plugin-react@7.37.5
│ └─┬ minimatch@3.1.5
│   └── brace-expansion@1.1.18
├─┬ i18next-parser@9.4.0
│ └─┬ broccoli-plugin@4.0.7
│   └─┬ quick-temp@0.1.9
│     └─┬ rimraf@5.0.10
│       └─┬ glob@10.5.0
│         └─┬ minimatch@9.0.9
│           └── brace-expansion@2.1.4 deduped
├─┬ jest-cli@30.5.0
│ ├─┬ @jest/core@30.5.0
│ │ ├─┬ @jest/reporters@30.5.0
│ │ │ └─┬ glob@13.0.6
│ │ │   └─┬ minimatch@10.2.6
│ │ │     └── brace-expansion@5.0.9
│ │ ├─┬ jest-config@30.5.0
│ │ │ ├─┬ babel-jest@30.5.0
│ │ │ │ └─┬ babel-plugin-istanbul@8.0.2
│ │ │ │   └─┬ test-exclude@7.0.2
│ │ │ │     └─┬ glob@10.5.0
│ │ │ │       └─┬ minimatch@9.0.9
│ │ │ │         └── brace-expansion@2.1.4 deduped
│ │ │ └─┬ glob@13.0.6
│ │ │   └─┬ minimatch@10.2.6
│ │ │     └── brace-expansion@5.0.9
│ │ └─┬ jest-runtime@30.5.0
│ │   └─┬ glob@13.0.6
│ │     └─┬ minimatch@10.2.6
│ │       └── brace-expansion@5.0.9
│ └─┬ jest-config@30.5.0
│   ├─┬ babel-jest@30.5.0
│   │ └─┬ babel-plugin-istanbul@8.0.2
│   │   └─┬ test-exclude@7.0.2
│   │     └─┬ glob@10.5.0
│   │       └─┬ minimatch@9.0.9
│   │         └── brace-expansion@2.1.4 deduped
│   └─┬ glob@13.0.6
│     └─┬ minimatch@10.2.6
│       └── brace-expansion@5.0.9
├─┬ openapi-typescript@7.13.0
│ └─┬ @redocly/openapi-core@1.34.19
│   └─┬ minimatch@5.1.9
│     └── brace-expansion@2.1.4
└─┬ ts-jest@29.4.12
  └─┬ @jest/transform@30.5.0
    └─┬ babel-plugin-istanbul@8.0.2
      └─┬ test-exclude@7.0.2
        ├─┬ glob@10.5.0
        │ └─┬ minimatch@9.0.9
        │   └── brace-expansion@2.1.4 deduped
        └─┬ minimatch@10.2.6
          └── brace-expansion@5.0.9

After — yarn why

├─ minimatch@npm:10.2.6
│  └─ brace-expansion@npm:5.0.9 (via npm:^5.0.8)
│
├─ minimatch@npm:3.1.5
│  └─ brace-expansion@npm:1.1.18 (via npm:^1.1.7)
│
├─ minimatch@npm:5.1.9
│  └─ brace-expansion@npm:2.1.4 (via npm:^2.0.1)
│
└─ minimatch@npm:9.0.9
   └─ brace-expansion@npm:2.1.4 (via npm:^2.0.2)

2. `nanoid`

Field	Value
Fixed version(s)	3.3.12, 5.1.11
Strategy	✅ Already remediated
Reason	All 1 installed copy/copies satisfy fix versions
Action taken	No changes required (already remediated)
Verification	✅ Verified
Verification detail	Verified: all installed copies satisfy fixed versions (All 1 installed copy/copies satisfy fix versions)

📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
└─┬ css-loader@6.11.0
  └─┬ postcss@8.5.26
    └── nanoid@3.3.18

Before — yarn why

└─ postcss@npm:8.5.26
   └─ nanoid@npm:3.3.18 (via npm:^3.3.17)

After — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
└─┬ css-loader@6.11.0
  └─┬ postcss@8.5.26
    └── nanoid@3.3.18

After — yarn why

└─ postcss@npm:8.5.26
   └─ nanoid@npm:3.3.18 (via npm:^3.3.17)

3. `browserslist`

Field	Value
Fixed version(s)	4.28.7
Strategy	✅ Already remediated
Reason	All 1 installed copy/copies satisfy fix versions
Action taken	No changes required (already remediated)
Verification	✅ Verified
Verification detail	Verified: all installed copies satisfy fixed versions (All 1 installed copy/copies satisfy fix versions)

📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ @babel/core@7.29.7
│ └─┬ @babel/helper-compilation-targets@7.29.7
│   └── browserslist@4.28.8 deduped
├─┬ @babel/preset-env@7.29.7
│ └─┬ core-js-compat@3.50.0
│   └── browserslist@4.28.8 deduped
└─┬ webpack@5.110.2 invalid: "^4.0.0" from node_modules/cache-loader
  └─┬ browserslist@4.28.8
    └─┬ update-browserslist-db@1.3.2
      └── browserslist@4.28.8 deduped

Before — yarn why

├─ @babel/helper-compilation-targets@npm:7.29.7
│  └─ browserslist@npm:4.28.8 (via npm:^4.24.0)
│
├─ core-js-compat@npm:3.50.0
│  └─ browserslist@npm:4.28.8 (via npm:^4.28.7)
│
├─ webpack@npm:5.110.2
│  └─ browserslist@npm:4.28.8 (via npm:^4.28.1)
│
└─ webpack@npm:5.110.2 [def00]
   └─ browserslist@npm:4.28.8 (via npm:^4.28.1)

After — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ @babel/core@7.29.7
│ └─┬ @babel/helper-compilation-targets@7.29.7
│   └── browserslist@4.28.8 deduped
├─┬ @babel/preset-env@7.29.7
│ └─┬ core-js-compat@3.50.0
│   └── browserslist@4.28.8 deduped
└─┬ webpack@5.110.2 invalid: "^4.0.0" from node_modules/cache-loader
  └─┬ browserslist@4.28.8
    └─┬ update-browserslist-db@1.3.2
      └── browserslist@4.28.8 deduped

After — yarn why

├─ @babel/helper-compilation-targets@npm:7.29.7
│  └─ browserslist@npm:4.28.8 (via npm:^4.24.0)
│
├─ core-js-compat@npm:3.50.0
│  └─ browserslist@npm:4.28.8 (via npm:^4.28.7)
│
├─ webpack@npm:5.110.2
│  └─ browserslist@npm:4.28.8 (via npm:^4.28.1)
│
└─ webpack@npm:5.110.2 [def00]
   └─ browserslist@npm:4.28.8 (via npm:^4.28.1)

4. `tar`

Field	Value
Fixed version(s)	7.5.21
Strategy	✅ Already remediated
Reason	All 1 installed copy/copies satisfy fix versions
Action taken	No changes required (already remediated)
Verification	✅ Verified
Verification detail	Verified: all installed copies satisfy fixed versions (All 1 installed copy/copies satisfy fix versions)

📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ node-gyp@13.0.2 extraneous
│ └── tar@7.5.22 deduped
└── tar@7.5.22 extraneous

Before — yarn why

└─ node-gyp@npm:13.0.2
   └─ tar@npm:7.5.22 (via npm:^7.5.4)

After — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ node-gyp@13.0.2 extraneous
│ └── tar@7.5.22 deduped
└── tar@7.5.22 extraneous

After — yarn why

└─ node-gyp@npm:13.0.2
   └─ tar@npm:7.5.22 (via npm:^7.5.4)

5. `js-yaml`

Field	Value
Fixed version(s)	5.2.2
Strategy	⚠️ Manual triage required
Reason	No same-major fix for installed major(s) [3, 4] — available fixes cover major(s) [5]; cross-major resolution would break semver contracts — needs manual triage
Action taken	Skipped — triage needed (cannot auto-remediate)
Verification	⚠️ Triage needed
Verification detail	Skipped verification — package requires triage

Action required: This package could not be auto-remediated.
Review the analysis artifact and apply a fix manually before closing this ticket.

📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ babel-jest@29.7.0
│ └─┬ babel-plugin-istanbul@6.1.1
│   └─┬ @istanbuljs/load-nyc-config@1.1.0
│     └── js-yaml@3.15.2
├─┬ eslint@8.57.1
│ ├─┬ @eslint/eslintrc@2.1.4
│ │ └── js-yaml@4.3.2 deduped
│ └── js-yaml@4.3.2
├─┬ i18next-parser@9.4.0
│ └── js-yaml@4.3.2 deduped
├─┬ openapi-typescript@7.13.0
│ └─┬ @redocly/openapi-core@1.34.19
│   └── js-yaml@4.3.1
└─┬ stylelint@16.12.0
  └─┬ cosmiconfig@9.0.2
    └── js-yaml@4.3.2 deduped

Before — yarn why

├─ @eslint/eslintrc@npm:2.1.4
│  └─ js-yaml@npm:4.3.2 (via npm:^4.1.0)
│
├─ @istanbuljs/load-nyc-config@npm:1.1.0
│  └─ js-yaml@npm:3.15.2 (via npm:^3.13.1)
│
├─ @redocly/openapi-core@npm:1.34.19
│  └─ js-yaml@npm:4.3.1 (via npm:4.3.1)
│
├─ cosmiconfig@npm:9.0.2
│  └─ js-yaml@npm:4.3.2 (via npm:^4.1.0)
│
├─ cosmiconfig@npm:9.0.2 [0d1dc]
│  └─ js-yaml@npm:4.3.2 (via npm:^4.1.0)
│
├─ eslint@npm:8.57.1
│  └─ js-yaml@npm:4.3.2 (via npm:^4.1.0)
│
└─ i18next-parser@npm:9.4.0
   └─ js-yaml@npm:4.3.2 (via npm:^4.1.0)

6. `baseline-browser-mapping`

Field	Value
Fixed version(s)	2.11.0
Strategy	✅ Already remediated
Reason	All 1 installed copy/copies satisfy fix versions
Action taken	No changes required (already remediated)
Verification	✅ Verified
Verification detail	Verified: all installed copies satisfy fixed versions (All 1 installed copy/copies satisfy fix versions)

📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
└─┬ webpack@5.110.2 invalid: "^4.0.0" from node_modules/cache-loader
  └─┬ browserslist@4.28.8
    └── baseline-browser-mapping@2.11.20

Before — yarn why

└─ browserslist@npm:4.28.8
   └─ baseline-browser-mapping@npm:2.11.20 (via npm:^2.11.12)

After — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
└─┬ webpack@5.110.2 invalid: "^4.0.0" from node_modules/cache-loader
  └─┬ browserslist@4.28.8
    └── baseline-browser-mapping@2.11.20

After — yarn why

└─ browserslist@npm:4.28.8
   └─ baseline-browser-mapping@npm:2.11.20 (via npm:^2.11.12)

7. `lodash`

Field	Value
Fixed version(s)	4.18.0
Strategy	✅ Already remediated
Reason	All 1 installed copy/copies satisfy fix versions
Action taken	No changes required (already remediated)
Verification	✅ Verified
Verification detail	Verified: all installed copies satisfy fixed versions (All 1 installed copy/copies satisfy fix versions)

📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ @openshift-console/dynamic-plugin-sdk-webpack@4.22.0
│ ├─┬ @openshift/dynamic-plugin-sdk-webpack@5.3.0
│ │ └── lodash@4.18.1 deduped
│ └── lodash@4.18.1
├─┬ @openshift-console/dynamic-plugin-sdk@4.22.0
│ └── lodash@4.18.1 deduped
├─┬ @openshift/dynamic-plugin-sdk-utils@5.0.3
│ └── lodash@4.18.1 deduped
├─┬ @openshift/dynamic-plugin-sdk@8.2.0 invalid: "^4 || ^5" from node_modules/@openshift/dynamic-plugin-sdk-extensions
│ └── lodash@4.18.1 deduped
├─┬ @patternfly/react-charts@8.6.1
│ ├── lodash@4.18.1 deduped
│ ├─┬ victory-area@37.3.6
│ │ └── lodash@4.18.1 deduped
│ ├─┬ victory-axis@37.3.6
│ │ └── lodash@4.18.1 deduped
│ ├─┬ victory-bar@37.3.6
│ │ └── lodash@4.18.1 deduped
│ ├─┬ victory-box-plot@37.3.6
│ │ └── lodash@4.18.1 deduped
│ ├─┬ victory-chart@37.3.6
│ │ └── lodash@4.18.1 deduped
│ ├─┬ victory-core@37.3.6
│ │ └── lodash@4.18.1 deduped
│ ├─┬ victory-create-container@37.3.6
│ │ └── lodash@4.18.1 deduped
│ ├─┬ victory-cursor-container@37.3.6
│ │ └── lodash@4.18.1 deduped
│ ├─┬ victory-group@37.3.6
│ │ └── lodash@4.18.1 deduped
│ ├─┬ victory-legend@37.3.6
│ │ └── lodash@4.18.1 deduped
│ ├─┬ victory-line@37.3.6
│ │ └── lodash@4.18.1 deduped
│ ├─┬ victory-pie@37.3.6
│ │ └── lodash@4.18.1 deduped
│ ├─┬ victory-scatter@37.3.6
│ │ └── lodash@4.18.1 deduped
│ ├─┬ victory-stack@37.3.6
│ │ └── lodash@4.18.1 deduped
│ ├─┬ victory-tooltip@37.3.6
│ │ └── lodash@4.18.1 deduped
│ ├─┬ victory-voronoi-container@37.3.6
│ │ └── lodash@4.18.1 deduped
│ └─┬ victory-zoom-container@37.3.6
│   └── lodash@4.18.1 deduped
├─┬ @patternfly/react-table@6.6.2
│ └── lodash@4.18.1 deduped
├─┬ babel-plugin-transform-imports@1.5.1
│ └─┬ babel-types@6.26.0
│   └── lodash@4.18.1 deduped
├─┬ dagre@0.8.5
│ ├─┬ graphlib@2.1.8
│ │ └── lodash@4.18.1 deduped
│ └── lodash@4.18.1 deduped
├─┬ formik@2.4.9
│ └── lodash@4.18.1 deduped
└─┬ victory@37.3.6
  ├─┬ victory-brush-container@37.3.6
  │ └── lodash@4.18.1 deduped
  ├─┬ victory-brush-line@37.3.6
  │ └── lodash@4.18.1 deduped
  ├─┬ victory-candlestick@37.3.6
  │ └── lodash@4.18.1 deduped
  ├─┬ victory-canvas@37.3.6
  │ └── lodash@4.18.1 deduped
  ├─┬ victory-errorbar@37.3.6
  │ └── lodash@4.18.1 deduped
  ├─┬ victory-histogram@37.3.6
  │ └── lodash@4.18.1 deduped
  ├─┬ victory-polar-axis@37.3.6
  │ └── lodash@4.18.1 deduped
  ├─┬ victory-selection-container@37.3.6
  │ └── lodash@4.18.1 deduped
  ├─┬ victory-shared-events@37.3.6
  │ └── lodash@4.18.1 deduped
  └─┬ victory-voronoi@37.3.6
    └── lodash@4.18.1 deduped

Before — yarn why

├─ @openshift-console/dynamic-plugin-sdk-webpack@npm:4.22.0
│  └─ lodash@npm:4.18.1 (via npm:^4.17.21)
│
├─ @openshift-console/dynamic-plugin-sdk-webpack@npm:4.22.0 [def00]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.21)
│
├─ @openshift-console/dynamic-plugin-sdk@npm:4.22.0
│  └─ lodash@npm:4.18.1 (via npm:^4.17.21)
│
├─ @openshift-console/dynamic-plugin-sdk@npm:4.22.0 [def00]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.21)
│
├─ @openshift/dynamic-plugin-sdk-utils@npm:5.0.3
│  └─ lodash@npm:4.18.1 (via npm:^4.17.23)
│
├─ @openshift/dynamic-plugin-sdk-utils@npm:5.0.3 [def00]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.23)
│
├─ @openshift/dynamic-plugin-sdk-webpack@npm:5.3.0
│  └─ lodash@npm:4.18.1 (via npm:^4.17.23)
│
├─ @openshift/dynamic-plugin-sdk-webpack@npm:5.3.0 [249a3]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.23)
│
├─ @openshift/dynamic-plugin-sdk@npm:8.2.0
│  └─ lodash@npm:4.18.1 (via npm:^4.17.23)
│
├─ @openshift/dynamic-plugin-sdk@npm:8.2.0 [def00]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.23)
│
├─ @openshift/dynamic-plugin-sdk@npm:8.2.0 [f357f]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.23)
│
├─ @patternfly/react-charts@npm:8.6.1
│  └─ lodash@npm:4.18.1 (via npm:^4.17.23)
│
├─ @patternfly/react-charts@npm:8.6.1 [def00]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.23)
│
├─ @patternfly/react-table@npm:6.6.2
│  └─ lodash@npm:4.18.1 (via npm:^4.18.1)
│
├─ @patternfly/react-table@npm:6.6.2 [def00]
│  └─ lodash@npm:4.18.1 (via npm:^4.18.1)
│
├─ babel-types@npm:6.26.0
│  └─ lodash@npm:4.18.1 (via npm:^4.17.4)
│
├─ dagre@npm:0.8.5
│  └─ lodash@npm:4.18.1 (via npm:^4.17.15)
│
├─ formik@npm:2.4.9
│  └─ lodash@npm:4.18.1 (via npm:^4.17.21)
│
├─ formik@npm:2.4.9 [def00]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.21)
│
├─ graphlib@npm:2.1.8
│  └─ lodash@npm:4.18.1 (via npm:^4.17.15)
│
├─ victory-area@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-area@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-axis@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-axis@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-bar@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-bar@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-box-plot@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-box-plot@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-brush-container@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-brush-container@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-brush-line@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-brush-line@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-candlestick@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-candlestick@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-canvas@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-canvas@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-chart@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-chart@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-core@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.21)
│
├─ victory-core@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.21)
│
├─ victory-create-container@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-create-container@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-cursor-container@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-cursor-container@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-errorbar@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-errorbar@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-group@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-group@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-histogram@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-histogram@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-legend@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-legend@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-line@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-line@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-pie@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-pie@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-polar-axis@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-polar-axis@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-scatter@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-scatter@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-selection-container@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-selection-container@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-shared-events@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-shared-events@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-stack@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-stack@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-tooltip@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-tooltip@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-voronoi-container@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-voronoi-container@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-voronoi@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-voronoi@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-zoom-container@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
└─ victory-zoom-container@npm:37.3.6 [21d1b]
   └─ lodash@npm:4.18.1 (via npm:^4.17.19)

After — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ @openshift-console/dynamic-plugin-sdk-webpack@4.22.0
│ ├─┬ @openshift/dynamic-plugin-sdk-webpack@5.3.0
│ │ └── lodash@4.18.1 deduped
│ └── lodash@4.18.1
├─┬ @openshift-console/dynamic-plugin-sdk@4.22.0
│ └── lodash@4.18.1 deduped
├─┬ @openshift/dynamic-plugin-sdk-utils@5.0.3
│ └── lodash@4.18.1 deduped
├─┬ @openshift/dynamic-plugin-sdk@8.2.0 invalid: "^4 || ^5" from node_modules/@openshift/dynamic-plugin-sdk-extensions
│ └── lodash@4.18.1 deduped
├─┬ @patternfly/react-charts@8.6.1
│ ├── lodash@4.18.1 deduped
│ ├─┬ victory-area@37.3.6
│ │ └── lodash@4.18.1 deduped
│ ├─┬ victory-axis@37.3.6
│ │ └── lodash@4.18.1 deduped
│ ├─┬ victory-bar@37.3.6
│ │ └── lodash@4.18.1 deduped
│ ├─┬ victory-box-plot@37.3.6
│ │ └── lodash@4.18.1 deduped
│ ├─┬ victory-chart@37.3.6
│ │ └── lodash@4.18.1 deduped
│ ├─┬ victory-core@37.3.6
│ │ └── lodash@4.18.1 deduped
│ ├─┬ victory-create-container@37.3.6
│ │ └── lodash@4.18.1 deduped
│ ├─┬ victory-cursor-container@37.3.6
│ │ └── lodash@4.18.1 deduped
│ ├─┬ victory-group@37.3.6
│ │ └── lodash@4.18.1 deduped
│ ├─┬ victory-legend@37.3.6
│ │ └── lodash@4.18.1 deduped
│ ├─┬ victory-line@37.3.6
│ │ └── lodash@4.18.1 deduped
│ ├─┬ victory-pie@37.3.6
│ │ └── lodash@4.18.1 deduped
│ ├─┬ victory-scatter@37.3.6
│ │ └── lodash@4.18.1 deduped
│ ├─┬ victory-stack@37.3.6
│ │ └── lodash@4.18.1 deduped
│ ├─┬ victory-tooltip@37.3.6
│ │ └── lodash@4.18.1 deduped
│ ├─┬ victory-voronoi-container@37.3.6
│ │ └── lodash@4.18.1 deduped
│ └─┬ victory-zoom-container@37.3.6
│   └── lodash@4.18.1 deduped
├─┬ @patternfly/react-table@6.6.2
│ └── lodash@4.18.1 deduped
├─┬ babel-plugin-transform-imports@1.5.1
│ └─┬ babel-types@6.26.0
│   └── lodash@4.18.1 deduped
├─┬ dagre@0.8.5
│ ├─┬ graphlib@2.1.8
│ │ └── lodash@4.18.1 deduped
│ └── lodash@4.18.1 deduped
├─┬ formik@2.4.9
│ └── lodash@4.18.1 deduped
└─┬ victory@37.3.6
  ├─┬ victory-brush-container@37.3.6
  │ └── lodash@4.18.1 deduped
  ├─┬ victory-brush-line@37.3.6
  │ └── lodash@4.18.1 deduped
  ├─┬ victory-candlestick@37.3.6
  │ └── lodash@4.18.1 deduped
  ├─┬ victory-canvas@37.3.6
  │ └── lodash@4.18.1 deduped
  ├─┬ victory-errorbar@37.3.6
  │ └── lodash@4.18.1 deduped
  ├─┬ victory-histogram@37.3.6
  │ └── lodash@4.18.1 deduped
  ├─┬ victory-polar-axis@37.3.6
  │ └── lodash@4.18.1 deduped
  ├─┬ victory-selection-container@37.3.6
  │ └── lodash@4.18.1 deduped
  ├─┬ victory-shared-events@37.3.6
  │ └── lodash@4.18.1 deduped
  └─┬ victory-voronoi@37.3.6
    └── lodash@4.18.1 deduped

After — yarn why

├─ @openshift-console/dynamic-plugin-sdk-webpack@npm:4.22.0
│  └─ lodash@npm:4.18.1 (via npm:^4.17.21)
│
├─ @openshift-console/dynamic-plugin-sdk-webpack@npm:4.22.0 [def00]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.21)
│
├─ @openshift-console/dynamic-plugin-sdk@npm:4.22.0
│  └─ lodash@npm:4.18.1 (via npm:^4.17.21)
│
├─ @openshift-console/dynamic-plugin-sdk@npm:4.22.0 [def00]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.21)
│
├─ @openshift/dynamic-plugin-sdk-utils@npm:5.0.3
│  └─ lodash@npm:4.18.1 (via npm:^4.17.23)
│
├─ @openshift/dynamic-plugin-sdk-utils@npm:5.0.3 [def00]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.23)
│
├─ @openshift/dynamic-plugin-sdk-webpack@npm:5.3.0
│  └─ lodash@npm:4.18.1 (via npm:^4.17.23)
│
├─ @openshift/dynamic-plugin-sdk-webpack@npm:5.3.0 [249a3]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.23)
│
├─ @openshift/dynamic-plugin-sdk@npm:8.2.0
│  └─ lodash@npm:4.18.1 (via npm:^4.17.23)
│
├─ @openshift/dynamic-plugin-sdk@npm:8.2.0 [def00]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.23)
│
├─ @openshift/dynamic-plugin-sdk@npm:8.2.0 [f357f]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.23)
│
├─ @patternfly/react-charts@npm:8.6.1
│  └─ lodash@npm:4.18.1 (via npm:^4.17.23)
│
├─ @patternfly/react-charts@npm:8.6.1 [def00]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.23)
│
├─ @patternfly/react-table@npm:6.6.2
│  └─ lodash@npm:4.18.1 (via npm:^4.18.1)
│
├─ @patternfly/react-table@npm:6.6.2 [def00]
│  └─ lodash@npm:4.18.1 (via npm:^4.18.1)
│
├─ babel-types@npm:6.26.0
│  └─ lodash@npm:4.18.1 (via npm:^4.17.4)
│
├─ dagre@npm:0.8.5
│  └─ lodash@npm:4.18.1 (via npm:^4.17.15)
│
├─ formik@npm:2.4.9
│  └─ lodash@npm:4.18.1 (via npm:^4.17.21)
│
├─ formik@npm:2.4.9 [def00]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.21)
│
├─ graphlib@npm:2.1.8
│  └─ lodash@npm:4.18.1 (via npm:^4.17.15)
│
├─ victory-area@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-area@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-axis@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-axis@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-bar@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-bar@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-box-plot@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-box-plot@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-brush-container@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-brush-container@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-brush-line@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-brush-line@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-candlestick@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-candlestick@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-canvas@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-canvas@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-chart@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-chart@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-core@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.21)
│
├─ victory-core@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.21)
│
├─ victory-create-container@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-create-container@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-cursor-container@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-cursor-container@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-errorbar@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-errorbar@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-group@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-group@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-histogram@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-histogram@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-legend@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-legend@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-line@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-line@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-pie@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-pie@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-polar-axis@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-polar-axis@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-scatter@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-scatter@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-selection-container@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-selection-container@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-shared-events@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-shared-events@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-stack@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-stack@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-tooltip@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-tooltip@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-voronoi-container@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-voronoi-container@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-voronoi@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-voronoi@npm:37.3.6 [21d1b]
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
├─ victory-zoom-container@npm:37.3.6
│  └─ lodash@npm:4.18.1 (via npm:^4.17.19)
│
└─ victory-zoom-container@npm:37.3.6 [21d1b]
   └─ lodash@npm:4.18.1 (via npm:^4.17.19)

8. `linkify-it`

Field	Value
Fixed version(s)	5.0.2
Strategy	✅ Already remediated
Reason	Package is not installed in the dependency tree
Action taken	No changes required (already remediated)
Verification	✅ Verified
Verification detail	Verified: all installed copies satisfy fixed versions (Package is not installed in the dependency tree)

📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
└── (empty)

After — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
└── (empty)

9. `fast-uri`

Field	Value
Fixed version(s)	2.4.5, 3.1.6, 4.1.3
Strategy	✅ Already remediated
Reason	All 1 installed copy/copies satisfy fix versions
Action taken	No changes required (already remediated)
Verification	✅ Verified
Verification detail	Verified: all installed copies satisfy fixed versions (All 1 installed copy/copies satisfy fix versions)

📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ babel-loader@9.2.1
│ └─┬ schema-utils@4.3.3
│   └─┬ ajv@8.20.0
│     └── fast-uri@3.1.6
└─┬ stylelint@16.12.0
  └─┬ table@6.9.0
    └─┬ ajv@8.20.0
      └── fast-uri@3.1.6 deduped

Before — yarn why

└─ ajv@npm:8.20.0
   └─ fast-uri@npm:3.1.6 (via npm:^3.0.1)

After — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ babel-loader@9.2.1
│ └─┬ schema-utils@4.3.3
│   └─┬ ajv@8.20.0
│     └── fast-uri@3.1.6
└─┬ stylelint@16.12.0
  └─┬ table@6.9.0
    └─┬ ajv@8.20.0
      └── fast-uri@3.1.6 deduped

After — yarn why

└─ ajv@npm:8.20.0
   └─ fast-uri@npm:3.1.6 (via npm:^3.0.1)

10. `extract-zip`

Field	Value
Fixed version(s)	2.0.1
Strategy	✅ Already remediated
Reason	Package is not installed in the dependency tree
Action taken	No changes required (already remediated)
Verification	✅ Verified
Verification detail	Verified: all installed copies satisfy fixed versions (Package is not installed in the dependency tree)

📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
└── (empty)

After — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
└── (empty)

11. `webpack-dev-middleware`

Field	Value
Fixed version(s)	5.3.4, 6.1.2, 7.1.0
Strategy	✅ Already remediated
Reason	All 1 installed copy/copies satisfy fix versions
Action taken	No changes required (already remediated)
Verification	✅ Verified
Verification detail	Verified: all installed copies satisfy fixed versions (All 1 installed copy/copies satisfy fix versions)

📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
└─┬ webpack-dev-server@5.2.6
  └── webpack-dev-middleware@7.4.5

Before — yarn why

├─ webpack-dev-server@npm:5.2.6
│  └─ webpack-dev-middleware@npm:7.4.5 (via npm:^7.4.2)
│
└─ webpack-dev-server@npm:5.2.6 [def00]
   └─ webpack-dev-middleware@npm:7.4.5 [3f729] (via npm:^7.4.2 [3f729])

After — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
└─┬ webpack-dev-server@5.2.6
  └── webpack-dev-middleware@7.4.5

After — yarn why

├─ webpack-dev-server@npm:5.2.6
│  └─ webpack-dev-middleware@npm:7.4.5 (via npm:^7.4.2)
│
└─ webpack-dev-server@npm:5.2.6 [def00]
   └─ webpack-dev-middleware@npm:7.4.5 [3f729] (via npm:^7.4.2 [3f729])

12. `postcss`

Field	Value
Fixed version(s)	8.5.19
Strategy	✅ Already remediated
Reason	All 1 installed copy/copies satisfy fix versions
Action taken	No changes required (already remediated)
Verification	✅ Verified
Verification detail	Verified: all installed copies satisfy fixed versions (All 1 installed copy/copies satisfy fix versions)

📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ css-loader@6.11.0
│ ├─┬ icss-utils@5.1.0
│ │ └── postcss@8.5.26 deduped
│ ├─┬ postcss-modules-extract-imports@3.1.0
│ │ └── postcss@8.5.26 deduped
│ ├─┬ postcss-modules-local-by-default@4.2.0
│ │ └── postcss@8.5.26 deduped
│ ├─┬ postcss-modules-scope@3.2.1
│ │ └── postcss@8.5.26 deduped
│ ├─┬ postcss-modules-values@4.0.0
│ │ └── postcss@8.5.26 deduped
│ └── postcss@8.5.26
├─┬ resolve-url-loader@5.0.0
│ └── postcss@8.5.26 deduped
└─┬ stylelint@16.12.0
  ├─┬ postcss-safe-parser@7.0.1
  │ └── postcss@8.5.26 deduped
  └── postcss@8.5.26 deduped

Before — yarn why

├─ css-loader@npm:6.11.0
│  └─ postcss@npm:8.5.26 (via npm:^8.4.33)
│
├─ css-loader@npm:6.11.0 [def00]
│  └─ postcss@npm:8.5.26 (via npm:^8.4.33)
│
├─ resolve-url-loader@npm:5.0.0
│  └─ postcss@npm:8.5.26 (via npm:^8.2.14)
│
└─ stylelint@npm:16.12.0
   └─ postcss@npm:8.5.26 (via npm:^8.4.49)

After — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ css-loader@6.11.0
│ ├─┬ icss-utils@5.1.0
│ │ └── postcss@8.5.26 deduped
│ ├─┬ postcss-modules-extract-imports@3.1.0
│ │ └── postcss@8.5.26 deduped
│ ├─┬ postcss-modules-local-by-default@4.2.0
│ │ └── postcss@8.5.26 deduped
│ ├─┬ postcss-modules-scope@3.2.1
│ │ └── postcss@8.5.26 deduped
│ ├─┬ postcss-modules-values@4.0.0
│ │ └── postcss@8.5.26 deduped
│ └── postcss@8.5.26
├─┬ resolve-url-loader@5.0.0
│ └── postcss@8.5.26 deduped
└─┬ stylelint@16.12.0
  ├─┬ postcss-safe-parser@7.0.1
  │ └── postcss@8.5.26 deduped
  └── postcss@8.5.26 deduped

After — yarn why

├─ css-loader@npm:6.11.0
│  └─ postcss@npm:8.5.26 (via npm:^8.4.33)
│
├─ css-loader@npm:6.11.0 [def00]
│  └─ postcss@npm:8.5.26 (via npm:^8.4.33)
│
├─ resolve-url-loader@npm:5.0.0
│  └─ postcss@npm:8.5.26 (via npm:^8.2.14)
│
└─ stylelint@npm:16.12.0
   └─ postcss@npm:8.5.26 (via npm:^8.4.49)

13. `undici`

Field	Value
Fixed version(s)	6.24.0, 7.24.0
Strategy	⚠️ Manual triage required
Reason	No same-major fix for installed major(s) [8] — available fixes cover major(s) [6, 7]; cross-major resolution would break semver contracts — needs manual triage
Action taken	Skipped — triage needed (cannot auto-remediate)
Verification	⚠️ Triage needed
Verification detail	Skipped verification — package requires triage

Action required: This package could not be auto-remediated.
Review the analysis artifact and apply a fix manually before closing this ticket.

📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
├─┬ i18next-parser@9.4.0
│ └─┬ cheerio@1.2.0
│   └── undici@7.29.0
└─┬ node-gyp@13.0.2 extraneous
  └── undici@8.10.1 extraneous

Before — yarn why

├─ cheerio@npm:1.2.0
│  └─ undici@npm:7.29.0 (via npm:^7.19.0)
│
└─ node-gyp@npm:13.0.2
   └─ undici@npm:8.10.1 (via npm:^8.4.1)

Report generated by audit-report.ts. Artifacts in cve-artifacts/.

openshift-ci · 2026-09-01T07:21:13Z

Hi @github-actions[bot]. Thanks for your PR.

I'm waiting for a openshift-pipelines member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

arvindk-softwaredev

/lgtm

openshift-ci · 2026-09-01T07:51:51Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: arvindk-softwaredev, github-actions[bot]

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [arvindk-softwaredev]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

chore: fix CVEs

3227a93

openshift-ci Bot requested review from anwesha-palit-redhat and vdemeester September 1, 2026 07:21

openshift-ci Bot added the needs-ok-to-test label Sep 1, 2026

anwesha-palit-redhat requested review from arvindk-softwaredev and removed request for anwesha-palit-redhat and vdemeester September 1, 2026 07:28

anwesha-palit-redhat added jira/valid-reference and removed needs-ok-to-test labels Sep 1, 2026

arvindk-softwaredev approved these changes Sep 1, 2026

View reviewed changes

openshift-ci Bot assigned arvindk-softwaredev Sep 1, 2026

openshift-ci Bot added the lgtm Looks Good to Me Label label Sep 1, 2026

openshift-ci Bot added the approved Label for Approved PRs label Sep 1, 2026

openshift-merge-bot Bot merged commit 4fb9980 into release-v1.24.x Sep 1, 2026
2 checks passed

Navigation Menu

Uh oh!

chore: Fix vulnerable dependencies on release-v1.24.x - #1323

chore: Fix vulnerable dependencies on release-v1.24.x#1323
openshift-merge-bot[bot] merged 1 commit into
release-v1.24.xfrom
auto/cve/fix-release-v1.24.x

github-actions Bot commented Sep 1, 2026

Uh oh!

openshift-ci Bot commented Sep 1, 2026

Uh oh!

arvindk-softwaredev left a comment

Uh oh!

openshift-ci Bot commented Sep 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

github-actions Bot commented Sep 1, 2026

CVE Remediation Report

Overall status

Summary

Package details

1. brace-expansion

2. nanoid

3. browserslist

4. tar

5. js-yaml

6. baseline-browser-mapping

7. lodash

8. linkify-it

9. fast-uri

10. extract-zip

11. webpack-dev-middleware

12. postcss

13. undici

Uh oh!

openshift-ci Bot commented Sep 1, 2026

Uh oh!

arvindk-softwaredev left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci Bot commented Sep 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

1. `brace-expansion`

2. `nanoid`

3. `browserslist`

4. `tar`

5. `js-yaml`

6. `baseline-browser-mapping`

7. `lodash`

8. `linkify-it`

9. `fast-uri`

10. `extract-zip`

11. `webpack-dev-middleware`

12. `postcss`

13. `undici`