DFBUGS-10397: CVE vulnerable Fixes to master by sowmithri2001 · Pull Request #3138 · red-hat-storage/odf-console

sowmithri2001 · 2026-09-21T07:00:14Z

Description

The following packages were added/updated in the resolutions block of package.json to address CVE vulnerabilities:

Tested locally ocp main + odf master

Updated:
fast-uri : 3.1.7
js-yaml: 4.3.2
undici: 6.28.1

Added:
nanoid: 3.3.18

Change Type

Please select all applicable options:

Bug Fix

Component / Area Impacted

Please select all applicable options:

ODF

Screenshots / Recordings

Recordings / Demo Videos

Screen.Recording.2026-09-21.at.12.29.07.PM.mov

Summary by CodeRabbit

Chores
- Updated project dependencies as part of routine maintenance.
- These updates do not introduce any visible changes to the product’s features or behavior.

openshift-ci-robot · 2026-09-21T07:00:22Z

@sowmithri2001: This pull request references [Jira Issue DFBUGS-10397](https://redhat.atlassian.net/browse/DFBUGS-10397), which is valid. The bug has been moved to the POST state.

2 validation(s) were run on this bug

bug is open, matching expected state (open)
bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (srozen@redhat.com), skipping review request.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Description

jira link : https://redhat.atlassian.net/browse/DFBUGS-10397
https://redhat.atlassian.net/browse/DFBUGS-10568
https://redhat.atlassian.net/browse/DFBUGS-10591
https://redhat.atlassian.net/browse/DFBUGS-10695
https://redhat.atlassian.net/browse/DFBUGS-10715
https://redhat.atlassian.net/browse/DFBUGS-10735
https://redhat.atlassian.net/browse/DFBUGS-9749
https://redhat.atlassian.net/browse/DFBUGS-9996
https://redhat.atlassian.net/browse/DFBUGS-10174
https://redhat.atlassian.net/browse/DFBUGS-10273
https://redhat.atlassian.net/browse/DFBUGS-10288
https://redhat.atlassian.net/browse/DFBUGS-10328
https://redhat.atlassian.net/browse/DFBUGS-10306

The following packages were added/updated in the resolutions block of package.json to address CVE vulnerabilities:

Tested locally ocp main + odf master

Updated:
fast-uri : 3.1.7
js-yaml: 4.3.2
undici: 6.28.1

Added:
nanoid: 3.3.18

Change Type

Please select all applicable options:

Bug Fix

Component / Area Impacted

Please select all applicable options:

ODF

Screenshots / Recordings

Recordings / Demo Videos

Screen.Recording.2026-09-21.at.12.29.07.PM.mov

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2026-09-21T07:00:25Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: sowmithri2001
Once this PR has been reviewed and has the lgtm label, please assign bipuladh for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci · 2026-09-21T07:00:26Z

Hi @sowmithri2001. Thanks for your PR.

I'm waiting for a red-hat-storage member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

coderabbitai · 2026-09-21T07:01:06Z

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: b407a42d-478d-4bf0-bc2b-b6b55c992104

📥 Commits

Reviewing files that changed from the base of the PR and between 8f6be5d and 43c2dab.

⛔ Files ignored due to path filters (1)

yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (1)

packages/shared/package.json

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

Walkthrough

The root package resolutions update fast-uri, js-yaml, and undici, and add a resolution for nanoid. The shared package updates its js-yaml dependency range.

Changes

Dependency version updates

Layer / File(s)	Summary
Manifest version updates `package.json`, `packages/shared/package.json`	The root resolutions update `fast-uri` to `^3.1.7`, `js-yaml` to `^4.3.2`, and `undici` to `^6.28.1`, and add `nanoid` at `^3.3.18`. The shared package updates its `js-yaml` range to `^4.3.2`.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Suggested reviewers: sanjalkatiyar

Merge Risk: ⚪ Minimal · up to 43c2d

The updated dependency versions are recorded in the lockfile used by CI, with no identified merge-blocking issue.

Architecture Summary

Architecture risk: 🔵 Low · up to 43c2d

The change affects 2 systems.

Changed systems: package.json, packages/shared

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

observed — package.json (service) was modified; 1 changed file maps to changed impact.
observed — packages/shared (library) was modified; 1 changed file maps to changed impact.

Before / after behavior

observed — Modified behavior in package.json: Updates the fast-uri resolution from ^3.1.4 to ^3.1.7 and the js-yaml resolution from ^4.3.0 to ^4.3.2, and adds a nanoid resolution at ^3.3.18.
observed — Modified behavior in package.json: Updates the undici resolution from ^6.27.0 to ^6.28.1.
observed — Modified behavior in packages/shared/package.json: The js-yaml dependency range changed from ^4.3.0 to ^4.3.2.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies dependency vulnerability fixes, which matches the main changes to package resolutions and dependencies.

✨ Finishing Touches 💡 2

⚔️ Resolve merge conflicts 💡

Resolve merge conflict in branch CVE-vulnerable-master

🛠️ Fix failing CI checks 💡

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Create a new PR

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

openshift-ci-robot · 2026-09-21T07:02:46Z

@sowmithri2001: This pull request references [Jira Issue DFBUGS-10397](https://redhat.atlassian.net/browse/DFBUGS-10397), which is valid.

2 validation(s) were run on this bug

bug is open, matching expected state (open)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (srozen@redhat.com), skipping review request.

Details

In response to this:

Description

jira link : https://redhat.atlassian.net/browse/DFBUGS-10397
https://redhat.atlassian.net/browse/DFBUGS-10568
https://redhat.atlassian.net/browse/DFBUGS-10591
https://redhat.atlassian.net/browse/DFBUGS-10695
https://redhat.atlassian.net/browse/DFBUGS-10715
https://redhat.atlassian.net/browse/DFBUGS-10735
https://redhat.atlassian.net/browse/DFBUGS-9749
https://redhat.atlassian.net/browse/DFBUGS-9996
https://redhat.atlassian.net/browse/DFBUGS-10174
https://redhat.atlassian.net/browse/DFBUGS-10273
https://redhat.atlassian.net/browse/DFBUGS-10288
https://redhat.atlassian.net/browse/DFBUGS-10328
https://redhat.atlassian.net/browse/DFBUGS-10306

The following packages were added/updated in the resolutions block of package.json to address CVE vulnerabilities:

Tested locally ocp main + odf master

Updated:
fast-uri : 3.1.7
js-yaml: 4.3.2
undici: 6.28.1

Added:
nanoid: 3.3.18

Change Type

Please select all applicable options:

Bug Fix

Component / Area Impacted

Please select all applicable options:

ODF

Screenshots / Recordings

Recordings / Demo Videos

Screen.Recording.2026-09-21.at.12.29.07.PM.mov

Summary by CodeRabbit

Chores

Updated project configuration as part of routine maintenance.

No user-facing features, behavior changes, or public API changes are included in this update.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2026-09-25T04:30:18Z

@sowmithri2001: This pull request references [Jira Issue DFBUGS-10397](https://redhat.atlassian.net/browse/DFBUGS-10397), which is valid.

2 validation(s) were run on this bug

bug is open, matching expected state (open)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (srozen@redhat.com), skipping review request.

Details

In response to this:

Description

jira link : https://redhat.atlassian.net/browse/DFBUGS-10397
https://redhat.atlassian.net/browse/DFBUGS-10568
https://redhat.atlassian.net/browse/DFBUGS-10591
https://redhat.atlassian.net/browse/DFBUGS-10695
https://redhat.atlassian.net/browse/DFBUGS-10715
https://redhat.atlassian.net/browse/DFBUGS-10735
https://redhat.atlassian.net/browse/DFBUGS-9749
https://redhat.atlassian.net/browse/DFBUGS-9996
https://redhat.atlassian.net/browse/DFBUGS-10174
https://redhat.atlassian.net/browse/DFBUGS-10273
https://redhat.atlassian.net/browse/DFBUGS-10288
https://redhat.atlassian.net/browse/DFBUGS-10328
https://redhat.atlassian.net/browse/DFBUGS-10306

The following packages were added/updated in the resolutions block of package.json to address CVE vulnerabilities:

Tested locally ocp main + odf master

Updated:
fast-uri : 3.1.7
js-yaml: 4.3.2
undici: 6.28.1

Added:
nanoid: 3.3.18

Change Type

Please select all applicable options:

Bug Fix

Component / Area Impacted

Please select all applicable options:

ODF

Screenshots / Recordings

Recordings / Demo Videos

Screen.Recording.2026-09-21.at.12.29.07.PM.mov

Summary by CodeRabbit

Chores

Updated project configuration as part of routine maintenance.

No changes to user-facing features, product behavior, or public APIs are included. This update does not add or remove capabilities, and it does not change how the product works for end users.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2026-09-25T04:34:37Z

@sowmithri2001: This pull request references [Jira Issue DFBUGS-10397](https://redhat.atlassian.net/browse/DFBUGS-10397), which is valid.

2 validation(s) were run on this bug

bug is open, matching expected state (open)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (srozen@redhat.com), skipping review request.

Details

In response to this:

Description

jira link : https://redhat.atlassian.net/browse/DFBUGS-10397
https://redhat.atlassian.net/browse/DFBUGS-10568
https://redhat.atlassian.net/browse/DFBUGS-10591
https://redhat.atlassian.net/browse/DFBUGS-10695
https://redhat.atlassian.net/browse/DFBUGS-10715
https://redhat.atlassian.net/browse/DFBUGS-10735
https://redhat.atlassian.net/browse/DFBUGS-9749
https://redhat.atlassian.net/browse/DFBUGS-9996
https://redhat.atlassian.net/browse/DFBUGS-10174
https://redhat.atlassian.net/browse/DFBUGS-10273
https://redhat.atlassian.net/browse/DFBUGS-10288
https://redhat.atlassian.net/browse/DFBUGS-10328
https://redhat.atlassian.net/browse/DFBUGS-10306

The following packages were added/updated in the resolutions block of package.json to address CVE vulnerabilities:

Tested locally ocp main + odf master

Updated:
fast-uri : 3.1.7
js-yaml: 4.3.2
undici: 6.28.1

Added:
nanoid: 3.3.18

Change Type

Please select all applicable options:

Bug Fix

Component / Area Impacted

Please select all applicable options:

ODF

Screenshots / Recordings

Recordings / Demo Videos

Screen.Recording.2026-09-21.at.12.29.07.PM.mov

Summary by CodeRabbit

Chores

Updated project configuration as part of routine maintenance.

This update does not change user-facing features, product behavior, or public APIs. No capabilities were added or removed, and the product continues to work the same way for end users.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2026-09-29T05:51:26Z

@sowmithri2001: This pull request references [Jira Issue DFBUGS-10397](https://redhat.atlassian.net/browse/DFBUGS-10397), which is valid.

2 validation(s) were run on this bug

bug is open, matching expected state (open)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (srozen@redhat.com), skipping review request.

Details

In response to this:

Description

jira link : https://redhat.atlassian.net/browse/DFBUGS-10397
https://redhat.atlassian.net/browse/DFBUGS-10568
https://redhat.atlassian.net/browse/DFBUGS-10591
https://redhat.atlassian.net/browse/DFBUGS-10695
https://redhat.atlassian.net/browse/DFBUGS-10715
https://redhat.atlassian.net/browse/DFBUGS-10735
https://redhat.atlassian.net/browse/DFBUGS-9749
https://redhat.atlassian.net/browse/DFBUGS-9996
https://redhat.atlassian.net/browse/DFBUGS-10174
https://redhat.atlassian.net/browse/DFBUGS-10273
https://redhat.atlassian.net/browse/DFBUGS-10288
https://redhat.atlassian.net/browse/DFBUGS-10328
https://redhat.atlassian.net/browse/DFBUGS-10306

The following packages were added/updated in the resolutions block of package.json to address CVE vulnerabilities:

Tested locally ocp main + odf master

Updated:
fast-uri : 3.1.7
js-yaml: 4.3.2
undici: 6.28.1

Added:
nanoid: 3.3.18

Change Type

Please select all applicable options:

Bug Fix

Component / Area Impacted

Please select all applicable options:

ODF

Screenshots / Recordings

Recordings / Demo Videos

Screen.Recording.2026-09-21.at.12.29.07.PM.mov

Summary by CodeRabbit

Chores

Updated project dependencies as part of routine maintenance.

These updates do not introduce any visible changes to the product’s features or behavior.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2026-10-01T15:38:37Z

@sowmithri2001: This pull request references [Jira Issue DFBUGS-10397](https://redhat.atlassian.net/browse/DFBUGS-10397), which is valid.

2 validation(s) were run on this bug

bug is open, matching expected state (open)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (sdurgbun@redhat.com), skipping review request.

Details

In response to this:

Description

jira link : https://redhat.atlassian.net/browse/DFBUGS-10397
https://redhat.atlassian.net/browse/DFBUGS-10568
https://redhat.atlassian.net/browse/DFBUGS-10591
https://redhat.atlassian.net/browse/DFBUGS-10695
https://redhat.atlassian.net/browse/DFBUGS-10715
https://redhat.atlassian.net/browse/DFBUGS-10735
https://redhat.atlassian.net/browse/DFBUGS-9749
https://redhat.atlassian.net/browse/DFBUGS-9996
https://redhat.atlassian.net/browse/DFBUGS-10174
https://redhat.atlassian.net/browse/DFBUGS-10273
https://redhat.atlassian.net/browse/DFBUGS-10288
https://redhat.atlassian.net/browse/DFBUGS-10328
https://redhat.atlassian.net/browse/DFBUGS-10306

The following packages were added/updated in the resolutions block of package.json to address CVE vulnerabilities:

Tested locally ocp main + odf master

Updated:
fast-uri : 3.1.7
js-yaml: 4.3.2
undici: 6.28.1

Added:
nanoid: 3.3.18

Change Type

Please select all applicable options:

Bug Fix

Component / Area Impacted

Please select all applicable options:

ODF

Screenshots / Recordings

Recordings / Demo Videos

Screen.Recording.2026-09-21.at.12.29.07.PM.mov

Summary by CodeRabbit

Chores

Updated project dependencies as part of routine maintenance.

These updates do not introduce any visible changes to the product’s features or behavior.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci Bot added the needs-ok-to-test label Sep 21, 2026

sowmithri2001 force-pushed the CVE-vulnerable-master branch from b68e3e5 to fab3ffe Compare September 21, 2026 08:41

Soundarya189r reviewed Sep 24, 2026

View reviewed changes

Comment thread package.json Outdated

openshift-ci Bot added the needs-rebase label Sep 25, 2026

sowmithri2001 force-pushed the CVE-vulnerable-master branch from 96e3733 to 3bf1900 Compare September 25, 2026 04:31

sowmithri2001 force-pushed the CVE-vulnerable-master branch 2 times, most recently from 2d90b21 to 43c2dab Compare September 29, 2026 05:47

upgraded vulnerable version

773a5ae

sowmithri2001 force-pushed the CVE-vulnerable-master branch from 43c2dab to 773a5ae Compare October 1, 2026 14:37

openshift-ci Bot removed the needs-rebase label Oct 1, 2026

Conversation

sowmithri2001 commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Change Type

Component / Area Impacted

Screenshots / Recordings

Recordings / Demo Videos

Summary by CodeRabbit

Uh oh!

openshift-ci-robot commented Sep 21, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Change Type

Component / Area Impacted

Screenshots / Recordings

Recordings / Demo Videos

Uh oh!

openshift-ci Bot commented Sep 21, 2026

Uh oh!

openshift-ci Bot commented Sep 21, 2026

Uh oh!

coderabbitai Bot commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Architecture Summary

Uh oh!

openshift-ci-robot commented Sep 21, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Change Type

Component / Area Impacted

Screenshots / Recordings

Recordings / Demo Videos

Summary by CodeRabbit

Uh oh!

Uh oh!

openshift-ci-robot commented Sep 25, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Change Type

Component / Area Impacted

Screenshots / Recordings

Recordings / Demo Videos

Summary by CodeRabbit

Uh oh!

openshift-ci-robot commented Sep 25, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Change Type

Component / Area Impacted

Screenshots / Recordings

Recordings / Demo Videos

Summary by CodeRabbit

Uh oh!

openshift-ci-robot commented Sep 29, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Change Type

Component / Area Impacted

Screenshots / Recordings

Recordings / Demo Videos

Summary by CodeRabbit

Uh oh!

openshift-ci-robot commented Oct 1, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Change Type

Component / Area Impacted

Screenshots / Recordings

Recordings / Demo Videos

Summary by CodeRabbit

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

sowmithri2001 commented Sep 21, 2026 •

edited

Loading

openshift-ci-robot commented Sep 21, 2026 •

edited by openshift-ci Bot

Loading

coderabbitai Bot commented Sep 21, 2026 •

edited

Loading

openshift-ci-robot commented Sep 21, 2026 •

edited by openshift-ci Bot

Loading

openshift-ci-robot commented Sep 25, 2026 •

edited by openshift-ci Bot

Loading

openshift-ci-robot commented Sep 25, 2026 •

edited by openshift-ci Bot

Loading

openshift-ci-robot commented Sep 29, 2026 •

edited by openshift-ci Bot

Loading

openshift-ci-robot commented Oct 1, 2026 •

edited by openshift-ci Bot

Loading