fix(cost-management): bump yarn.lock packages for Dependabot CVEs

[kim-tsao]

Summary

• yarn up -R on workspaces/cost-management for open Dependabot alert packages, then yarn install and yarn dedupe.
• Keep react-router / react-router-dom on the same patch (co-bump; auto-included react-router-dom).

Fully fixed

package	before	after	CVEs cleared
@grpc/grpc-js	1.13.4	1.14.4	CVE-2026-48068, CVE-2026-48069
@remix-run/router	1.23.2	1.23.4	CVE-2026-40181
basic-ftp	5.0.5	5.3.1	CVE-2026-27699, GHSA-6v7q-wjvx-w8wg
brace-expansion	1.1.11, 2.1.0, 5.0.5	1.1.18, 2.1.4, 5.0.9	CVE-2026-13149
form-data	2.5.6, 4.0.5	2.5.6, 4.0.6	CVE-2026-12143
http-proxy-middleware	2.0.9	2.0.10	CVE-2026-55602
js-cookie	2.2.1	3.0.8	CVE-2026-46625
launch-editor	2.10.0	2.14.1	CVE-2026-53632
multer	2.1.1	2.3.0	CVE-2026-5038, CVE-2026-5079
pbkdf2	3.1.2	3.1.6	CVE-2025-6545, CVE-2025-6547
picomatch	2.3.1, 4.0.4	2.3.2, 4.0.7	CVE-2026-33672
qs	6.14.2, 6.15.3, 6.16.0	6.15.3, 6.16.0	CVE-2026-8723
react-router-dom	6.30.3	6.30.6	-
webpack-dev-server	5.2.1	5.2.6	CVE-2026-14620, CVE-2026-14631, CVE-2026-6402, CVE-2026-9595
websocket-driver	0.7.4	0.7.5	CVE-2026-54466

Partial leftovers

package	before	after	remaining
axios	1.15.2, 1.9.0	1.20.0, 1.9.0	1.9.0
js-yaml	3.14.1, 4.1.1, 4.3.1	3.15.2, 4.1.1, 4.3.2	4.1.1
minimatch	10.2.3, 10.2.5, 3.1.2, 5.1.6, 7.4.9, 8.0.4, 9.0.3, 9.0.5	10.2.3, 10.2.6, 3.1.2, 3.1.5, 5.1.9, 7.4.9, 8.0.7, 9.0.3, 9.0.9	3.1.2, 9.0.3
react-router	6.30.3	6.30.6	6.30.6
tmp	0.0.33, 0.2.5	0.0.33, 0.2.7	0.0.33

Unchanged

package	before	after	remaining
@nestjs/core	11.1.1	11.1.1	needs 11.1.18
file-type	16.5.4, 20.5.0, 3.9.0	16.5.4, 20.5.0, 3.9.0	16.5.4, 20.5.0
got	9.6.0	9.6.0	needs 11.8.5
ip-address	10.1.0, 9.0.5	10.1.0, 9.0.5	needs 10.1.1, 10.3.1
lodash	4.17.21, 4.17.23, 4.18.1	4.17.21, 4.17.23, 4.18.1	4.17.21, 4.17.23
tar	6.2.1, 7.5.22	6.2.1, 7.5.22	6.2.1
tar-fs	2.0.1, 2.1.5, 3.1.3	2.0.1, 2.1.5, 3.1.3	2.0.1
undici	5.29.0, 7.29.0	5.29.0, 7.29.0	5.29.0
urllib	3.27.3	3.27.3	needs 4.9.1
uuid	10.0.0, 11.1.1, 3.4.0, 8.3.2, 9.0.1	10.0.0, 11.1.1, 3.4.0, 8.3.2, 9.0.1	10.0.0, 3.4.0, 8.3.2, 9.0.1

[rhdh-qodo-merge]

PR Summary by Qodo

Fix cost-management CVEs with dependency lockfile upgrades

🐞 Bug fix ⚙️ Configuration changes 🕐 20-40 Minutes

AI Description

• Upgrade vulnerable cost-management dependencies to patched versions across the resolved graph.
• Keep React Router packages patch-aligned while deduplicating transitive dependency resolutions.
• Preserve constrained versions where transitive requirements prevent complete remediation.

Diagram

graph TD
  A["Dependabot alerts"] --> B["Yarn upgrade"] --> C["Resolved graph"] --> D["Cost workspace"]
  C --> E["Router stack"]
  C --> F["Dev tooling"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Separate advisory-specific upgrades

• ➕ Produces smaller diffs with clearer CVE-to-package traceability
• ➕ Simplifies rollback when one upgrade causes a regression
• ➖ Repeats lockfile regeneration and validation work
• ➖ Creates overlapping transitive changes and greater merge-conflict risk

2. Force versions with resolutions

• ➕ Could remove additional vulnerable transitive versions immediately
• ➕ Limits broad changes elsewhere in the dependency graph
• ➖ May violate upstream compatibility constraints
• ➖ Adds overrides requiring continued maintenance and later removal

Recommendation: Keep the grouped workspace-scoped lockfile regeneration. It efficiently remediates related alerts, deduplicates compatible versions, and preserves React Router patch alignment; constrained leftovers should be handled separately through upstream upgrades rather than risky forced resolutions.

Files changed (1) +416 / -161

Other (1) +416 / -161

yarn.lockUpgrade vulnerable cost-management dependency resolutions +416/-161

Upgrade vulnerable cost-management dependency resolutions

• Regenerates and deduplicates the cost-management dependency graph with patched releases for gRPC, routing, HTTP, parsing, cryptography, file upload, WebSocket, and development-server packages. It also aligns react-router and react-router-dom at 6.30.6 and introduces updated transitive chains required by newer webpack development tooling.

workspaces/cost-management/yarn.lock

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rhdh-qodo-merge]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can describe a rule in plain language on the Rules page and Qodo drafts it for you

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 62.00%. Comparing base (e058f0d) to head (666de90).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4520   +/-   ##
=======================================
  Coverage   62.00%   62.00%           
=======================================
  Files        2597     2597           
  Lines      104302   104302           
  Branches    29307    29304    -3     
=======================================
  Hits        64671    64671           
- Misses      39032    39036    +4     
+ Partials      599      595    -4     

Flag	Coverage Δ		*Carryforward flag
adoption-insights	84.30% <ø> (ø)		Carriedforward from e058f0d
ai-integrations	76.15% <ø> (ø)		Carriedforward from e058f0d
app-defaults	56.22% <ø> (ø)		Carriedforward from e058f0d
augment	46.67% <ø> (ø)		Carriedforward from e058f0d
boost	80.00% <ø> (ø)		Carriedforward from e058f0d
bulk-import	72.79% <ø> (ø)		Carriedforward from e058f0d
cost-management	13.55% <ø> (ø)
dcm	72.09% <ø> (ø)		Carriedforward from e058f0d
e2e-adoption-insights	60.00% <ø> (ø)		Carriedforward from e058f0d
e2e-extensions	62.32% <ø> (ø)		Carriedforward from e058f0d
e2e-global-header	50.35% <ø> (ø)		Carriedforward from e058f0d
e2e-homepage	61.11% <ø> (ø)		Carriedforward from e058f0d
e2e-intelligent-assistant	47.04% <ø> (ø)		Carriedforward from e058f0d
e2e-orchestrator	49.52% <ø> (ø)		Carriedforward from e058f0d
e2e-orchestrator-plugin	49.51% <ø> (ø)		Carriedforward from e058f0d
e2e-quickstart	55.21% <ø> (ø)		Carriedforward from e058f0d
e2e-scorecard	50.21% <ø> (ø)		Carriedforward from e058f0d
e2e-theme	16.36% <ø> (ø)		Carriedforward from e058f0d
extensions	56.66% <ø> (ø)		Carriedforward from e058f0d
global-floating-action-button	71.18% <ø> (ø)		Carriedforward from e058f0d
global-header	68.09% <ø> (ø)		Carriedforward from e058f0d
homepage	48.39% <ø> (ø)		Carriedforward from e058f0d
install-dynamic-plugins	58.57% <ø> (ø)		Carriedforward from e058f0d
intelligent-assistant	76.40% <ø> (ø)		Carriedforward from e058f0d
konflux	91.98% <ø> (ø)		Carriedforward from e058f0d
lightspeed	69.02% <ø> (ø)		Carriedforward from e058f0d
mcp-integrations	84.14% <ø> (ø)		Carriedforward from e058f0d
orchestrator	71.13% <ø> (ø)		Carriedforward from e058f0d
quickstart	63.74% <ø> (ø)		Carriedforward from e058f0d
sandbox	79.56% <ø> (ø)		Carriedforward from e058f0d
scorecard	87.65% <ø> (ø)		Carriedforward from e058f0d
theme	87.91% <ø> (ø)		Carriedforward from e058f0d
translations	5.12% <ø> (ø)		Carriedforward from e058f0d
x2a	77.10% <ø> (ø)		Carriedforward from e058f0d

*This pull request uses carry forward flags. Click here to find out more.

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update e058f0d...666de90. Read the comment docs.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[kim-tsao]

superseded by #4572