update intelligent-assistant CVEs

[kim-tsao]

Hey, I just made a Pull Request!

Fixes : https://redhat.atlassian.net/browse/RHIDP-16169

Updates CVEs in main that were previous fixed in Z streams.
Fixed some moderates intended for next release.
Prioritized updates on prod dependencies and dev deps (which will show up in SBOMs). Ignored anything from local harnesses (app, app-legacy, backend)

• fast-xml-parser: Ran a yarn up -R on the various @aws-sdk clients to bump the transitive deps
• dompurify: update monaco-editor to 0.56 to bump transitive dep. Unpatched versions are from local harnesses
• standard yarn up -R <package> on :
  • axios
  • form-data
  • minimatch
  • tmp
  • path-to-regexp
  • brace-expansion
  • react-router
• jws: yarn up -R + updated parent packages: google-auth-library, gtoken, jsonwebtoken
• ip-address: updated parent packages: express-rate-limit, socks

✔️ Checklist

• A changeset describing the change and affected packages. (more info)
• Added or Updated documentation
• Tests for new functionality and regression tests for bug fixes
• Screenshots attached (for UI changes)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 59.58%. Comparing base (2e4c46e) to head (a4f89eb).
⚠️ Report is 9 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4275   +/-   ##
=======================================
  Coverage   59.58%   59.58%           
=======================================
  Files        2459     2459           
  Lines       98272    98272           
  Branches    27448    27451    +3     
=======================================
  Hits        58559    58559           
  Misses      39348    39348           
  Partials      365      365           

Flag	Coverage Δ		*Carryforward flag
adoption-insights	84.55% <ø> (ø)		Carriedforward from 93ca5ee
ai-integrations	68.29% <ø> (ø)		Carriedforward from 93ca5ee
app-defaults	69.79% <ø> (ø)		Carriedforward from 93ca5ee
augment	46.67% <ø> (ø)		Carriedforward from 93ca5ee
boost	77.63% <ø> (ø)		Carriedforward from 93ca5ee
bulk-import	72.79% <ø> (ø)		Carriedforward from 93ca5ee
cost-management	13.55% <ø> (ø)		Carriedforward from 93ca5ee
dcm	67.21% <ø> (ø)		Carriedforward from 93ca5ee
e2e-adoption-insights	60.00% <ø> (ø)		Carriedforward from 93ca5ee
e2e-extensions	62.13% <ø> (ø)		Carriedforward from 93ca5ee
e2e-intelligent-assistant	46.74% <ø> (ø)		Carriedforward from 93ca5ee
extensions	56.59% <ø> (ø)		Carriedforward from 93ca5ee
global-floating-action-button	71.18% <ø> (ø)		Carriedforward from 93ca5ee
global-header	66.50% <ø> (ø)		Carriedforward from 93ca5ee
homepage	47.50% <ø> (ø)		Carriedforward from 93ca5ee
install-dynamic-plugins	59.95% <ø> (ø)		Carriedforward from 93ca5ee
intelligent-assistant	75.42% <ø> (ø)
konflux	91.98% <ø> (ø)		Carriedforward from 93ca5ee
lightspeed	69.02% <ø> (ø)		Carriedforward from 93ca5ee
mcp-integrations	83.40% <ø> (ø)		Carriedforward from 93ca5ee
orchestrator	71.27% <ø> (ø)		Carriedforward from 93ca5ee
quickstart	63.74% <ø> (ø)		Carriedforward from 93ca5ee
sandbox	79.56% <ø> (ø)		Carriedforward from 93ca5ee
scorecard	86.25% <ø> (ø)		Carriedforward from 93ca5ee
theme	88.14% <ø> (ø)		Carriedforward from 93ca5ee
translations	5.12% <ø> (ø)		Carriedforward from 93ca5ee
x2a	79.20% <ø> (ø)		Carriedforward from 93ca5ee

*This pull request uses carry forward flags. Click here to find out more.

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 2e4c46e...a4f89eb. Read the comment docs.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[rhdh-gh-app]

Changed Packages

Package Name	Package Path	Changeset Bump	Current Version
@red-hat-developer-hub/backstage-plugin-intelligent-assistant	workspaces/intelligent-assistant/plugins/intelligent-assistant	patch	v3.2.0

[rhdh-qodo-merge]

PR Summary by Qodo

Remediate intelligent-assistant CVEs via dependency upgrades

🐞 Bug fix ⚙️ Configuration changes 🕐 40+ Minutes

AI Description

• Bump intelligent-assistant dependencies to pick up patched versions for known CVEs.
• Upgrade monaco-editor to 0.56.0 to pull in updated dompurify transitively.
• Add a changeset to publish a patch release of the intelligent-assistant plugin.

Diagram

graph TD
  A["IA plugin"] --> B["package.json"] --> C["yarn.lock"]
  C --> D["monaco-editor"] --> E["dompurify"]
  C --> F["HTTP deps"]
  C --> G["Auth deps"]
  C --> H["Net deps"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Use Yarn resolutions/overrides for only the vulnerable transitives

• ➕ Smaller diff and less risk of incidental upgrades
• ➕ Targets only the CVE-bearing packages
• ➖ Can create unsupported dependency graphs and harder future upgrades
• ➖ Not all packages behave correctly when forcibly overridden

2. Introduce automated dependency update workflow (Renovate/Dependabot) for this workspace

• ➕ Reduces long-lived CVE backlog by shipping smaller, frequent bumps
• ➕ Improves visibility and traceability of security-related upgrades
• ➖ Requires ongoing triage/configuration and can increase PR volume
• ➖ May need additional allow/ignore rules for local harness packages

3. Patch via upstream parent-package upgrades only (avoid direct bumps where possible)

• ➕ Keeps dependency tree aligned with upstream expectations
• ➕ Less chance of peer/dependency mismatches
• ➖ Often forces larger version jumps in parent packages
• ➖ May not fully eliminate CVEs if parents lag behind

Recommendation: The PR’s approach (upgrading the relevant parent packages and re-locking) is the most reliable way to ensure CVE fixes actually land in the resolved graph. Consider a follow-up to add automated dependency update tooling to prevent future CVE accumulation; use resolutions sparingly and only when parent upgrades cannot deliver patched transitives.

Files changed (3) +188 / -203

Other (3) +188 / -203

thin-plums-confess.mdAdd changeset for monaco-editor bump patch release +5/-0

Add changeset for monaco-editor bump patch release

• Adds a changeset marking a patch release for the intelligent-assistant plugin. Documents the monaco-editor 0.56.0 bump to pick up the dompurify update.

workspaces/intelligent-assistant/.changeset/thin-plums-confess.md

package.jsonUpgrade monaco-editor to 0.56.0 +1/-1

Upgrade monaco-editor to 0.56.0

• Updates the plugin’s direct dependency on monaco-editor from ^0.55.0 to ^0.56.0. This is intended to pull in patched transitive dependencies (notably dompurify).

workspaces/intelligent-assistant/plugins/intelligent-assistant/package.json

yarn.lockRe-lock dependency graph to patched versions for CVEs +182/-202

Re-lock dependency graph to patched versions for CVEs

• Updates many resolved versions and checksums after running targeted 'yarn up -R' upgrades. Includes bumps across monaco-editor/dompurify, axios/form-data/minimatch/tmp/path-to-regexp/brace-expansion, and auth/network-related transitives (e.g., google-auth-library/jws/ip-address).

workspaces/intelligent-assistant/yarn.lock

[rhdh-qodo-merge]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can enable the Remediation agent and Qodo fixes findings in a dedicated fix PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Jdubrick]

/lgtm