Fix CVEs

[asmasarw]

No description provided.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 61.06%. Comparing base (893f068) to head (116c451).
⚠️ Report is 11 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3111   +/-   ##
=======================================
  Coverage   61.06%   61.06%           
=======================================
  Files        2071     2071           
  Lines       64170    64170           
  Branches    16735    16732    -3     
=======================================
  Hits        39188    39188           
- Misses      24438    24442    +4     
+ Partials      544      540    -4     

Flag	Coverage Δ		*Carryforward flag
adoption-insights	83.58% <ø> (ø)		Carriedforward from 8fb2303
ai-integrations	70.03% <ø> (ø)		Carriedforward from 8fb2303
app-defaults	69.60% <ø> (ø)		Carriedforward from 8fb2303
augment	69.36% <ø> (ø)		Carriedforward from 8fb2303
bulk-import	72.45% <ø> (ø)		Carriedforward from 8fb2303
cost-management	16.49% <ø> (ø)
dcm	32.85% <ø> (ø)		Carriedforward from 8fb2303
extensions	61.79% <ø> (ø)		Carriedforward from 8fb2303
global-floating-action-button	73.75% <ø> (ø)		Carriedforward from 8fb2303
global-header	61.68% <ø> (ø)		Carriedforward from 8fb2303
homepage	50.84% <ø> (ø)		Carriedforward from 8fb2303
konflux	91.01% <ø> (ø)		Carriedforward from 8fb2303
lightspeed	70.36% <ø> (ø)		Carriedforward from 8fb2303
mcp-integrations	81.59% <ø> (ø)		Carriedforward from 8fb2303
orchestrator	35.14% <ø> (ø)		Carriedforward from 8fb2303
quickstart	62.64% <ø> (ø)		Carriedforward from 8fb2303
sandbox	79.56% <ø> (ø)		Carriedforward from 8fb2303
scorecard	83.61% <ø> (ø)		Carriedforward from 8fb2303
theme	64.54% <ø> (ø)		Carriedforward from 8fb2303
translations	8.49% <ø> (ø)		Carriedforward from 8fb2303
x2a	82.47% <ø> (ø)		Carriedforward from 8fb2303

*This pull request uses carry forward flags. Click here to find out more.

---

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 893f068...116c451. Read the comment docs.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[PreetiW]

@asmasarw thank you for the PR, all package upgrade looks good except two packages I have raised the concerned please check the comments and fix. also minimatch alert #3068 (High — ReDoS via repeated wildcards with non-matching literal) is still open in Dependabot and is not addressed by this PR. Consider adding a minimatch resolution (e.g. "minimatch": "9.0.5" or latest 10.x) to close it out alongside the other fixes.

Reference:

Dependabot alert: https://github.com/redhat-developer/rhdh-plugins/security/dependabot/3068

Please also create a changeset in workspaces/cost-management/.changeset/fix-cve-resolutions.md with below contents so it will automatically bump the version

---
'@red-hat-developer-hub/plugin-cost-management': patch
'@red-hat-developer-hub/plugin-cost-management-backend': patch
'@red-hat-developer-hub/plugin-cost-management-common': patch
---
fix: patch transitive dependency CVEs via yarn resolutions
Pins vulnerable transitive dependencies to patched versions to address open Dependabot alerts:

Thank you.

[PreetiW]

@asmasarw thank you for the PR, all package upgrade looks good except two packages I have raised the concerned please check the comments and fix. also minimatch alert #3068 (High — ReDoS via repeated wildcards with non-matching literal) is still open in Dependabot and is not addressed by this PR. Consider adding a minimatch resolution (e.g. "minimatch": "9.0.5" or latest 10.x) to close it out alongside the other fixes.

Reference:

Dependabot alert: https://github.com/redhat-developer/rhdh-plugins/security/dependabot/3068

Please also create a changeset in workspaces/cost-management/.changeset/fix-cve-resolutions.md with below contents so it will automatically bump the version

---
'@red-hat-developer-hub/plugin-cost-management': patch
'@red-hat-developer-hub/plugin-cost-management-backend': patch
'@red-hat-developer-hub/plugin-cost-management-common': patch
---
fix: patch transitive dependency CVEs via yarn resolutions
Pins vulnerable transitive dependencies to patched versions to address open Dependabot alerts:

--- mention the dependencies details here -----

Thank you.

[rhdh-gh-app]

Unexpected Changesets

The following changeset(s) reference packages that have not been changed in this PR:

• /home/runner/work/rhdh-plugins/rhdh-plugins/workspaces/cost-management/.changeset/fix-transitive-dep-cves.md: @red-hat-developer-hub/plugin-cost-management, @red-hat-developer-hub/plugin-cost-management-backend, @red-hat-developer-hub/plugin-cost-management-common

Note that only changes that affect the published package require changesets, for example changes to tests and storybook stories do not require changesets.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[PreetiW]

@asmasarw thank you for making the changes. LGTM 🎉