chore(orchestrator): backporting CVE commits to the workspace/orchestrator for 1.8.6#2797
Conversation
…#2779) * fix: ran yarn up -R ajv. fixes https://access.redhat.com/security/cve/cve-2025-69873 * fix: ran yarn up -R path-to-regexp fixes https://access.redhat.com/security/cve/CVE-2026-4926 * fix: ran yarn up -R lodash fixes: https://access.redhat.com/security/cve/CVE-2026-4800 * squash: add the changeset
Code Review by Qodo🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)
Great, no issues found!Qodo reviewed your code and found no material issues that require reviewⓘ The new review experience is currently in Beta. Learn more |
|
Review Summary by QodoSecurity: Backport CVE fixes for orchestrator 1.8.6 release
WalkthroughsDescription• Update axios from 1.11.0 to 1.15.0 to fix CVE-2026-40175 • Update lodash from 4.17.21 to 4.18.1 to fix CVE-2026-4800 • Update ajv and path-to-regexp dependencies for CVE fixes • Add changesets documenting security vulnerability patches Diagramflowchart LR
CVE["CVE Vulnerabilities<br/>axios, lodash, ajv,<br/>path-to-regexp"]
UPDATE["Dependency Updates<br/>to patched versions"]
PACKAGES["Orchestrator Packages<br/>backend, common,<br/>form-react, form-widgets"]
CHANGESET["Changesets Created<br/>for release tracking"]
CVE -- "fix" --> UPDATE
UPDATE -- "applied to" --> PACKAGES
UPDATE -- "documented in" --> CHANGESET
File Changes1. workspaces/orchestrator/.changeset/lucky-cars-study.md
|
1 participant
Hey, I just made a Pull Request!
These are 2 cherry picks from PRs #2773 and #2767
✔️ Checklist