chore: upgrade ip-address in orchestrator to >= 10.3.1 [orchestrator] [release-1.10]

[Omar-AlJaljuli]

Hey, I just made a Pull Request!

ip-address in orchestrator is vulnerable with CVE-2026-69192. Upgrading ip-address to version >= 10.3.1.

Upgrade done using 'yarn up -R ...'.

✔️ Checklist

• A changeset describing the change and affected packages. (more info)
• Added or Updated documentation
• Tests for new functionality and regression tests for bug fixes
• Screenshots attached (for UI changes)

[rhdh-qodo-merge]

PR Summary by Qodo

chore(orchestrator): bump ip-address to 10.4.0 to remediate CVE-2026-69192

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Upgrade orchestrator's locked ip-address version to a non-vulnerable release.
• Remediate CVE-2026-69192 by moving off ip-address 10.2.0.
• Refresh yarn.lock via yarn up -R to capture updated resolution/checksum.

Diagram

graph TD
  A["Orchestrator workspace"] --> B["workspaces/orchestrator/yarn.lock"] --> C["ip-address@10.4.0"] --> D["CVE-2026-69192 mitigated"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Use Yarn resolutions/overrides to force >= 10.3.1

• ➕ Can patch transitive occurrences without changing direct dependency declarations
• ➕ Often quicker if multiple packages pull different ranges
• ➖ Can mask underlying dependency constraints and diverge from upstream intent
• ➖ Needs ongoing maintenance as dependency graph evolves

2. Patch via patch-package (or vendored fix)

• ➕ Avoids dependency upgrade if the new version introduces regressions
• ➕ Can target a minimal fix footprint
• ➖ Higher maintenance burden and harder audits
• ➖ Not ideal for a public CVE when an upstream fix exists

Recommendation: Proceed with the dependency upgrade (current approach). For a known CVE with an upstream fix available, moving to a patched ip-address release in the lockfile is the lowest-maintenance and most auditable remediation. Consider resolutions/overrides only if additional vulnerable transitive paths remain after this bump.

Files changed (1) +3 / -3

Other (1) +3 / -3

yarn.lockResolve ip-address to 10.4.0 with updated checksum +3/-3

Resolve ip-address to 10.4.0 with updated checksum

• Updates the locked ip-address resolution from 10.2.0 to 10.4.0 and refreshes the corresponding Yarn resolution/checksum entry. This is intended to remediate CVE-2026-69192 by ensuring orchestrator installs a non-vulnerable version.

workspaces/orchestrator/yarn.lock

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rhdh-qodo-merge]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (orchestrator/release-1.10@0f6f9df). Learn more about missing BASE report.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@                     Coverage Diff                      @@
##             orchestrator/release-1.10    #4180   +/-   ##
============================================================
  Coverage                             ?   59.57%           
============================================================
  Files                                ?     2097           
  Lines                                ?    65234           
  Branches                             ?    16986           
============================================================
  Hits                                 ?    38862           
  Misses                               ?    25977           
  Partials                             ?      395           

Flag	Coverage Δ		*Carryforward flag
adoption-insights	83.58% <ø> (?)		Carriedforward from 95b5a82
ai-integrations	70.03% <ø> (?)		Carriedforward from 95b5a82
app-defaults	69.60% <ø> (?)		Carriedforward from 95b5a82
augment	69.36% <ø> (?)		Carriedforward from 95b5a82
bulk-import	72.86% <ø> (?)		Carriedforward from 95b5a82
cost-management	16.49% <ø> (?)		Carriedforward from 95b5a82
dcm	32.85% <ø> (?)		Carriedforward from 95b5a82
extensions	61.79% <ø> (?)		Carriedforward from 95b5a82
global-floating-action-button	74.30% <ø> (?)		Carriedforward from 95b5a82
global-header	61.68% <ø> (?)		Carriedforward from 95b5a82
homepage	50.95% <ø> (?)		Carriedforward from 95b5a82
konflux	91.01% <ø> (?)		Carriedforward from 95b5a82
lightspeed	68.34% <ø> (?)		Carriedforward from 95b5a82
mcp-integrations	81.59% <ø> (?)		Carriedforward from 95b5a82
orchestrator	37.54% <ø> (?)
quickstart	62.64% <ø> (?)		Carriedforward from 95b5a82
sandbox	79.56% <ø> (?)		Carriedforward from 95b5a82
scorecard	83.58% <ø> (?)		Carriedforward from 95b5a82
theme	64.54% <ø> (?)		Carriedforward from 95b5a82
translations	8.49% <ø> (?)		Carriedforward from 95b5a82
x2a	57.33% <ø> (?)		Carriedforward from 95b5a82

*This pull request uses carry forward flags. Click here to find out more.

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 0f6f9df...16c9e90. Read the comment docs.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.