chore: update brace-expansion in orchestrator to versions 5.0.9, 2.1.4, 1.1.18 [orchestrator] [release-1.10]

[Omar-AlJaljuli]

…4, 1.1.18

Hey, I just made a Pull Request!

brace-expansion in orchestrator is vulnerable with CVE-2026-69152. Upgrading ip-address to versions 5.0.9, 2.1.4, 1.1.18.

Upgrade done using 'yarn up -R ...'.

✔️ Checklist

• A changeset describing the change and affected packages. (more info)
• Added or Updated documentation
• Tests for new functionality and regression tests for bug fixes
• Screenshots attached (for UI changes)

[rhdh-qodo-merge]

PR Summary by Qodo

Fix CVE by upgrading brace-expansion in orchestrator lockfile

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 5 minutes

AI Description

• Bump brace-expansion patch versions to address CVE-2026-69152.
• Update orchestrator workspace yarn.lock entries for 1.x, 2.x, and 5.x ranges.

High-Level Assessment

The following are alternative approaches to this PR:

1. Add Yarn resolutions to force a single patched version

• ➕ Ensures transitive consumers converge on one patched version (where compatible)
• ➕ Can reduce duplicate dependency copies
• ➖ May violate semver expectations for some dependents and introduce runtime risk
• ➖ Requires ongoing maintenance and periodic reconciliation

2. Run yarn dedupe after upgrade

• ➕ Potentially reduces multiple brace-expansion versions in the lockfile
• ➕ Smaller lockfile surface area to audit
• ➖ May change more of the lockfile than necessary for a security-only fix
• ➖ Could cause unexpected dependency graph shifts

Recommendation: The current approach (patch-level upgrades within existing semver ranges via lockfile update) is the safest, lowest-risk remediation for the CVE. Consider a follow-up dedupe/resolutions change only if you need to reduce multi-version occurrences and have validated compatibility.

Files changed (1) +9 / -9

Other (1) +9 / -9

yarn.lockUpgrade brace-expansion to patched versions across 1.x/2.x/5.x +9/-9

Upgrade brace-expansion to patched versions across 1.x/2.x/5.x

• Updates the resolved brace-expansion versions and checksums for ranges used by the orchestrator workspace. Specifically bumps 1.1.16→1.1.18, 2.1.2→2.1.4, and 5.0.8→5.0.9 to remediate the reported vulnerability.

workspaces/orchestrator/yarn.lock

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rhdh-qodo-merge]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (orchestrator/release-1.10@0f6f9df). Learn more about missing BASE report.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@                     Coverage Diff                      @@
##             orchestrator/release-1.10    #4182   +/-   ##
============================================================
  Coverage                             ?   59.57%           
============================================================
  Files                                ?     2097           
  Lines                                ?    65234           
  Branches                             ?    17001           
============================================================
  Hits                                 ?    38862           
  Misses                               ?    25980           
  Partials                             ?      392           

Flag	Coverage Δ		*Carryforward flag
adoption-insights	83.58% <ø> (?)		Carriedforward from 95b5a82
ai-integrations	70.03% <ø> (?)		Carriedforward from 95b5a82
app-defaults	69.60% <ø> (?)		Carriedforward from 95b5a82
augment	69.36% <ø> (?)		Carriedforward from 95b5a82
bulk-import	72.86% <ø> (?)		Carriedforward from 95b5a82
cost-management	16.49% <ø> (?)		Carriedforward from 95b5a82
dcm	32.85% <ø> (?)		Carriedforward from 95b5a82
extensions	61.79% <ø> (?)		Carriedforward from 95b5a82
global-floating-action-button	74.30% <ø> (?)		Carriedforward from 95b5a82
global-header	61.68% <ø> (?)		Carriedforward from 95b5a82
homepage	50.95% <ø> (?)		Carriedforward from 95b5a82
konflux	91.01% <ø> (?)		Carriedforward from 95b5a82
lightspeed	68.34% <ø> (?)		Carriedforward from 95b5a82
mcp-integrations	81.59% <ø> (?)		Carriedforward from 95b5a82
orchestrator	37.54% <ø> (?)
quickstart	62.64% <ø> (?)		Carriedforward from 95b5a82
sandbox	79.56% <ø> (?)		Carriedforward from 95b5a82
scorecard	83.58% <ø> (?)		Carriedforward from 95b5a82
theme	64.54% <ø> (?)		Carriedforward from 95b5a82
translations	8.49% <ø> (?)		Carriedforward from 95b5a82
x2a	57.33% <ø> (?)		Carriedforward from 95b5a82

*This pull request uses carry forward flags. Click here to find out more.

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 0f6f9df...55cf9b5. Read the comment docs.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.