chore: upgrade brace-expansion in lightspeed to version 5.0.9, 2.1.4, 1.1.18 [Lightspeed] [release-1.10]

[Omar-AlJaljuli]

Hey, I just made a Pull Request!

brace-expansion in orchestrator is vulnerable with CVE-2026-69152. Upgrading ip-address to versions 5.0.9, 2.1.4, 1.1.18.

Upgrade done using 'yarn up -R ...'.

✔️ Checklist

• A changeset describing the change and affected packages. (more info)
• Added or Updated documentation
• Tests for new functionality and regression tests for bug fixes
• Screenshots attached (for UI changes)

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rhdh-qodo-merge]

PR Summary by Qodo

chore(lightspeed): bump brace-expansion to patched versions

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Patch CVE-2026-69152 by upgrading transitive brace-expansion versions in Lightspeed.
• Refresh workspaces/lightspeed yarn.lock via yarn up -R to capture updated resolutions.

Diagram

graph TD
  WS["Lightspeed workspace"] --> LOCK["workspaces/lightspeed/yarn.lock"] --> BRACE["brace-expansion (1.1.18/2.1.4/5.0.9)"]
  BRACE --> CVE["Fixes CVE-2026-69152"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Pin via Yarn resolutions/overrides

• ➕ Forces patched versions even if upstream ranges drift
• ➕ Makes the security intent explicit in source control
• ➖ Adds ongoing maintenance burden and potential conflicts
• ➖ Can mask the need to update upstream dependencies

2. Upgrade the direct parent dependencies instead

• ➕ Avoids explicit overrides by moving the ecosystem forward
• ➕ May pull in additional upstream security fixes
• ➖ Potentially larger dependency churn and regression surface
• ➖ May require code changes if parent packages introduce breaking changes

Recommendation: The current approach (lockfile refresh via yarn up -R to pick up patched transitive versions) is appropriate for a targeted CVE remediation with minimal blast radius. Consider adding an explicit resolution only if the patched versions are at risk of being downgraded by future dependency changes.

Files changed (1) +9 / -9

Other (1) +9 / -9

yarn.lockUpgrade brace-expansion transitive resolutions (v1/v2/v5) and checksums +9/-9

Upgrade brace-expansion transitive resolutions (v1/v2/v5) and checksums

• Bumps brace-expansion resolutions to 1.1.18, 2.1.4, and 5.0.9 in the Lightspeed workspace lockfile. Updates the corresponding integrity checksums to match the new artifacts.

workspaces/lightspeed/yarn.lock

[rhdh-qodo-merge]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (lightspeed/release-1.10@fce5805). Learn more about missing BASE report.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@                    Coverage Diff                     @@
##             lightspeed/release-1.10    #4183   +/-   ##
==========================================================
  Coverage                           ?   60.96%           
==========================================================
  Files                              ?     2098           
  Lines                              ?    65167           
  Branches                           ?    16945           
==========================================================
  Hits                               ?    39726           
  Misses                             ?    25219           
  Partials                           ?      222           

Flag	Coverage Δ		*Carryforward flag
adoption-insights	83.58% <ø> (?)		Carriedforward from 230b90c
ai-integrations	70.03% <ø> (?)		Carriedforward from 230b90c
app-defaults	69.60% <ø> (?)		Carriedforward from 230b90c
augment	69.36% <ø> (?)		Carriedforward from 230b90c
bulk-import	72.86% <ø> (?)		Carriedforward from 230b90c
cost-management	16.49% <ø> (?)		Carriedforward from 230b90c
dcm	32.85% <ø> (?)		Carriedforward from 230b90c
extensions	61.79% <ø> (?)		Carriedforward from 230b90c
global-floating-action-button	74.30% <ø> (?)		Carriedforward from 230b90c
global-header	61.68% <ø> (?)		Carriedforward from 230b90c
homepage	50.95% <ø> (?)		Carriedforward from 230b90c
konflux	91.01% <ø> (?)		Carriedforward from 230b90c
lightspeed	68.13% <ø> (?)
mcp-integrations	81.59% <ø> (?)		Carriedforward from 230b90c
orchestrator	36.36% <ø> (?)		Carriedforward from 230b90c
quickstart	62.88% <ø> (?)		Carriedforward from 230b90c
sandbox	79.56% <ø> (?)		Carriedforward from 230b90c
scorecard	83.58% <ø> (?)		Carriedforward from 230b90c
theme	64.54% <ø> (?)		Carriedforward from 230b90c
translations	8.49% <ø> (?)		Carriedforward from 230b90c
x2a	78.28% <ø> (?)		Carriedforward from 230b90c

*This pull request uses carry forward flags. Click here to find out more.

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update fce5805...d8cbfbc. Read the comment docs.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.