fix extensions CVEs on main

[kim-tsao]

Hey, I just made a Pull Request!

Fixes: https://redhat.atlassian.net/browse/RHIDP-16100

• Updates CVEs in main that were previous fixed in Z streams.
• Fixed some moderates intended for next release.
• Prioritized updates on prod dependencies and dev deps (which will show up in SBOMs). Ignored anything from local harnesses (app, app-legacy, backend)

• fast-xml-parser: Ran a yarn up -R on the various @aws-sdk clients to bump the transitive deps
• form-data: yarn up -R form-data
• protobufjs: yarn up -R protobufjs
• path-to-regexp: yarn up -R path-to-regexp. >= 8.0.0, < 8.4.0
• tmp: yarn up -R tmp. Only affects dev dependency
• js-cookie: `yarn up -R @react-hookz/web and react-use" to bump transitive dep
• js-yaml: yarn up -R js-yaml
• ip-address: yarn up -R express-rate-limit to bump transitive dep
• dompurify: semver bump on monaco-editor in package.json, yarn up -R dompurify
• react-router: yarn up -R react-router-dom to bump transitive dep

✔️ Checklist

• A changeset describing the change and affected packages. (more info)
• Added or Updated documentation
• Tests for new functionality and regression tests for bug fixes
• Screenshots attached (for UI changes)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 58.33%. Comparing base (e632466) to head (78536cd).
⚠️ Report is 6 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4202   +/-   ##
=======================================
  Coverage   58.33%   58.33%           
=======================================
  Files        2432     2432           
  Lines       96775    96775           
  Branches    26912    26912           
=======================================
  Hits        56455    56455           
+ Misses      40121    40120    -1     
- Partials      199      200    +1     

Flag	Coverage Δ		*Carryforward flag
adoption-insights	84.55% <ø> (ø)		Carriedforward from 70af478
ai-integrations	69.76% <ø> (ø)		Carriedforward from 70af478
app-defaults	69.79% <ø> (ø)		Carriedforward from 70af478
augment	46.67% <ø> (ø)		Carriedforward from 70af478
boost	76.77% <ø> (ø)		Carriedforward from 70af478
bulk-import	72.79% <ø> (ø)		Carriedforward from 70af478
cost-management	13.55% <ø> (ø)		Carriedforward from 70af478
dcm	67.21% <ø> (ø)		Carriedforward from 70af478
extensions	56.59% <ø> (ø)
global-floating-action-button	71.18% <ø> (ø)		Carriedforward from 70af478
global-header	66.50% <ø> (ø)		Carriedforward from 70af478
homepage	47.50% <ø> (ø)		Carriedforward from 70af478
install-dynamic-plugins	59.95% <ø> (ø)		Carriedforward from 70af478
intelligent-assistant	75.24% <ø> (ø)		Carriedforward from 70af478
konflux	91.98% <ø> (ø)		Carriedforward from 70af478
lightspeed	69.02% <ø> (ø)		Carriedforward from 70af478
mcp-integrations	83.40% <ø> (ø)		Carriedforward from 70af478
orchestrator	66.91% <ø> (ø)		Carriedforward from 70af478
quickstart	63.74% <ø> (ø)		Carriedforward from 70af478
sandbox	79.56% <ø> (ø)		Carriedforward from 70af478
scorecard	86.17% <ø> (ø)		Carriedforward from 70af478
theme	88.77% <ø> (ø)		Carriedforward from 70af478
translations	5.12% <ø> (ø)		Carriedforward from 70af478
x2a	79.20% <ø> (ø)		Carriedforward from 70af478

*This pull request uses carry forward flags. Click here to find out more.

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update e632466...78536cd. Read the comment docs.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[rhdh-gh-app]

Changed Packages

Package Name	Package Path	Changeset Bump	Current Version
@red-hat-developer-hub/backstage-plugin-extensions	workspaces/extensions/plugins/extensions	patch	v0.19.1

[rhdh-qodo-merge]

PR Summary by Qodo

Remediate CVEs in extensions workspace via dependency upgrades

🐞 Bug fix ⚙️ Configuration changes 🕐 20-40 Minutes

AI Description

• Upgrade vulnerable direct and transitive npm dependencies in the extensions workspace.
• Bump monaco-editor to pull in patched dompurify.
• Refresh yarn.lock resolutions for AWS SDK, router, and other CVE-flagged packages.

Diagram

graph TD
  A["plugins/extensions/package.json"] --> B[("yarn.lock")] --> C["UI deps"] --> E["Patched CVE transitives"]
  B --> D["AWS SDK deps"] --> E
  B --> F["Dev-only deps"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Use Yarn resolutions/packageExtensions to pin only vulnerable transitives

• ➕ Minimizes version churn (especially AWS SDK/@smithy updates)
• ➕ Reduces risk of behavioral changes from large dependency upgrades
• ➖ Overrides can drift from upstream dependency intent and complicate upgrades
• ➖ May not satisfy tooling/SBOM policies that prefer upstream bumps over overrides

2. Targeted upgrades of only direct parents of each CVE (avoid -R)

• ➕ Smaller lockfile diff; easier to review and bisect
• ➕ Less chance of incidental upgrades
• ➖ Harder to ensure all vulnerable transitives are fully eliminated
• ➖ May require iterative audit cycles as new findings surface

3. Adopt/lean on Renovate (or similar) for recurring CVE upgrade PRs

• ➕ Consistent, automated dependency hygiene and smaller incremental PRs
• ➕ Can batch by ecosystem/workspace with predictable cadence
• ➖ Initial setup/tuning cost; may increase PR volume
• ➖ Still needs human validation for risky upgrades (routers, AWS SDK, editor libs)

Recommendation: The PR’s approach (bumping the owning direct dependencies so patched transitives are pulled in) is generally the most maintainable for CVE remediation and SBOM accuracy. If review risk is a concern due to the large AWS SDK/@smithy churn, consider a follow-up strategy of using resolutions only for any remaining hard-to-upgrade CVEs, but prefer upstream bumps as done here.

Files changed (2) +345 / -1298

Other (2) +345 / -1298

package.jsonBump monaco-editor to 0.56.0 to pick up patched transitives +1/-1

Bump monaco-editor to 0.56.0 to pick up patched transitives

• Updates the extensions plugin’s monaco-editor dependency from ^0.55.0 to ^0.56.0. This is intended to pull a newer dompurify version via the dependency chain.

workspaces/extensions/plugins/extensions/package.json

yarn.lockRefresh lockfile to resolve multiple CVE-related dependency upgrades +344/-1297

Refresh lockfile to resolve multiple CVE-related dependency upgrades

• Updates resolved versions for several direct and transitive dependencies, including AWS SDK/@smithy packages, fast-xml-parser, form-data, protobufjs (and related @protobufjs/* and long), path-to-regexp, js-cookie (and @types/js-cookie), js-yaml, express-rate-limit/ip-address, dompurify, react-router-dom/react-router/@remix-run/router, and tmp. Removes/replaces older vulnerable resolutions in favor of newer patched releases.

workspaces/extensions/yarn.lock

[rhdh-qodo-merge]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 🔗 Cross-repo conflicts (1) 📜 Skill insights (0)

1. RHDH not inheriting updates 🔗 Cross-repo conflict ⛨ Security

Description

This PR updates dependencies for @red-hat-developer-hub/backstage-plugin-extensions (e.g.,
monaco-editor→0.56.0 which pulls a newer dompurify), but RHDH currently mounts Extensions via a
dynamic-plugin wrapper pinned to @red-hat-developer-hub/backstage-plugin-extensions@0.18.0, so RHDH
will continue shipping the older dependency set until it bumps the embedded package and regenerates
its lockfile.

Code

workspaces/extensions/plugins/extensions/package.json[72]

+    "monaco-editor": "^0.56.0",

Relevance

● Weak

Similar cross-repo “downstream rhdh wrapper pins version, needs follow-up bump” note was rejected as
out-of-scope.

PR-#3896

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The PR updates the Extensions plugin to require monaco-editor ^0.56.0 (and the workspace lock
resolves monaco-editor 0.56.0 which depends on dompurify 3.4.8). In the pinned RHDH snapshot, the
Extensions dynamic-plugin wrapper embeds @red-hat-developer-hub/backstage-plugin-extensions@0.18.0
and RHDH’s dynamic-plugins lock resolves monaco-editor 0.55.1 and dompurify 3.2.7, so RHDH will not
pick up the updated dependency set until it bumps the embedded version and re-locks.

workspaces/extensions/plugins/extensions/package.json[54-79]
workspaces/extensions/yarn.lock[25254-25260]
workspaces/extensions/yarn.lock[17644-17646]
External repo: redhat-developer/rhdh, app-config.dynamic-plugins.yaml [597-615]
External repo: redhat-developer/rhdh, dynamic-plugins/wrappers/red-hat-developer-hub-backstage-plugin-extensions/package.json [44-50]
External repo: redhat-developer/rhdh, dynamic-plugins/yarn.lock [26642-26644]
External repo: redhat-developer/rhdh, dynamic-plugins/yarn.lock [20159-20161]
External repo: redhat-developer/rhdh, dynamic-plugins/yarn.lock [12118]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The Extensions plugin dependency update (notably `monaco-editor` -> `^0.56.0`, bringing in a newer `dompurify`) will not reach the **RHDH distribution** as long as RHDH’s dynamic-plugin wrapper stays pinned to `@red-hat-developer-hub/backstage-plugin-extensions@0.18.0`.

### Issue Context
RHDH mounts the Extensions UI via the `red-hat-developer-hub.backstage-plugin-extensions` dynamic plugin and its wrapper package, which embeds a specific published version of `@red-hat-developer-hub/backstage-plugin-extensions`. This PR updates the plugin’s dependency graph in rhdh-plugins, but downstream (RHDH) must explicitly bump the embedded package version + re-lock to pick it up.

### Fix Focus Areas
- workspaces/extensions/plugins/extensions/package.json[69-79]
- workspaces/extensions/yarn.lock[25254-25260]
- workspaces/extensions/yarn.lock[17644-17646]
- /cross_repos/rhdh/dynamic-plugins/wrappers/red-hat-developer-hub-backstage-plugin-extensions/package.json[44-50]
- /cross_repos/rhdh/app-config.dynamic-plugins.yaml[597-615]
- /cross_repos/rhdh/dynamic-plugins/yarn.lock[26642-26644]

**Concrete steps**
1) In this repo (rhdh-plugins): ensure the change is actually publishable/consumable by RHDH (typically: add the appropriate changeset/version bump for `@red-hat-developer-hub/backstage-plugin-extensions` so a new npm version is released).
2) In `redhat-developer/rhdh`: bump the wrapper’s embedded dependency `@red-hat-developer-hub/backstage-plugin-extensions` from `0.18.0` to the newly released version and regenerate `dynamic-plugins/yarn.lock` so it resolves the updated `monaco-editor`/`dompurify` graph.
3) Validate the dynamic plugin build/export flow in RHDH after the bump.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context used

✅ Compliance rules (platform): 11 rules

✅ Cross-repo context

  Explored: repo: redhat-developer/rhdh (sha: 4c5a4e85)

  Not relevant to this PR: redhat-developer/rhdh-chart

  Not relevant to this PR: redhat-developer/rhdh-operator

  Not relevant to this PR: redhat-developer/rhdh-local

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

[its-mitesh-kumar]

/lgtm based on its only version update and CI is green.

[kim-tsao]

/fs-fix create a patch version bump and commit

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud