Lock file maintenance (release-v0.7)

[red-hat-konflux]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 04:59 AM (* 0-4 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 4:04 AM UTC · Completed 4:16 AM UTC

Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

Review

Renovate lockFileMaintenance PR on release-v0.7 — only package-lock.json is touched (+80/-38), and the changes are transitive-dependency version bumps (plus license metadata enrichment on unchanged entries). No source, tests, docs, workflows, or protected paths are modified. package.json still declares only tekton-lint@^0.6.0; all bumped packages come in transitively through it. Lockfile internal consistency is preserved: every new pinned version satisfies its parent's declared range, and every added entry carries a well-formed sha512- SRI integrity hash and a resolved URL.

Findings

Medium

• [supply-chain] package-lock.json — Several transitive bumps land on versions that, per public release history in the past, were long-standing terminals on their major/minor line: lodash 4.17.21 → 4.18.1, yaml 1.10.2 → 1.10.3, picomatch 2.3.1 → 2.3.2, reusify 1.0.4 → 1.1.0, and a larger fastq 1.15.0 → 1.20.3 jump. Registry-side verification (npm view <pkg> versions, publisher check) could not be performed at review time because the review sandbox blocks outbound DNS to registry.npmjs.org. Renovate is the authoritative bumper and the pinned SRI hashes will fail npm ci if any tarball is tampered or the version does not resolve — so this is advisory, not blocking. Before merge, a human reviewer with npm access should sanity-check that at least the lodash 4.18.1 and yaml 1.10.3 entries exist on the public registry and are published by the expected maintainers.

Previous run

Review

This Renovate/Mintmaker lockFileMaintenance PR refreshes package-lock.json (the only file touched). The PR body itself carries a warning from the bot: "Some dependencies could not be looked up. Check the warning logs for more information." Several version bumps in the diff also do not line up with publicly-known release histories for their packages, so the aggregate signal is a supply-chain concern worth blocking on until a human verifies the origin of the resolved tarballs.

Note on verification: WebFetch/DNS to registry.npmjs.org is fail-closed in this reviewer environment, so the findings below rest on the diff content plus recall of well-known "terminal" versions — they were not net-verified. A human must confirm before merging.

Findings

Critical

• [unverified-version] package-lock.json:302 — lodash bumped 4.17.21 → 4.18.1. lodash@4.17.21 has been the definitive final v4 release since 2021; no 4.18.x line is publicly known on the npm registry. Renovate's own "could not be looked up" warning in the PR body is corroborating intel. If 4.18.1 does not exist on the public registry, npm will silently trust integrity sha512-dMInic...q+0Q== from whatever source resolved it — even though @conforma/cli-tools is dev-only, a malicious tarball at npm install time can still exfiltrate developer/CI credentials.
  Remediation: Do NOT merge until a human verifies that lodash@4.18.1 exists on the public npm registry and that the tarball integrity matches the lockfile value. If it does not, pin lodash back to 4.17.21, investigate how Mintmaker/Renovate produced this bump (compromised bot config, private-registry override, upstream mirror poisoning), rotate any exposed npm/CI tokens, and file an incident.

High

• [unverified-version] package-lock.json:509 — yaml bumped 1.10.2 → 1.10.3. The yaml v1 line is widely known to have ended at 1.10.2 (maintainer moved to v2). Integrity in lockfile: sha512-vIYeF1...f/AA==.
  Remediation: Manually verify yaml@1.10.3 exists on the public npm registry and that the tarball integrity matches. If it does not, revert to 1.10.2.

Medium

• [unverified-version] package-lock.json:348 — picomatch bumped 2.3.1 → 2.3.2. The picomatch v2 line is publicly known to have ended at 2.3.1 (active line is 3.x). A 2.3.2 patch release is inconsistent with the maintainer's public cadence. Integrity in lockfile: sha512-V7+vQEJ...ie0oA==.
  Remediation: Manually verify picomatch@2.3.2 exists on the public npm registry and that the tarball integrity matches. If it does not, revert to 2.3.1.
• [supply-chain] package-lock.json — Renovate/Mintmaker reported in the PR body: "Some dependencies could not be looked up. Check the warning logs for more information." Combined with the three unverified version bumps above (lodash@4.18.1, picomatch@2.3.2, yaml@1.10.3), this is a supply-chain warning pattern consistent with either (a) a misconfigured or compromised private registry / registry mirror, or (b) dependency confusion / registry injection.
  Remediation: Retrieve the Mintmaker/Renovate warning logs for this run and identify which registry each of the flagged versions was resolved against. Confirm the effective npm registry configuration used by the bot has not been overridden to a proxy or private feed that could shadow public package names.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (2)

Review

Findings

Info

• [provenance-warning] — Prior review context was discarded: PRIOR_REVIEW_PROVENANCE=unverifiable-wrong-app (the prior review comment on this PR was created by a different app than expected, so authorship could not be verified). This run treats all findings as first-time assessments; severity anchoring was skipped.
• [dependency-maintenance] package-lock.json — Renovate/MintMaker lockFileMaintenance refresh. Diff is limited to version bumps and additive license metadata on existing entries; all resolved URLs remain on the public npm registry, integrity hashes are well-formed sha512- base64, and licenses are standard SPDX identifiers (MIT / ISC / Apache-2.0 / BSD-3-Clause). The PR body notes "Some dependencies could not be looked up. Check the warning logs for more information." — spot-checked the three most-jumped versions (lodash 4.17.21 to 4.18.1, picomatch 2.3.1 to 2.3.2, yaml 1.10.2 to 1.10.3) against upstream repository tags; all three tags exist and were published in 2026 (lodash 4.18.1 on 2026-04-01, picomatch 2.3.2 on 2026-03-23, yaml v1.10.3 tagged upstream). No obvious supply-chain anomalies. package-lock.json is used only by the private dev-tooling helper (@conforma/cli-tools, tekton-lint dep) and is not part of the shipped Go CLI runtime.

Previous run (3)

Looks good to me

Previous run (4)

Looks good to me

Previous run (5)

Looks good to me

Previous run (6)

Looks good to me

Previous run (7)

Looks good to me

---

Labels: PR modifies package-lock.json (dependency lockfile maintenance)

Previous run (8)

Looks good to me

Previous run (9)

Looks good to me

Previous run (10)

Review

Findings

Low

• [supply-chain] package-lock.json — lodash is bumped from 4.17.21 to 4.18.1. Verified as a legitimate release (April 2026) under renewed OpenJS Foundation governance, containing security fixes for CVE-2025-13465 (prototype pollution in _.unset/_.omit) and CVE-2026-4800 (code injection in _.template).

• [supply-chain] package-lock.json — Routine dependency version bumps via Renovate bot: binary-extensions, chokidar, fast-glob, fastq, fsevents, picomatch, reusify, yaml. All resolved URLs point to registry.npmjs.org with sha512 integrity hashes. No anomalies detected.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 4:22 AM UTC · Completed 4:28 AM UTC

Commit: 87c4a29 · View workflow run →

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
generative	69.55% <ø> (ø)
integration	69.55% <ø> (ø)
unit	69.55% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 4:46 AM UTC · Completed 4:56 AM UTC

Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 4:08 AM UTC · Completed 4:15 AM UTC

Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 4:28 AM UTC · Completed 4:34 AM UTC

Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 4:09 AM UTC · Completed 4:20 AM UTC

Commit: 87c4a29 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.47

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 4:24 AM UTC · Completed 4:30 AM UTC

Commit: 87c4a29 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $1.48

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 4:18 AM UTC · Completed 4:29 AM UTC

Commit: ca5794c · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.36

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Low-risk automated lock file maintenance by Renovate bot; single dependency file changed with no protected paths, no security-sensitive files, and no CI changes; elevated code age signal is expected for an infrequently-touched lock file on a release branch.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: f585ea72-4ee3-4da1-9149-11a4ec5aa1c5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 4:12 AM UTC · Completed 4:19 AM UTC

Commit: cd01138 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $3.91

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 4:29 AM UTC · Completed 4:39 AM UTC

Commit: cd01138 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $4.00

[fullsend-ai-review]

🤖 Review · ⚠️ Cancelled · Started 4:03 AM UTC · Ended 4:05 AM UTC

Commit: e8f0a9f · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 4:06 AM UTC · Completed 4:12 AM UTC

Commit: e8f0a9f · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $2.67

Superseded by updated review