OCPBUGS-98488: security: fix js-yaml vulnerable version

[jgbernalp]

Summary by CodeRabbit

• Chores
  • Updated the YAML processing dependency to a fixed version for more consistent application behavior.

[openshift-ci-robot]

@jgbernalp: This pull request references Jira Issue OCPBUGS-98488, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[jgbernalp]

/label qe-approved

[openshift-ci-robot]

@jgbernalp: This pull request references Jira Issue OCPBUGS-98488, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[jgbernalp]

/cherry-pick release-coo-ocp-4.22 release-coo-ocp-4.15 release-coo-ocp-4.12

[openshift-cherrypick-robot]

@jgbernalp: once the present PR merges, I will cherry-pick it on top of release-coo-ocp-4.22 in a new PR and assign it to you.

Details

In response to this:

/cherry-pick release-coo-ocp-4.22

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 19658b28-8d65-43b8-9dc5-da0697816621

📥 Commits

Reviewing files that changed from the base of the PR and between 2241c8a and 8d0c32a.

⛔ Files ignored due to path filters (1)

• web/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• web/package.json

---

Walkthrough

The web package changes the js-yaml dependency from ^4.2.0 to the exact version 4.3.1.

Changes

Dependency version

Layer / File(s)	Summary
Pin js-yaml dependency web/package.json	The package now specifies js-yaml version 4.3.1 instead of ^4.2.0.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: etmurasaki, peteryurkovich

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the security fix for the vulnerable js-yaml dependency, which matches the pull request changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR changes only js-yaml entries in web/package.json and web/package-lock.json; no Ginkgo test declarations or dynamic test titles changed.
Test Structure And Quality	✅ Passed	The commit only changes web/package.json and web/package-lock.json to pin js-yaml; it adds no Ginkgo tests or test-code changes, so this check is not applicable.
Microshift Test Compatibility	✅ Passed	PASS: The commit changes only web/package.json and web/package-lock.json for js-yaml; it adds no Ginkgo e2e tests or MicroShift-sensitive test code.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The PR changes only web dependency manifests and adds no Ginkgo e2e tests or multi-node assumptions; SNO compatibility review is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	The patch only pins js-yaml in web/package.json and web/package-lock.json; it adds no deployment, operator, controller, or scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	The commit changes only js-yaml dependency files; the repository builds monitoring-plugin, not an OTE binary, and contains no OTE suite or process-level stdout writes.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The pull request changes only dependency metadata in two JSON files; it adds no Ginkgo e2e tests or test networking and therefore does not trigger this check.
No-Weak-Crypto	✅ Passed	The PR changes only js-yaml dependency and lockfile entries; the diff contains no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret-comparison changes.
Container-Privileges	✅ Passed	The PR changes only js-yaml entries in web/package.json and package-lock.json; it adds no container or Kubernetes privilege settings.
No-Sensitive-Data-In-Logs	✅ Passed	The commit changes only js-yaml dependency declarations and lockfile metadata; it adds no logging statements or sensitive-data output.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[jgbernalp]

/test e2e-monitoring

[PeterYurkovich]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jgbernalp, PeterYurkovich

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [PeterYurkovich,jgbernalp]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@jgbernalp: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci-robot]

@jgbernalp: Jira Issue OCPBUGS-98488: All pull requests linked via external trackers have merged:

• openshift/monitoring-plugin#1115

Jira Issue OCPBUGS-98488 has been moved to the MODIFIED state.

Details

In response to this:

Summary by CodeRabbit

• Chores
• Updated the YAML processing dependency to a fixed version for more consistent application behavior.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-cherrypick-robot]

@jgbernalp: new pull request created: #1116

Details

In response to this:

/cherry-pick release-coo-ocp-4.22 release-coo-ocp-4.15 release-coo-ocp-4.12

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-merge-robot]

Fix included in release 5.0.0-0.nightly-2026-08-07-030024