Lock file maintenance (main)

[red-hat-konflux]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 04:59 AM (* 0-4 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 4:49 AM UTC · Completed 4:58 AM UTC
Commit: 47d3320 · View workflow run →

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	54.51% <ø> (ø)
generative	12.25% <ø> (ø)
integration	23.56% <ø> (ø)
unit	72.24% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fullsend-ai-review]

Looks good to me

Previous run

Looks good to me

Previous run (2)

Looks good to me

Previous run (3)

Looks good to me

Previous run (4)

Looks good to me

Previous run (5)

Looks good to me

Previous run (6)

Review

Findings

Info

• [scope-authorization-implicit] N/A — Authorization inferred from the mechanical nature of the change (value-only Renovate lockfile bump: fastq 1.19.1 → 1.20.3, a transitive dev-tool dependency). renovate.json in the repository authorizes this bot. No architectural review required.
• [provenance-warning] N/A — Prior review context discarded: provenance validation failed (unverifiable-wrong-app). This review treats all findings as first-time assessments; severity anchoring was skipped for this run.

Previous run (7)

Review

Findings

Info

• [provenance-warning] N/A — Prior review context discarded: provenance validation failed (unverifiable-wrong-app). This review treats all findings as first-time assessments.

Previous run (8)

Looks good to me

Previous run (9)

Looks good to me

Previous run (10)

Looks good to me

Previous run (11)

Looks good to me

Previous run (12)

Looks good to me

Previous run (13)

Looks good to me

Previous run (14)

Looks good to me

Previous run (15)

Looks good to me

Previous run (16)

Looks good to me

Previous run (17)

Looks good to me

Previous run (18)

Looks good to me

Previous run (19)

Looks good to me

Previous run (20)

Looks good to me

Previous run (21)

Looks good to me

Previous run (22)

Looks good to me

Previous run (23)

Review — Approve

Lock file maintenance — 4 transitive dependency version bumps in package-lock.json. No source code changes.

Package	From	To	Notes
fastq	1.19.1	1.20.1	Minor bump; adds abort() API
lodash	4.17.21	4.18.1	Security fix — CVE-2026-4800 (CVSS 8.1, code injection via _.template imports) and GHSA-f23m-r3pf-42rh (prototype pollution in _.unset/_.omit)
picomatch	2.3.1	2.3.2	Security fix — CVE-2026-33672 (method injection via POSIX bracket expressions)
yaml	1.10.2	1.10.3	Patch bump; no known vulnerabilities

Supply chain verification

• ✅ All resolved URLs point to registry.npmjs.org
• ✅ All integrity hashes use sha512
• ✅ All version bumps satisfy their parent packages' semver constraints
• ✅ No dependency confusion or typosquatting indicators
• ✅ lodash 4.18.1 verified as legitimate release (published April 2026, fixes long-standing CVEs)
• ✅ picomatch 2.3.2 verified as legitimate security backport to 2.x line

This PR contains two beneficial security updates. The "Possible security concern" label reflects that dependency updates warrant scrutiny — the review confirms these changes are safe and recommended.

Previous run (24)

Review — Approve

PR: #3370 — Lock file maintenance npm dependencies (main)
Author: red-hat-konflux[bot] (Renovate / MintMaker)
Scope: package-lock.json only (12 additions, 12 deletions)

Summary

Automated lock file maintenance bumping four transitive npm dependencies to their latest versions:

Package	From	To	Bump	Constraint satisfied
fastq	1.19.1	1.20.1	minor	^1.6.0 ✅
lodash	4.17.21	4.18.1	minor	^4.17.15 ✅
picomatch	2.3.1	2.3.2	patch	^2.3.1 / ^2.0.4 / ^2.2.1 ✅
yaml	1.10.2	1.10.3	patch	^1.8.2 ✅

Review dimensions

Dimension	Result
Security	✅ No secrets, injection patterns, or permission changes. All packages resolve from registry.npmjs.org. The lodash 4.18.1 bump is a legitimate security update patching known vulnerabilities. No supply chain red flags.
Correctness	✅ All version bumps satisfy their declared semver ranges. Dependency graph structure unchanged. Integrity hashes present for all entries.
Intent & coherence	✅ Mechanical, generated change — authorization inferred from automated maintenance nature.
Style & conventions	✅ Early exit — value-only lock file change follows surrounding context patterns.
Documentation	✅ No documentation surface area — lock file only.
Cross-repo contracts	⏭ Skipped — no exported interfaces or API changes.

Verdict

Clean lock file maintenance. All dependency bumps are valid within their semver constraints, no structural changes to the dependency graph, and no security concerns. Safe to merge.

Previous run (25)

Review — Approve

PR: #3370 — Lock file maintenance npm dependencies (main)
Author: red-hat-konflux[bot] (Renovate/MintMaker)
Scope: 1 file (package-lock.json), 12 additions / 12 deletions

Summary

Automated lockfile maintenance refreshing 4 transitive npm dependencies of tekton-lint:

Package	Old Version	New Version	Notes
fastq	1.19.1	1.20.1	Minor bump
lodash	4.17.21	4.18.1	Security release — patches prototype pollution (GHSA-f23m-r3pf-42rh) and code injection via template imports (CVE-2026-4800)
picomatch	2.3.1	2.3.2	Security release — patches CVE-2026-33671 and CVE-2026-33672
yaml	1.10.2	1.10.3	Patch bump

Security Assessment

• ✅ All resolved URLs point to the official npm registry (registry.npmjs.org)
• ✅ All integrity hashes are valid sha512 format
• ✅ lodash 4.18.1 is a verified legitimate release (Sovereign Tech Agency-funded maintenance resumed in 2026); this update patches known CVEs
• ✅ picomatch 2.3.2 is a verified security release patching ReDoS vulnerabilities
• ✅ No dependency confusion, typosquatting, or supply chain anomalies detected
• ✅ No secrets, injection patterns, hidden Unicode characters, or bidirectional text overrides

Dimensional Coverage

Dimension	Result
Security	✅ No findings — supply chain verified, updates patch known CVEs
Correctness	✅ N/A — lockfile-only, no application logic
Intent & coherence	✅ Mechanical change from authorized bot — implicit authorization
Style & conventions	✅ N/A — generated lockfile follows existing format
Documentation	✅ N/A — no code changes requiring doc updates
Cross-repo contracts	✅ N/A — no API surface changes

This lockfile maintenance PR is safe to merge. The lodash and picomatch updates are particularly beneficial as they patch known security vulnerabilities.

Previous run (26)

Looks good to me

---

Labels: Lock file maintenance PR updating npm dependencies fits the 'dependencies' label.

Previous run (27)

Review

Findings

High

• [supply chain / dependency integrity] package-lock.json:302 — lodash is being updated from 4.17.21 to 4.18.1. As of mid-2025, lodash 4.17.21 was the latest release and the repository had been largely inactive. However, the current date is June 2026, meaning a legitimate 4.18.x release could have occurred in the intervening year. The version should be verified against the npm registry before merging.
  Remediation: Before merging: (1) Run npm view lodash versions or check https://www.npmjs.com/package/lodash to confirm 4.18.1 is a legitimate release. (2) If it does not exist or was published by an unexpected maintainer, reject this PR. (3) If legitimate, review the changelog before accepting.

Low

• [supply chain / dependency verification] package-lock.json — The other dependency updates in this PR (fastq 1.19.1 → 1.20.1, picomatch 2.3.1 → 2.3.2, yaml 1.10.2 → 1.10.3) are routine minor/patch bumps from well-maintained packages. These are normal lock file maintenance updates produced by Renovate.

---

Labels: PR contains a dependency version bump that requires manual verification for supply chain integrity

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:22 AM UTC · Completed 2:29 AM UTC
Commit: 47d3320 · View workflow run →

Superseded by updated review

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 4:46 AM UTC · Completed 4:54 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 4:44 AM UTC · Completed 4:50 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:17 AM UTC · Completed 2:23 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Review · ⚠️ Cancelled · Ended 4:03 AM UTC

Commit: 5748476 · View workflow run →

Superseded by updated review

Superseded by updated review