chore: upgrade tmp >= 0.2.6 where possible [Orchestrator] [release-1.10]

[Omar-AlJaljuli]

Hey, I just made a Pull Request!

Although tmp is a transitive dep of a devDep, it is in the SBOMs and has a vulnerability CVE-2026-44705. Fix by upgrading to tmp version > 0.2.5. This couldn't be upgraded under @changesets/cli@2.27.9, but that is a devDependency so it's no problem.

Upgrade using 'yarn up -R ...'.

✔️ Checklist

• A changeset describing the change and affected packages. (more info)
• Added or Updated documentation
• Tests for new functionality and regression tests for bug fixes
• Screenshots attached (for UI changes)

[rhdh-qodo-merge]

PR Summary by Qodo

Upgrade transitive tmp to 0.2.7 in orchestrator workspace lockfile

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 5 minutes

AI Description

• Bump transitive dependency tmp to >=0.2.6 to remediate CVE-2026-44705.
• Update orchestrator workspace yarn.lock to reflect the resolved tmp@0.2.7.

High-Level Assessment

Updating the lockfile resolution to pull tmp@0.2.7 is the simplest and lowest-risk remediation for a transitive vulnerability. Alternatives like adding explicit Yarn resolutions/constraints or upgrading upstream devDependencies (e.g., @changesets/cli) would add maintenance overhead without materially improving the outcome for this PR.

Files changed (1) +3 / -3

Other (1) +3 / -3

yarn.lockResolve tmp from 0.2.5 to 0.2.7 +3/-3

Resolve tmp from 0.2.5 to 0.2.7

• Updates the Yarn lock entry for tmp@^0.2.5 to resolve to tmp@0.2.7, including updated integrity metadata. This is intended to eliminate exposure to CVE-2026-44705 present in tmp<=0.2.5.

workspaces/orchestrator/yarn.lock

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rhdh-qodo-merge]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Incomplete tmp upgrade 🐞 Bug ⛨ Security

Description

The change bumps tmp to 0.2.7 only in workspaces/orchestrator/yarn.lock, while other workspace
lockfiles still pin tmp@^0.2.5 to 0.2.5. This leaves the repo with mixed tmp resolutions and may not
achieve a repo-wide dependency upgrade objective (e.g., SBOM/vulnerability scan cleanup).

Code

workspaces/orchestrator/yarn.lock[R38032-38034]

+  version: 0.2.7
+  resolution: "tmp@npm:0.2.7"
+  checksum: 10c0/59eb55584f2f07210d3231b6a1f6b5c2b9794d8a7b509c8ee867ed2acad6d2245ee2448b7937b676ffbff3155a70077edde8a69f9d7cf0f90c86a62e8910c357

Relevance

●●● Strong

Team has accepted fixing/deduping workspace yarn.lock to avoid mixed dependency versions after
bumps.

PR-#2547
PR-#4000

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The orchestrator lockfile now resolves tmp to 0.2.7, but other workspaces still resolve tmp@^0.2.5
to 0.2.5, showing the upgrade was not applied consistently across the monorepo’s per-workspace
lockfiles.

workspaces/orchestrator/yarn.lock[38031-38036]
workspaces/adoption-insights/yarn.lock[33568-33573]
workspaces/ai-integrations/yarn.lock[32329-32334]
workspaces/x2a/yarn.lock[33905-33910]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
Only `workspaces/orchestrator/yarn.lock` was updated to resolve `tmp@^0.2.5` to `0.2.7`, but other workspaces still resolve `tmp@^0.2.5` to `0.2.5`.

### Issue Context
This repo uses per-workspace `yarn.lock` files, so updating one workspace does not update others.

### Fix
Update each workspace lockfile that still resolves `tmp` to `0.2.5` so they resolve to the intended upgraded version (e.g., `0.2.7`).

Practical approaches:
- Run `yarn up -R tmp@^0.2.7` (or equivalent) in each affected workspace directory and commit the resulting lockfile changes.
- Or use a monorepo command that iterates workspaces (if supported in this repo) to apply the same upgrade everywhere.

### Fix Focus Areas
- workspaces/orchestrator/yarn.lock[38031-38036]
- workspaces/adoption-insights/yarn.lock[33568-33573]
- workspaces/ai-integrations/yarn.lock[32329-32334]
- workspaces/x2a/yarn.lock[33905-33910]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context used

✅ Compliance rules (platform): 11 rules

✅ Cross-repo context

  Not relevant to this PR: redhat-developer/rhdh

  Not relevant to this PR: redhat-developer/rhdh-chart

  Not relevant to this PR: redhat-developer/rhdh-operator

  Not relevant to this PR: redhat-developer/rhdh-local

Tip of the day

💡 Did you know, you can reply 'qodo' on any finding to push back, ask questions, or dig deeper

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 59.57%. Comparing base (0f6f9df) to head (4d494f2).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@                    Coverage Diff                     @@
##           orchestrator/release-1.10    #4240   +/-   ##
==========================================================
  Coverage                      59.57%   59.57%           
==========================================================
  Files                           2097     2097           
  Lines                          65234    65234           
  Branches                       16986    17004   +18     
==========================================================
  Hits                           38862    38862           
  Misses                         25977    25977           
  Partials                         395      395           

Flag	Coverage Δ		*Carryforward flag
adoption-insights	83.58% <ø> (ø)		Carriedforward from 0f6f9df
ai-integrations	70.03% <ø> (ø)		Carriedforward from 0f6f9df
app-defaults	69.60% <ø> (ø)		Carriedforward from 0f6f9df
augment	69.36% <ø> (ø)		Carriedforward from 0f6f9df
bulk-import	72.86% <ø> (ø)		Carriedforward from 0f6f9df
cost-management	16.49% <ø> (ø)		Carriedforward from 0f6f9df
dcm	32.85% <ø> (ø)		Carriedforward from 0f6f9df
extensions	61.79% <ø> (ø)		Carriedforward from 0f6f9df
global-floating-action-button	74.30% <ø> (ø)		Carriedforward from 0f6f9df
global-header	61.68% <ø> (ø)		Carriedforward from 0f6f9df
homepage	50.95% <ø> (ø)		Carriedforward from 0f6f9df
konflux	91.01% <ø> (ø)		Carriedforward from 0f6f9df
lightspeed	68.34% <ø> (ø)		Carriedforward from 0f6f9df
mcp-integrations	81.59% <ø> (ø)		Carriedforward from 0f6f9df
orchestrator	37.54% <ø> (ø)
quickstart	62.64% <ø> (ø)		Carriedforward from 0f6f9df
sandbox	79.56% <ø> (ø)		Carriedforward from 0f6f9df
scorecard	83.58% <ø> (ø)		Carriedforward from 0f6f9df
theme	64.54% <ø> (ø)		Carriedforward from 0f6f9df
translations	8.49% <ø> (ø)		Carriedforward from 0f6f9df
x2a	57.33% <ø> (ø)		Carriedforward from 0f6f9df

*This pull request uses carry forward flags. Click here to find out more.

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 0f6f9df...4d494f2. Read the comment docs.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.