fix(cost-management): remove workspace resolutions

[kim-tsao]

Hey, I just made a Pull Request!

• Removed most workspace resolutions to prepare for batch dependabot updates
• Updated msw in package.json (dev dependency) to pick up tough-cookie fix (transitive dep)
• Added a workspace resolution for prismjs (fix is now consistent with other workspaces)

✔️ Checklist

• A changeset describing the change and affected packages. (more info)
• Added or Updated documentation
• Tests for new functionality and regression tests for bug fixes
• Screenshots attached (for UI changes)

[rhdh-gh-app]

Changed Packages

Package Name	Package Path	Changeset Bump	Current Version
@red-hat-developer-hub/plugin-cost-management-backend	workspaces/cost-management/plugins/cost-management-backend	patch	v2.2.1

[rhdh-qodo-merge]

PR Summary by Qodo

Reduce cost-management resolutions and upgrade MSW

🐞 Bug fix ⚙️ Configuration changes 🕐 20-40 Minutes

AI Description

• Removes broad workspace resolutions so future dependency updates resolve independently.
• Upgrades MSW to consume the patched tough-cookie transitive dependency.
• Retains a scoped PrismJS resolution and records the backend patch release.

Diagram

graph TD
  A["Backend manifest"] --> B["MSW 2.15"] --> C["Tough Cookie 6"]
  D["Workspace manifest"] --> E["Scoped PrismJS"] --> F[("Yarn lockfile")]
  D --> F
  B --> F

Loading

High-Level Assessment

The targeted strategy is appropriate: remove stale broad overrides, retain only the consumer-scoped PrismJS constraint, and upgrade the direct MSW dependency to obtain the tough-cookie security fix. Retaining all resolutions would continue masking the natural dependency graph and obstruct planned Dependabot batches, while manually pinning additional transitives would recreate the maintenance burden this PR removes.

Files changed (4) +550 / -249

Bug fix (1) +1 / -1

package.jsonUpgrade backend MSW to 2.15.0 +1/-1

Upgrade backend MSW to 2.15.0

• Raises the backend development dependency on MSW from 2.3.4 to 2.15.0 so its transitive graph uses the patched tough-cookie release.

workspaces/cost-management/plugins/cost-management-backend/package.json

Documentation (1) +5 / -0

breezy-dancers-feel.mdRecord the backend MSW patch update +5/-0

Record the backend MSW patch update

• Adds a patch changeset for the cost-management backend package documenting the MSW 2.15.0 dependency update.

workspaces/cost-management/.changeset/breezy-dancers-feel.md

Other (2) +544 / -248

package.jsonReplace broad resolutions with scoped PrismJS override +1/-23

Replace broad resolutions with scoped PrismJS override

• Removes most workspace-wide dependency resolutions so packages can follow their declared ranges. Retains a PrismJS override scoped specifically to refractor 3.6.0, plus the existing minimatch and es5-ext constraints.

workspaces/cost-management/package.json

yarn.lockRegenerate dependencies after resolution cleanup +543/-225

Regenerate dependencies after resolution cleanup

• Regenerates the Yarn graph for MSW 2.15.0 and the removal of broad workspace pins. The resulting lockfile updates the MSW interceptor and cookie stack while allowing numerous transitive packages to resolve according to their own ranges.

workspaces/cost-management/yarn.lock

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rhdh-qodo-merge]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Old ip-address versions return 🐞 Bug ⛨ Security

Description

Removing the ip-address resolution reintroduces ip-address@10.1.0 and 9.0.5 through active
dependency paths, undoing the workspace's enforced 10.2.0 security floor. Runtime consumers such
as express-rate-limit and socks will therefore load the older copies instead of the patched
resolution.

Code

workspaces/cost-management/package.json[88]

-    "ip-address": "10.2.0",

Relevance

●●● Strong

PR #4432 accepted the same security finding: an older pinned ip-address remains alongside the
patched version.

PR-#4432

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The generated lockfile proves that removing the override creates two older installations:
express-rate-limit requests exact 10.1.0, while socks requests ^9.0.5 and resolves to 9.0.5.
The accepted prior review documents the same defect pattern—leaving older ip-address copies
installed alongside a patched release.

workspaces/cost-management/yarn.lock[22589-22596]
workspaces/cost-management/yarn.lock[25217-25230]
workspaces/cost-management/yarn.lock[34724-34730]
PR-#4432

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Removing the workspace-wide `ip-address` resolution causes older `10.1.0` and `9.0.5` copies to be installed again through runtime dependencies.

## Issue Context
Keep the patched floor until every transitive depender has been upgraded to ranges that resolve to an acceptable patched version; regenerate the lockfile afterward and verify no older copies remain.

## Fix Focus Areas
- workspaces/cost-management/package.json[64-71]
- workspaces/cost-management/yarn.lock[25217-25230]
- workspaces/cost-management/yarn.lock[34724-34730]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

✅ Compliance rules (platform): 27 rules

✅ Cross-repo context — repo relationships

Tip of the day

💡 Did you know, you can switch off images and animations for a plain-text comment

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 61.59%. Comparing base (36e044f) to head (2f08c9e).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4459   +/-   ##
=======================================
  Coverage   61.59%   61.59%           
=======================================
  Files        2557     2557           
  Lines      102092   102092           
  Branches    28594    28591    -3     
=======================================
  Hits        62882    62882           
  Misses      38608    38608           
  Partials      602      602           

Flag	Coverage Δ		*Carryforward flag
adoption-insights	84.55% <ø> (ø)		Carriedforward from 36e044f
ai-integrations	67.70% <ø> (ø)		Carriedforward from 36e044f
app-defaults	48.37% <ø> (ø)		Carriedforward from 36e044f
augment	46.67% <ø> (ø)		Carriedforward from 36e044f
boost	79.84% <ø> (ø)		Carriedforward from 36e044f
bulk-import	72.79% <ø> (ø)		Carriedforward from 36e044f
cost-management	13.55% <ø> (ø)
dcm	72.09% <ø> (ø)		Carriedforward from 36e044f
e2e-adoption-insights	60.00% <ø> (ø)		Carriedforward from 36e044f
e2e-extensions	62.13% <ø> (ø)		Carriedforward from 36e044f
e2e-global-header	49.45% <ø> (ø)		Carriedforward from 36e044f
e2e-homepage	61.11% <ø> (ø)		Carriedforward from 36e044f
e2e-intelligent-assistant	46.68% <ø> (ø)		Carriedforward from 36e044f
e2e-orchestrator	49.52% <ø> (ø)		Carriedforward from 36e044f
e2e-quickstart	55.21% <ø> (ø)		Carriedforward from 36e044f
e2e-scorecard	50.21% <ø> (ø)		Carriedforward from 36e044f
e2e-theme	16.36% <ø> (ø)		Carriedforward from 36e044f
extensions	56.59% <ø> (ø)		Carriedforward from 36e044f
global-floating-action-button	71.18% <ø> (ø)		Carriedforward from 36e044f
global-header	66.50% <ø> (ø)		Carriedforward from 36e044f
homepage	48.48% <ø> (ø)		Carriedforward from 36e044f
install-dynamic-plugins	58.57% <ø> (ø)		Carriedforward from 36e044f
intelligent-assistant	75.35% <ø> (ø)		Carriedforward from 36e044f
konflux	91.98% <ø> (ø)		Carriedforward from 36e044f
lightspeed	69.02% <ø> (ø)		Carriedforward from 36e044f
mcp-integrations	84.14% <ø> (ø)		Carriedforward from 36e044f
orchestrator	70.86% <ø> (ø)		Carriedforward from 36e044f
quickstart	63.74% <ø> (ø)		Carriedforward from 36e044f
sandbox	79.56% <ø> (ø)		Carriedforward from 36e044f
scorecard	87.40% <ø> (ø)		Carriedforward from 36e044f
theme	88.91% <ø> (ø)		Carriedforward from 36e044f
translations	5.12% <ø> (ø)		Carriedforward from 36e044f
x2a	79.20% <ø> (ø)		Carriedforward from 36e044f

*This pull request uses carry forward flags. Click here to find out more.

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 36e044f...2f08c9e. Read the comment docs.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.