fix(cost-management): remove workspace resolutions

[kim-tsao]

Hey, I just made a Pull Request!

• Removed most workspace resolutions to prepare for batch dependabot updates
• Updated msw in package.json (dev dependency) to pick up tough-cookie fix (transitive dep)
• Added a workspace resolution for prismjs (fix is now consistent with other workspaces)

✔️ Checklist

• A changeset describing the change and affected packages. (more info)
• Added or Updated documentation
• Tests for new functionality and regression tests for bug fixes
• Screenshots attached (for UI changes)

[rhdh-gh-app]

Missing Changesets

The following package(s) are changed by this PR but do not have a changeset:

• @red-hat-developer-hub/plugin-cost-management-backend
• @red-hat-developer-hub/plugin-cost-management-common
• @red-hat-developer-hub/plugin-cost-management

See CONTRIBUTING.md for more information about how to add changesets.

Changed Packages

Package Name	Package Path	Changeset Bump	Current Version
@red-hat-developer-hub/plugin-cost-management-backend	workspaces/cost-management/plugins/cost-management-backend	none	v2.2.2
@red-hat-developer-hub/plugin-cost-management-common	workspaces/cost-management/plugins/cost-management-common	none	v2.2.2
@red-hat-developer-hub/plugin-cost-management	workspaces/cost-management/plugins/cost-management	none	v2.2.2

[rhdh-qodo-merge]

PR Summary by Qodo

Reduce cost-management resolutions and upgrade MSW

🐞 Bug fix ⚙️ Configuration changes 🕐 20-40 Minutes

AI Description

• Removes broad workspace resolutions so future dependency updates resolve independently.
• Upgrades MSW to consume the patched tough-cookie transitive dependency.
• Retains a scoped PrismJS resolution and records the backend patch release.

Diagram

graph TD
  A["Backend manifest"] --> B["MSW 2.15"] --> C["Tough Cookie 6"]
  D["Workspace manifest"] --> E["Scoped PrismJS"] --> F[("Yarn lockfile")]
  D --> F
  B --> F

Loading

High-Level Assessment

The targeted strategy is appropriate: remove stale broad overrides, retain only the consumer-scoped PrismJS constraint, and upgrade the direct MSW dependency to obtain the tough-cookie security fix. Retaining all resolutions would continue masking the natural dependency graph and obstruct planned Dependabot batches, while manually pinning additional transitives would recreate the maintenance burden this PR removes.

Files changed (4) +550 / -249

Bug fix (1) +1 / -1

package.jsonUpgrade backend MSW to 2.15.0 +1/-1

Upgrade backend MSW to 2.15.0

• Raises the backend development dependency on MSW from 2.3.4 to 2.15.0 so its transitive graph uses the patched tough-cookie release.

workspaces/cost-management/plugins/cost-management-backend/package.json

Documentation (1) +5 / -0

breezy-dancers-feel.mdRecord the backend MSW patch update +5/-0

Record the backend MSW patch update

• Adds a patch changeset for the cost-management backend package documenting the MSW 2.15.0 dependency update.

workspaces/cost-management/.changeset/breezy-dancers-feel.md

Other (2) +544 / -248

package.jsonReplace broad resolutions with scoped PrismJS override +1/-23

Replace broad resolutions with scoped PrismJS override

• Removes most workspace-wide dependency resolutions so packages can follow their declared ranges. Retains a PrismJS override scoped specifically to refractor 3.6.0, plus the existing minimatch and es5-ext constraints.

workspaces/cost-management/package.json

yarn.lockRegenerate dependencies after resolution cleanup +543/-225

Regenerate dependencies after resolution cleanup

• Regenerates the Yarn graph for MSW 2.15.0 and the removal of broad workspace pins. The resulting lockfile updates the MSW interceptor and cookie stack while allowing numerous transitive packages to resolve according to their own ranges.

workspaces/cost-management/yarn.lock

[rhdh-qodo-merge]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Old ip-address versions return 🐞 Bug ⛨ Security

Description

Removing the ip-address resolution reintroduces ip-address@10.1.0 and 9.0.5 through active
dependency paths, undoing the workspace's enforced 10.2.0 security floor. Runtime consumers such
as express-rate-limit and socks will therefore load the older copies instead of the patched
resolution.

Code

workspaces/cost-management/package.json[88]

-    "ip-address": "10.2.0",

Relevance

●●● Strong

PR #4432 accepted the same security finding: an older pinned ip-address remains alongside the
patched version.

PR-#4432

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The generated lockfile proves that removing the override creates two older installations:
express-rate-limit requests exact 10.1.0, while socks requests ^9.0.5 and resolves to 9.0.5.
The accepted prior review documents the same defect pattern—leaving older ip-address copies
installed alongside a patched release.

workspaces/cost-management/yarn.lock[22589-22596]
workspaces/cost-management/yarn.lock[25217-25230]
workspaces/cost-management/yarn.lock[34724-34730]
PR-#4432

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Removing the workspace-wide `ip-address` resolution causes older `10.1.0` and `9.0.5` copies to be installed again through runtime dependencies.

## Issue Context
Keep the patched floor until every transitive depender has been upgraded to ranges that resolve to an acceptable patched version; regenerate the lockfile afterward and verify no older copies remain.

## Fix Focus Areas
- workspaces/cost-management/package.json[64-71]
- workspaces/cost-management/yarn.lock[25217-25230]
- workspaces/cost-management/yarn.lock[34724-34730]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

✅ Compliance rules (platform): 27 rules

✅ Cross-repo context — repo relationships

Tip of the day

💡 Did you know, you can switch off images and animations for a plain-text comment

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 61.66%. Comparing base (08e6312) to head (b82ff3e).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4459   +/-   ##
=======================================
  Coverage   61.66%   61.66%           
=======================================
  Files        2572     2572           
  Lines      102950   102950           
  Branches    28857    28864    +7     
=======================================
  Hits        63482    63482           
  Misses      37614    37614           
  Partials     1854     1854           

Flag	Coverage Δ		*Carryforward flag
adoption-insights	84.55% <ø> (ø)		Carriedforward from 08e6312
ai-integrations	69.09% <ø> (ø)		Carriedforward from 08e6312
app-defaults	55.55% <ø> (ø)		Carriedforward from 08e6312
augment	46.67% <ø> (ø)		Carriedforward from 08e6312
boost	79.84% <ø> (ø)		Carriedforward from 08e6312
bulk-import	72.79% <ø> (ø)		Carriedforward from 08e6312
cost-management	13.55% <ø> (ø)
dcm	72.09% <ø> (ø)		Carriedforward from 08e6312
e2e-adoption-insights	60.00% <ø> (ø)		Carriedforward from 08e6312
e2e-extensions	62.13% <ø> (ø)		Carriedforward from 08e6312
e2e-global-header	49.45% <ø> (ø)		Carriedforward from 08e6312
e2e-homepage	61.11% <ø> (ø)		Carriedforward from 08e6312
e2e-intelligent-assistant	46.65% <ø> (ø)		Carriedforward from 08e6312
e2e-orchestrator	49.52% <ø> (ø)		Carriedforward from 08e6312
e2e-orchestrator-plugin	49.51% <ø> (ø)		Carriedforward from 08e6312
e2e-quickstart	55.21% <ø> (ø)		Carriedforward from 08e6312
e2e-scorecard	50.21% <ø> (ø)		Carriedforward from 08e6312
e2e-theme	16.36% <ø> (ø)		Carriedforward from 08e6312
extensions	56.59% <ø> (ø)		Carriedforward from 08e6312
global-floating-action-button	71.18% <ø> (ø)		Carriedforward from 08e6312
global-header	66.50% <ø> (ø)		Carriedforward from 08e6312
homepage	48.39% <ø> (ø)		Carriedforward from 08e6312
install-dynamic-plugins	58.57% <ø> (ø)		Carriedforward from 08e6312
intelligent-assistant	75.35% <ø> (ø)		Carriedforward from 08e6312
konflux	91.98% <ø> (ø)		Carriedforward from 08e6312
lightspeed	69.02% <ø> (ø)		Carriedforward from 08e6312
mcp-integrations	84.14% <ø> (ø)		Carriedforward from 08e6312
orchestrator	70.87% <ø> (ø)		Carriedforward from 08e6312
quickstart	63.74% <ø> (ø)		Carriedforward from 08e6312
sandbox	79.56% <ø> (ø)		Carriedforward from 08e6312
scorecard	87.65% <ø> (ø)		Carriedforward from 08e6312
theme	88.76% <ø> (ø)		Carriedforward from 08e6312
translations	5.12% <ø> (ø)		Carriedforward from 08e6312
x2a	77.10% <ø> (ø)		Carriedforward from 08e6312

*This pull request uses carry forward flags. Click here to find out more.

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 08e6312...b82ff3e. Read the comment docs.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[PreetiW]

@kim-tsao left few comments on the PR - let me know your thoughts and rest of the changes looks good to me. Also can you please rebase your PR. Thanks!

[PreetiW]

left a comment around .changeset

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud