feat: add process docs and scripts for yarn.lock only backports#2713
Draft
JessicaJHee wants to merge 3 commits into
Draft
feat: add process docs and scripts for yarn.lock only backports#2713JessicaJHee wants to merge 3 commits into
JessicaJHee wants to merge 3 commits into
Conversation
JessicaJHee
force-pushed
the
lockfile-patch-scripts
branch
from
66ee59f to
7793d32
Compare
github-actions
Bot
added
the
non-workspace-changes
jonkoops
requested changes
Jun 30, 2026
Contributor
There was a problem hiding this comment.
As per redhat-developer/rhdh-adr#9 and architecture call agreements, all new scripts should be written using TypeScript as the preferred language.
JessicaJHee
force-pushed
the
lockfile-patch-scripts
branch
from
7793d32 to
d45d20f
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
JessicaJHee
force-pushed
the
lockfile-patch-scripts
branch
3 times, most recently
from
c0371e1 to
5ecd8a8
Compare
JessicaJHee
force-pushed
the
lockfile-patch-scripts
branch
from
5ecd8a8 to
d0ef54a
Compare
JessicaJHee
force-pushed
the
lockfile-patch-scripts
branch
from
d0ef54a to
c37d759
Compare
Member
Author
|
@jonkoops Just converted the script over to TypeScript. I dismissed a few path validation SonarCloud warnings since the script requires cross repo access. Accepting the risk since this is a local only script meant to be run manually. We're looking to integrate this in the future in a GitHub actions as well, in that case the inputs will be controlled as well. PTAL :) |
Signed-off-by: Jessica He <jhe@redhat.com>
JessicaJHee
force-pushed
the
lockfile-patch-scripts
branch
from
c37d759 to
03c7e7f
Compare
alizard0
reviewed
Jul 1, 2026
|
|
||
| | Option | Required | Description | | ||
| |--------|----------|-------------| | ||
| | `--release` | yes | RHDH release line (e.g. `1.10` → branch `release-1.10` on rhdh-plugin-export-overlays) | |
Member
There was a problem hiding this comment.
non-blocking comment: if 1.10 means release-1.10, why dont the user specify direclty --release release-1.10
alizard0
reviewed
Jul 1, 2026
| backports: | ||
| - cve_ids: | ||
| - CVE-2026-44486 | ||
| - CVE-2026-44487 |
Member
There was a problem hiding this comment.
non-blocking: in the example we should set at least one cve with override
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds tooling to backport transitive dependency CVE fixes in
yarn.lockonly for z-stream releases — without bumpingsource.json:repo-ref.Tooling lives in
scripts/yarnlock-backport/(TypeScript CLI). Full workflow: user-guide/06-patch-management.md.Commands
Typical usage:
Artifacts per workspace
Documentation
user-guide/06-patch-management.md(prepare →yarn up→ generate, re-roll when patch apply fails, manifest format)scripts/yarnlock-backport/README.md— quick startFork clones need an
upstreamremote for rhdh-plugin-export-overlays and rhdh-plugins; the tool syncs release branches and fetches pinnedrepo-refSHAs from upstream.Example output
Lightspeed CVE backport generated with this tooling: #2722