OCPBUGS-74470: bump lodash to ^4.17.23 to address CVE-2025-13465

[sunku5494]

Summary by CodeRabbit

• Chores
  • Updated lodash dependency to version 4.17.23 across multiple packages.
  • Added explicit dependency resolution constraints for lodash and lodash-es to ensure consistent versions across the project.

[openshift-ci-robot]

@sunku5494: This pull request references Jira Issue OCPBUGS-74470, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.22.0) matches configured target version for branch (4.22.0)
• bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @xiaojiey

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

@openshift-ci-robot: GitHub didn't allow me to request PR reviews from the following users: xiaojiey.

Note that only openshift-assisted members and repo collaborators can review this PR, and authors cannot review their own PRs.

Details

In response to this:

@sunku5494: This pull request references Jira Issue OCPBUGS-74470, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.22.0) matches configured target version for branch (4.22.0)
• bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @xiaojiey

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

Hi @sunku5494. Thanks for your PR.

I'm waiting for a openshift-assisted member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

---

📝 Walkthrough

Walkthrough

This PR updates lodash dependencies across multiple package.json files in the monorepo to version ^4.17.23 and adds a top-level resolutions field to enforce consistent lodash and lodash-es versions globally.

Changes

Cohort / File(s)	Summary
Lodash Version Updates apps/assisted-disconnected-ui/package.json, apps/assisted-ui/package.json	Updated lodash dependency from ^4 to ^4.17.23 in both application packages.
Root Resolutions Field package.json	Added top-level "resolutions" field pinning lodash and lodash-es to ^4.17.23 to enforce consistent versions across the monorepo.

Estimated Code Review Effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Suggested Labels

size/M

Suggested Reviewers

• ammont82
• asmasarw

Poem

🐰 Hop hop, versions aligned!
Lodash locked, no more mess to find,
Resolutions set with care so neat,
Dependencies march to a unified beat! 🎯

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically summarizes the main change: bumping lodash to address a CVE vulnerability, which is reflected across all modified package.json files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci-robot]

@sunku5494: This pull request references Jira Issue OCPBUGS-74470, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.22.0) matches configured target version for branch (4.22.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @xiaojiey

Details

In response to this:

Summary by CodeRabbit

• Chores
• Updated lodash dependency to version 4.17.23 across multiple packages.
• Added explicit dependency resolution constraints for lodash and lodash-es to ensure consistent versions across the project.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

@openshift-ci-robot: GitHub didn't allow me to request PR reviews from the following users: xiaojiey.

Note that only openshift-assisted members and repo collaborators can review this PR, and authors cannot review their own PRs.

Details

In response to this:

@sunku5494: This pull request references Jira Issue OCPBUGS-74470, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.22.0) matches configured target version for branch (4.22.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @xiaojiey

In response to this:

Summary by CodeRabbit

• Chores
• Updated lodash dependency to version 4.17.23 across multiple packages.
• Added explicit dependency resolution constraints for lodash and lodash-es to ensure consistent versions across the project.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[rawagner]

/ok-to-test

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ElayAharoni, rawagner, sunku5494

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [rawagner]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci-robot]

@sunku5494: Jira Issue OCPBUGS-74470: All pull requests linked via external trackers have merged:

• openshift-assisted/assisted-installer-ui#3410

Jira Issue OCPBUGS-74470 has been moved to the MODIFIED state.

Details

In response to this:

Summary by CodeRabbit

• Chores
• Updated lodash dependency to version 4.17.23 across multiple packages.
• Added explicit dependency resolution constraints for lodash and lodash-es to ensure consistent versions across the project.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.