chore: Fix vulnerable dependencies on main

[github-actions]

CVE Remediation Report

Generated: 2026-08-12T06:55:18.413Z

Release branch: main

Overall status

❌ One or more packages failed verification

Summary

Package	Fixed version(s)	Strategy	Verified
protobufjs	7.6.5, 8.6.6	⚠️ Manual triage required	⚠️ Triage needed

Package details

1. protobufjs

Field	Value
Fixed version(s)	7.6.5, 8.6.6
Strategy	⚠️ Manual triage required
Reason	No same-major fix for installed major(s) [6] — available fixes cover major(s) [7, 8]; cross-major resolution would break semver contracts — needs manual triage
Action taken	Skipped — triage needed (cannot auto-remediate)
Verification	⚠️ Triage needed
Verification detail	Skipped verification — package requires triage

Action required: This package could not be auto-remediated.
Review the analysis artifact and apply a fix manually before closing this ticket.

📋 Before / after dependency evidence

Before — npm ls

pipelines-console-plugin@0.0.1 /home/runner/work/console-plugin/console-plugin
└─┬ gherkin-lint@4.2.4
  └─┬ gherkin@9.0.0
    └─┬ cucumber-messages@8.0.0
      └── protobufjs@6.11.6

Before — yarn why

└─ cucumber-messages@npm:8.0.0
   └─ protobufjs@npm:6.11.6 (via npm:^6.8.8)

---

Report generated by audit-report.ts. Artifacts in cve-artifacts/.

[openshift-ci]

Hi @github-actions[bot]. Thanks for your PR.

I'm waiting for a openshift-pipelines member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by: github-actions[bot]

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[arvindk-softwaredev]

/retest

[arvindk-softwaredev]

/test e2e

[qodo-code-review]

Unsupported PR languages

[openshift-ci]

@github-actions[bot]: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e	2af4ac8	link	true	/test e2e

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.