NO-ISSUE: backport CVE dependency fixes to release-1.2

[celdrake]

Summary

Combined backport of CVE dependency fixes from main (since 6481cf4e, inclusive) to release-1.2.

CVE / Advisory	Package	Old → New
CVE-2026-12143	form-data	4.0.5 → 4.0.6
CVE-2026-50289	systeminformation	5.31.6 → 5.33.0
CVE-2026-54490 / CVE-2026-54466	websocket-driver	0.7.4 → 0.7.5
CVE-2026-48779	ws	8.19.0 → 8.21.1
CVE-2026-13311	shell-quote	1.8.4 → 1.10.0
CVE-2026-46595 (+ related)	golang.org/x/crypto	v0.43.0 → v0.52.0
GHSA-2p49-hgcm-8545	svgo	4.0.1 → 4.0.2
CVE-2026-16221	fast-uri	3.1.3 → 3.1.4
CVE-2026-59869	js-yaml	4.1.0 → 4.3.0 (+ root overrides)

Go module note

golang.org/x/crypto@v0.52.0 requires go 1.25.0 and updates transitive golang.org/x/net, golang.org/x/sys, and golang.org/x/text. The release branch already used toolchain go1.25.8.

Excluded (intentional)

• CVE-2026-13149 (brace-expansion) — already merged via CVE-2026-13149: backport CVE fix to release-1.2 #737
• PR Bump http-proxy-middleware and webpack-dev-server #732 (http-proxy-middleware / webpack-dev-server) — skipped per request

Source commits on main

• Update form-data to v4.0.6 - fixes CVE-2026-12143 #721 6481cf4e — form-data
• CVE-2026-46595: patch golang.org/x/crypto in proxy #726 9cd4a171 — golang.org/x/crypto
• Bump systeminformation from 5.31.6 to 5.31.17 #729 b24618bd — systeminformation
• Bump websocket-driver from 0.7.4 to 0.7.5 #730 7bef7573 — websocket-driver
• Bump ws from 8.19.0 to 8.21.1 #731 34b95ac6 — ws
• Bump shell-quote from 1.8.4 to 1.10.0 #739 eb798101 — shell-quote
• Bump svgo from 4.0.1 to 4.0.2 #744 44f02d5f — svgo
• Bump fast-uri from 3.1.3 to 3.1.4 #745 bc73bce2 — fast-uri
• CVE-2026-59869: patch js-yaml to v4.3.0 #747 20623999 — js-yaml

Test plan

• Confirmed patched package versions in package-lock.json / proxy/go.mod
• cd proxy && go build ./...
• CI green on this PR

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 660b5e59-a490-4034-b8d7-a1f142a87fc7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[celdrake]

Added follow-up commit with the two newly merged main CVE bumps:

• svgo 4.0.2 (Bump svgo from 4.0.1 to 4.0.2 #744 / Dependabot EDM-772: Move helm chart to main repo #164)
• fast-uri 3.1.4 (Bump fast-uri from 3.1.3 to 3.1.4 #745 / CVE-2026-16221)

[celdrake]

Added follow-up commit for CVE-2026-59869 from main #747:

• js-yaml → 4.3.0 in ui-components / standalone / ocp-plugin
• root package.json overrides to force js-yaml@4.3.0