fix(cve): update axios, browserslist, baseline-browser-mapping for CVE fixes

[crackcodecamp]

Summary

Round 4 CVE fixes for RHOAI 2.25.11 — addresses 5 CVEs (8 Jira trackers fixed, 4 VEX-closed, 1 RBAC issue noted).

Changes

Package	Before	After	CVEs Fixed	Trackers
axios	1.18.1	>=1.19.0	CVE-2026-67313, 67320	RHOAIENG-84657, 84656, 84672, 84671
browserslist	4.28.1	4.28.8	CVE-2026-73088, 73089	RHOAIENG-83144, 83143, 83163, 83162
baseline-browser-mapping	2.9.19	2.11.15	CVE-2026-45819	RHOAIENG-84140, 84139

browserslist and baseline-browser-mapping updated via in-place lockfile surgery (dependency list changed between versions).

VEX-Closed

CVE	Package	Trackers	Reason
CVE-2026-73643	js-yaml	RHOAIENG-83896, 83895	Production backend at 4.3.1 (fixed). Dev-only remainder
CVE-2026-73566	node-tar	RHOAIENG-83932, 83931	Already at latest 7.5.22, not flagged by npm audit

Not in scope

• CVE-2026-18949 (RHOAIENG-82508) — ClusterRole RBAC config issue, not a dependency CVE
• @fastify/busboy (RHOAIENG-84711, 84710, 84725, 84724) — assigned to Premved, blocked on RHOAIENG-81841

Jira Trackers

• axios: RHOAIENG-84657, 84656, 84672, 84671
• browserslist: RHOAIENG-83144, 83143, 83163, 83162
• baseline-browser-mapping: RHOAIENG-84140, 84139

Test plan

• npm run build passes
• npm run test:backend — 17/17 tests pass
• CI pipeline passes

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 63b492e6-425b-4103-a539-c4adbc29112c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[manaswinidas]

/lgtm
/approve

Tested as non-admin user:

• Create a workbench
• Start/stop an existing workbench
• Pipelines and other pages load fine.

These work fine.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: manaswinidas

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [manaswinidas]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment