fix(deps): bump tinypool to >=2.1.2 (CVE-2026-104849)

[redhat-chai-bot]

Summary

Fixes CVE-2026-104849, a critical (CVSS 9.5) prototype-pollution vulnerability in tinypool versions prior to 2.1.2.

Details

tinypool 1.1.1 was locked in package-lock.json as a transitive dependency of vitest. The vulnerability allows code injection through prototype pollution of Object.prototype.filename, which can trick the worker pool into loading attacker-controlled JavaScript.

This change adds "tinypool": ">=2.1.2" to the existing overrides section in the root package.json, forcing npm to resolve tinypool version 2.2.0. Only package.json and package-lock.json are modified.

Validation

• All 82 tests pass across 4 test files
• npm ls tinypool confirms version 2.2.0 (overridden)
• No production code changes — tinypool is a devDependency (transitive via vitest)

---

AI-generated. Review for accuracy.

@celdrake requested from Slack

Summary

The change adds a root package.json override that requires tinypool >=2.1.2. The lockfile resolves the package to 2.2.0. This overrides the version requested by vitest (^1.1.1).

The change is limited to dependency configuration. It does not change files in libs/ui-components/, libs/types/, libs/i18n/, libs/cypress/, apps/standalone/, apps/ocp-plugin/, proxy/, packaging/, or .github/workflows/. It does not affect shared UI components, platform-specific app code, the Go auth proxy, container builds, E2E tests, or CI configuration. No cross-cutting product-code impact is evident.

The stated security objective is to require a tinypool version at or above the specified threshold. The supplied evidence does not include an independent vulnerability assessment, test results, or review findings.

Risk classification

The applied risk label and its classification criteria are unavailable in the supplied evidence. The labeling instructions were not provided, so this summary cannot determine whether risk:ship, risk:show, or risk:ask was applied, or whether another classification was close.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: flightctl/flightctl-ui/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Enterprise
• Run ID: baf9d908-2f3f-4407-93d0-508814455add

📥 Commits

Reviewing files that changed from the base of the PR and between d0d337b and edbb7e6.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• package.json

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 9 remain after this review.

---

Walkthrough

The root overrides configuration adds a minimum version of 2.1.2 for tinypool. The existing fast-uri override remains unchanged.

Changes

Dependency Override

Layer / File(s)	Summary
Add tinypool override package.json	The overrides configuration adds a tinypool override requiring version 2.1.2 or later. The existing fast-uri override remains unchanged.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Bug fix

Suggested labels: risk:ask

Suggested reviewers: celdrake

Merge Risk: ⚪ Minimal · up to edbb7

The override targets a patched Tinypool version, with no verified compatibility blocker. It is mergeable after normal dependency checks.

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
No-Hardcoded-Secrets	❌ Error	The pull request adds a 88-character Base64 string to package-lock.json: the new tinypool SHA-512 integrity value. This matches the check's explicit rule to flag Base64 strings longer than 32 char…	Remove the newly added long Base64 literal from the changed configuration, or store it through an approved non-literal mechanism. If npm integrity metadata must remain in package-lock.json, update this check to exempt standard package-man…

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: updating the transitive tinypool dependency to address CVE-2026-104849.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Weak-Crypto	✅ Passed	The pull request only changes the npm override and the resolved tinypool lockfile entry. It adds no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom cryptography, or secret comparison logic. The loc…
No-Injection-Vectors	✅ Passed	PASS. The pull request changes only dependency metadata in package.json and package-lock.json. The added lines define the tinypool override and lock version 2.2.0. They do not add eval, exec…
Container-Privileges	✅ Passed	PASS. The pull request changes only package.json and package-lock.json to update tinypool. It does not add or modify container or Kubernetes manifests, and the diff contains no privilege-related…
No-Sensitive-Data-In-Logs	✅ Passed	PASS. The pull request changes only dependency metadata in package.json and package-lock.json. It adds the tinypool override and updates its resolved package version. It adds no logging code or …
Resource-Leaks	✅ Passed	The pull request changes only package.json and package-lock.json. It changes no Go files under proxy/, so the resource-leak criteria do not apply.
Unchecked-Errors	✅ Passed	The pull request changes only package.json and package-lock.json. It changes no Go files under proxy/, so it introduces no unchecked or swallowed Go error returns.
Ai-Attribution	✅ Passed	The PR description mentions AI-generated content, so attribution was checked. The reviewed commit has no Co-Authored-By trailer and no other AI attribution trailer. Therefore, the prohibited AI `Co-…
Generated-Files-Not-Hand-Edited	✅ Passed	The pull request changes only package.json and package-lock.json. It does not directly edit any files under the specified generated OpenAPI model directories or libs/i18n/locales/en/translation.json.
I18n-Compliance	✅ Passed	PASS. The pull request changes only package.json and package-lock.json. It changes no .tsx files, so it introduces no user-facing string or t() key issue covered by this check.

Full details: No-Hardcoded-Secrets

Explanation

The pull request adds a 88-character Base64 string to package-lock.json: the new tinypool SHA-512 integrity value. This matches the check's explicit rule to flag Base64 strings longer than 32 characters in configuration files. No API key, token, password, private key, or embedded URL credentials were found.

Resolution

Remove the newly added long Base64 literal from the changed configuration, or store it through an approved non-literal mechanism. If npm integrity metadata must remain in package-lock.json, update this check to exempt standard package-manager integrity hashes because this value is an integrity checksum, not a credential.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}