fix: update node; update dependencies (#915)

## What

## Why

## Notes

<!-- ⚠️ ↓↓↓ Auto-generated by Codefresh CI. Any edits may be overridden.
Image: ~codefresh/cli~ ↓↓↓ ⚠️ -->

## Security Report — codefresh/cli

> [!NOTE]
> Compared security scans:
>
> **Current image**:

[quay.io/codefresh/cli:cfs-13045-security@sha256:b8638037483323542ef9c0392eff88c7dc9afb513e1f2d186660339fd14936ca](https://app.prismacloud.io/compute?computeState=/monitor/vulnerabilities/images/ci?search%3Dsha256%253Ab8638037483323542ef9c0392eff88c7dc9afb513e1f2d186660339fd14936ca)
>
> **Baseline**:

[quay.io/codefresh/cli:master@sha256:b519f285928b4b61d087b32c1a7ac9232d6583df34c41665a9316041af216f28](https://app.prismacloud.io/compute?computeState=/monitor/vulnerabilities/images/ci?search%3Dsha256%253Ab519f285928b4b61d087b32c1a7ac9232d6583df34c41665a9316041af216f28)

### Fixed CVEs: 32
#### 🟣 Critical: 1
- CVE-2026-34182 in `openssl@3.5.6-r0` at `unknown path`
#### 🔴 High: 14
- CVE-2026-45447 in `openssl@3.5.6-r0` at `unknown path`
- CVE-2026-7383 in `openssl@3.5.6-r0` at `unknown path`
- CVE-2026-9076 in `openssl@3.5.6-r0` at `unknown path`
- CVE-2026-6276 in `curl@8.19.0-r0` at `unknown path`
- CVE-2026-5773 in `curl@8.19.0-r0` at `unknown path`
- CVE-2026-45736 in `ws@8.20.0` at `/cf-cli/node_modules/ws`
- CVE-2026-45445 in `openssl@3.5.6-r0` at `unknown path`
- CVE-2026-45186 in `expat@2.7.5-r0` at `unknown path`
- CVE-2026-42764 in `openssl@3.5.6-r0` at `unknown path`
- CVE-2026-41080 in `expat@2.7.5-r0` at `unknown path`
- CVE-2026-34183 in `openssl@3.5.6-r0` at `unknown path`
- CVE-2026-34180 in `openssl@3.5.6-r0` at `unknown path`
- CVE-2026-12143 in `form-data@2.5.5` at
`/cf-cli/node_modules/form-data`
- CVE-2026-34181 in `openssl@3.5.6-r0` at `unknown path`
#### 🟠 Medium: 13
- CVE-2026-5545 in `curl@8.19.0-r0` at `unknown path`
- CVE-2025-66413 in `git@2.52.0-r0` at `unknown path`
- CVE-2026-6253 in `curl@8.19.0-r0` at `unknown path`
- CVE-2026-4873 in `curl@8.19.0-r0` at `unknown path`
- CVE-2026-42767 in `openssl@3.5.6-r0` at `unknown path`
- CVE-2026-42766 in `openssl@3.5.6-r0` at `unknown path`
- CVE-2026-53655 in `tar@7.5.14` at
`/cf-cli/node_modules/@kubernetes/client-node/node_modules/tar`
- CVE-2026-8723 in `qs@6.15.1` at `/cf-cli/node_modules/qs`
- CVE-2026-7168 in `curl@8.19.0-r0` at `unknown path`
- CVE-2026-7009 in `curl@8.19.0-r0` at `unknown path`
- CVE-2026-6429 in `curl@8.19.0-r0` at `unknown path`
- CVE-2026-42769 in `openssl@3.5.6-r0` at `unknown path`
- CVE-2026-45446 in `openssl@3.5.6-r0` at `unknown path`
#### 🟡 Low: 4
- CVE-2026-42770 in `openssl@3.5.6-r0` at `unknown path`
- CVE-2026-42768 in `openssl@3.5.6-r0` at `unknown path`
- CVE-2026-48779 in `ws@7.5.10` at
`/cf-cli/node_modules/kubernetes-client/node_modules/ws`
- CVE-2026-48779 in `ws@8.20.0` at `/cf-cli/node_modules/ws`

### Fixed issues: 13
<!-- Fixed issues:
~[{"identifier":"CFS-13342","dueDate":"2026-07-21"},{"identifier":"CFS-13319","dueDate":"2026-07-21"},{"identifier":"CFS-13045","dueDate":"2026-07-16"},{"identifier":"CFS-12998","dueDate":"2026-08-15"},{"identifier":"CFS-12862","dueDate":"2026-07-16"},{"identifier":"CFS-7415","dueDate":"2026-07-22"},{"identifier":"CFS-7308","dueDate":"2026-07-18"},{"identifier":"CFS-7232","dueDate":"2026-07-14"},{"identifier":"CFS-7231","dueDate":"2026-07-14"},{"identifier":"CFS-7230","dueDate":"2026-07-14"},{"identifier":"CFS-7229","dueDate":"2026-07-14"},{"identifier":"CFS-7228","dueDate":"2026-07-14"},{"identifier":"CFS-7213","dueDate":"2026-07-13"}]~
-->
- Fixes
[CFS-13342](https://linear.app/octopus/issue/CFS-13342/security-or-codefreshcli-or-cve-2026-45186-or)
- Fixes
[CFS-13319](https://linear.app/octopus/issue/CFS-13319/security-or-codefreshcli-or-cve-2026-41080-or)
- Fixes
[CFS-13045](https://linear.app/octopus/issue/CFS-13045/security-or-codefreshcli-or-cve-2026-12143-or)
- Fixes
[CFS-12998](https://linear.app/octopus/issue/CFS-12998/security-or-codefreshcli-or-cve-2026-53655-or)
- Fixes
[CFS-12862](https://linear.app/octopus/issue/CFS-12862/security-or-codefreshcli-or-cve-2026-48779-or)
- Fixes
[CFS-7415](https://linear.app/octopus/issue/CFS-7415/security-or-codefreshcli-or-cve-2026-8723-ormedium)
- Fixes
[CFS-7308](https://linear.app/octopus/issue/CFS-7308/security-or-codefreshcli-or-cve-2026-45736-ormedium)
- Fixes
[CFS-7232](https://linear.app/octopus/issue/CFS-7232/security-or-codefreshcli-or-cve-2026-6429-ormedium)
- Fixes
[CFS-7231](https://linear.app/octopus/issue/CFS-7231/security-or-codefreshcli-or-cve-2026-6253-ormedium)
- Fixes
[CFS-7230](https://linear.app/octopus/issue/CFS-7230/security-or-codefreshcli-or-cve-2026-7009-ormedium)
- Fixes
[CFS-7229](https://linear.app/octopus/issue/CFS-7229/security-or-codefreshcli-or-cve-2026-4873-ormedium)
- Fixes
[CFS-7228](https://linear.app/octopus/issue/CFS-7228/security-or-codefreshcli-or-cve-2026-7168-ormedium)
- Fixes
[CFS-7213](https://linear.app/octopus/issue/CFS-7213/security-or-codefreshcli-or-cve-2026-5545-ormedium)

<!-- ⚠️ ↑↑↑ Auto-generated by Codefresh CI. Any edits may be overridden.
Image: ~codefresh/cli~ ↑↑↑ ⚠️ -->

Author: alinashklyar

.nvmrc

@@ -1 +1 @@
-v24.13.0
+v24.18.0

Dockerfile

@@ -1,4 +1,4 @@
-FROM node:24.15.0-alpine3.23
+FROM node:24.18.0-alpine3.24
 ARG TARGETPLATFORM
 RUN apk --update add --no-cache \
     bash \
@@ -7,8 +7,8 @@ RUN apk --update add --no-cache \
     git \
     jq
 RUN npm upgrade -g npm
-COPY --from=mikefarah/yq:4.53.2 /usr/bin/yq /usr/local/bin/yq
-ADD --chmod=775 https://dl.k8s.io/release/v1.36.0/bin/${TARGETPLATFORM}/kubectl /usr/local/bin/kubectl
+COPY --from=mikefarah/yq:4.53.3 /usr/bin/yq /usr/local/bin/yq
+ADD --chmod=775 https://dl.k8s.io/release/v1.36.1/bin/${TARGETPLATFORM}/kubectl /usr/local/bin/kubectl
 WORKDIR /cf-cli
 COPY package.json yarn.lock check-version.js run-check-version.js /cf-cli/
 RUN yarn install --prod --frozen-lockfile && \

Dockerfile-debian

@@ -1,4 +1,4 @@
-FROM node:24.13.0-trixie-slim
+FROM node:24.18.0-trixie-slim
 ARG TARGETPLATFORM
 RUN apt update \
     && apt -y install \
@@ -11,8 +11,8 @@ RUN apt update \
     jq \
     && ln -s /bin/busybox /usr/bin/[[
 RUN npm upgrade -g npm
-COPY --from=mikefarah/yq:4.52.4 /usr/bin/yq /usr/local/bin/yq
-ADD --chmod=775 https://dl.k8s.io/release/v1.35.3/bin/${TARGETPLATFORM}/kubectl /usr/local/bin/kubectl
+COPY --from=mikefarah/yq:4.53.3 /usr/bin/yq /usr/local/bin/yq
+ADD --chmod=775 https://dl.k8s.io/release/v1.36.1/bin/${TARGETPLATFORM}/kubectl /usr/local/bin/kubectl
 WORKDIR /cf-cli
 COPY package.json yarn.lock check-version.js run-check-version.js /cf-cli/
 RUN yarn install --prod --frozen-lockfile && \

Dockerfile-debian-rootless

@@ -1,4 +1,4 @@
-FROM node:24.13.0-trixie-slim
+FROM node:24.18.0-trixie-slim
 ARG TARGETPLATFORM
 RUN apt update \
     && apt -y install \
@@ -10,8 +10,8 @@ RUN apt update \
     jq \
     && ln -s /bin/busybox /usr/bin/[[
 RUN npm upgrade -g npm
-COPY --from=mikefarah/yq:4.52.4 /usr/bin/yq /usr/local/bin/yq
-ADD --chmod=775 https://dl.k8s.io/release/v1.35.3/bin/${TARGETPLATFORM}/kubectl /usr/local/bin/kubectl
+COPY --from=mikefarah/yq:4.53.3 /usr/bin/yq /usr/local/bin/yq
+ADD --chmod=775 https://dl.k8s.io/release/v1.36.1/bin/${TARGETPLATFORM}/kubectl /usr/local/bin/kubectl
 WORKDIR /cf-cli
 COPY package.json yarn.lock check-version.js run-check-version.js /cf-cli/
 RUN yarn install --prod --frozen-lockfile && \

Dockerfile-rootless

@@ -1,13 +1,13 @@
-FROM node:24.13.0-alpine3.23
+FROM node:24.18.0-alpine3.24
 ARG TARGETPLATFORM
 RUN apk --update add --no-cache \
     bash \
     ca-certificates \
     curl \
     git \
     jq
-COPY --from=mikefarah/yq:4.52.4 /usr/bin/yq /usr/local/bin/yq
-ADD --chmod=775 https://dl.k8s.io/release/v1.35.3/bin/${TARGETPLATFORM}/kubectl /usr/local/bin/kubectl
+COPY --from=mikefarah/yq:4.53.3 /usr/bin/yq /usr/local/bin/yq
+ADD --chmod=775 https://dl.k8s.io/release/v1.36.1/bin/${TARGETPLATFORM}/kubectl /usr/local/bin/kubectl
 WORKDIR /cf-cli
 COPY package.json yarn.lock check-version.js run-check-version.js /cf-cli/
 RUN yarn install --prod --frozen-lockfile && \

docs/docs.spec.js

@@ -1,7 +1,7 @@
 const docs = require('../docs');
 
 describe('docs generation', () => {
-    jest.setTimeout(20000);
+    jest.setTimeout(60000);
     it('should generate docs', async () => {
         return await docs();
     });

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codefresh",
-  "version": "1.2.1",
+  "version": "1.2.2",
   "description": "Codefresh command line utility",
   "main": "index.js",
   "preferGlobal": true,
@@ -45,7 +45,7 @@
     "tough-cookie": "^4.1.3",
     "openid-client": "^4.9.0",
     "**/request/form-data": "^2.5.5",
-    "**/request/qs": "^6.14.2"
+    "**/request/qs": "^6.15.2"
   },
   "dependencies": {
     "adm-zip": "^0.5.5",

yarn.lock

@@ -3942,14 +3942,14 @@ form-data-encoder@^4.0.2:
   integrity sha512-G6NsmEW15s0Uw9XnCg+33H3ViYRyiM0hMrMhhqQOR8NFc5GhYrI+6I3u7OTw7b91J2g8rtvMBZJDbcGb2YUniw==
 
 form-data@^2.3.2, form-data@^2.5.5, form-data@~2.3.2:
-  version "2.5.5"
-  resolved "https://registry.yarnpkg.com/form-data/-/form-data-2.5.5.tgz#a5f6364ad7e4e67e95b4a07e2d8c6f711c74f624"
-  integrity sha512-jqdObeR2rxZZbPSGL+3VckHMYtu+f9//KXBsVny6JSX/pa38Fy+bGjuG8eW/H6USNQWhLi8Num++cU2yOCNz4A==
+  version "2.5.6"
+  resolved "https://registry.yarnpkg.com/form-data/-/form-data-2.5.6.tgz#ef39b3d99e2fc9f25420c0db7962fe36cafcd244"
+  integrity sha512-Ogz/E85h9tlfJzpI6TuFpGcHZFhLrb9Gw8wq9v40CxSCPnv7ahKr6Xgtkn0KYCDQJ8DNn5VoMO8EXr9V5PadyA==
   dependencies:
     asynckit "^0.4.0"
     combined-stream "^1.0.8"
     es-set-tostringtag "^2.1.0"
-    hasown "^2.0.2"
+    hasown "^2.0.4"
     mime-types "^2.1.35"
     safe-buffer "^5.2.1"
 
@@ -4258,6 +4258,13 @@ hasown@^2.0.2:
   dependencies:
     function-bind "^1.1.2"
 
+hasown@^2.0.4:
+  version "2.0.4"
+  resolved "https://registry.yarnpkg.com/hasown/-/hasown-2.0.4.tgz#8c62d8cb90beb2aad5d0a5b67581ad9854c3f003"
+  integrity sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==
+  dependencies:
+    function-bind "^1.1.2"
+
 html-escaper@^2.0.0:
   version "2.0.2"
   resolved "https://registry.yarnpkg.com/html-escaper/-/html-escaper-2.0.2.tgz#dfd60027da36a36dfcbe236262c00a5822681453"
@@ -5126,9 +5133,9 @@ js-yaml@^3.10.0, js-yaml@^3.13.1, js-yaml@^3.14.0:
     esprima "^4.0.0"
 
 js-yaml@^4.1.0:
-  version "4.1.1"
-  resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-4.1.1.tgz#854c292467705b699476e1a2decc0c8a3458806b"
-  integrity sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==
+  version "4.2.0"
+  resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-4.2.0.tgz#2bd9e85682dd91bd469afb809d816043b3d49524"
+  integrity sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==
   dependencies:
     argparse "^2.0.1"
 
@@ -6064,12 +6071,13 @@ pure-rand@^6.0.0:
   resolved "https://registry.yarnpkg.com/pure-rand/-/pure-rand-6.1.0.tgz#d173cf23258231976ccbdb05247c9787957604f2"
   integrity sha512-bVWawvoZoBYpp6yIoQtQXHZjmz35RSVHnUOTefl8Vcjr8snTPY1wnpSPMWekcFwbxI6gtmT7rSYPFvz71ldiOA==
 
-qs@^6.12.3, qs@^6.14.2, qs@^6.9.0, qs@^6.9.4, qs@~6.5.2:
-  version "6.15.1"
-  resolved "https://registry.yarnpkg.com/qs/-/qs-6.15.1.tgz#bdb55aed06bfac257a90c44a446a73fba5575c8f"
-  integrity sha512-6YHEFRL9mfgcAvql/XhwTvf5jKcOiiupt2FiJxHkiX1z4j7WL8J/jRHYLluORvc1XxB5rV20KoeK00gVJamspg==
+qs@^6.12.3, qs@^6.15.2, qs@^6.9.0, qs@^6.9.4, qs@~6.5.2:
+  version "6.15.3"
+  resolved "https://registry.yarnpkg.com/qs/-/qs-6.15.3.tgz#76852132a58ed5c7c0ef67e4441b9bb5d6061b3b"
+  integrity sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==
   dependencies:
-    side-channel "^1.1.0"
+    es-define-property "^1.0.1"
+    side-channel "^1.1.1"
 
 querystring-browser@^1.0.4:
   version "1.0.4"
@@ -6476,7 +6484,7 @@ shebang-regex@^3.0.0:
   resolved "https://registry.yarnpkg.com/shebang-regex/-/shebang-regex-3.0.0.tgz#ae16f1644d873ecad843b0307b143362d4c42172"
   integrity sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==
 
-side-channel-list@^1.0.0:
+side-channel-list@^1.0.0, side-channel-list@^1.0.1:
   version "1.0.1"
   resolved "https://registry.yarnpkg.com/side-channel-list/-/side-channel-list-1.0.1.tgz#c2e0b5a14a540aebee3bbc6c3f8666cc9b509127"
   integrity sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==
@@ -6516,6 +6524,17 @@ side-channel@^1.1.0:
     side-channel-map "^1.0.1"
     side-channel-weakmap "^1.0.2"
 
+side-channel@^1.1.1:
+  version "1.1.1"
+  resolved "https://registry.yarnpkg.com/side-channel/-/side-channel-1.1.1.tgz#ea02c62e05dc4bea67d4442f0fb71ee192f8e0ab"
+  integrity sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==
+  dependencies:
+    es-errors "^1.3.0"
+    object-inspect "^1.13.4"
+    side-channel-list "^1.0.1"
+    side-channel-map "^1.0.1"
+    side-channel-weakmap "^1.0.2"
+
 signal-exit@^3.0.2, signal-exit@^3.0.3, signal-exit@^3.0.7:
   version "3.0.7"
   resolved "https://registry.yarnpkg.com/signal-exit/-/signal-exit-3.0.7.tgz#a9a1767f8af84155114eaabd73f99273c8f59ad9"
@@ -6901,21 +6920,10 @@ tar-stream@^3.1.5:
     fast-fifo "^1.2.0"
     streamx "^2.15.0"
 
-tar@^7.0.0:
-  version "7.5.14"
-  resolved "https://registry.yarnpkg.com/tar/-/tar-7.5.14.tgz#4a5021989e5f53a2bdaa2e25592873c1ee3b447c"
-  integrity sha512-/7sHKgQO3JLP9ESlwTYUUftHUadOURUqq23xs1vjcnp8Vss6k0wCfzulyEtk5g91pjvnuriimGlyG7k6msrzRw==
-  dependencies:
-    "@isaacs/fs-minipass" "^4.0.0"
-    chownr "^3.0.0"
-    minipass "^7.1.2"
-    minizlib "^3.1.0"
-    yallist "^5.0.0"
-
-tar@^7.5.7:
-  version "7.5.13"
-  resolved "https://registry.yarnpkg.com/tar/-/tar-7.5.13.tgz#0d214ed56781a26edc313581c0e2d929ceeb866d"
-  integrity sha512-tOG/7GyXpFevhXVh8jOPJrmtRpOTsYqUIkVdVooZYJS/z8WhfQUX8RJILmeuJNinGAMSu1veBr4asSHFt5/hng==
+tar@^7.0.0, tar@^7.5.7:
+  version "7.5.17"
+  resolved "https://registry.yarnpkg.com/tar/-/tar-7.5.17.tgz#5eace4af68b088bb1d737ba9fffdacbbb70ba6e0"
+  integrity sha512-wPEBwzapC+2PaTYPH6e2L+cNOEE227S47wUYFqlegcs8zlLLmeb9Fcff1HVZY4Fwku/1Eyv38n7GYwB2aaS71g==
   dependencies:
     "@isaacs/fs-minipass" "^4.0.0"
     chownr "^3.0.0"
@@ -7453,14 +7461,14 @@ write-file-atomic@^4.0.2:
     signal-exit "^3.0.7"
 
 ws@^7.2.3:
-  version "7.5.10"
-  resolved "https://registry.yarnpkg.com/ws/-/ws-7.5.10.tgz#58b5c20dc281633f6c19113f39b349bd8bd558d9"
-  integrity sha512-+dbF1tHwZpXcbOJdVOkzLDxZP1ailvSxM6ZweXTegylPny803bFhA+vqBYw4s31NSAk4S2Qz+AKXK9a4wkdjcQ==
+  version "7.5.11"
+  resolved "https://registry.yarnpkg.com/ws/-/ws-7.5.11.tgz#9460daf1812bb81a423c5b9eac746941a86310fa"
+  integrity sha512-zS54Oen9bITtp7kp2XM3AydrCIq1D+HwJOuH+c+e4LfpL/lotP5osijd+UoMnxwAam1GN8R4KtLAyIrIcBNpiA==
 
 ws@^8.18.0:
-  version "8.20.0"
-  resolved "https://registry.yarnpkg.com/ws/-/ws-8.20.0.tgz#4cd9532358eba60bc863aad1623dfb045a4d4af8"
-  integrity sha512-sAt8BhgNbzCtgGbt2OxmpuryO63ZoDk/sqaB/znQm94T4fCEsy/yV+7CdC1kJhOU9lboAEU7R3kquuycDoibVA==
+  version "8.21.0"
+  resolved "https://registry.yarnpkg.com/ws/-/ws-8.21.0.tgz#012e413fc07429945121b0c153158c4343086951"
+  integrity sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==
 
 xtend@^4.0.0:
   version "4.0.2"