chore(orchestrator): patch yarn.lock to resolve 1.10.2 CVEs

Signed-off-by: Jessica He <jhe@redhat.com>

Author: JessicaJHee

workspaces/orchestrator/patches/0-cve-yarn-lock.patch

@@ -0,0 +1,70 @@
+--- yarn.lock
++++ yarn.lock
+@@ -24775,29 +24775,29 @@
+   linkType: hard
+ 
+ "form-data@npm:^2.5.0":
+-  version: 2.5.5
+-  resolution: "form-data@npm:2.5.5"
++  version: 2.5.6
++  resolution: "form-data@npm:2.5.6"
+   dependencies:
+     asynckit: "npm:^0.4.0"
+     combined-stream: "npm:^1.0.8"
+     es-set-tostringtag: "npm:^2.1.0"
+-    hasown: "npm:^2.0.2"
++    hasown: "npm:^2.0.4"
+     mime-types: "npm:^2.1.35"
+     safe-buffer: "npm:^5.2.1"
+-  checksum: 10c0/7fb70447849fc9bce4d01fe9a626f6587441f85779a2803b67f803e1ab52b0bd78db0a7acd80d944c665f68ca90936c327f1244b730719b638a0219e98b20488
++  checksum: 10c0/de6b085a2b0d013299ccc888b677dbdb3d2a54ef8d74982bda9ad7d928f57440abae1bc736a5b85ea01077cfb6c72e9a7752dc786304271c03bd0013ef8f08cb
+   languageName: node
+   linkType: hard
+ 
+ "form-data@npm:^4.0.1, form-data@npm:^4.0.5":
+-  version: 4.0.5
+-  resolution: "form-data@npm:4.0.5"
++  version: 4.0.6
++  resolution: "form-data@npm:4.0.6"
+   dependencies:
+     asynckit: "npm:^0.4.0"
+     combined-stream: "npm:^1.0.8"
+     es-set-tostringtag: "npm:^2.1.0"
+-    hasown: "npm:^2.0.2"
+-    mime-types: "npm:^2.1.12"
+-  checksum: 10c0/dd6b767ee0bbd6d84039db12a0fa5a2028160ffbfaba1800695713b46ae974a5f6e08b3356c3195137f8530dcd9dfcb5d5ae1eeff53d0db1e5aad863b619ce3b
++    hasown: "npm:^2.0.4"
++    mime-types: "npm:^2.1.35"
++  checksum: 10c0/43947a77bf0ff45c6ceed789778982d47a3f3e720a74b71721174ebf3310a5f1a8be1d6b38a3ee3688e8a18a2c4273073ec0844cd37efda3eaf46d41c9c318ff
+   languageName: node
+   linkType: hard
+ 
+@@ -25855,6 +25855,15 @@
+   dependencies:
+     function-bind: "npm:^1.1.2"
+   checksum: 10c0/3769d434703b8ac66b209a4cca0737519925bbdb61dd887f93a16372b14694c63ff4e797686d87c90f08168e81082248b9b028bad60d4da9e0d1148766f56eb9
++  languageName: node
++  linkType: hard
++
++"hasown@npm:^2.0.4":
++  version: 2.0.4
++  resolution: "hasown@npm:2.0.4"
++  dependencies:
++    function-bind: "npm:^1.1.2"
++  checksum: 10c0/2d8de939e270b70618f8cebb69746620db10617dbb495bc66ddad326955ea24d3ca4af133aff3eb7c1853e0218f867bc2b050ec26fe02e3aea58f880ffc5e506
+   languageName: node
+   linkType: hard
+ 
+@@ -38727,9 +38736,9 @@
+   linkType: hard
+ 
+ "undici@npm:^7.1.1, undici@npm:^7.16.0, undici@npm:^7.2.3, undici@npm:^7.24.0":
+-  version: 7.25.0
+-  resolution: "undici@npm:7.25.0"
+-  checksum: 10c0/02a0b45dc14eb91bc488948750232450fe52f27a6b08086d6ac6736bb47908d600fe3a96d346f12eab24729c782e5c2f693bc8e8eca6696d4e4c09b1ed4cb4ec
++  version: 7.28.0
++  resolution: "undici@npm:7.28.0"
++  checksum: 10c0/fe781983a26098795e99bb1f64906cbb7d0bcaa029a26baade007b53ea67f2631d189b8f9671a31f4c8d0cb3773b7559608628ba54452fef51fec90e7c78bb0d
+   languageName: node
+   linkType: hard
+

workspaces/orchestrator/patches/cve-backports.yaml

@@ -0,0 +1,24 @@
+# CVE backports applied via workspace patches (not repo-ref bumps).
+# Auto-generated by scripts/yarnlock-backport — do not edit by hand.
+
+patch_file: 0-cve-yarn-lock.patch
+backports:
+  - cve_ids:
+      - CVE-2026-12143
+    package: form-data
+    patch_version: 4.0.6
+  - cve_ids:
+      - CVE-2026-42338
+    package: ip-address
+    patch_version: 10.2.0
+  - cve_ids:
+      - CVE-2026-12151
+      - CVE-2026-6734
+      - CVE-2026-9697
+    package: undici
+    patch_version: 7.28.0
+  - cve_ids:
+      - CVE-2026-45736
+      - CVE-2026-48779
+    package: ws
+    patch_version: 8.21.0