fix: address PR review comments

- Fix subcomponent: trustyai-service-operator repos incorrectly grouped
  under lm-evaluation-harness — give them their own subcomponent value
- Add missing case in Step 3: container extracted but not found in
  container_to_repo_mapping → fall back to all repos with warning
- Add language-specific transitive dependency guidance in Step 5.2.1:
  Go (replace directive), Python (update parent package), Node (overrides)
- Fix package regex to support npm scoped packages (@grpc/grpc-js etc)

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Author: vmrh21

workflows/cve-fixer/.claude/commands/cve.fix.md

@@ -72,7 +72,7 @@ Summary:
    ```bash
    SUMMARY="CVE-2025-66418 rhoai/odh-llm-d-routing-sidecar-rhel9: urllib3: Unbounded decompression"
    CONTAINER=$(echo "$SUMMARY" | grep -oP '(?<=CVE-[0-9]+-[0-9]+ )[\w/.-]+(?=:)')
-   PACKAGE=$(echo "$SUMMARY" | grep -oP '(?<=: )[\w._-]+(?=:)')
+   PACKAGE=$(echo "$SUMMARY" | grep -oP '(?<=: )[\w.@/_-]+(?=:)')
    ```
 
    Store `CONTAINER` and `PACKAGE` per CVE for use in Steps 3 and 5.
@@ -122,7 +122,10 @@ Summary:
 
    If a `CONTAINER` was extracted in Step 1:
    - Look up `CONTAINER` in `container_to_repo_mapping` for the component
-   - This gives the **primary repo** (e.g., `opendatahub-io/workload-variant-autoscaler`)
+   - **If container not found in mapping**:
+     - Log a warning: "⚠️ Container [CONTAINER] not in mapping — may be a new container not yet registered. Processing all component repos."
+     - Fall back to processing all repos in the component (scan in Step 5 filters irrelevant ones)
+   - **If container found**: gives the **primary repo** (e.g., `opendatahub-io/workload-variant-autoscaler`)
    - Check if the primary repo has a `subcomponent` field in the `repositories` section
      - **If `subcomponent` is defined**: collect all repos in the component with the same `subcomponent` value — this is the chain (upstream + midstream + downstream)
      - **If `subcomponent` is not defined**: process ALL repositories in the component (safe fallback — the CVE scan in Step 5 will filter out repos where the CVE doesn't exist)
@@ -303,8 +306,12 @@ Summary:
      - If version is in affected range → proceed with fix
      - If version is already patched → mark as already fixed (see below)
    - **Package not found in any manifest** → it may be transitive or RPM-installed
-     - **Still proceed with fix attempt** — try to add/pin the package at a safe version
-     - Include note in PR: "⚠️ Package not found directly in manifests — may be a transitive or RPM-installed dependency. Manual review required to confirm fix is effective."
+     - **Do NOT blindly add a direct dependency** — this can cause version conflicts or unnecessary bloat
+     - Instead, document the situation and create PR with guidance:
+       - **Go**: transitive deps require a `replace` directive in go.mod — add it only if intentional
+       - **Python**: adding to requirements.txt may conflict with what pip resolves transitively; prefer updating the parent package that pulls it in
+       - **Node**: use npm `overrides` to force a safe version without adding a direct dep
+     - Include note in PR: "⚠️ Package not found directly in manifests — may be a transitive or RPM-installed dependency. Manual review required to confirm the right fix approach."
    - **Both scan AND version check find nothing** → mark as already fixed:
      - **DO NOT create a PR**
      - **Print to stdout**: "✅ CVE-YYYY-XXXXX is already fixed in [repository] ([branch]). No action needed."

workflows/cve-fixer/component-repository-mappings.json

@@ -610,7 +610,7 @@
             "primary_target": "main",
             "backport_targets": "release/1.37.0, release/1.38.0"
           },
-          "subcomponent": "lm-evaluation-harness"
+          "subcomponent": "trustyai-service-operator"
         },
         "opendatahub-io/eval-hub": {
           "github_url": "https://github.com/opendatahub-io/eval-hub",
@@ -673,7 +673,7 @@
             "primary_target": "main",
             "backport_targets": "release/odh-3.3, release/odh-3.4, release/odh-3.4-ea2"
           },
-          "subcomponent": "lm-evaluation-harness"
+          "subcomponent": "trustyai-service-operator"
         },
         "red-hat-data-services/eval-hub": {
           "github_url": "https://github.com/red-hat-data-services/eval-hub",
@@ -740,7 +740,7 @@
             "primary_target": "main",
             "backport_targets": "rhoai-3.3, rhoai-3.4, rhoai-3.4-ea.1, rhoai-3.4-ea.2"
           },
-          "subcomponent": "lm-evaluation-harness"
+          "subcomponent": "trustyai-service-operator"
         },
         "trustyai-explainability/llama-stack-provider-ragas": {
           "github_url": "https://github.com/trustyai-explainability/llama-stack-provider-ragas",