fix(deps): update kubernetes-client version to fix a CVE (janus-idp#2356

)

* fix(deps): update kubernetes-client dependancy

* fix(deps): do not embed plugin-kubernetes-common package in export-dynamic script

* add changeset

* remove kubernetes-common dependancy from ocm-bacckend

.changeset/spicy-pens-press.md

@@ -0,0 +1,9 @@
+---
+"@janus-idp/backstage-scaffolder-backend-module-kubernetes": patch
+"@janus-idp/shared-react": patch
+"@janus-idp/backstage-plugin-ocm-backend": patch
+"@janus-idp/backstage-plugin-topology": patch
+"@janus-idp/backstage-plugin-tekton": patch
+---
+
+Fix CVE-2024-21534 by upgrading @kubernetes/client-node package to 0.22.1

plugins/kubernetes-actions/package.json

@@ -45,7 +45,7 @@
     "@backstage/backend-plugin-api": "^1.0.0",
     "@backstage/catalog-client": "^1.7.0",
     "@backstage/plugin-scaffolder-node": "^0.4.11",
-    "@kubernetes/client-node": "^0.20.0"
+    "@kubernetes/client-node": "^0.22.1"
   },
   "devDependencies": {
     "@backstage/catalog-model": "1.7.0",

plugins/ocm-backend/package.json

@@ -31,8 +31,8 @@
   "scripts": {
     "build": "backstage-cli package build",
     "clean": "backstage-cli package clean",
-    "export-dynamic": "janus-cli package export-dynamic-plugin --embed-package @backstage/plugin-kubernetes-common",
-    "export-dynamic:clean": "janus-cli package export-dynamic-plugin --embed-package @backstage/plugin-kubernetes-common --clean",
+    "export-dynamic": "janus-cli package export-dynamic-plugin",
+    "export-dynamic:clean": "janus-cli package export-dynamic-plugin --clean",
     "lint:check": "backstage-cli package lint",
     "lint:fix": "backstage-cli package lint --fix",
     "postpack": "backstage-cli package postpack",
@@ -54,11 +54,10 @@
     "@backstage/catalog-model": "^1.7.0",
     "@backstage/errors": "^1.2.4",
     "@backstage/plugin-catalog-node": "^1.13.0",
-    "@backstage/plugin-kubernetes-common": "^0.8.3",
     "@backstage/plugin-permission-common": "^0.8.1",
     "@backstage/plugin-permission-node": "^0.8.3",
     "@janus-idp/backstage-plugin-ocm-common": "*",
-    "@kubernetes/client-node": "^0.20.0",
+    "@kubernetes/client-node": "^0.22.1",
     "express": "^4.18.2",
     "semver": "^7.5.4"
   },

plugins/ocm-backend/src/constants.ts

@@ -1,2 +1,3 @@
 export const CONSOLE_CLAIM = 'consoleurl.cluster.open-cluster-management.io';
 export const HUB_CLUSTER_NAME_IN_OCM = 'local-cluster';
+export const ANNOTATION_KUBERNETES_API_SERVER = 'kubernetes.io/api-server';

plugins/ocm-backend/src/providers/ManagedClusterProvider.ts

@@ -30,7 +30,6 @@ import type {
   EntityProvider,
   EntityProviderConnection,
 } from '@backstage/plugin-catalog-node';
-import { ANNOTATION_KUBERNETES_API_SERVER } from '@backstage/plugin-kubernetes-common';
 
 import { CustomObjectsApi } from '@kubernetes/client-node';
 
@@ -39,7 +38,11 @@ import {
   ANNOTATION_PROVIDER_ID,
 } from '@janus-idp/backstage-plugin-ocm-common';
 
-import { CONSOLE_CLAIM, HUB_CLUSTER_NAME_IN_OCM } from '../constants';
+import {
+  ANNOTATION_KUBERNETES_API_SERVER,
+  CONSOLE_CLAIM,
+  HUB_CLUSTER_NAME_IN_OCM,
+} from '../constants';
 import { readOcmConfigs } from '../helpers/config';
 import {
   getManagedCluster,

plugins/shared-react/package.json

@@ -40,7 +40,7 @@
     "@backstage/core-plugin-api": "^1.9.4",
     "@backstage/plugin-kubernetes-common": "^0.8.3",
     "@backstage/plugin-kubernetes-react": "^0.4.3",
-    "@kubernetes/client-node": "^0.20.0",
+    "@kubernetes/client-node": "^0.22.1",
     "@material-ui/core": "^4.12.4",
     "@mui/icons-material": "5.15.17",
     "classnames": "^2.3.2",

plugins/tekton/package.json

@@ -52,7 +52,7 @@
     "@backstage/theme": "^0.5.7",
     "@janus-idp/backstage-plugin-tekton-common": "*",
     "@janus-idp/shared-react": "*",
-    "@kubernetes/client-node": "^0.20.0",
+    "@kubernetes/client-node": "^0.22.1",
     "@material-ui/core": "^4.9.13",
     "@material-ui/icons": "^4.11.3",
     "@material-ui/lab": "^4.0.0-alpha.45",

plugins/topology/package.json

@@ -49,7 +49,7 @@
     "@backstage/theme": "^0.5.7",
     "@janus-idp/backstage-plugin-topology-common": "*",
     "@janus-idp/shared-react": "*",
-    "@kubernetes/client-node": "^0.20.0",
+    "@kubernetes/client-node": "^0.22.1",
     "@material-ui/core": "^4.9.13",
     "@material-ui/icons": "^4.11.3",
     "@material-ui/lab": "^4.0.0-alpha.45",