fix(deps): update kubernetes-client version to fix a CVE

[karthikjeeyar]

Fixes:
https://issues.redhat.com/browse/RHIDP-4440

This upgrades the following packages

• ocm-backend
• shared-react
• kubernetes-action
• topology
• tekton

Note: 1.3.x fix for Argocd will be contributed from backstage/community-plugin.

Fix CVE

CVE-2024-21534

[karthikjeeyar]

/assign @kim-tsao @nickboldt

[karthikjeeyar]

we are using plugin-kubernetes-common dependancy in 4 out of 5 plugins changed in this PR, and that plugin is pinned to v0.20.0 https://github.com/backstage/backstage/blob/master/plugins/kubernetes-common/package.json#L58 causing issues in CI checks.

Error: The version of a dependency ('@kubernetes/client-node') of an embedded module conflicts with main module dependencies: '0.20.0', '^0.22.1': cannot proceed!

[kim-tsao]

@PatAKnight can you or your team please review the ocm-backend plugin? Can you consider the QE and docs impact this change may have?

[changeset-bot]

🦋 Changeset detected

Latest commit: d4529c5

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 5 packages

Name	Type
@janus-idp/backstage-scaffolder-backend-module-kubernetes	Patch
@janus-idp/shared-react	Patch
@janus-idp/backstage-plugin-ocm-backend	Patch
@janus-idp/backstage-plugin-topology	Patch
@janus-idp/backstage-plugin-tekton	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[karthikjeeyar]

/retest

[PatAKnight]

Plugin still works from my side of things.

But I was unable to test the ocm backend plugin dynamically. It might have to do with the plugins repo being on backstage 1.30 vs showcase repo being on backstage 1.29 and the various deprecations in @backstage/backend-dynamic-feature-service. @gashcrumb is that something that you can verify?

[PatAKnight]

I ended up figuring out how to get the ocm backend dynamic plugin tested. It ended up being the version mismatch after some hacking of backstage-showcase. Looks good to me. @invincibleJai, does anyone from the frontend team want to take a look at this?

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[kim-tsao]

/lgtm

[kim-tsao]

/cherry-pick release-1.3

[openshift-cherrypick-robot]

@kim-tsao: #2356 failed to apply on top of branch "release-1.3":

Applying: fix(deps): update kubernetes-client dependancy
Using index info to reconstruct a base tree...
M	plugins/kubernetes-actions/package.json
M	plugins/ocm-backend/package.json
M	plugins/shared-react/package.json
M	plugins/tekton/package.json
M	plugins/topology/package.json
Falling back to patching base and 3-way merge...
Auto-merging plugins/topology/package.json
CONFLICT (content): Merge conflict in plugins/topology/package.json
Auto-merging plugins/tekton/package.json
CONFLICT (content): Merge conflict in plugins/tekton/package.json
Auto-merging plugins/shared-react/package.json
CONFLICT (content): Merge conflict in plugins/shared-react/package.json
Auto-merging plugins/ocm-backend/package.json
CONFLICT (content): Merge conflict in plugins/ocm-backend/package.json
Auto-merging plugins/kubernetes-actions/package.json
CONFLICT (content): Merge conflict in plugins/kubernetes-actions/package.json
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config advice.mergeConflict false"
Patch failed at 0001 fix(deps): update kubernetes-client dependancy

In response to this:

/cherry-pick release-1.3

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.