Bump @kubernetes/client-node to ^1.0.0-rc7

Signed-off-by: Corey Daley <cdaley@redhat.com>
2024-10-14 13:59:24 -04:00
parent 112fd691e4
commit 71b87043ef
15 changed files with 206 additions and 47 deletions
@@ -0,0 +1,9 @@
+---
+'@backstage/plugin-kubernetes-backend': minor
+'@backstage/plugin-kubernetes-common': minor
+'@backstage/plugin-kubernetes-react': minor
+'@backstage/plugin-kubernetes-node': minor
+'@backstage/plugin-kubernetes': minor
+---
+
+Bumping @kubernetes/client-node to 1.0.0-rc7 to mitigate CVEs related to the request and tough-cookie packages
@@ -78,7 +78,7 @@
    "@backstage/types": "workspace:^",
    "@google-cloud/container": "^5.0.0",
    "@jest-mock/express": "^2.0.1",
-    "@kubernetes/client-node": "0.20.0",
+    "@kubernetes/client-node": "1.0.0-rc7",
    "@types/express": "^4.17.6",
    "@types/http-proxy-middleware": "^1.0.0",
    "@types/luxon": "^3.0.0",
@@ -30,7 +30,6 @@ import {
  mockServices,
  registerMswTestHooks,
 } from '@backstage/backend-test-utils';
-import { Config } from '@kubernetes/client-node';

 const mockCertDir = createMockDirectory({
  content: {
@@ -651,6 +650,7 @@ describe('KubernetesFetcher', () => {
    });
    describe('when server uses TLS', () => {
      let httpsRequest: jest.SpyInstance;
+      const initialCAPath = process.env.KUBERNETES_CA_FILE_PATH;
      beforeAll(() => {
        httpsRequest = jest.spyOn(
          // this is pretty egregious reverse engineering of msw.
@@ -662,7 +662,13 @@ describe('KubernetesFetcher', () => {
      });
      beforeEach(() => {
        httpsRequest.mockClear();
+        process.env.KUBERNETES_CA_FILE_PATH = mockCertDir.resolve('ca.crt');
      });
+
+      afterEach(() => {
+        process.env.KUBERNETES_CA_FILE_PATH = initialCAPath;
+      });
+
      it('should trust specified caData', async () => {
        worker.use(
          rest.get('https://localhost:9999/api/v1/pods', (req, res, ctx) =>
@@ -755,7 +761,7 @@ describe('KubernetesFetcher', () => {
              name: 'cluster1',
              url: 'https://localhost:9999',
              authMetadata: {},
-              caFile: mockCertDir.resolve('ca.crt'),
+              caFile: process.env.KUBERNETES_CA_FILE_PATH,
            },
            credential: { type: 'bearer token', token: 'token' },
            objectTypesToFetch: new Set<ObjectToFetch>([
@@ -1009,7 +1015,7 @@ describe('KubernetesFetcher', () => {
          serviceId: 'some-service',
          clusterDetails: {
            name: 'unauthenticated-cluster',
-            url: 'http://ignored',
+            url: 'https://10.10.10.10',
            authMetadata: {},
          },
          credential: { type: 'anonymous' },
@@ -1025,18 +1031,21 @@ describe('KubernetesFetcher', () => {
    describe('Backstage running on k8s', () => {
      const initialHost = process.env.KUBERNETES_SERVICE_HOST;
      const initialPort = process.env.KUBERNETES_SERVICE_PORT;
-      const initialCaPath = Config.SERVICEACCOUNT_CA_PATH;
+      const initialCAPath = process.env.KUBERNETES_CA_FILE_PATH;
+
+      beforeEach(() => {
+        process.env.KUBERNETES_CA_FILE_PATH = mockCertDir.resolve('ca.crt');
+      });

      afterEach(() => {
        process.env.KUBERNETES_SERVICE_HOST = initialHost;
        process.env.KUBERNETES_SERVICE_PORT = initialPort;
-        Config.SERVICEACCOUNT_CA_PATH = initialCaPath;
+        process.env.KUBERNETES_CA_FILE_PATH = initialCAPath;
      });

      it('makes in-cluster requests when cluster details has no token', async () => {
        process.env.KUBERNETES_SERVICE_HOST = '10.10.10.10';
        process.env.KUBERNETES_SERVICE_PORT = '443';
-        Config.SERVICEACCOUNT_CA_PATH = mockCertDir.resolve('ca.crt');
        worker.use(
          rest.get('https://10.10.10.10/api/v1/pods', (req, res, ctx) =>
            res(
@@ -1052,7 +1061,7 @@ describe('KubernetesFetcher', () => {
          serviceId: 'some-service',
          clusterDetails: {
            name: 'overridden-to-in-cluster',
-            url: 'http://ignored',
+            url: 'https://10.10.10.10',
            authMetadata: {
              [ANNOTATION_KUBERNETES_AUTH_PROVIDER]: 'serviceAccount',
            },
@@ -17,7 +17,6 @@
 import {
  bufferFromFileOrString,
  Cluster,
-  Config,
  CoreV1Api,
  KubeConfig,
  Metrics,
@@ -31,6 +30,7 @@ import {
 } from '../types/types';
 import {
  ANNOTATION_KUBERNETES_AUTH_PROVIDER,
+  SERVICEACCOUNT_CA_PATH,
  FetchResponse,
  KubernetesErrorTypes,
  KubernetesFetchError,
@@ -156,8 +156,7 @@ export class KubernetesClientBasedFetcher implements KubernetesFetcher {
      if (podMetrics.ok && podList.ok) {
        return topPods(
          {
-            listPodForAllNamespaces: () =>
-              podList.json().then(b => ({ body: b })),
+            listPodForAllNamespaces: () => podList.json(),
          } as unknown as CoreV1Api,
          {
            getPodMetrics: () => podMetrics.json(),
@@ -249,7 +248,7 @@ export class KubernetesClientBasedFetcher implements KubernetesFetcher {
    return (
      authProvider === 'serviceAccount' &&
      !clusterDetails.authMetadata.serviceAccountToken &&
-      fs.pathExistsSync(Config.SERVICEACCOUNT_CA_PATH)
+      fs.pathExistsSync(SERVICEACCOUNT_CA_PATH)
    );
  }

@@ -39,7 +39,6 @@ import { rest } from 'msw';
 import { setupServer } from 'msw/node';
 import request from 'supertest';
 import { AddressInfo, WebSocket, WebSocketServer } from 'ws';
-import { Config } from '@kubernetes/client-node';

 import { LocalKubectlProxyClusterLocator } from '../cluster-locator/LocalKubectlProxyLocator';
 import {
@@ -1014,23 +1013,26 @@ describe('KubernetesProxy', () => {
  describe('Backstage running on k8s', () => {
    const initialHost = process.env.KUBERNETES_SERVICE_HOST;
    const initialPort = process.env.KUBERNETES_SERVICE_PORT;
-    const initialCaPath = Config.SERVICEACCOUNT_CA_PATH;
+    const initialCAPath = process.env.KUBERNETES_CA_FILE_PATH;
+
+    beforeEach(() => {
+      process.env.KUBERNETES_CA_FILE_PATH = mockCertDir.resolve('ca.crt');
+    });

    afterEach(() => {
      process.env.KUBERNETES_SERVICE_HOST = initialHost;
      process.env.KUBERNETES_SERVICE_PORT = initialPort;
-      Config.SERVICEACCOUNT_CA_PATH = initialCaPath;
+      process.env.KUBERNETES_CA_FILE_PATH = initialCAPath;
    });

    it('makes in-cluster requests when cluster details has no token', async () => {
      process.env.KUBERNETES_SERVICE_HOST = '10.10.10.10';
      process.env.KUBERNETES_SERVICE_PORT = '443';
-      Config.SERVICEACCOUNT_CA_PATH = mockCertDir.resolve('ca.crt');

      clusterSupplier.getClusters.mockResolvedValue([
        {
          name: 'cluster1',
-          url: 'http://ignored',
+          url: 'https://10.10.10.10',
          authMetadata: {
            [ANNOTATION_KUBERNETES_AUTH_PROVIDER]: 'serviceAccount',
          },
@@ -22,6 +22,7 @@ import {
 } from '@backstage/errors';
 import {
  ANNOTATION_KUBERNETES_AUTH_PROVIDER,
+  SERVICEACCOUNT_CA_PATH,
  kubernetesProxyPermission,
  KubernetesRequestAuth,
 } from '@backstage/plugin-kubernetes-common';
@@ -29,7 +30,6 @@ import { AuthorizeResult } from '@backstage/plugin-permission-common';
 import {
  bufferFromFileOrString,
  Cluster,
-  Config,
  KubeConfig,
 } from '@kubernetes/client-node';
 import { createProxyMiddleware, RequestHandler } from 'http-proxy-middleware';
@@ -263,7 +263,7 @@ export class KubernetesProxy {

    if (
      authProvider === 'serviceAccount' &&
-      fs.pathExistsSync(Config.SERVICEACCOUNT_CA_PATH) &&
+      fs.pathExistsSync(SERVICEACCOUNT_CA_PATH) &&
      !cluster.authMetadata.serviceAccountToken
    ) {
      const kc = new KubeConfig();
@@ -55,7 +55,7 @@
    "@backstage/catalog-model": "workspace:^",
    "@backstage/plugin-permission-common": "workspace:^",
    "@backstage/types": "workspace:^",
-    "@kubernetes/client-node": "0.20.0",
+    "@kubernetes/client-node": "1.0.0-rc7",
    "kubernetes-models": "^4.3.1",
    "lodash": "^4.17.21",
    "luxon": "^3.0.0"
@@ -0,0 +1,23 @@
+/*
+ * Copyright 2024 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * A constant that specifies the location of the certificate for the service account.
+ *
+ * @internal
+ */
+export const SERVICEACCOUNT_CA_PATH =
+  '/var/run/secrets/kubernetes.io/serviceaccount/ca.crt';
@@ -22,6 +22,7 @@

 export * from './types';
 export * from './catalog-entity-constants';
+export * from './certificate-authority-constants';
 export {
  kubernetesProxyPermission,
  kubernetesPermissions,
@@ -42,7 +42,7 @@
    "@backstage/catalog-model": "workspace:^",
    "@backstage/plugin-kubernetes-common": "workspace:^",
    "@backstage/types": "workspace:^",
-    "@kubernetes/client-node": "^0.20.0",
+    "@kubernetes/client-node": "1.0.0-rc7",
    "node-fetch": "^2.7.0",
    "winston": "^3.2.1"
  },
@@ -49,7 +49,7 @@
    "@backstage/types": "workspace:^",
    "@kubernetes-models/apimachinery": "^2.0.0",
    "@kubernetes-models/base": "^5.0.0",
-    "@kubernetes/client-node": "^0.20.0",
+    "@kubernetes/client-node": "1.0.0-rc7",
    "@material-ui/core": "^4.9.13",
    "@material-ui/icons": "^4.11.3",
    "@material-ui/lab": "^4.0.0-alpha.61",
@@ -20,14 +20,15 @@ import { JobsAccordions } from './JobsAccordions';
 import * as oneCronJobsFixture from '../../__fixtures__/1-cronjobs.json';
 import { renderInTestApp } from '@backstage/test-utils';
 import { kubernetesProviders } from '../../hooks/test-utils';
-import { V1Job, ObjectSerializer } from '@kubernetes/client-node';
+import { V1Job } from '@kubernetes/client-node';
+import { ObjectSerializer } from '@kubernetes/client-node/dist/gen/models/ObjectSerializer';

 describe('JobsAccordions', () => {
  it('should render 2 jobs', async () => {
    const wrapper = kubernetesProviders(oneCronJobsFixture, new Set<string>());

    const jobs: V1Job[] = oneCronJobsFixture.jobs.map(
-      job => ObjectSerializer.deserialize(job, 'V1Job') as V1Job,
+      job => ObjectSerializer.deserialize(job, 'V1Job', '') as V1Job,
    );

    await renderInTestApp(wrapper(<JobsAccordions jobs={jobs} />));
@@ -14,8 +14,8 @@
 * limitations under the License.
 */

-import { V1ObjectMeta } from '@kubernetes/client-node/dist/gen/model/v1ObjectMeta';
 import {
+  V1ObjectMeta,
  V2HorizontalPodAutoscaler,
  V1Pod,
  V1ReplicaSet,
@@ -68,7 +68,7 @@
    "@backstage/plugin-kubernetes-react": "workspace:^",
    "@kubernetes-models/apimachinery": "^2.0.0",
    "@kubernetes-models/base": "^5.0.0",
-    "@kubernetes/client-node": "0.20.0",
+    "@kubernetes/client-node": "1.0.0-rc7",
    "@material-ui/core": "^4.12.2",
    "cronstrue": "^2.2.0",
    "js-yaml": "^4.0.0",
@@ -6731,7 +6731,7 @@ __metadata:
    "@backstage/types": "workspace:^"
    "@google-cloud/container": ^5.0.0
    "@jest-mock/express": ^2.0.1
-    "@kubernetes/client-node": 0.20.0
+    "@kubernetes/client-node": 1.0.0-rc7
    "@types/aws4": ^1.5.1
    "@types/express": ^4.17.6
    "@types/http-proxy-middleware": ^1.0.0
@@ -6805,7 +6805,7 @@ __metadata:
    "@backstage/cli": "workspace:^"
    "@backstage/plugin-permission-common": "workspace:^"
    "@backstage/types": "workspace:^"
-    "@kubernetes/client-node": 0.20.0
+    "@kubernetes/client-node": 1.0.0-rc7
    kubernetes-models: ^4.3.1
    lodash: ^4.17.21
    luxon: ^3.0.0
@@ -6826,7 +6826,7 @@ __metadata:
    "@backstage/plugin-kubernetes-backend": "workspace:^"
    "@backstage/plugin-kubernetes-common": "workspace:^"
    "@backstage/types": "workspace:^"
-    "@kubernetes/client-node": ^0.20.0
+    "@kubernetes/client-node": 1.0.0-rc7
    msw: ^1.3.1
    node-fetch: ^2.7.0
    supertest: ^7.0.0
@@ -6849,7 +6849,7 @@ __metadata:
    "@backstage/types": "workspace:^"
    "@kubernetes-models/apimachinery": ^2.0.0
    "@kubernetes-models/base": ^5.0.0
-    "@kubernetes/client-node": ^0.20.0
+    "@kubernetes/client-node": 1.0.0-rc7
    "@material-ui/core": ^4.9.13
    "@material-ui/icons": ^4.11.3
    "@material-ui/lab": ^4.0.0-alpha.61
@@ -6898,7 +6898,7 @@ __metadata:
    "@backstage/test-utils": "workspace:^"
    "@kubernetes-models/apimachinery": ^2.0.0
    "@kubernetes-models/base": ^5.0.0
-    "@kubernetes/client-node": 0.20.0
+    "@kubernetes/client-node": 1.0.0-rc7
    "@material-ui/core": ^4.12.2
    "@testing-library/dom": ^10.0.0
    "@testing-library/jest-dom": ^6.0.0
@@ -10634,6 +10634,15 @@ __metadata:
  languageName: node
  linkType: hard

+"@isaacs/fs-minipass@npm:^4.0.0":
+  version: 4.0.1
+  resolution: "@isaacs/fs-minipass@npm:4.0.1"
+  dependencies:
+    minipass: ^7.0.4
+  checksum: 5d36d289960e886484362d9eb6a51d1ea28baed5f5d0140bbe62b99bac52eaf06cc01c2bc0d3575977962f84f6b2c4387b043ee632216643d4787b0999465bf2
+  languageName: node
+  linkType: hard
+
 "@isaacs/string-locale-compare@npm:^1.1.0":
  version: 1.1.0
  resolution: "@isaacs/string-locale-compare@npm:1.1.0"
@@ -10984,7 +10993,16 @@ __metadata:
  languageName: node
  linkType: hard

-"@jsep-plugin/regex@npm:^1.0.1":
+"@jsep-plugin/assignment@npm:^1.2.1":
+  version: 1.2.1
+  resolution: "@jsep-plugin/assignment@npm:1.2.1"
+  peerDependencies:
+    jsep: ^0.4.0||^1.0.0
+  checksum: d56fd7423c59dd269c50b0a9c22ec05f099a789ec8e8980f2307782f496ab3f0740151f1bdc7a1f3a8ee9085cdeb6f5b4def0d6b312e6b93ab160e6489b400f2
+  languageName: node
+  linkType: hard
+
+"@jsep-plugin/regex@npm:^1.0.1, @jsep-plugin/regex@npm:^1.0.3":
  version: 1.0.3
  resolution: "@jsep-plugin/regex@npm:1.0.3"
  peerDependencies:
@@ -11068,7 +11086,7 @@ __metadata:
  languageName: node
  linkType: hard

-"@kubernetes/client-node@npm:0.20.0, @kubernetes/client-node@npm:^0.20.0":
+"@kubernetes/client-node@npm:0.20.0":
  version: 0.20.0
  resolution: "@kubernetes/client-node@npm:0.20.0"
  dependencies:
@@ -11094,6 +11112,33 @@ __metadata:
  languageName: node
  linkType: hard

+"@kubernetes/client-node@npm:1.0.0-rc7":
+  version: 1.0.0-rc7
+  resolution: "@kubernetes/client-node@npm:1.0.0-rc7"
+  dependencies:
+    "@types/js-yaml": ^4.0.1
+    "@types/node": ^22.0.0
+    "@types/node-fetch": ^2.6.9
+    "@types/stream-buffers": ^3.0.3
+    "@types/tar": ^6.1.1
+    "@types/ws": ^8.5.4
+    form-data: ^4.0.0
+    isomorphic-ws: ^5.0.0
+    js-yaml: ^4.1.0
+    jsonpath-plus: ^10.0.0
+    node-fetch: ^2.6.9
+    openid-client: ^5.6.5
+    rfc4648: ^1.3.0
+    stream-buffers: ^3.0.2
+    tar: ^7.0.0
+    tmp-promise: ^3.0.2
+    tslib: ^2.5.0
+    url-parse: ^1.4.3
+    ws: ^8.18.0
+  checksum: 82dca69f28e24c635badf866c1f548078d9ce2db5d4911c1831d257b9db3748fe306e35bdb3c04b54d9d6e5565625c0f3a43fc4bd75945b83475654b74ce5c31
+  languageName: node
+  linkType: hard
+
 "@leichtgewicht/ip-codec@npm:^2.0.1":
  version: 2.0.3
  resolution: "@leichtgewicht/ip-codec@npm:2.0.3"
@@ -18543,7 +18588,7 @@ __metadata:
  languageName: node
  linkType: hard

-"@types/node-fetch@npm:^2.5.12, @types/node-fetch@npm:^2.6.4":
+"@types/node-fetch@npm:^2.5.12, @types/node-fetch@npm:^2.6.4, @types/node-fetch@npm:^2.6.9":
  version: 2.6.11
  resolution: "@types/node-fetch@npm:2.6.11"
  dependencies:
@@ -18562,7 +18607,7 @@ __metadata:
  languageName: node
  linkType: hard

-"@types/node@npm:*, @types/node@npm:>=13.7.0":
+"@types/node@npm:*, @types/node@npm:>=13.7.0, @types/node@npm:^22.0.0":
  version: 22.7.7
  resolution: "@types/node@npm:22.7.7"
  dependencies:
@@ -19168,6 +19213,15 @@ __metadata:
  languageName: node
  linkType: hard

+"@types/stream-buffers@npm:^3.0.3":
+  version: 3.0.7
+  resolution: "@types/stream-buffers@npm:3.0.7"
+  dependencies:
+    "@types/node": "*"
+  checksum: b5cf12f69ba866035207e2313bd795166c30ca18329b8c07a96ec5e30d702a0c23b12fa789c7ebc3a08091ea01eca8db84203c93b6823e7477df016a49540f84
+  languageName: node
+  linkType: hard
+
 "@types/styled-jsx@npm:^2.2.8":
  version: 2.2.8
  resolution: "@types/styled-jsx@npm:2.2.8"
@@ -19362,7 +19416,7 @@ __metadata:
  languageName: node
  linkType: hard

-"@types/ws@npm:*, @types/ws@npm:^8.0.0, @types/ws@npm:^8.5.10, @types/ws@npm:^8.5.3":
+"@types/ws@npm:*, @types/ws@npm:^8.0.0, @types/ws@npm:^8.5.10, @types/ws@npm:^8.5.3, @types/ws@npm:^8.5.4":
  version: 8.5.12
  resolution: "@types/ws@npm:8.5.12"
  dependencies:
@@ -23134,6 +23188,13 @@ __metadata:
  languageName: node
  linkType: hard

+"chownr@npm:^3.0.0":
+  version: 3.0.0
+  resolution: "chownr@npm:3.0.0"
+  checksum: fd73a4bab48b79e66903fe1cafbdc208956f41ea4f856df883d0c7277b7ab29fd33ee65f93b2ec9192fc0169238f2f8307b7735d27c155821d886b84aa97aa8d
+  languageName: node
+  linkType: hard
+
 "chrome-trace-event@npm:^1.0.2":
  version: 1.0.2
  resolution: "chrome-trace-event@npm:1.0.2"
@@ -32106,10 +32167,10 @@ __metadata:
  languageName: node
  linkType: hard

-"jsep@npm:^1.1.2, jsep@npm:^1.2.0":
-  version: 1.3.8
-  resolution: "jsep@npm:1.3.8"
-  checksum: d6de7f3bc3aa93e71b6a8fd5436db87efd11d7081230bf072c3359c5f9ff1e36dd01e4e09b09f10cacf35d5dbaf2f32ea5cf98ffe41717ea7bd489d580bbab83
+"jsep@npm:^1.1.2, jsep@npm:^1.2.0, jsep@npm:^1.3.9":
+  version: 1.3.9
+  resolution: "jsep@npm:1.3.9"
+  checksum: d1f3e2cc00209f67a989b73c2a89d2ccbea908d950ec959e2448c6449b134c6367b47eef4e1292767cb490f0b5b72e7309080b93ee4c7398684df2514dbd33a3
  languageName: node
  linkType: hard

@@ -32365,6 +32426,20 @@ __metadata:
  languageName: node
  linkType: hard

+"jsonpath-plus@npm:^10.0.0":
+  version: 10.0.0
+  resolution: "jsonpath-plus@npm:10.0.0"
+  dependencies:
+    "@jsep-plugin/assignment": ^1.2.1
+    "@jsep-plugin/regex": ^1.0.3
+    jsep: ^1.3.9
+  bin:
+    jsonpath: bin/jsonpath-cli.js
+    jsonpath-plus: bin/jsonpath-cli.js
+  checksum: 992a62a0a5d2b96b40389de0608943840db39b466f9d3c1d71b4801e34b8d397c74811213e24e33c833b74aa83d9ce7860c1e7e0bc29980161489ea4a3962ecf
+  languageName: node
+  linkType: hard
+
 "jsonpath-plus@npm:^6.0.1":
  version: 6.0.1
  resolution: "jsonpath-plus@npm:6.0.1"
@@ -34817,7 +34892,7 @@ __metadata:
  languageName: node
  linkType: hard

-"minipass@npm:^5.0.0 || ^6.0.2 || ^7.0.0, minipass@npm:^7.0.2, minipass@npm:^7.0.3, minipass@npm:^7.1.2":
+"minipass@npm:^5.0.0 || ^6.0.2 || ^7.0.0, minipass@npm:^7.0.2, minipass@npm:^7.0.3, minipass@npm:^7.0.4, minipass@npm:^7.1.2":
  version: 7.1.2
  resolution: "minipass@npm:7.1.2"
  checksum: 2bfd325b95c555f2b4d2814d49325691c7bee937d753814861b0b49d5edcda55cbbf22b6b6a60bb91eddac8668771f03c5ff647dcd9d0f798e9548b9cdc46ee3
@@ -34834,6 +34909,16 @@ __metadata:
  languageName: node
  linkType: hard

+"minizlib@npm:^3.0.1":
+  version: 3.0.1
+  resolution: "minizlib@npm:3.0.1"
+  dependencies:
+    minipass: ^7.0.4
+    rimraf: ^5.0.5
+  checksum: da0a53899252380475240c587e52c824f8998d9720982ba5c4693c68e89230718884a209858c156c6e08d51aad35700a3589987e540593c36f6713fe30cd7338
+  languageName: node
+  linkType: hard
+
 "mkdirp-classic@npm:^0.5.2, mkdirp-classic@npm:^0.5.3":
  version: 0.5.3
  resolution: "mkdirp-classic@npm:0.5.3"
@@ -36322,7 +36407,7 @@ __metadata:
  languageName: node
  linkType: hard

-"openid-client@npm:^5.2.1, openid-client@npm:^5.3.0, openid-client@npm:^5.4.3, openid-client@npm:^5.5.0":
+"openid-client@npm:^5.2.1, openid-client@npm:^5.3.0, openid-client@npm:^5.4.3, openid-client@npm:^5.5.0, openid-client@npm:^5.6.5":
  version: 5.7.0
  resolution: "openid-client@npm:5.7.0"
  dependencies:
@@ -42629,6 +42714,20 @@ __metadata:
  languageName: node
  linkType: hard

+"tar@npm:^7.0.0":
+  version: 7.4.3
+  resolution: "tar@npm:7.4.3"
+  dependencies:
+    "@isaacs/fs-minipass": ^4.0.0
+    chownr: ^3.0.0
+    minipass: ^7.1.2
+    minizlib: ^3.0.1
+    mkdirp: ^3.0.1
+    yallist: ^5.0.0
+  checksum: 8485350c0688331c94493031f417df069b778aadb25598abdad51862e007c39d1dd5310702c7be4a6784731a174799d8885d2fde0484269aea205b724d7b2ffa
+  languageName: node
+  linkType: hard
+
 "tarn@npm:^3.0.2":
  version: 3.0.2
  resolution: "tarn@npm:3.0.2"
@@ -42974,6 +43073,15 @@ __metadata:
  languageName: node
  linkType: hard

+"tmp-promise@npm:^3.0.2":
+  version: 3.0.3
+  resolution: "tmp-promise@npm:3.0.3"
+  dependencies:
+    tmp: ^0.2.0
+  checksum: f854f5307dcee6455927ec3da9398f139897faf715c5c6dcee6d9471ae85136983ea06662eba2edf2533bdcb0fca66d16648e79e14381e30c7fb20be9c1aa62c
+  languageName: node
+  linkType: hard
+
 "tmp@npm:^0.0.33":
  version: 0.0.33
  resolution: "tmp@npm:0.0.33"
@@ -42983,7 +43091,7 @@ __metadata:
  languageName: node
  linkType: hard

-"tmp@npm:^0.2.3":
+"tmp@npm:^0.2.0, tmp@npm:^0.2.3":
  version: 0.2.3
  resolution: "tmp@npm:0.2.3"
  checksum: 73b5c96b6e52da7e104d9d44afb5d106bb1e16d9fa7d00dbeb9e6522e61b571fbdb165c756c62164be9a3bbe192b9b268c236d370a2a0955c7689cd2ae377b95
@@ -43789,9 +43897,9 @@ __metadata:
  linkType: hard

 "underscore@npm:^1.12.1":
-  version: 1.13.6
-  resolution: "underscore@npm:1.13.6"
-  checksum: d5cedd14a9d0d91dd38c1ce6169e4455bb931f0aaf354108e47bd46d3f2da7464d49b2171a5cf786d61963204a42d01ea1332a903b7342ad428deaafaf70ec36
+  version: 1.13.7
+  resolution: "underscore@npm:1.13.7"
+  checksum: 174b011af29e4fbe2c70eb2baa8bfab0d0336cf2f5654f364484967bc6264a86224d0134b9176e4235c8cceae00d11839f0fd4824268de04b11c78aca1241684
  languageName: node
  linkType: hard

@@ -44158,7 +44266,7 @@ __metadata:
  languageName: node
  linkType: hard

-"url-parse@npm:^1.5.10, url-parse@npm:^1.5.3":
+"url-parse@npm:^1.4.3, url-parse@npm:^1.5.10, url-parse@npm:^1.5.3":
  version: 1.5.10
  resolution: "url-parse@npm:1.5.10"
  dependencies:
@@ -45491,6 +45599,13 @@ __metadata:
  languageName: node
  linkType: hard

+"yallist@npm:^5.0.0":
+  version: 5.0.0
+  resolution: "yallist@npm:5.0.0"
+  checksum: eba51182400b9f35b017daa7f419f434424410691bbc5de4f4240cc830fdef906b504424992700dc047f16b4d99100a6f8b8b11175c193f38008e9c96322b6a5
+  languageName: node
+  linkType: hard
+
 "yaml-ast-parser@npm:^0.0.43":
  version: 0.0.43
  resolution: "yaml-ast-parser@npm:0.0.43"