From e8a57e747343e29177e6ace73bc36253058d2b0b Mon Sep 17 00:00:00 2001
From: Joseph Campos <joseph.campos@gendigital.com>
Date: Fri, 8 Dec 2023 13:44:05 -0800
Subject: [PATCH 1/3] Fixing Snyk vulnerability SNYK-JS-ZOD-5925617 by
 upgrading zod packages to latest

Signed-off-by: Joseph Campos <joseph.campos@gendigital.com>
---
 packages/backend-tasks/package.json                   | 2 +-
 packages/cli-node/package.json                        | 2 +-
 packages/cli/package.json                             | 2 +-
 packages/core-app-api/package.json                    | 2 +-
 packages/core-components/package.json                 | 2 +-
 packages/frontend-plugin-api/package.json             | 2 +-
 plugins/auth-node/package.json                        | 2 +-
 plugins/catalog-backend/package.json                  | 2 +-
 plugins/home/package.json                             | 2 +-
 plugins/permission-backend/package.json               | 2 +-
 plugins/permission-common/package.json                | 2 +-
 plugins/permission-node/package.json                  | 2 +-
 plugins/playlist-backend/package.json                 | 2 +-
 plugins/scaffolder-backend-module-gitlab/package.json | 2 +-
 plugins/scaffolder-backend/package.json               | 2 +-
 plugins/scaffolder-node/package.json                  | 2 +-
 plugins/scaffolder-react/package.json                 | 2 +-
 plugins/scaffolder/package.json                       | 2 +-
 plugins/search-backend/package.json                   | 2 +-
 19 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/packages/backend-tasks/package.json b/packages/backend-tasks/package.json
index f1ac622864..7c100969f5 100644
--- a/packages/backend-tasks/package.json
+++ b/packages/backend-tasks/package.json
@@ -44,7 +44,7 @@
     "luxon": "^3.0.0",
     "uuid": "^8.0.0",
     "winston": "^3.2.1",
-    "zod": "^3.21.4"
+    "zod": "^3.22.4"
   },
   "devDependencies": {
     "@backstage/backend-test-utils": "workspace:^",
diff --git a/packages/cli-node/package.json b/packages/cli-node/package.json
index 36368fd4a9..34b8d6c97d 100644
--- a/packages/cli-node/package.json
+++ b/packages/cli-node/package.json
@@ -35,7 +35,7 @@
     "@yarnpkg/parsers": "^3.0.0-rc.4",
     "fs-extra": "10.1.0",
     "semver": "^7.5.3",
-    "zod": "^3.21.4"
+    "zod": "^3.22.4"
   },
   "devDependencies": {
     "@backstage/cli": "workspace:^",
diff --git a/packages/cli/package.json b/packages/cli/package.json
index 997ec0d067..8cd6cde861 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -138,7 +138,7 @@
     "yaml": "^2.0.0",
     "yml-loader": "^2.1.0",
     "yn": "^4.0.0",
-    "zod": "^3.21.4"
+    "zod": "^3.22.4"
   },
   "devDependencies": {
     "@backstage/backend-common": "workspace:^",
diff --git a/packages/core-app-api/package.json b/packages/core-app-api/package.json
index b18f31eb4f..691f19f46c 100644
--- a/packages/core-app-api/package.json
+++ b/packages/core-app-api/package.json
@@ -54,7 +54,7 @@
     "prop-types": "^15.7.2",
     "react-use": "^17.2.4",
     "zen-observable": "^0.10.0",
-    "zod": "^3.21.4"
+    "zod": "^3.22.4"
   },
   "peerDependencies": {
     "react": "^16.13.1 || ^17.0.0 || ^18.0.0",
diff --git a/packages/core-components/package.json b/packages/core-components/package.json
index e657e50b9d..8cd69031b1 100644
--- a/packages/core-components/package.json
+++ b/packages/core-components/package.json
@@ -86,7 +86,7 @@
     "react-window": "^1.8.6",
     "remark-gfm": "^3.0.1",
     "zen-observable": "^0.10.0",
-    "zod": "^3.21.4"
+    "zod": "^3.22.4"
   },
   "peerDependencies": {
     "react": "^16.13.1 || ^17.0.0 || ^18.0.0",
diff --git a/packages/frontend-plugin-api/package.json b/packages/frontend-plugin-api/package.json
index 813351a6a0..32939c9fe0 100644
--- a/packages/frontend-plugin-api/package.json
+++ b/packages/frontend-plugin-api/package.json
@@ -47,7 +47,7 @@
     "@material-ui/core": "^4.12.4",
     "@types/react": "^16.13.1 || ^17.0.0",
     "lodash": "^4.17.21",
-    "zod": "^3.21.4",
+    "zod": "^3.22.4",
     "zod-to-json-schema": "^3.21.4"
   }
 }
diff --git a/plugins/auth-node/package.json b/plugins/auth-node/package.json
index ebdbe6d368..6833dd7391 100644
--- a/plugins/auth-node/package.json
+++ b/plugins/auth-node/package.json
@@ -43,7 +43,7 @@
     "node-fetch": "^2.6.7",
     "passport": "^0.7.0",
     "winston": "^3.2.1",
-    "zod": "^3.21.4",
+    "zod": "^3.22.4",
     "zod-to-json-schema": "^3.21.4"
   },
   "devDependencies": {
diff --git a/plugins/catalog-backend/package.json b/plugins/catalog-backend/package.json
index 8525cc4834..72305d3525 100644
--- a/plugins/catalog-backend/package.json
+++ b/plugins/catalog-backend/package.json
@@ -82,7 +82,7 @@
     "winston": "^3.2.1",
     "yaml": "^2.0.0",
     "yn": "^4.0.0",
-    "zod": "^3.21.4"
+    "zod": "^3.22.4"
   },
   "devDependencies": {
     "@backstage/backend-test-utils": "workspace:^",
diff --git a/plugins/home/package.json b/plugins/home/package.json
index 2bcc271e5f..c2851badc6 100644
--- a/plugins/home/package.json
+++ b/plugins/home/package.json
@@ -72,7 +72,7 @@
     "react-grid-layout": "1.3.4",
     "react-resizable": "^3.0.4",
     "react-use": "^17.2.4",
-    "zod": "^3.21.4"
+    "zod": "^3.22.4"
   },
   "peerDependencies": {
     "react": "^16.13.1 || ^17.0.0 || ^18.0.0",
diff --git a/plugins/permission-backend/package.json b/plugins/permission-backend/package.json
index 2b95f48511..6794f510a6 100644
--- a/plugins/permission-backend/package.json
+++ b/plugins/permission-backend/package.json
@@ -56,7 +56,7 @@
     "node-fetch": "^2.6.7",
     "winston": "^3.2.1",
     "yn": "^4.0.0",
-    "zod": "^3.21.4"
+    "zod": "^3.22.4"
   },
   "devDependencies": {
     "@backstage/cli": "workspace:^",
diff --git a/plugins/permission-common/package.json b/plugins/permission-common/package.json
index 0cc2d043df..b28fc01d22 100644
--- a/plugins/permission-common/package.json
+++ b/plugins/permission-common/package.json
@@ -47,7 +47,7 @@
     "@backstage/types": "workspace:^",
     "cross-fetch": "^4.0.0",
     "uuid": "^8.0.0",
-    "zod": "^3.21.4"
+    "zod": "^3.22.4"
   },
   "devDependencies": {
     "@backstage/cli": "workspace:^",
diff --git a/plugins/permission-node/package.json b/plugins/permission-node/package.json
index 5cd6616e18..b80bcfe68a 100644
--- a/plugins/permission-node/package.json
+++ b/plugins/permission-node/package.json
@@ -55,7 +55,7 @@
     "@types/express": "^4.17.6",
     "express": "^4.17.1",
     "express-promise-router": "^4.1.0",
-    "zod": "^3.21.4",
+    "zod": "^3.22.4",
     "zod-to-json-schema": "^3.20.4"
   },
   "devDependencies": {
diff --git a/plugins/playlist-backend/package.json b/plugins/playlist-backend/package.json
index 15943da053..7bfece7c20 100644
--- a/plugins/playlist-backend/package.json
+++ b/plugins/playlist-backend/package.json
@@ -46,7 +46,7 @@
     "uuid": "^8.2.0",
     "winston": "^3.2.1",
     "yn": "^4.0.0",
-    "zod": "^3.21.4"
+    "zod": "^3.22.4"
   },
   "devDependencies": {
     "@backstage/backend-test-utils": "workspace:^",
diff --git a/plugins/scaffolder-backend-module-gitlab/package.json b/plugins/scaffolder-backend-module-gitlab/package.json
index bdb55606f1..ad745251d8 100644
--- a/plugins/scaffolder-backend-module-gitlab/package.json
+++ b/plugins/scaffolder-backend-module-gitlab/package.json
@@ -37,7 +37,7 @@
     "@backstage/plugin-scaffolder-node": "workspace:^",
     "@gitbeaker/node": "^35.8.0",
     "yaml": "^2.0.0",
-    "zod": "^3.21.4"
+    "zod": "^3.22.4"
   },
   "devDependencies": {
     "@backstage/backend-common": "workspace:^",
diff --git a/plugins/scaffolder-backend/package.json b/plugins/scaffolder-backend/package.json
index b8ee699287..7d2daf7b38 100644
--- a/plugins/scaffolder-backend/package.json
+++ b/plugins/scaffolder-backend/package.json
@@ -98,7 +98,7 @@
     "winston": "^3.2.1",
     "yaml": "^2.0.0",
     "zen-observable": "^0.10.0",
-    "zod": "^3.21.4"
+    "zod": "^3.22.4"
   },
   "devDependencies": {
     "@backstage/backend-test-utils": "workspace:^",
diff --git a/plugins/scaffolder-node/package.json b/plugins/scaffolder-node/package.json
index 5e939c2ec1..af2d422184 100644
--- a/plugins/scaffolder-node/package.json
+++ b/plugins/scaffolder-node/package.json
@@ -52,7 +52,7 @@
     "fs-extra": "10.1.0",
     "jsonschema": "^1.2.6",
     "winston": "^3.2.1",
-    "zod": "^3.21.4",
+    "zod": "^3.22.4",
     "zod-to-json-schema": "^3.20.4"
   },
   "devDependencies": {
diff --git a/plugins/scaffolder-react/package.json b/plugins/scaffolder-react/package.json
index 86a6560317..5dadd3c5d5 100644
--- a/plugins/scaffolder-react/package.json
+++ b/plugins/scaffolder-react/package.json
@@ -77,7 +77,7 @@
     "react-use": "^17.2.4",
     "use-immer": "^0.9.0",
     "zen-observable": "^0.10.0",
-    "zod": "^3.21.4",
+    "zod": "^3.22.4",
     "zod-to-json-schema": "^3.20.4"
   },
   "peerDependencies": {
diff --git a/plugins/scaffolder/package.json b/plugins/scaffolder/package.json
index 4fbe55b326..98fbd543fa 100644
--- a/plugins/scaffolder/package.json
+++ b/plugins/scaffolder/package.json
@@ -88,7 +88,7 @@
     "react-use": "^17.2.4",
     "yaml": "^2.0.0",
     "zen-observable": "^0.10.0",
-    "zod": "^3.21.4",
+    "zod": "^3.22.4",
     "zod-to-json-schema": "^3.20.4"
   },
   "peerDependencies": {
diff --git a/plugins/search-backend/package.json b/plugins/search-backend/package.json
index 8220718ac0..5be5d3d994 100644
--- a/plugins/search-backend/package.json
+++ b/plugins/search-backend/package.json
@@ -61,7 +61,7 @@
     "qs": "^6.10.1",
     "winston": "^3.2.1",
     "yn": "^4.0.0",
-    "zod": "^3.21.4"
+    "zod": "^3.22.4"
   },
   "devDependencies": {
     "@backstage/backend-test-utils": "workspace:^",

From 0cbb03bead7cce6a3f9d227bdb5a67955aeadfbc Mon Sep 17 00:00:00 2001
From: Joseph Campos <joseph.campos@gendigital.com>
Date: Fri, 8 Dec 2023 15:44:20 -0800
Subject: [PATCH 2/3] Fixing Snyk vulnerability SNYK-JS-ZOD-5925617 by
 upgrading zod packages to latest

Signed-off-by: Joseph Campos <joseph.campos@gendigital.com>
---
 .changeset/tough-dancers-suffer.md | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)
 create mode 100644 .changeset/tough-dancers-suffer.md

diff --git a/.changeset/tough-dancers-suffer.md b/.changeset/tough-dancers-suffer.md
new file mode 100644
index 0000000000..fd439668db
--- /dev/null
+++ b/.changeset/tough-dancers-suffer.md
@@ -0,0 +1,23 @@
+---
+'@backstage/plugin-scaffolder-backend-module-gitlab': patch
+'@backstage/frontend-plugin-api': patch
+'@backstage/plugin-permission-backend': patch
+'@backstage/plugin-scaffolder-backend': patch
+'@backstage/plugin-permission-common': patch
+'@backstage/core-components': patch
+'@backstage/plugin-playlist-backend': patch
+'@backstage/plugin-scaffolder-react': patch
+'@backstage/plugin-catalog-backend': patch
+'@backstage/plugin-permission-node': patch
+'@backstage/plugin-scaffolder-node': patch
+'@backstage/backend-tasks': patch
+'@backstage/plugin-search-backend': patch
+'@backstage/core-app-api': patch
+'@backstage/plugin-scaffolder': patch
+'@backstage/cli-node': patch
+'@backstage/plugin-auth-node': patch
+'@backstage/cli': patch
+'@backstage/plugin-home': patch
+---
+
+Fixing regular expression ReDoS with zod packages. Upgrading to latest. ref: https://security.snyk.io/vuln/SNYK-JS-ZOD-5925617

From b9846ff5043bb6275d64df9dcf6774f6e4b803f8 Mon Sep 17 00:00:00 2001
From: Joseph Campos <joseph.campos@gendigital.com>
Date: Mon, 11 Dec 2023 09:17:37 -0800
Subject: [PATCH 3/3] Tests seemed fine, updating yarn.lock now

Signed-off-by: Joseph Campos <joseph.campos@gendigital.com>
---
 yarn.lock | 40 ++++++++++++++++++++--------------------
 1 file changed, 20 insertions(+), 20 deletions(-)

diff --git a/yarn.lock b/yarn.lock
index fd0650d51c..73990b339f 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -3457,7 +3457,7 @@ __metadata:
     uuid: ^8.0.0
     wait-for-expect: ^3.0.2
     winston: ^3.2.1
-    zod: ^3.21.4
+    zod: ^3.22.4
   languageName: unknown
   linkType: soft
 
@@ -3551,7 +3551,7 @@ __metadata:
     fs-extra: 10.1.0
     mock-fs: ^5.2.0
     semver: ^7.5.3
-    zod: ^3.21.4
+    zod: ^3.22.4
   languageName: unknown
   linkType: soft
 
@@ -3697,7 +3697,7 @@ __metadata:
     yaml: ^2.0.0
     yml-loader: ^2.1.0
     yn: ^4.0.0
-    zod: ^3.21.4
+    zod: ^3.22.4
   peerDependencies:
     "@vitejs/plugin-react": ^4.0.4
     vite: ^4.4.9
@@ -3805,7 +3805,7 @@ __metadata:
     react-router-stable: "npm:react-router@^6.3.0"
     react-use: ^17.2.4
     zen-observable: ^0.10.0
-    zod: ^3.21.4
+    zod: ^3.22.4
   peerDependencies:
     react: ^16.13.1 || ^17.0.0 || ^18.0.0
     react-dom: ^16.13.1 || ^17.0.0 || ^18.0.0
@@ -4004,7 +4004,7 @@ __metadata:
     react-window: ^1.8.6
     remark-gfm: ^3.0.1
     zen-observable: ^0.10.0
-    zod: ^3.21.4
+    zod: ^3.22.4
   peerDependencies:
     react: ^16.13.1 || ^17.0.0 || ^18.0.0
     react-dom: ^16.13.1 || ^17.0.0 || ^18.0.0
@@ -4214,7 +4214,7 @@ __metadata:
     "@types/react": ^16.13.1 || ^17.0.0
     history: ^5.3.0
     lodash: ^4.17.21
-    zod: ^3.21.4
+    zod: ^3.22.4
     zod-to-json-schema: ^3.21.4
   peerDependencies:
     react: ^16.13.1 || ^17.0.0 || ^18.0.0
@@ -5040,7 +5040,7 @@ __metadata:
     supertest: ^6.1.3
     uuid: ^8.0.0
     winston: ^3.2.1
-    zod: ^3.21.4
+    zod: ^3.22.4
     zod-to-json-schema: ^3.21.4
   languageName: unknown
   linkType: soft
@@ -5808,7 +5808,7 @@ __metadata:
     winston: ^3.2.1
     yaml: ^2.0.0
     yn: ^4.0.0
-    zod: ^3.21.4
+    zod: ^3.22.4
   languageName: unknown
   linkType: soft
 
@@ -7379,7 +7379,7 @@ __metadata:
     react-grid-layout: 1.3.4
     react-resizable: ^3.0.4
     react-use: ^17.2.4
-    zod: ^3.21.4
+    zod: ^3.22.4
   peerDependencies:
     react: ^16.13.1 || ^17.0.0 || ^18.0.0
     react-dom: ^16.13.1 || ^17.0.0 || ^18.0.0
@@ -8300,7 +8300,7 @@ __metadata:
     supertest: ^6.1.6
     winston: ^3.2.1
     yn: ^4.0.0
-    zod: ^3.21.4
+    zod: ^3.22.4
   languageName: unknown
   linkType: soft
 
@@ -8315,7 +8315,7 @@ __metadata:
     cross-fetch: ^4.0.0
     msw: ^1.0.0
     uuid: ^8.0.0
-    zod: ^3.21.4
+    zod: ^3.22.4
   languageName: unknown
   linkType: soft
 
@@ -8337,7 +8337,7 @@ __metadata:
     express-promise-router: ^4.1.0
     msw: ^1.0.0
     supertest: ^6.1.3
-    zod: ^3.21.4
+    zod: ^3.22.4
     zod-to-json-schema: ^3.20.4
   languageName: unknown
   linkType: soft
@@ -8410,7 +8410,7 @@ __metadata:
     uuid: ^8.2.0
     winston: ^3.2.1
     yn: ^4.0.0
-    zod: ^3.21.4
+    zod: ^3.22.4
   languageName: unknown
   linkType: soft
 
@@ -8639,7 +8639,7 @@ __metadata:
     "@backstage/plugin-scaffolder-node": "workspace:^"
     "@gitbeaker/node": ^35.8.0
     yaml: ^2.0.0
-    zod: ^3.21.4
+    zod: ^3.22.4
   languageName: unknown
   linkType: soft
 
@@ -8764,7 +8764,7 @@ __metadata:
     winston: ^3.2.1
     yaml: ^2.0.0
     zen-observable: ^0.10.0
-    zod: ^3.21.4
+    zod: ^3.22.4
   languageName: unknown
   linkType: soft
 
@@ -8795,7 +8795,7 @@ __metadata:
     fs-extra: 10.1.0
     jsonschema: ^1.2.6
     winston: ^3.2.1
-    zod: ^3.21.4
+    zod: ^3.22.4
     zod-to-json-schema: ^3.20.4
   languageName: unknown
   linkType: soft
@@ -8846,7 +8846,7 @@ __metadata:
     react-use: ^17.2.4
     use-immer: ^0.9.0
     zen-observable: ^0.10.0
-    zod: ^3.21.4
+    zod: ^3.22.4
     zod-to-json-schema: ^3.20.4
   peerDependencies:
     react: ^16.13.1 || ^17.0.0 || ^18.0.0
@@ -8913,7 +8913,7 @@ __metadata:
     react-use: ^17.2.4
     yaml: ^2.0.0
     zen-observable: ^0.10.0
-    zod: ^3.21.4
+    zod: ^3.22.4
     zod-to-json-schema: ^3.20.4
   peerDependencies:
     react: ^16.13.1 || ^17.0.0 || ^18.0.0
@@ -9098,7 +9098,7 @@ __metadata:
     supertest: ^6.1.3
     winston: ^3.2.1
     yn: ^4.0.0
-    zod: ^3.21.4
+    zod: ^3.22.4
   languageName: unknown
   linkType: soft
 
@@ -45347,7 +45347,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"zod@npm:^3.21.4":
+"zod@npm:^3.21.4, zod@npm:^3.22.4":
   version: 3.22.4
   resolution: "zod@npm:3.22.4"
   checksum: 80bfd7f8039b24fddeb0718a2ec7c02aa9856e4838d6aa4864335a047b6b37a3273b191ef335bf0b2002e5c514ef261ffcda5a589fb084a48c336ffc4cdbab7f