Fixing jsonpath-plus critical security issue.

[kamilmadejek]

Fixes:

• https://github.com/nephio-project/kpt-backstage-plugins/security/dependabot/43

This PR overrides @kubernetes/client-node version to a one that does not depend on a jsonpath-plus package vulnerable to Remote Code Execution.

The library change does not appear to have an effect on application's functionality.

[liamfallon]

/approve

Thanks so much @kamilmadejek for rushing this out

[efiacor]

/approve
/lgtm

[nephio-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: efiacor, kamilmadejek, liamfallon

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [efiacor,liamfallon]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[efiacor]

@kamilmadejek
Look like the vuln is still getting flagged for some reason.
https://github.com/nephio-project/kpt-backstage-plugins/security/dependabot/45

[kamilmadejek]

@efiacor It's quite a coincidence because this is an unrelated new issue concerning an old dependency:

Published to the GitHub Advisory Database yesterday

It's actually so new that the local audit tool (built-in in npm/yarn) still does not report it. Fix for this one shouldn't be complicated, I will publish PR tomorrow first thing in the morning.

[efiacor]

@efiacor It's quite a coincidence because this is an unrelated new issue concerning an old dependency:

Published to the GitHub Advisory Database yesterday

It's actually so new that the local audit tool (built-in in npm/yarn) still does not report it. Fix for this one shouldn't be complicated, I will publish PR tomorrow first thing in the morning.

Perfect. Thank you sir!

[kamilmadejek]

@efiacor New PR: #78