@red-hat-developer-hub/plugin-cost-management-common 2.1.0 → 2.2.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +69 -0
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,74 @@
|
|
|
1
1
|
# @red-hat-developer-hub/plugin-cost-management-common
|
|
2
2
|
|
|
3
|
+
## 2.2.1
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- 558b7c3: fix: patch transitive dependency CVEs via yarn resolutions
|
|
8
|
+
|
|
9
|
+
Pins vulnerable transitive dependencies to patched versions to address open Dependabot alerts:
|
|
10
|
+
|
|
11
|
+
- 815580b: fix: additional CVE patches and dependency updates for 2.2.1
|
|
12
|
+
|
|
13
|
+
Covers the following changes merged after the initial CVE patch (558b7c3):
|
|
14
|
+
|
|
15
|
+
- chore(deps): update rhdh cost management dependencies (patch) (#3000) — bumps
|
|
16
|
+
`@aws-sdk/core/fast-xml-parser` to 4.5.6, `request/form-data` to 2.5.5,
|
|
17
|
+
`request/tough-cookie` to 4.1.4, `typeorm` to 0.3.29, and `file-type` to 21.3.4
|
|
18
|
+
via yarn resolutions
|
|
19
|
+
|
|
20
|
+
- fix: resolve lodash CVEs via workspace resolution (#3135) — pins lodash to 4.18.1
|
|
21
|
+
to address GHSA-r5fr-rjxr-66jc (Code Injection via _.template, CVSS 8.1) and
|
|
22
|
+
GHSA-f23m-r3pf-42rh (Prototype Pollution via _.unset/\_.omit, CVSS 6.5)
|
|
23
|
+
|
|
24
|
+
- fix: update lodash direct deps to 4.18.1 to close Dependabot alerts (#3142) —
|
|
25
|
+
updates pinned lodash versions in individual plugin package.json files so
|
|
26
|
+
Dependabot can detect the fix for GHSA-r5fr-rjxr-66jc and GHSA-f23m-r3pf-42rh
|
|
27
|
+
|
|
28
|
+
- fix: CVE patches for casbin/minimatch and fast-xml-parser (#3143) — adds
|
|
29
|
+
`casbin/minimatch` resolution to 7.4.8 and bumps `fast-xml-parser` to 5.7.3
|
|
30
|
+
|
|
31
|
+
- fix: upgrade @backstage-community/plugin-rbac-backend to ^7.12.4 (#3161) —
|
|
32
|
+
upgrades rbac-backend and rbac-common to address a Backstage backend CVE
|
|
33
|
+
|
|
34
|
+
- chore(deps): update linkifyjs to v4.3.3 (#3155) — patch version bump
|
|
35
|
+
|
|
36
|
+
## 2.2.0
|
|
37
|
+
|
|
38
|
+
### Minor Changes
|
|
39
|
+
|
|
40
|
+
- ce8cb07: Add authorization, input validation, and confirmation dialog for Apply Recommendation workflow.
|
|
41
|
+
|
|
42
|
+
- New `ros.apply` permission required to execute the Apply Recommendation workflow
|
|
43
|
+
- New backend `POST /apply-recommendation` endpoint validates `resourceType` against server-side allowlist and checks `ros.apply` permission before forwarding to Orchestrator
|
|
44
|
+
- Workflow execution now routes through the cost-management backend instead of directly to the Orchestrator plugin, enabling server-side authorization and audit logging
|
|
45
|
+
- Confirmation dialog added before workflow execution to prevent accidental clicks
|
|
46
|
+
|
|
47
|
+
- 7b7bab9: **BREAKING**: Changed permission name separator from `.` to `/` for cluster-specific and cluster-project-specific permissions.
|
|
48
|
+
|
|
49
|
+
This resolves an ambiguity where dotted cluster names (e.g., `my.cluster`) could not be distinguished from the separator in permission names like `ros.my.cluster.project`.
|
|
50
|
+
|
|
51
|
+
New format:
|
|
52
|
+
|
|
53
|
+
- `ros/{clusterName}` and `ros/{clusterName}/{projectName}` (was `ros.{clusterName}` and `ros.{clusterName}.{projectName}`)
|
|
54
|
+
- `cost/{clusterName}` and `cost/{clusterName}/{projectName}` (was `cost.{clusterName}` and `cost.{clusterName}.{projectName}`)
|
|
55
|
+
|
|
56
|
+
Generic permissions (`ros.plugin`, `ros.apply`, `cost.plugin`) are unchanged.
|
|
57
|
+
|
|
58
|
+
See `docs/rbac.md` for a migration guide.
|
|
59
|
+
|
|
60
|
+
- ab26a80: Move Cost Management data fetching server-side to eliminate token exposure and RBAC bypass
|
|
61
|
+
|
|
62
|
+
- Added secure backend proxy (`/api/cost-management/proxy/*`) that authenticates requests via Backstage httpAuth, checks RBAC permissions, retrieves SSO tokens internally, and injects server-side cluster/project filters before forwarding to the Cost Management API
|
|
63
|
+
- Removed `/token` endpoint that exposed SSO service account credentials to the browser
|
|
64
|
+
- Removed `dangerously-allow-unauthenticated` proxy configuration from `app-config.dynamic.yaml`
|
|
65
|
+
- Updated `OptimizationsClient` and `CostManagementSlimClient` to route through the new secure backend proxy instead of the old Backstage proxy
|
|
66
|
+
- Eliminated client-side RBAC filter injection that could be bypassed by calling the proxy directly
|
|
67
|
+
|
|
68
|
+
### Patch Changes
|
|
69
|
+
|
|
70
|
+
- 5148408: Migrated to Jest 30 as required by @backstage/cli 0.36.0.
|
|
71
|
+
|
|
3
72
|
## 2.0.1
|
|
4
73
|
|
|
5
74
|
### Patch Changes
|
package/package.json
CHANGED