@red-hat-developer-hub/plugin-cost-management 2.1.0 → 2.2.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/CHANGELOG.md +66 -0
  2. package/app-config.dynamic.yaml +2 -2
  3. package/package.json +3 -3
package/CHANGELOG.md CHANGED
@@ -1,5 +1,71 @@
1
1
  # @red-hat-developer-hub/plugin-cost-management
2
2
 
3
+ ## 2.2.1
4
+
5
+ ### Patch Changes
6
+
7
+ - 558b7c3: fix: patch transitive dependency CVEs via yarn resolutions
8
+
9
+ Pins vulnerable transitive dependencies to patched versions to address open Dependabot alerts:
10
+
11
+ - 815580b: fix: additional CVE patches and dependency updates for 2.2.1
12
+
13
+ Covers the following changes merged after the initial CVE patch (558b7c3):
14
+
15
+ - chore(deps): update rhdh cost management dependencies (patch) (#3000) — bumps
16
+ `@aws-sdk/core/fast-xml-parser` to 4.5.6, `request/form-data` to 2.5.5,
17
+ `request/tough-cookie` to 4.1.4, `typeorm` to 0.3.29, and `file-type` to 21.3.4
18
+ via yarn resolutions
19
+
20
+ - fix: resolve lodash CVEs via workspace resolution (#3135) — pins lodash to 4.18.1
21
+ to address GHSA-r5fr-rjxr-66jc (Code Injection via _.template, CVSS 8.1) and
22
+ GHSA-f23m-r3pf-42rh (Prototype Pollution via _.unset/\_.omit, CVSS 6.5)
23
+
24
+ - fix: update lodash direct deps to 4.18.1 to close Dependabot alerts (#3142) —
25
+ updates pinned lodash versions in individual plugin package.json files so
26
+ Dependabot can detect the fix for GHSA-r5fr-rjxr-66jc and GHSA-f23m-r3pf-42rh
27
+
28
+ - fix: CVE patches for casbin/minimatch and fast-xml-parser (#3143) — adds
29
+ `casbin/minimatch` resolution to 7.4.8 and bumps `fast-xml-parser` to 5.7.3
30
+
31
+ - fix: upgrade @backstage-community/plugin-rbac-backend to ^7.12.4 (#3161) —
32
+ upgrades rbac-backend and rbac-common to address a Backstage backend CVE
33
+
34
+ - chore(deps): update linkifyjs to v4.3.3 (#3155) — patch version bump
35
+
36
+ - Updated dependencies [558b7c3]
37
+ - Updated dependencies [815580b]
38
+ - @red-hat-developer-hub/plugin-cost-management-common@2.2.1
39
+
40
+ ## 2.2.0
41
+
42
+ ### Minor Changes
43
+
44
+ - ce8cb07: Add authorization, input validation, and confirmation dialog for Apply Recommendation workflow.
45
+
46
+ - New `ros.apply` permission required to execute the Apply Recommendation workflow
47
+ - New backend `POST /apply-recommendation` endpoint validates `resourceType` against server-side allowlist and checks `ros.apply` permission before forwarding to Orchestrator
48
+ - Workflow execution now routes through the cost-management backend instead of directly to the Orchestrator plugin, enabling server-side authorization and audit logging
49
+ - Confirmation dialog added before workflow execution to prevent accidental clicks
50
+
51
+ - ab26a80: Move Cost Management data fetching server-side to eliminate token exposure and RBAC bypass
52
+
53
+ - Added secure backend proxy (`/api/cost-management/proxy/*`) that authenticates requests via Backstage httpAuth, checks RBAC permissions, retrieves SSO tokens internally, and injects server-side cluster/project filters before forwarding to the Cost Management API
54
+ - Removed `/token` endpoint that exposed SSO service account credentials to the browser
55
+ - Removed `dangerously-allow-unauthenticated` proxy configuration from `app-config.dynamic.yaml`
56
+ - Updated `OptimizationsClient` and `CostManagementSlimClient` to route through the new secure backend proxy instead of the old Backstage proxy
57
+ - Eliminated client-side RBAC filter injection that could be bypassed by calling the proxy directly
58
+
59
+ ### Patch Changes
60
+
61
+ - fdcdf41: Fix `menuItems` keys in `app-config.dynamic.yaml` to use dots instead of slashes as path separators, so that "Optimizations" and "OpenShift" are properly nested under the "Cost management" parent menu in the RHDH sidebar.
62
+ - 5148408: Migrated to Jest 30 as required by @backstage/cli 0.36.0.
63
+ - Updated dependencies [ce8cb07]
64
+ - Updated dependencies [5148408]
65
+ - Updated dependencies [7b7bab9]
66
+ - Updated dependencies [ab26a80]
67
+ - @red-hat-developer-hub/plugin-cost-management-common@2.2.0
68
+
3
69
  ## 2.0.1
4
70
 
5
71
  ### Patch Changes
package/app-config.dynamic.yaml CHANGED
@@ -16,10 +16,10 @@ dynamicPlugins:
16
16
  icon: costManagementIconOutlined
17
17
  text: OpenShift
18
18
  menuItems:
19
- cost-management/optimizations:
19
+ cost-management.optimizations:
20
20
  parent: cost-management
21
21
  priority: 10
22
- cost-management/openshift:
22
+ cost-management.openshift:
23
23
  parent: cost-management
24
24
  priority: 20
25
25
  cost-management:
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@red-hat-developer-hub/plugin-cost-management",
3
- "version": "2.1.0",
3
+ "version": "2.2.1",
4
4
  "backstage": {
5
5
  "pluginId": "cost-management",
6
6
  "pluginPackages": [
@@ -23,9 +23,9 @@
23
23
  "@material-ui/lab": "4.0.0-alpha.61",
24
24
  "@patternfly/react-charts": "^8.3.0",
25
25
  "@patternfly/react-tokens": "^6.1.0",
26
- "@red-hat-developer-hub/plugin-cost-management-common": "^2.1.0",
26
+ "@red-hat-developer-hub/plugin-cost-management-common": "^2.2.1",
27
27
  "date-fns": "^3.6.0",
28
- "lodash": "^4.17.21",
28
+ "lodash": "^4.18.1",
29
29
  "react-intl": "^6.6.8",
30
30
  "react-use": "^17.2.4",
31
31
  "victory-area": "^37.3.4",