Fixing Snyk vulnerability SNYK-JS-ZOD-5925617 by upgrading zod packages to latest

[Thutm]

Hey, I just made a Pull Request!

Addressing SNYK-JS-ZOD-5925617 by upgrading zod to latest in packages found with depends. Relied on yarn why for depends list. Will resolve issue #21777

ref:
https://security.snyk.io/vuln/SNYK-JS-ZOD-5925617
#21777

✔️ Checklist

• A changeset describing the change and affected packages. (more info)
• Added or updated documentation
• Tests for new functionality and regression tests for bug fixes
• Screenshots attached (for UI changes)
• All your commits have a Signed-off-by line in the message. (more info)

[backstage-goalie]

Changed Packages

Package Name	Package Path	Changeset Bump	Current Version
@backstage/backend-tasks	packages/backend-tasks	patch	v0.5.13-next.2
@backstage/cli-node	packages/cli-node	patch	v0.2.0
@backstage/cli	packages/cli	patch	v0.25.0-next.2
@backstage/core-app-api	packages/core-app-api	patch	v1.11.2-next.1
@backstage/core-components	packages/core-components	patch	v0.13.9-next.2
@backstage/frontend-plugin-api	packages/frontend-plugin-api	patch	v0.4.0-next.2
@backstage/plugin-auth-node	plugins/auth-node	patch	v0.4.2-next.2
@backstage/plugin-catalog-backend	plugins/catalog-backend	patch	v1.16.0-next.2
@backstage/plugin-home	plugins/home	patch	v0.6.0-next.2
@backstage/plugin-permission-backend	plugins/permission-backend	patch	v0.5.31-next.2
@backstage/plugin-permission-common	plugins/permission-common	patch	v0.7.10
@backstage/plugin-permission-node	plugins/permission-node	patch	v0.7.19-next.2
@backstage/plugin-playlist-backend	plugins/playlist-backend	patch	v0.3.12-next.2
@backstage/plugin-scaffolder-backend-module-gitlab	plugins/scaffolder-backend-module-gitlab	patch	v0.2.11-next.2
@backstage/plugin-scaffolder-backend	plugins/scaffolder-backend	patch	v1.19.2-next.2
@backstage/plugin-scaffolder-node	plugins/scaffolder-node	patch	v0.2.9-next.2
@backstage/plugin-scaffolder-react	plugins/scaffolder-react	patch	v1.6.2-next.2
@backstage/plugin-scaffolder	plugins/scaffolder	patch	v1.16.2-next.2
@backstage/plugin-search-backend	plugins/search-backend	patch	v1.4.8-next.2

[backstage-goalie]

Thanks for the contribution!
All commits need to be DCO signed before they are reviewed. Please refer to the the DCO section in CONTRIBUTING.md or the DCO status for more info.

[Thutm]

Didn't squash my commits or sign them all. Will fix.

[github-actions]

Uffizzi Cluster pr-21800 was deleted.

[Thutm]

Test case failing on depends. emotion may need to lock/rollback versions on csstype for now? frenic/csstype#189

[freben]

This doesn't fix the problem right? The lockfile doesn't remove any vulnerable resolutions.

[freben]

To be clear, I don't mind this fix - but just noting that we already resolved to a fixed version (it was already in-range of the previous range as well), and so could anyone adopting Backstage too. However we also have a transitive dep on zod@npm:~3.18.0 which ultimately gets pulled in by @oriflame/backstage-plugin-score-card@npm:^0.7.0. And THAT does not have a fix in-range, and there's no new release of that plugin that bumps to a newer core-components to circumvent it.

So I'm wondering if the actual fix is to remove the dependency on that plugin, or contact their author to see if they can address it.

[freben]

I'll merge this since it still moves us somewhat forward, but let's also consider the other zod depencency branch that lingers behind as per the above

[github-actions]

Thank you for contributing to Backstage! The changes in this pull request will be part of the 1.21.0 release, scheduled for Tue, 19 Dec 2023.

[raphaelbp12]

Test case failing on depends. emotion may need to lock/rollback versions on csstype for now? frenic/csstype#189

Will this PR fix this issue?

[freben]

No, that's unrelated.