chore(deps): bump yup to 1.7.1

packages/lib-core/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog for `@openshift/dynamic-plugin-sdk`
 
+## 6.1.0 - TBD
+
+- Update yup to 1.7.1 ([#289])
+
 ## 6.0.0 - 2026-01-06
 
 > This release adds new features, including the ability to load plugins from local manifests,
@@ -90,3 +94,4 @@
 [#274]: https://github.com/openshift/dynamic-plugin-sdk/pull/274
 [#280]: https://github.com/openshift/dynamic-plugin-sdk/pull/280
 [#281]: https://github.com/openshift/dynamic-plugin-sdk/pull/281
+[#289]: https://github.com/openshift/dynamic-plugin-sdk/pull/289

packages/lib-core/package.json

@@ -34,6 +34,6 @@
     "lodash": "^4.17.21",
     "semver": "^7.3.7",
     "uuid": "^8.3.2",
-    "yup": "^0.32.11"
+    "yup": "^1.7.1"
   }
 }

packages/lib-core/src/yup-schemas.ts

@@ -83,16 +83,39 @@ export const extensionSchema = yup
  */
 export const extensionArraySchema = yup.array().of(extensionSchema).required();
 
+/**
+ * Schema for Record<string, string> objects.
+ */
+export const recordStringStringSchema = yup
+  .object() // Rejects non-objects and null
+  .test(
+    'property?: Record<string, string>',
+    'Must be either undefined OR an object with string keys and values',
+    (obj: object) => {
+      // Allow undefined because these fields are optional
+      if (obj === undefined) {
+        return true;
+      }
+
+      // Objects can have Symbol() as keys, so ensure there are none
+      if (Object.getOwnPropertySymbols(obj).length > 0) {
+        return new yup.ValidationError('Must be an object with no symbols as keys');
+      }
+
+      // Object keys can only be symbols or strings, but since we've ruled out symbols,
+      // we can assume that all keys are strings. We just need to check the values now
+      return Object.values(obj).every((value) => typeof value === 'string');
+    },
+  );
+
 /**
  * Schema for `PluginRuntimeMetadata` objects.
  */
 export const pluginRuntimeMetadataSchema = yup.object().required().shape({
   name: pluginNameSchema,
   version: semverStringSchema,
-  // TODO(vojtech): Yup lacks native support for map-like structures with arbitrary keys
-  // TODO(vojtech): we need to validate dependency values as semver ranges
-  dependencies: yup.object(),
-  optionalDependencies: yup.object(),
+  dependencies: recordStringStringSchema,
+  optionalDependencies: recordStringStringSchema,
   customProperties: yup.object(),
 });
 

packages/lib-webpack/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog for `@openshift/dynamic-plugin-sdk-webpack`
 
+## 5.1.0 - TBD
+
+- Update yup to 1.7.1 ([#289])
+
 ## 5.0.0 - 2026-01-06
 
 - BREAKING: Minimum compatible version of `webpack` increased to `^5.100.0` ([#280])
@@ -67,3 +71,4 @@
 [#256]: https://github.com/openshift/dynamic-plugin-sdk/pull/256
 [#259]: https://github.com/openshift/dynamic-plugin-sdk/pull/259
 [#280]: https://github.com/openshift/dynamic-plugin-sdk/pull/280
+[#289]: https://github.com/openshift/dynamic-plugin-sdk/pull/289

packages/lib-webpack/package.json

@@ -31,7 +31,7 @@
   "dependencies": {
     "lodash": "^4.17.21",
     "semver": "^7.3.7",
-    "yup": "^0.32.11"
+    "yup": "^1.7.1"
   },
   "engines": {
     "node": ">=16"

packages/lib-webpack/src/yup-schemas.ts

@@ -2,14 +2,14 @@ import * as yup from 'yup';
 import {
   extensionArraySchema,
   pluginRuntimeMetadataSchema,
+  recordStringStringSchema
 } from '@openshift/dynamic-plugin-sdk/src/shared-webpack';
 
 /**
  * Schema for `PluginBuildMetadata` objects.
  */
 export const pluginBuildMetadataSchema = pluginRuntimeMetadataSchema.shape({
-  // TODO(vojtech): Yup lacks native support for map-like structures with arbitrary keys
-  exposedModules: yup.object(),
+  exposedModules: recordStringStringSchema,
 });
 
 /**

yarn.lock

@@ -1169,7 +1169,7 @@ __metadata:
   dependencies:
     lodash: ^4.17.21
     semver: ^7.3.7
-    yup: ^0.32.11
+    yup: ^1.7.1
   peerDependencies:
     webpack: ^5.100.0
   languageName: node
@@ -1181,7 +1181,7 @@ __metadata:
   dependencies:
     lodash: ^4.17.21
     semver: ^7.3.7
-    yup: ^0.32.11
+    yup: ^1.7.1
   peerDependencies:
     webpack: ^5.100.0
   languageName: node
@@ -1193,7 +1193,7 @@ __metadata:
   dependencies:
     lodash: ^4.17.21
     semver: ^7.3.7
-    yup: ^0.32.11
+    yup: ^1.7.1
   peerDependencies:
     webpack: ^5.100.0
   languageName: unknown
@@ -1206,7 +1206,7 @@ __metadata:
     lodash: ^4.17.21
     semver: ^7.3.7
     uuid: ^8.3.2
-    yup: ^0.32.11
+    yup: ^1.7.1
   peerDependencies:
     react: ^17 || ^18
   languageName: node
@@ -1219,7 +1219,7 @@ __metadata:
     lodash: ^4.17.21
     semver: ^7.3.7
     uuid: ^8.3.2
-    yup: ^0.32.11
+    yup: ^1.7.1
   peerDependencies:
     react: ^17 || ^18
   languageName: node
@@ -1232,7 +1232,7 @@ __metadata:
     lodash: ^4.17.21
     semver: ^7.3.7
     uuid: ^8.3.2
-    yup: ^0.32.11
+    yup: ^1.7.1
   peerDependencies:
     react: ^17 || ^18
   languageName: unknown
@@ -1838,7 +1838,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@types/lodash@npm:^4.14.175, @types/lodash@npm:^4.14.192":
+"@types/lodash@npm:^4.14.192":
   version: 4.14.192
   resolution: "@types/lodash@npm:4.14.192"
   checksum: 31e1f0543a04158d2c429c45efd7c77882736630d0652f82eb337d6159ec0c249c5d175c0af731537b53271e665ff8d76f43221d75d03646d31cb4bd6f0056b1
@@ -7201,13 +7201,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"lodash-es@npm:^4.17.21":
-  version: 4.17.21
-  resolution: "lodash-es@npm:4.17.21"
-  checksum: 05cbffad6e2adbb331a4e16fbd826e7faee403a1a04873b82b42c0f22090f280839f85b95393f487c1303c8a3d2a010048bf06151a6cbe03eee4d388fb0a12d2
-  languageName: node
-  linkType: hard
-
 "lodash.get@npm:^4.4.2":
   version: 4.4.2
   resolution: "lodash.get@npm:4.4.2"
@@ -7634,13 +7627,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"nanoclone@npm:^0.2.1":
-  version: 0.2.1
-  resolution: "nanoclone@npm:0.2.1"
-  checksum: 96b2954e22f70561f41e20d69856266c65583c2a441dae108f1dc71b716785d2c8038dac5f1d5e92b117aed3825f526b53139e2e5d6e6db8a77cfa35b3b8bf40
-  languageName: node
-  linkType: hard
-
 "nanoid@npm:^3.3.11":
   version: 3.3.11
   resolution: "nanoid@npm:3.3.11"
@@ -8672,10 +8658,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"property-expr@npm:^2.0.4":
-  version: 2.0.4
-  resolution: "property-expr@npm:2.0.4"
-  checksum: 7ac142e189f0feef685f327f582efe13bfbc24a0b6e2328afdb38520bc140caa5f91dfa9529f2539b4468d85dc83a593e1ef0e0f7401b525368bb634b323bf54
+"property-expr@npm:^2.0.5":
+  version: 2.0.6
+  resolution: "property-expr@npm:2.0.6"
+  checksum: 89977f4bb230736c1876f460dd7ca9328034502fd92e738deb40516d16564b850c0bbc4e052c3df88b5b8cd58e51c93b46a94bea049a3f23f4a022c038864cab
   languageName: node
   linkType: hard
 
@@ -9963,6 +9949,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"tiny-case@npm:^1.0.3":
+  version: 1.0.3
+  resolution: "tiny-case@npm:1.0.3"
+  checksum: 3f7a30c39d5b0e1bc097b0b271bec14eb5b836093db034f35a0de26c14422380b50dc12bfd37498cf35b192f5df06f28a710712c87ead68872a9e37ad6f6049d
+  languageName: node
+  linkType: hard
+
 "tiny-invariant@npm:^1.0.2":
   version: 1.2.0
   resolution: "tiny-invariant@npm:1.2.0"
@@ -10240,6 +10233,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"type-fest@npm:^2.19.0":
+  version: 2.19.0
+  resolution: "type-fest@npm:2.19.0"
+  checksum: a4ef07ece297c9fba78fc1bd6d85dff4472fe043ede98bd4710d2615d15776902b595abf62bd78339ed6278f021235fb28a96361f8be86ed754f778973a0d278
+  languageName: node
+  linkType: hard
+
 "typedarray-to-buffer@npm:^3.1.5":
   version: 3.1.5
   resolution: "typedarray-to-buffer@npm:3.1.5"
@@ -10888,18 +10888,15 @@ __metadata:
   languageName: node
   linkType: hard
 
-"yup@npm:^0.32.11":
-  version: 0.32.11
-  resolution: "yup@npm:0.32.11"
+"yup@npm:^1.7.1":
+  version: 1.7.1
+  resolution: "yup@npm:1.7.1"
   dependencies:
-    "@babel/runtime": ^7.15.4
-    "@types/lodash": ^4.14.175
-    lodash: ^4.17.21
-    lodash-es: ^4.17.21
-    nanoclone: ^0.2.1
-    property-expr: ^2.0.4
+    property-expr: ^2.0.5
+    tiny-case: ^1.0.3
     toposort: ^2.0.2
-  checksum: 43a16786b47cc910fed4891cebdd89df6d6e31702e9462e8f969c73eac88551ce750732608012201ea6b93802c8847cb0aa27b5d57370640f4ecf30f9f97d4b0
+    type-fest: ^2.19.0
+  checksum: 80d0d6838da457d489a97ee0b9c26fa9f59355a553f86842ea114b049811a918a0e7221f9c22bb88314699ddfb3e24ded49f7ab10a0e74dd273d03430110d5af
   languageName: node
   linkType: hard