chore: patch cli-common, backend-plugin-api, techdocs-node [release-1.9]

[Omar-AlJaljuli]

Description

@backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks.
Upstream fixed it at backstage/backstage@66e08b0#diff-a00c2d14ca2579883df4436744e43f3ef63a192c850c36603bdaac92364354fcR3

There are three patches:

@backstage/plugin-techdocs-node - the one that had the vulnerability
@backstage/cli-common - techdocs-node uses a method from this package isChildPath that required an update too.
@backstage/backend-plugin-api is another package that uses isChildPath and as this was patched for fixing the CVE, this package needed an update too.

All patches were applied as resolutions in package.json and dynamic-plugins/package.json, with an exception of @backstage-plugin-techdocs being applied only on dynamic-plugins/package.json because it is not used by package.json

Which issue(s) does this PR fix

RHDHBUGS-2844

PR acceptance criteria

Please make sure that the following steps are complete:

• GitHub Actions are completed and successful
• Unit Tests are updated and passing
• E2E Tests are updated and passing
• Documentation is updated if necessary (requirement for new features)
• Add a screenshot if the change is UX/UI related

How to test changes / Special notes to the reviewer

[github-actions]

Image was built and published successfully. It is available at:

• quay.io/rhdh-community/rhdh:pr-4498
• quay.io/rhdh-community/rhdh:pr-4498-c26c382b

[kim-tsao]

/test e2e-ocp-helm

[github-actions]

The container image build workflow finished with status: cancelled.

[github-actions]

Image was built and published successfully. It is available at:

• quay.io/rhdh-community/rhdh:pr-4498
• quay.io/rhdh-community/rhdh:pr-4498-5a853e0e

[Omar-AlJaljuli]

/retest

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Image was built and published successfully. It is available at:

• quay.io/rhdh-community/rhdh:pr-4498
• quay.io/rhdh-community/rhdh:pr-4498-4919b4dd

[openshift-ci]

@Omar-AlJaljuli: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-ocp-helm	4919b4d	link	true	/test e2e-ocp-helm

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[Omar-AlJaljuli]

/retest