chore: patch cli-common, backend-plugin-api, techdocs-node [release-1.9]

[Omar-AlJaljuli]

Description

@backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks.
Upstream fixed it at backstage/backstage@66e08b0#diff-a00c2d14ca2579883df4436744e43f3ef63a192c850c36603bdaac92364354fcR3

There are three patches:

@backstage/plugin-techdocs-node - the one that had the vulnerability
@backstage/cli-common - techdocs-node uses a method from this package isChildPath that required an update too.
@backstage/backend-plugin-api is another package that uses isChildPath and as this was patched for fixing the CVE, this package needed an update too.

All patches were applied as resolutions in package.json and dynamic-plugins/package.json, with an exception of @backstage-plugin-techdocs being applied only on dynamic-plugins/package.json because it is not used by package.json

Which issue(s) does this PR fix

RHDHBUGS-2844

PR acceptance criteria

Please make sure that the following steps are complete:

• GitHub Actions are completed and successful
• Unit Tests are updated and passing
• E2E Tests are updated and passing
• Documentation is updated if necessary (requirement for new features)
• Add a screenshot if the change is UX/UI related

How to test changes / Special notes to the reviewer

[github-actions]

Image was built and published successfully. It is available at:

• quay.io/rhdh-community/rhdh:pr-4498
• quay.io/rhdh-community/rhdh:pr-4498-c26c382b

[kim-tsao]

/test e2e-ocp-helm

[github-actions]

The container image build workflow finished with status: cancelled.

[github-actions]

Image was built and published successfully. It is available at:

• quay.io/rhdh-community/rhdh:pr-4498
• quay.io/rhdh-community/rhdh:pr-4498-5a853e0e

[Omar-AlJaljuli]

/retest

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Image was built and published successfully. It is available at:

• quay.io/rhdh-community/rhdh:pr-4498
• quay.io/rhdh-community/rhdh:pr-4498-4919b4dd

[Omar-AlJaljuli]

/retest

[kim-tsao]

/lgtm

[kim-tsao]

/lgtm cancel