Merge 4acc222462 into 0111ed9f4d

Signed-off-by: Gabriele Fedi <gabriele.fedi@enterprisedb.com>

internal/cnpgi/operator/rbac/ensure.go

@@ -31,7 +31,6 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	barmancloudv1 "github.com/cloudnative-pg/plugin-barman-cloud/api/v1"
-	"github.com/cloudnative-pg/plugin-barman-cloud/internal/cnpgi/metadata"
 	"github.com/cloudnative-pg/plugin-barman-cloud/internal/cnpgi/operator/specs"
 )
 
@@ -62,9 +61,7 @@ func EnsureRole(
 		return err
 	}
 
-	return patchRole(ctx, c, roleKey, newRole.Rules, map[string]string{
+	return patchRole(ctx, c, roleKey, newRole.Rules, specs.GetRequiredLabels(cluster))
-		metadata.ClusterLabelName: cluster.Name,
-	})
 }
 
 // EnsureRoleRules updates the rules of an existing Role to match
@@ -90,6 +87,53 @@ func EnsureRoleRules(
 	return err
 }
 
+// EnsureRoleBinding ensures the RoleBinding for the given Cluster matches
+// the desired state.
+//
+// This function is called from the Pre hook (gRPC). It creates the RoleBinding
+// if it does not exist, otherwise it patches Subjects and labels to match
+// the desired state.
+func EnsureRoleBinding(ctx context.Context, c client.Client, cluster *cnpgv1.Cluster) error {
+	contextLogger := log.FromContext(ctx)
+
+	desiredRoleBinding := specs.BuildRoleBinding(cluster)
+	if err := specs.SetControllerReference(cluster, desiredRoleBinding); err != nil {
+		return err
+	}
+
+	roleBinding := &rbacv1.RoleBinding{}
+
+	if err := c.Get(ctx, client.ObjectKey{
+		Namespace: cluster.Namespace,
+		Name:      specs.GetRBACName(cluster.Name),
+	}, roleBinding); err != nil {
+		if apierrs.IsNotFound(err) {
+			contextLogger.Info("Creating RoleBinding", "name", desiredRoleBinding.Name,
+				"namespace", desiredRoleBinding.Namespace)
+			return c.Create(ctx, desiredRoleBinding)
+		}
+		return err
+	}
+
+	if !roleBindingNeedsUpdate(roleBinding, desiredRoleBinding) {
+		return nil
+	}
+
+	contextLogger.Info("Patching role binding",
+		"name", roleBinding.Name, "namespace", roleBinding.Namespace)
+
+	oldRoleBinding := roleBinding.DeepCopy()
+	if roleBinding.Labels == nil {
+		roleBinding.Labels = make(map[string]string, len(desiredRoleBinding.Labels))
+	}
+	for k, v := range desiredRoleBinding.Labels {
+		roleBinding.Labels[k] = v
+	}
+	roleBinding.Subjects = desiredRoleBinding.Subjects
+
+	return c.Patch(ctx, roleBinding, client.MergeFrom(oldRoleBinding))
+}
+
 // ensureRoleExists creates the Role if it does not exist. Returns
 // nil on success and nil on AlreadyExists (another writer created
 // it concurrently). The caller always follows up with patchRole.
@@ -179,3 +223,17 @@ func labelsNeedUpdate(existing, desired map[string]string) bool {
 	}
 	return false
 }
+
+// roleBindingNeedsUpdate returns true if the existing RoleBinding's
+// Subjects differ from the desired or if labels need update.
+func roleBindingNeedsUpdate(existing, desired *rbacv1.RoleBinding) bool {
+	if !equality.Semantic.DeepEqual(existing.Subjects, desired.Subjects) {
+		return true
+	}
+
+	if labelsNeedUpdate(existing.Labels, desired.Labels) {
+		return true
+	}
+
+	return false
+}

internal/cnpgi/operator/rbac/ensure_test.go

@@ -25,6 +25,7 @@ import (
 
 	barmanapi "github.com/cloudnative-pg/barman-cloud/pkg/api"
 	cnpgv1 "github.com/cloudnative-pg/cloudnative-pg/api/v1"
+	"github.com/cloudnative-pg/cloudnative-pg/pkg/utils"
 	machineryapi "github.com/cloudnative-pg/machinery/pkg/api"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
@@ -42,6 +43,15 @@ import (
 	"github.com/cloudnative-pg/plugin-barman-cloud/internal/cnpgi/operator/rbac"
 )
 
+func expectRequiredLabels(labels map[string]string, clusterName string) {
+	ExpectWithOffset(1, labels).To(HaveKeyWithValue(metadata.ClusterLabelName, clusterName))
+	ExpectWithOffset(1, labels).To(HaveKeyWithValue(utils.KubernetesAppLabelName, utils.AppName))
+	ExpectWithOffset(1, labels).To(HaveKeyWithValue(utils.KubernetesAppInstanceLabelName, clusterName))
+	ExpectWithOffset(1, labels).To(HaveKeyWithValue(utils.KubernetesAppManagedByLabelName, "plugin-barman-cloud"))
+	ExpectWithOffset(1, labels).To(HaveKeyWithValue(utils.KubernetesAppComponentLabelName, utils.DatabaseComponentName))
+	ExpectWithOffset(1, labels).To(HaveKey(utils.KubernetesAppVersionLabelName))
+}
+
 func newScheme() *runtime.Scheme {
 	s := runtime.NewScheme()
 	utilruntime.Must(rbacv1.AddToScheme(s))
@@ -124,7 +134,7 @@ var _ = Describe("EnsureRole", func() {
 			Expect(role.OwnerReferences[0].Name).To(Equal("test-cluster"))
 			Expect(role.OwnerReferences[0].Kind).To(Equal("Cluster"))
 
-			Expect(role.Labels).To(HaveKeyWithValue(metadata.ClusterLabelName, "test-cluster"))
+			expectRequiredLabels(role.Labels, "test-cluster")
 		})
 	})
 
@@ -210,7 +220,7 @@ var _ = Describe("EnsureRole", func() {
 					Name:      "test-cluster-barman-cloud",
 					Namespace: "default",
 					Labels: map[string]string{
-						"app.kubernetes.io/managed-by": "helm",
+						"custom-label": "custom-value",
 					},
 				},
 			}
@@ -227,8 +237,8 @@ var _ = Describe("EnsureRole", func() {
 				Name:      "test-cluster-barman-cloud",
 			}, &role)).To(Succeed())
 
-			Expect(role.Labels).To(HaveKeyWithValue("app.kubernetes.io/managed-by", "helm"))
+			Expect(role.Labels).To(HaveKeyWithValue("custom-label", "custom-value"))
-			Expect(role.Labels).To(HaveKeyWithValue(metadata.ClusterLabelName, "test-cluster"))
+			expectRequiredLabels(role.Labels, "test-cluster")
 		})
 	})
 
@@ -257,12 +267,202 @@ var _ = Describe("EnsureRole", func() {
 				Name:      "test-cluster-barman-cloud",
 			}, &role)).To(Succeed())
 
-			Expect(role.Labels).To(HaveKeyWithValue(metadata.ClusterLabelName, "test-cluster"))
+			expectRequiredLabels(role.Labels, "test-cluster")
 			Expect(role.Rules).To(HaveLen(3))
 		})
 	})
 })
 
+var _ = Describe("EnsureRoleBinding", func() {
+	var (
+		ctx        context.Context
+		cluster    *cnpgv1.Cluster
+		fakeClient client.Client
+	)
+
+	BeforeEach(func() {
+		ctx = context.Background()
+		cluster = newCluster("test-cluster", "default")
+	})
+
+	Context("when the RoleBinding does not exist", func() {
+		BeforeEach(func() {
+			fakeClient = fake.NewClientBuilder().WithScheme(newScheme()).Build()
+		})
+
+		It("should create the RoleBinding with owner reference, labels, and correct subjects", func() {
+			err := rbac.EnsureRoleBinding(ctx, fakeClient, cluster)
+			Expect(err).NotTo(HaveOccurred())
+
+			var rb rbacv1.RoleBinding
+			Expect(fakeClient.Get(ctx, client.ObjectKey{
+				Namespace: "default",
+				Name:      "test-cluster-barman-cloud",
+			}, &rb)).To(Succeed())
+
+			Expect(rb.OwnerReferences).To(HaveLen(1))
+			Expect(rb.OwnerReferences[0].Name).To(Equal("test-cluster"))
+			Expect(rb.OwnerReferences[0].Kind).To(Equal("Cluster"))
+
+			expectRequiredLabels(rb.Labels, "test-cluster")
+
+			Expect(rb.Subjects).To(HaveLen(1))
+			Expect(rb.Subjects[0].Name).To(Equal("test-cluster"))
+			Expect(rb.Subjects[0].Kind).To(Equal("ServiceAccount"))
+
+			Expect(rb.RoleRef.Kind).To(Equal("Role"))
+			Expect(rb.RoleRef.Name).To(Equal("test-cluster-barman-cloud"))
+		})
+	})
+
+	Context("when the RoleBinding exists with matching state", func() {
+		BeforeEach(func() {
+			fakeClient = fake.NewClientBuilder().WithScheme(newScheme()).Build()
+			Expect(rbac.EnsureRoleBinding(ctx, fakeClient, cluster)).To(Succeed())
+		})
+
+		It("should not patch the RoleBinding", func() {
+			var before rbacv1.RoleBinding
+			Expect(fakeClient.Get(ctx, client.ObjectKey{
+				Namespace: "default",
+				Name:      "test-cluster-barman-cloud",
+			}, &before)).To(Succeed())
+
+			err := rbac.EnsureRoleBinding(ctx, fakeClient, cluster)
+			Expect(err).NotTo(HaveOccurred())
+
+			var after rbacv1.RoleBinding
+			Expect(fakeClient.Get(ctx, client.ObjectKey{
+				Namespace: "default",
+				Name:      "test-cluster-barman-cloud",
+			}, &after)).To(Succeed())
+
+			Expect(after.ResourceVersion).To(Equal(before.ResourceVersion))
+		})
+	})
+
+	Context("when the RoleBinding exists with different subjects", func() {
+		BeforeEach(func() {
+			fakeClient = fake.NewClientBuilder().WithScheme(newScheme()).Build()
+			existing := &rbacv1.RoleBinding{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "test-cluster-barman-cloud",
+					Namespace: "default",
+				},
+				Subjects: []rbacv1.Subject{
+					{
+						Kind:     "ServiceAccount",
+						Name:     "old-sa",
+						APIGroup: "",
+					},
+				},
+				RoleRef: rbacv1.RoleRef{
+					APIGroup: "rbac.authorization.k8s.io",
+					Kind:     "Role",
+					Name:     "test-cluster-barman-cloud",
+				},
+			}
+			Expect(fakeClient.Create(ctx, existing)).To(Succeed())
+		})
+
+		It("should patch the subjects to match the desired state", func() {
+			err := rbac.EnsureRoleBinding(ctx, fakeClient, cluster)
+			Expect(err).NotTo(HaveOccurred())
+
+			var rb rbacv1.RoleBinding
+			Expect(fakeClient.Get(ctx, client.ObjectKey{
+				Namespace: "default",
+				Name:      "test-cluster-barman-cloud",
+			}, &rb)).To(Succeed())
+
+			Expect(rb.Subjects).To(HaveLen(1))
+			Expect(rb.Subjects[0].Name).To(Equal("test-cluster"))
+		})
+	})
+
+	Context("when the RoleBinding has pre-existing unrelated labels", func() {
+		BeforeEach(func() {
+			fakeClient = fake.NewClientBuilder().WithScheme(newScheme()).Build()
+			existing := &rbacv1.RoleBinding{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "test-cluster-barman-cloud",
+					Namespace: "default",
+					Labels: map[string]string{
+						"custom-label": "custom-value",
+					},
+				},
+				Subjects: []rbacv1.Subject{
+					{
+						Kind:      "ServiceAccount",
+						Name:      "test-cluster",
+						Namespace: "default",
+						APIGroup:  "",
+					},
+				},
+				RoleRef: rbacv1.RoleRef{
+					APIGroup: "rbac.authorization.k8s.io",
+					Kind:     "Role",
+					Name:     "test-cluster-barman-cloud",
+				},
+			}
+			Expect(fakeClient.Create(ctx, existing)).To(Succeed())
+		})
+
+		It("should preserve unrelated labels while adding the required labels", func() {
+			err := rbac.EnsureRoleBinding(ctx, fakeClient, cluster)
+			Expect(err).NotTo(HaveOccurred())
+
+			var rb rbacv1.RoleBinding
+			Expect(fakeClient.Get(ctx, client.ObjectKey{
+				Namespace: "default",
+				Name:      "test-cluster-barman-cloud",
+			}, &rb)).To(Succeed())
+
+			Expect(rb.Labels).To(HaveKeyWithValue("custom-label", "custom-value"))
+			expectRequiredLabels(rb.Labels, "test-cluster")
+		})
+	})
+
+	Context("when the RoleBinding exists without labels (upgrade scenario)", func() {
+		BeforeEach(func() {
+			fakeClient = fake.NewClientBuilder().WithScheme(newScheme()).Build()
+			existing := &rbacv1.RoleBinding{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "test-cluster-barman-cloud",
+					Namespace: "default",
+				},
+				Subjects: []rbacv1.Subject{
+					{
+						Kind:      "ServiceAccount",
+						Name:      "test-cluster",
+						Namespace: "default",
+						APIGroup:  "",
+					},
+				},
+				RoleRef: rbacv1.RoleRef{
+					APIGroup: "rbac.authorization.k8s.io",
+					Kind:     "Role",
+					Name:     "test-cluster-barman-cloud",
+				},
+			}
+			Expect(fakeClient.Create(ctx, existing)).To(Succeed())
+		})
+
+		It("should add the required labels", func() {
+			err := rbac.EnsureRoleBinding(ctx, fakeClient, cluster)
+			Expect(err).NotTo(HaveOccurred())
+
+			var rb rbacv1.RoleBinding
+			Expect(fakeClient.Get(ctx, client.ObjectKey{
+				Namespace: "default",
+				Name:      "test-cluster-barman-cloud",
+			}, &rb)).To(Succeed())
+
+			expectRequiredLabels(rb.Labels, "test-cluster")
+		})
+	})
+})
+
 var _ = Describe("EnsureRoleRules", func() {
 	var (
 		ctx        context.Context

internal/cnpgi/operator/reconciler.go

@@ -27,14 +27,12 @@ import (
 	"github.com/cloudnative-pg/cnpg-i-machinery/pkg/pluginhelper/object"
 	"github.com/cloudnative-pg/cnpg-i/pkg/reconciler"
 	"github.com/cloudnative-pg/machinery/pkg/log"
-	rbacv1 "k8s.io/api/rbac/v1"
 	apierrs "k8s.io/apimachinery/pkg/api/errors"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	barmancloudv1 "github.com/cloudnative-pg/plugin-barman-cloud/api/v1"
 	"github.com/cloudnative-pg/plugin-barman-cloud/internal/cnpgi/operator/config"
 	"github.com/cloudnative-pg/plugin-barman-cloud/internal/cnpgi/operator/rbac"
-	"github.com/cloudnative-pg/plugin-barman-cloud/internal/cnpgi/operator/specs"
 )
 
 // ReconcilerImplementation implements the Reconciler capability
@@ -117,7 +115,7 @@ func (r ReconcilerImplementation) Pre(
 		return nil, err
 	}
 
-	if err := r.ensureRoleBinding(ctx, &cluster); err != nil {
+	if err := rbac.EnsureRoleBinding(ctx, r.Client, &cluster); err != nil {
 		return nil, err
 	}
 
@@ -136,34 +134,3 @@ func (r ReconcilerImplementation) Post(
 		Behavior: reconciler.ReconcilerHooksResult_BEHAVIOR_CONTINUE,
 	}, nil
 }
-
-func (r ReconcilerImplementation) ensureRoleBinding(
-	ctx context.Context,
-	cluster *cnpgv1.Cluster,
-) error {
-	var roleBinding rbacv1.RoleBinding
-	if err := r.Client.Get(ctx, client.ObjectKey{
-		Namespace: cluster.Namespace,
-		Name:      specs.GetRBACName(cluster.Name),
-	}, &roleBinding); err != nil {
-		if apierrs.IsNotFound(err) {
-			return r.createRoleBinding(ctx, cluster)
-		}
-		return err
-	}
-
-	// TODO: this assumes role bindings never change.
-	// Is that true? Should we relax this assumption?
-	return nil
-}
-
-func (r ReconcilerImplementation) createRoleBinding(
-	ctx context.Context,
-	cluster *cnpgv1.Cluster,
-) error {
-	roleBinding := specs.BuildRoleBinding(cluster)
-	if err := specs.SetControllerReference(cluster, roleBinding); err != nil {
-		return err
-	}
-	return r.Client.Create(ctx, roleBinding)
-}

internal/cnpgi/operator/specs/metadata.go

@@ -0,0 +1,47 @@
+/*
+Copyright © contributors to CloudNativePG, established as
+CloudNativePG a Series of LF Projects, LLC.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+SPDX-License-Identifier: Apache-2.0
+*/
+
+package specs
+
+import (
+	"fmt"
+
+	cnpgv1 "github.com/cloudnative-pg/cloudnative-pg/api/v1"
+	"github.com/cloudnative-pg/cloudnative-pg/pkg/utils"
+
+	"github.com/cloudnative-pg/plugin-barman-cloud/internal/cnpgi/metadata"
+)
+
+// GetRequiredLabels returns the labels that must be present on all plugin-managed objects for a given Cluster.
+func GetRequiredLabels(cluster *cnpgv1.Cluster) map[string]string {
+	requiredLabels := map[string]string{
+		metadata.ClusterLabelName: cluster.Name,
+		// Kubernetes recommended labels
+		utils.KubernetesAppLabelName:          utils.AppName,
+		utils.KubernetesAppInstanceLabelName:  cluster.Name,
+		utils.KubernetesAppManagedByLabelName: "plugin-barman-cloud",
+		utils.KubernetesAppComponentLabelName: utils.DatabaseComponentName,
+	}
+
+	if version, err := cluster.GetPostgresqlMajorVersion(); err == nil && version != 0 {
+		requiredLabels[utils.KubernetesAppVersionLabelName] = fmt.Sprint(version)
+	}
+
+	return requiredLabels
+}

internal/cnpgi/operator/specs/metadata_test.go

@@ -0,0 +1,67 @@
+/*
+Copyright © contributors to CloudNativePG, established as
+CloudNativePG a Series of LF Projects, LLC.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+SPDX-License-Identifier: Apache-2.0
+*/
+
+package specs
+
+import (
+	cnpgv1 "github.com/cloudnative-pg/cloudnative-pg/api/v1"
+	"github.com/cloudnative-pg/cloudnative-pg/pkg/utils"
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"github.com/cloudnative-pg/plugin-barman-cloud/internal/cnpgi/metadata"
+)
+
+var _ = Describe("GetRequiredLabels", func() {
+	It("should return all expected labels for a cluster without an image", func() {
+		cluster := &cnpgv1.Cluster{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "my-cluster",
+				Namespace: "default",
+			},
+		}
+		labels := GetRequiredLabels(cluster)
+
+		Expect(labels).To(HaveKeyWithValue(metadata.ClusterLabelName, "my-cluster"))
+		Expect(labels).To(HaveKeyWithValue(utils.KubernetesAppLabelName, utils.AppName))
+		Expect(labels).To(HaveKeyWithValue(utils.KubernetesAppInstanceLabelName, "my-cluster"))
+		Expect(labels).To(HaveKeyWithValue(utils.KubernetesAppManagedByLabelName, "plugin-barman-cloud"))
+		Expect(labels).To(HaveKeyWithValue(utils.KubernetesAppComponentLabelName, utils.DatabaseComponentName))
+		Expect(labels).To(HaveLen(6))
+	})
+
+	It("should use the major version from the image catalog ref", func() {
+		cluster := &cnpgv1.Cluster{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "pg16-cluster",
+				Namespace: "default",
+			},
+			Spec: cnpgv1.ClusterSpec{
+				ImageCatalogRef: &cnpgv1.ImageCatalogRef{
+					Major: 16,
+				},
+			},
+		}
+		labels := GetRequiredLabels(cluster)
+
+		Expect(labels).To(HaveKeyWithValue(utils.KubernetesAppVersionLabelName, "16"))
+		Expect(labels).To(HaveKeyWithValue(utils.KubernetesAppInstanceLabelName, "pg16-cluster"))
+	})
+})

internal/cnpgi/operator/specs/role.go

@@ -29,7 +29,6 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 	barmancloudv1 "github.com/cloudnative-pg/plugin-barman-cloud/api/v1"
-	"github.com/cloudnative-pg/plugin-barman-cloud/internal/cnpgi/metadata"
 )
 
 // BuildRole builds the Role object for this cluster
@@ -41,9 +40,7 @@ func BuildRole(
 		ObjectMeta: metav1.ObjectMeta{
 			Namespace: cluster.Namespace,
 			Name:      GetRBACName(cluster.Name),
-			Labels: map[string]string{
+			Labels:    GetRequiredLabels(cluster),
-				metadata.ClusterLabelName: cluster.Name,
-			},
 		},
 		Rules: BuildRoleRules(barmanObjects),
 	}
@@ -131,6 +128,7 @@ func BuildRoleBinding(
 		ObjectMeta: metav1.ObjectMeta{
 			Namespace: cluster.Namespace,
 			Name:      GetRBACName(cluster.Name),
+			Labels:    GetRequiredLabels(cluster),
 		},
 		Subjects: []rbacv1.Subject{
 			{

web/package.json

@@ -43,9 +43,10 @@
     ]
   },
   "engines": {
-    "node": ">=18.0"
+    "node": ">=20.0.0"
   },
   "resolutions": {
-    "webpackbar": "^7.0.0"
+    "webpackbar": "^7.0.0",
+    "serialize-javascript": ">=7.0.5"
   }
 }

web/yarn.lock

@@ -3389,9 +3389,9 @@ array-union@^2.1.0:
   integrity sha512-HGyxoOTYUyCM6stUe6EJgnd4EoewAI7zMdfqO+kGjnlZmBDz/cR5pf8r/cR4Wq60sL/p0IkcjUEEPwS3GFrIyw==
 
 asn1js@^3.0.6:
-  version "3.0.9"
+  version "3.0.10"
-  resolved "https://registry.yarnpkg.com/asn1js/-/asn1js-3.0.9.tgz#d48f454d263a0c9f5fe8c6c66057a4d69bccfece"
+  resolved "https://registry.yarnpkg.com/asn1js/-/asn1js-3.0.10.tgz#df26c874c8a8b41ca605efea47b2ad07551013dd"
-  integrity sha512-g35Ef4IMkE3mDaMAYd3GOJ/c41LKcaiJuuLZ9BF0EXkZwYc0tkFpmZqxWsKlmXS3Um42dAkyx//kibIETBjfqg==
+  integrity sha512-S2s3aOytiKdFRdulw2qPE51MzjzVOisppcVv7jVFR+Kw0kxwvFrDcYA0h7Ndqbmj0HkMIXYWaoj7fli8kgx1eg==
   dependencies:
     pvtsutils "^1.3.6"
     pvutils "^1.1.5"
@@ -5849,9 +5849,9 @@ json5@^2.1.2, json5@^2.2.3:
   integrity sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==
 
 jsonfile@^6.0.1:
-  version "6.2.0"
+  version "6.2.1"
-  resolved "https://registry.yarnpkg.com/jsonfile/-/jsonfile-6.2.0.tgz#7c265bd1b65de6977478300087c99f1c84383f62"
+  resolved "https://registry.yarnpkg.com/jsonfile/-/jsonfile-6.2.1.tgz#b6e31717f22cc37330b081ce0051ed5de53af2f6"
-  integrity sha512-FGuPw30AdOIUTRMC2OMRtQV+jkVj2cfPqSeWXv1NEAJ1qZ5zb1X6z1mFhbfOB/iy3ssJCD+3KuZ8r8C3uVFlAg==
+  integrity sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==
   dependencies:
     universalify "^2.0.0"
   optionalDependencies:
@@ -7854,13 +7854,6 @@ quick-lru@^5.1.1:
   resolved "https://registry.yarnpkg.com/quick-lru/-/quick-lru-5.1.1.tgz#366493e6b3e42a3a6885e2e99d18f80fb7a8c932"
   integrity sha512-WuyALRjWPDGtt/wzJiadO5AXY+8hZ80hVpe6MyivgraREW751X3SbhRvG3eLKOYN+8VEvqLcf3wdnt44Z4S4SA==
 
-randombytes@^2.1.0:
-  version "2.1.0"
-  resolved "https://registry.yarnpkg.com/randombytes/-/randombytes-2.1.0.tgz#df6f84372f0270dc65cdf6291349ab7a473d4f2a"
-  integrity sha512-vYl3iOX+4CKUWuxGi9Ukhie6fsqXqS9FE2Zaic4tNFD2N2QQaXOMFbuKK4QmDHC0JO6B1Zp41J0LpT0oR68amQ==
-  dependencies:
-    safe-buffer "^5.1.0"
-
 range-parser@1.2.0:
   version "1.2.0"
   resolved "https://registry.yarnpkg.com/range-parser/-/range-parser-1.2.0.tgz#f49be6b487894ddc40dcc94a322f611092e00d5e"
@@ -8296,7 +8289,7 @@ run-parallel@^1.1.9:
   dependencies:
     queue-microtask "^1.2.2"
 
-safe-buffer@5.2.1, safe-buffer@>=5.1.0, safe-buffer@^5.1.0, safe-buffer@~5.2.0:
+safe-buffer@5.2.1, safe-buffer@>=5.1.0, safe-buffer@~5.2.0:
   version "5.2.1"
   resolved "https://registry.yarnpkg.com/safe-buffer/-/safe-buffer-5.2.1.tgz#1eaf9fa9bdb1fdd4ec75f58f9cdb4e6b7827eec6"
   integrity sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==
@@ -8402,12 +8395,10 @@ send@~0.19.0, send@~0.19.1:
     range-parser "~1.2.1"
     statuses "~2.0.2"
 
-serialize-javascript@^6.0.0, serialize-javascript@^6.0.1:
+serialize-javascript@>=7.0.5, serialize-javascript@^6.0.0, serialize-javascript@^6.0.1:
-  version "6.0.2"
+  version "7.0.5"
-  resolved "https://registry.yarnpkg.com/serialize-javascript/-/serialize-javascript-6.0.2.tgz#defa1e055c83bf6d59ea805d8da862254eb6a6c2"
+  resolved "https://registry.yarnpkg.com/serialize-javascript/-/serialize-javascript-7.0.5.tgz#c798cc0552ffbb08981914a42a8756e339d0d5b1"
-  integrity sha512-Saa1xPByTTq2gdeFZYLLo+RFE35NHZkAbqZeWNd3BpzppeVisAqpDjcp8dyf6uIvEqJRd46jemmyA4iFIeVk8g==
+  integrity sha512-F4LcB0UqUl1zErq+1nYEEzSHJnIwb3AF2XWB94b+afhrekOUijwooAYqFyRbjYkm2PAKBabx6oYv/xDxNi8IBw==
-  dependencies:
-    randombytes "^2.1.0"
 
 serve-handler@^6.1.7:
   version "6.1.7"