Merge c1d963973d into c592966a4a

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

.github/workflows/ci.yml

@@ -40,7 +40,7 @@ jobs:
       - name: Install QEMU static binaries
         uses: docker/setup-qemu-action@v4
       - name: Install Task
-        uses: arduino/setup-task@v2
+        uses: arduino/setup-task@v3.0.0
       - name: Install Dagger
         env:
           # renovate: datasource=github-tags depName=dagger/dagger versioning=semver

.github/workflows/publish-docs.yml

@@ -28,7 +28,7 @@ jobs:
         uses: actions/checkout@v7.0.0
 
       - name: Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           # Use the latest LTS version of Node.js already installed on the runner.
           node-version: latest

.github/workflows/release-please.yml

@@ -21,13 +21,13 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v7.0.0
       - name: Install node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: 24
       - name: Install QEMU static binaries
         uses: docker/setup-qemu-action@v4
       - name: Install Task
-        uses: arduino/setup-task@v2
+        uses: arduino/setup-task@v3.0.0
       - name: Install Dagger
         env:
           # renovate: datasource=github-tags depName=dagger/dagger versioning=semver

.github/workflows/release-publish.yml

@@ -17,7 +17,7 @@ jobs:
       - name: Install QEMU static binaries
         uses: docker/setup-qemu-action@v4
       - name: Install Task
-        uses: arduino/setup-task@v2
+        uses: arduino/setup-task@v3.0.0
       - name: Install Dagger
         env:
           # renovate: datasource=github-tags depName=dagger/dagger versioning=semver

go.mod

@@ -14,7 +14,7 @@ require (
 	github.com/onsi/gomega v1.42.1
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/viper v1.21.0
-	google.golang.org/grpc v1.82.0
+	google.golang.org/grpc v1.82.1
 	gopkg.in/yaml.v3 v3.0.1
 	k8s.io/api v0.36.2
 	k8s.io/apiextensions-apiserver v0.36.2

go.sum

@@ -293,8 +293,8 @@ google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 h1:
 google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478/go.mod h1:C6ADNqOxbgdUUeRTU+LCHDPB9ttAMCTff6auwCVa4uc=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260610212136-7ab31c22f7ad h1:45WmJvIV6C2+O/jjLkPUH+F3aOj/1miDoU2DD0+NWbg=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20260610212136-7ab31c22f7ad/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.82.0 h1:vguDnZUPjE26w09A63VoxZPnvPjB5Riyc0mkXPFmAIU=
+google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE=
-google.golang.org/grpc v1.82.0/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
+google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
 google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI=
 google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

internal/cnpgi/operator/lifecycle.go

@@ -150,18 +150,25 @@ func (impl LifecycleImplementation) reconcileJob(
 		return nil, err
 	}
 
+	useAzureWorkloadIdentity, err := impl.collectAzureWorkloadIdentityUsage(ctx, pluginConfiguration)
+	if err != nil {
+		return nil, err
+	}
+
 	return reconcileJob(ctx, cluster, request, sidecarConfiguration{
-		env:          env,
+		env:                      env,
-		certificates: certificates,
+		certificates:             certificates,
-		resources:    resources,
+		resources:                resources,
+		useAzureWorkloadIdentity: useAzureWorkloadIdentity,
 	})
 }
 
 type sidecarConfiguration struct {
-	env            []corev1.EnvVar
+	env                      []corev1.EnvVar
-	certificates   []corev1.VolumeProjection
+	certificates             []corev1.VolumeProjection
-	resources      corev1.ResourceRequirements
+	resources                corev1.ResourceRequirements
-	additionalArgs []string
+	additionalArgs           []string
+	useAzureWorkloadIdentity bool
 }
 
 func reconcileJob(
@@ -248,11 +255,17 @@ func (impl LifecycleImplementation) reconcilePod(
 		return nil, err
 	}
 
+	useAzureWorkloadIdentity, err := impl.collectAzureWorkloadIdentityUsage(ctx, pluginConfiguration)
+	if err != nil {
+		return nil, err
+	}
+
 	return reconcileInstancePod(ctx, cluster, request, pluginConfiguration, sidecarConfiguration{
-		env:            env,
+		env:                      env,
-		certificates:   certificates,
+		certificates:             certificates,
-		resources:      resources,
+		resources:                resources,
-		additionalArgs: additionalArgs,
+		additionalArgs:           additionalArgs,
+		useAzureWorkloadIdentity: useAzureWorkloadIdentity,
 	})
 }
 
@@ -322,6 +335,25 @@ func (impl LifecycleImplementation) collectAdditionalInstanceArgs(
 	return nil, nil
 }
 
+func (impl LifecycleImplementation) collectAzureWorkloadIdentityUsage(
+	ctx context.Context,
+	pluginConfiguration *config.PluginConfiguration,
+) (bool, error) {
+	for _, objectKey := range pluginConfiguration.GetReferredBarmanObjectsKey() {
+		var objectStore barmancloudv1.ObjectStore
+		if err := impl.Client.Get(ctx, objectKey, &objectStore); err != nil {
+			return false, fmt.Errorf("while getting object store %s: %w", objectKey.String(), err)
+		}
+
+		if objectStore.Spec.Configuration.Azure != nil &&
+			objectStore.Spec.Configuration.Azure.UseDefaultAzureCredentials {
+			return true, nil
+		}
+	}
+
+	return false, nil
+}
+
 func reconcileInstancePod(
 	ctx context.Context,
 	cluster *cnpgv1.Cluster,
@@ -400,6 +432,13 @@ func reconcilePodSpec(
 		},
 	)
 
+	if config.useAzureWorkloadIdentity {
+		envs = append(envs, corev1.EnvVar{
+			Name:  "AZURE_FEDERATED_TOKEN_FILE",
+			Value: azureFederatedTokenFilePath,
+		})
+	}
+
 	envs = append(envs, config.env...)
 
 	baseProbe := &corev1.Probe{
@@ -488,6 +527,34 @@ func reconcilePodSpec(
 		spec.Volumes = removeVolume(spec.Volumes, barmanCertificatesVolumeName)
 	}
 
+	if config.useAzureWorkloadIdentity {
+		sidecarTemplate.VolumeMounts = ensureVolumeMount(
+			sidecarTemplate.VolumeMounts,
+			corev1.VolumeMount{
+				Name:      azureFederatedTokenVolumeName,
+				MountPath: azureFederatedTokenMountPath,
+				ReadOnly:  true,
+			},
+		)
+
+		spec.Volumes = ensureVolume(spec.Volumes, corev1.Volume{
+			Name: azureFederatedTokenVolumeName,
+			VolumeSource: corev1.VolumeSource{
+				Projected: &corev1.ProjectedVolumeSource{
+					Sources: []corev1.VolumeProjection{
+						{
+							ServiceAccountToken: &corev1.ServiceAccountTokenProjection{
+								Path:              azureFederatedTokenFileName,
+								Audience:          azureFederatedTokenAudience,
+								ExpirationSeconds: ptr.To[int64](azureFederatedTokenExpirationSeconds),
+							},
+						},
+					},
+				},
+			},
+		})
+	}
+
 	if err := injectPluginSidecarPodSpec(spec, &sidecarTemplate, mainContainerName); err != nil {
 		return err
 	}
@@ -495,6 +562,15 @@ func reconcilePodSpec(
 	return nil
 }
 
+const (
+	azureFederatedTokenVolumeName        = "azure-identity-token"
+	azureFederatedTokenMountPath         = "/var/run/secrets/azure/tokens"
+	azureFederatedTokenFileName          = "azure-identity-token"
+	azureFederatedTokenFilePath          = azureFederatedTokenMountPath + "/" + azureFederatedTokenFileName
+	azureFederatedTokenAudience          = "api://AzureADTokenExchange"
+	azureFederatedTokenExpirationSeconds = 3600
+)
+
 // TODO: move to machinery once the logic is finalized
 
 // InjectPluginVolumePodSpec injects the plugin volume into a CNPG Pod spec.

internal/cnpgi/operator/lifecycle_test.go

@@ -22,6 +22,7 @@ package operator
 import (
 	"encoding/json"
 
+	barmanapi "github.com/cloudnative-pg/barman-cloud/pkg/api"
 	cnpgv1 "github.com/cloudnative-pg/cloudnative-pg/api/v1"
 	"github.com/cloudnative-pg/cloudnative-pg/pkg/utils"
 	"github.com/cloudnative-pg/cnpg-i/pkg/lifecycle"
@@ -517,6 +518,134 @@ var _ = Describe("LifecycleImplementation", func() {
 			Expect(err).To(HaveOccurred())
 		})
 	})
+
+	Describe("collectAzureWorkloadIdentityUsage", func() {
+		It("returns true when any referred object store uses default Azure credentials", func(ctx SpecContext) {
+			ns := "test-ns"
+			cluster := &cnpgv1.Cluster{ObjectMeta: metav1.ObjectMeta{Name: "c", Namespace: ns}}
+			pc := &config.PluginConfiguration{
+				Cluster:                  cluster,
+				BarmanObjectName:         "primary-store",
+				RecoveryBarmanObjectName: "recovery-store",
+			}
+			primaryStore := &barmancloudv1.ObjectStore{
+				ObjectMeta: metav1.ObjectMeta{Name: pc.BarmanObjectName, Namespace: ns},
+				Spec: barmancloudv1.ObjectStoreSpec{
+					Configuration: barmanapi.BarmanObjectStoreConfiguration{
+						BarmanCredentials: barmanapi.BarmanCredentials{
+							Azure: &barmanapi.AzureCredentials{UseDefaultAzureCredentials: true},
+						},
+					},
+				},
+			}
+			recoveryStore := &barmancloudv1.ObjectStore{
+				ObjectMeta: metav1.ObjectMeta{Name: pc.RecoveryBarmanObjectName, Namespace: ns},
+			}
+			cli := buildClientFunc(primaryStore, recoveryStore).Build()
+
+			impl := LifecycleImplementation{Client: cli}
+			useWorkloadIdentity, err := impl.collectAzureWorkloadIdentityUsage(ctx, pc)
+			Expect(err).NotTo(HaveOccurred())
+			Expect(useWorkloadIdentity).To(BeTrue())
+		})
+
+		It("returns false when none of the referred object stores use default Azure credentials", func(ctx SpecContext) {
+			ns := "test-ns"
+			cluster := &cnpgv1.Cluster{ObjectMeta: metav1.ObjectMeta{Name: "c", Namespace: ns}}
+			pc := &config.PluginConfiguration{
+				Cluster:          cluster,
+				BarmanObjectName: "primary-store",
+			}
+			primaryStore := &barmancloudv1.ObjectStore{
+				ObjectMeta: metav1.ObjectMeta{Name: pc.BarmanObjectName, Namespace: ns},
+				Spec: barmancloudv1.ObjectStoreSpec{
+					Configuration: barmanapi.BarmanObjectStoreConfiguration{
+						BarmanCredentials: barmanapi.BarmanCredentials{
+							Azure: &barmanapi.AzureCredentials{InheritFromAzureAD: true},
+						},
+					},
+				},
+			}
+			cli := buildClientFunc(primaryStore).Build()
+
+			impl := LifecycleImplementation{Client: cli}
+			useWorkloadIdentity, err := impl.collectAzureWorkloadIdentityUsage(ctx, pc)
+			Expect(err).NotTo(HaveOccurred())
+			Expect(useWorkloadIdentity).To(BeFalse())
+		})
+	})
+})
+
+var _ = Describe("reconcilePodSpec", func() {
+	It("injects the Azure federated token volume and env when workload identity is enabled", func() {
+		cluster := &cnpgv1.Cluster{ObjectMeta: metav1.ObjectMeta{Name: "cluster-1", Namespace: "ns-1"}}
+		spec := &corev1.PodSpec{
+			Containers: []corev1.Container{
+				{
+					Name: "postgres",
+					Env: []corev1.EnvVar{
+						{Name: "AZURE_CLIENT_ID", Value: "client-id"},
+					},
+				},
+			},
+		}
+
+		err := reconcilePodSpec(
+			cluster,
+			spec,
+			"postgres",
+			corev1.Container{Args: []string{"instance"}},
+			sidecarConfiguration{useAzureWorkloadIdentity: true},
+		)
+		Expect(err).NotTo(HaveOccurred())
+		Expect(spec.Volumes).To(ContainElement(HaveField("Name", azureFederatedTokenVolumeName)))
+		Expect(spec.InitContainers).To(HaveLen(1))
+		Expect(spec.InitContainers[0].Env).To(ContainElement(corev1.EnvVar{
+			Name:  "AZURE_FEDERATED_TOKEN_FILE",
+			Value: azureFederatedTokenFilePath,
+		}))
+		Expect(spec.InitContainers[0].Env).To(ContainElement(corev1.EnvVar{
+			Name:  "AZURE_CLIENT_ID",
+			Value: "client-id",
+		}))
+		Expect(spec.InitContainers[0].VolumeMounts).To(ContainElement(corev1.VolumeMount{
+			Name:      azureFederatedTokenVolumeName,
+			MountPath: azureFederatedTokenMountPath,
+			ReadOnly:  true,
+		}))
+	})
+
+	It("does not override an existing federated token file env", func() {
+		cluster := &cnpgv1.Cluster{ObjectMeta: metav1.ObjectMeta{Name: "cluster-1", Namespace: "ns-1"}}
+		spec := &corev1.PodSpec{
+			Containers: []corev1.Container{
+				{
+					Name: "postgres",
+					Env: []corev1.EnvVar{
+						{Name: "AZURE_FEDERATED_TOKEN_FILE", Value: "/custom/token"},
+					},
+				},
+			},
+		}
+
+		err := reconcilePodSpec(
+			cluster,
+			spec,
+			"postgres",
+			corev1.Container{Args: []string{"instance"}},
+			sidecarConfiguration{useAzureWorkloadIdentity: true},
+		)
+		Expect(err).NotTo(HaveOccurred())
+		Expect(spec.InitContainers).To(HaveLen(1))
+		Expect(spec.InitContainers[0].Env).To(ContainElement(corev1.EnvVar{
+			Name:  "AZURE_FEDERATED_TOKEN_FILE",
+			Value: "/custom/token",
+		}))
+		Expect(spec.InitContainers[0].Env).NotTo(ContainElement(corev1.EnvVar{
+			Name:  "AZURE_FEDERATED_TOKEN_FILE",
+			Value: azureFederatedTokenFilePath,
+		}))
+	})
 })
 
 var _ = Describe("Volume utilities", func() {

test/e2e/internal/objectstore/azurite.go

@@ -72,8 +72,8 @@ func newAzuriteDeployment(namespace, name string) *appsv1.Deployment {
 						{
 							Name: name,
 							// renovate: datasource=docker depName=mcr.microsoft.com/azure-storage/azurite versioning=docker
-							// Version: 3.35.0
+							// Version: 3.36.0
-							Image: "mcr.microsoft.com/azure-storage/azurite@sha256:647c63a91102a9d8e8000aab803436e1fc85fbb285e7ce830a82ee5d6661cf37",
+							Image: "mcr.microsoft.com/azure-storage/azurite@sha256:37493d0f2e764467421ffe16eb3caa39277e5fa7f6adea18eb5bbfb3c5247f98",
 							Args: []string{
 								"azurite-blob",
 								"--blobHost",

test/e2e/internal/tests/walrestore/fixtures.go

@@ -121,8 +121,8 @@ func newS3ClientDeployment(namespace string) *appsv1.Deployment {
 						{
 							Name: s3ClientName,
 							// renovate: datasource=docker depName=amazon/aws-cli versioning=docker
-							// Version: 2.35.11
+							// Version: 2.35.24
-							Image:   "docker.io/amazon/aws-cli@sha256:749bfaf91d690b9a1768083822d620f96c19defdf9ca2dc227eb3695281fda5b",
+							Image:   "docker.io/amazon/aws-cli@sha256:f7e6c7fb03510fd1f4e27469458ca372a37c823a8c32860e0dd2f04a41787794",
 							Command: []string{"sleep", "infinity"},
 							Env: []corev1.EnvVar{
 								{

web/docs/object_stores.md

@@ -272,9 +272,10 @@ flow, which uses [`DefaultAzureCredential`](https://learn.microsoft.com/en-us/py
 to automatically discover and use available credentials in the following order:
 
 1. **Environment Variables** — `AZURE_CLIENT_ID`, `AZURE_CLIENT_SECRET`, and `AZURE_TENANT_ID` for Service Principal authentication
-2. **Managed Identity** — Uses the managed identity assigned to the pod
+2. **Workload Identity** — Uses `AZURE_CLIENT_ID`, `AZURE_TENANT_ID`, and a federated service account token
-3. **Azure CLI** — Uses credentials from the Azure CLI if available
+3. **Managed Identity** — Uses the managed identity assigned to the pod
-4. **Azure PowerShell** — Uses credentials from Azure PowerShell if available
+4. **Azure CLI** — Uses credentials from the Azure CLI if available
+5. **Azure PowerShell** — Uses credentials from Azure PowerShell if available
 
 This approach is particularly useful for getting started with development and testing; it allows
 the SDK to attempt multiple authentication mechanisms seamlessly across different environments.
@@ -295,6 +296,30 @@ spec:
   [...]
 ```
 
+When `useDefaultAzureCredentials: true` is set, the plugin sidecar projects a
+service account token with the Azure workload identity audience and exposes it
+as `AZURE_FEDERATED_TOKEN_FILE`. If your platform does not already inject
+`AZURE_CLIENT_ID` and `AZURE_TENANT_ID`, you can provide them through
+`.spec.instanceSidecarConfiguration.env`:
+
+```yaml
+apiVersion: barmancloud.cnpg.io/v1
+kind: ObjectStore
+metadata:
+  name: azure-store
+spec:
+  configuration:
+    destinationPath: "<destination path here>"
+    azureCredentials:
+      useDefaultAzureCredentials: true
+  instanceSidecarConfiguration:
+    env:
+    - name: AZURE_CLIENT_ID
+      value: "<managed-identity-client-id>"
+    - name: AZURE_TENANT_ID
+      value: "<tenant-id>"
+```
+
 ### Access Key, SAS Token, or Connection String
 
 Store credentials in a Kubernetes secret:

web/package.json

@@ -28,7 +28,7 @@
     "@docusaurus/module-type-aliases": "3.10.2",
     "@docusaurus/tsconfig": "3.10.2",
     "@docusaurus/types": "3.10.2",
-    "typescript": "~6.0.0"
+    "typescript": "~7.0.0"
   },
   "browserslist": {
     "production": [

web/yarn.lock

@@ -3074,6 +3074,106 @@
   dependencies:
     "@types/yargs-parser" "*"
 
+"@typescript/typescript-aix-ppc64@7.0.2":
+  version "7.0.2"
+  resolved "https://registry.yarnpkg.com/@typescript/typescript-aix-ppc64/-/typescript-aix-ppc64-7.0.2.tgz#cdc7ce81d60f1e09034960ddfb1fb880d7a776b6"
+  integrity sha512-MTKKkWB7p/0E9xi1d1tHtZ5PiLkGEMIq88pK2CubZjOsLtYTLqhgIgi6zepFa+9GHZ6h05NMCkQxGKiPXMxXtQ==
+
+"@typescript/typescript-darwin-arm64@7.0.2":
+  version "7.0.2"
+  resolved "https://registry.yarnpkg.com/@typescript/typescript-darwin-arm64/-/typescript-darwin-arm64-7.0.2.tgz#a55fdfcfa58df58d27db2237cde6a5c1e35a7235"
+  integrity sha512-gowzar9MwS/aRWp6f3a4KUqzRjAZjOsmGNCM6LcTgXum+dBfgsBVMN+AgvOCCbguXyick6LJhpBszxMebJ8syA==
+
+"@typescript/typescript-darwin-x64@7.0.2":
+  version "7.0.2"
+  resolved "https://registry.yarnpkg.com/@typescript/typescript-darwin-x64/-/typescript-darwin-x64-7.0.2.tgz#38d1c9172800a91d707bec64d2a370a016634db4"
+  integrity sha512-SZ9xZInqApNlNGc9s0W1VSsktYSOe9cFqNOIqmN1Gs8SmkjKZYFt017G4VwPxASInODuAdbTW7sXiFUf893RgA==
+
+"@typescript/typescript-freebsd-arm64@7.0.2":
+  version "7.0.2"
+  resolved "https://registry.yarnpkg.com/@typescript/typescript-freebsd-arm64/-/typescript-freebsd-arm64-7.0.2.tgz#f1ff8810030b35d2b5be0db6a2dc650460ea94fa"
+  integrity sha512-W5NH4y/J0plIIS5b2xvTEkU7JFxyqdMAOgf+Ilhl0vHQXKO5dZoxd+C/jEtq56c4F3wk71RB4BMRQ2XdI+bwYQ==
+
+"@typescript/typescript-freebsd-x64@7.0.2":
+  version "7.0.2"
+  resolved "https://registry.yarnpkg.com/@typescript/typescript-freebsd-x64/-/typescript-freebsd-x64-7.0.2.tgz#3d86b03f353c5b1ba95162eb6ce35533bfc294bd"
+  integrity sha512-UMGDx5sTpzNw3WiPebH7l90IWfJggEd+egHt/q6p7/Cm3zqoV7VxkGXt+3DxPIw8CcmvAB0j3sVVfbhX+M4Tpw==
+
+"@typescript/typescript-linux-arm64@7.0.2":
+  version "7.0.2"
+  resolved "https://registry.yarnpkg.com/@typescript/typescript-linux-arm64/-/typescript-linux-arm64-7.0.2.tgz#d9334d96d6dac6ff85da9c865588948de939e91f"
+  integrity sha512-Qh4eU4/y3yDjnfjjyPYihMj5/ODIlmt+Bzu17OI+fiSRDW57QmU5SiN63exPRNJPKUzcc1INa1NXdrJ+MqHjUQ==
+
+"@typescript/typescript-linux-arm@7.0.2":
+  version "7.0.2"
+  resolved "https://registry.yarnpkg.com/@typescript/typescript-linux-arm/-/typescript-linux-arm-7.0.2.tgz#ad94b41e1aee2a4dcc6a298c7b67c43345fde32e"
+  integrity sha512-gffT3xPz9sR7j/YJExkyPntrI0P2EP9XbOyWzth2/Gs0RstK+90RBcO0ncXoXy/beYll1SXw846Nf2zdnEz0QQ==
+
+"@typescript/typescript-linux-loong64@7.0.2":
+  version "7.0.2"
+  resolved "https://registry.yarnpkg.com/@typescript/typescript-linux-loong64/-/typescript-linux-loong64-7.0.2.tgz#2965aee4fc873360139d893daafe6397a29138ad"
+  integrity sha512-uEHck9i8hoAzXPiYRib1O7miOnz23SxIeVl6F4LXox+qov1K35jHcEW6VHKvZI+pyvl7fZEP4MCU5LYvIq1GuQ==
+
+"@typescript/typescript-linux-mips64el@7.0.2":
+  version "7.0.2"
+  resolved "https://registry.yarnpkg.com/@typescript/typescript-linux-mips64el/-/typescript-linux-mips64el-7.0.2.tgz#1a887a311bed3a833f80bfd4a9ed37c271936cf0"
+  integrity sha512-R4KvAMnE43W5Qeqb0Ly56O3mWMWIAgsMyz36DCaycd5nbg/9kzm0liw3JocfRqyJY0KPmzFjbswozXyW0DnIYA==
+
+"@typescript/typescript-linux-ppc64@7.0.2":
+  version "7.0.2"
+  resolved "https://registry.yarnpkg.com/@typescript/typescript-linux-ppc64/-/typescript-linux-ppc64-7.0.2.tgz#8b63c9b2f445b393eb4e43ec21da225dade3577d"
+  integrity sha512-DORx5b3sd/4S7eayxm4FQv+A7CrkUIGRaHiwI8oiHTAI1fAPWhF4J0vAlkC8biAlHSVVwxMQ3tjZ2/DVbnQiiA==
+
+"@typescript/typescript-linux-riscv64@7.0.2":
+  version "7.0.2"
+  resolved "https://registry.yarnpkg.com/@typescript/typescript-linux-riscv64/-/typescript-linux-riscv64-7.0.2.tgz#b6e8a35c289b3ea97a92a41d461aaeed0d3b36e1"
+  integrity sha512-wf0jqEDOjrPRnKwYRyyJDRo11KMbvMFrU+q4zqKyChODBzvlkbhNQfKvLxQCcwTpdDaXSHZTVuh0JoCrKCUMHQ==
+
+"@typescript/typescript-linux-s390x@7.0.2":
+  version "7.0.2"
+  resolved "https://registry.yarnpkg.com/@typescript/typescript-linux-s390x/-/typescript-linux-s390x-7.0.2.tgz#2ef96693be4861f6d17965427e5b009cbbed1a3e"
+  integrity sha512-IkwJc3L7yhytWd/ewjyxNDfOmswCm9GWMJT/ue/dU4aZNbwZeYAetq42VyLmsmSjvoX7z74X6ZaYCtzAr0EuGw==
+
+"@typescript/typescript-linux-x64@7.0.2":
+  version "7.0.2"
+  resolved "https://registry.yarnpkg.com/@typescript/typescript-linux-x64/-/typescript-linux-x64-7.0.2.tgz#73269cb0baba50aea0ca060445a6b88e583f1ce2"
+  integrity sha512-EYdf2cNg7rgCWJnxCdJ+F3V39O8ihb37eHAu1LK8oAFizgTQbPOK7zHHXbPt8rX24COqODXeI3sIf0fCXG7H/A==
+
+"@typescript/typescript-netbsd-arm64@7.0.2":
+  version "7.0.2"
+  resolved "https://registry.yarnpkg.com/@typescript/typescript-netbsd-arm64/-/typescript-netbsd-arm64-7.0.2.tgz#3a3649f97fafa210b4e6e3798c15e06605c8a901"
+  integrity sha512-+polYF4MF04aPpO5FTkHran9yUQDSXqy5GiSDKpsll5jy3l3+g9QLhpf39T+ePtefhXLOGrLl0QIjkQP6VnelA==
+
+"@typescript/typescript-netbsd-x64@7.0.2":
+  version "7.0.2"
+  resolved "https://registry.yarnpkg.com/@typescript/typescript-netbsd-x64/-/typescript-netbsd-x64-7.0.2.tgz#47ec59491a40c470d2807dc4d2b825528fd979ab"
+  integrity sha512-8YIT0EHM/3dq10ZOVF/A7pc/YSMtbcecct4rWtexrnSCHOPcpC2KTLXfTCR6vDpnSiY12heNb1GiN/wu+T/FyA==
+
+"@typescript/typescript-openbsd-arm64@7.0.2":
+  version "7.0.2"
+  resolved "https://registry.yarnpkg.com/@typescript/typescript-openbsd-arm64/-/typescript-openbsd-arm64-7.0.2.tgz#796be8da0bd989d8a3fb96f2801e38a8365b4baf"
+  integrity sha512-APT8+ClYnuYm1u9+kgGXoMj2VzWzcymwh2gNSQVySHfkRDGOTVkoWLjCmOQSaO+PoqQ57B0flRp9SA+7GnnkzQ==
+
+"@typescript/typescript-openbsd-x64@7.0.2":
+  version "7.0.2"
+  resolved "https://registry.yarnpkg.com/@typescript/typescript-openbsd-x64/-/typescript-openbsd-x64-7.0.2.tgz#d37fe2a729eb942c076c454ee7f1815faf7d560f"
+  integrity sha512-yX7s+Q0Dln0Dt9tEzZsAjXXR/+ytBM7AlglaqyeMPxQszJ1JhlJdZ6jLA+IzldHtflX81em7lDao1xXu+aRRkg==
+
+"@typescript/typescript-sunos-x64@7.0.2":
+  version "7.0.2"
+  resolved "https://registry.yarnpkg.com/@typescript/typescript-sunos-x64/-/typescript-sunos-x64-7.0.2.tgz#aba8d3464c3565a7044789baba96916bd4ab2c88"
+  integrity sha512-dLJDGaLZ1D4HPQn62u1n8mBDkJREwMsAkCdkwd4Ieqw+x3TUyTsqY0YiBCtE6H6OzzgGk3iuZ3vFWRS+E8/d1g==
+
+"@typescript/typescript-win32-arm64@7.0.2":
+  version "7.0.2"
+  resolved "https://registry.yarnpkg.com/@typescript/typescript-win32-arm64/-/typescript-win32-arm64-7.0.2.tgz#b9de50a17196383f62620b5f9d0a2f34ad3b60d7"
+  integrity sha512-Gyl1Vy6OsWesLzmq+EP0Fb7b4Nid5232AvcA2SFcdYreldpNtYFFofPjnt62y9hQy7VTaZp65ICJjuAQRaVcIQ==
+
+"@typescript/typescript-win32-x64@7.0.2":
+  version "7.0.2"
+  resolved "https://registry.yarnpkg.com/@typescript/typescript-win32-x64/-/typescript-win32-x64-7.0.2.tgz#cf3b7b0d6ce5635daca4c8e01c189cdcde47ec3c"
+  integrity sha512-0BQ3HkAHHlKLSp1qRvf3SUhGpGsDuhB/jgFw75guyqbxJqEaS0Cw/VFO8i2nHglJUzQCRtMMR/IBAKE3ETMC4g==
+
 "@ungap/structured-clone@^1.0.0":
   version "1.3.3"
   resolved "https://registry.yarnpkg.com/@ungap/structured-clone/-/structured-clone-1.3.3.tgz#094041e1a4cb1987f038335421281ac8be390bcc"
@@ -8912,10 +9012,31 @@ typedarray-to-buffer@^3.1.5:
   dependencies:
     is-typedarray "^1.0.0"
 
-typescript@~6.0.0:
+typescript@~7.0.0:
-  version "6.0.3"
+  version "7.0.2"
-  resolved "https://registry.yarnpkg.com/typescript/-/typescript-6.0.3.tgz#90251dc007916e972786cb94d74d15b185577d21"
+  resolved "https://registry.yarnpkg.com/typescript/-/typescript-7.0.2.tgz#9ec773d7954a8c182c17cc5bbd575aa28bc51582"
-  integrity sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw==
+  integrity sha512-8FYau96o3NKOhbjKi/qNvG/W5jhzxkbdm5sj9AbZ/5T5sWqn3hJgLfGx27sRKZWTvyzCP8dLRBTf5tBTSRVUNA==
+  optionalDependencies:
+    "@typescript/typescript-aix-ppc64" "7.0.2"
+    "@typescript/typescript-darwin-arm64" "7.0.2"
+    "@typescript/typescript-darwin-x64" "7.0.2"
+    "@typescript/typescript-freebsd-arm64" "7.0.2"
+    "@typescript/typescript-freebsd-x64" "7.0.2"
+    "@typescript/typescript-linux-arm" "7.0.2"
+    "@typescript/typescript-linux-arm64" "7.0.2"
+    "@typescript/typescript-linux-loong64" "7.0.2"
+    "@typescript/typescript-linux-mips64el" "7.0.2"
+    "@typescript/typescript-linux-ppc64" "7.0.2"
+    "@typescript/typescript-linux-riscv64" "7.0.2"
+    "@typescript/typescript-linux-s390x" "7.0.2"
+    "@typescript/typescript-linux-x64" "7.0.2"
+    "@typescript/typescript-netbsd-arm64" "7.0.2"
+    "@typescript/typescript-netbsd-x64" "7.0.2"
+    "@typescript/typescript-openbsd-arm64" "7.0.2"
+    "@typescript/typescript-openbsd-x64" "7.0.2"
+    "@typescript/typescript-sunos-x64" "7.0.2"
+    "@typescript/typescript-win32-arm64" "7.0.2"
+    "@typescript/typescript-win32-x64" "7.0.2"
 
 undici-types@~8.3.0:
   version "8.3.0"