[Snyk] Security upgrade @kubernetes/client-node from 0.22.3 to 1.0.0

[metju90]

Snyk has created this PR to fix 2 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json
• package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Server-side Request Forgery (SSRF) SNYK-JS-REQUEST-3361831	550
	Improper Validation of Specified Index, Position, or Offset in Input SNYK-JS-UUID-16133035	540

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Server-side Request Forgery (SSRF)

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Dependency Version Conflict 🔴 [critical] The upgraded @kubernetes/client-node@1.0.0 now explicitly depends on form-data: ^4.0.0. However, the existing overrides in package.json (visible in context) force form-data to version 2.5.5. This major version mismatch is highly likely to cause runtime errors (such as 'form.getHeaders is not a function' or similar) because node-fetch (the new underlying HTTP client) and the Kubernetes client's internal logic expect the v4 API. The override should be updated to a compatible v4 version. "form-data": "^4.0.0", Breaking API Upgrade 🟠 [major] Upgrading @kubernetes/client-node from 0.22.3 to 1.0.0 is a major breaking change. This version completely removes the request and byline dependencies in favor of node-fetch. Application code that relies on passing request options (like custom proxies or agents), accesses the internal request state, or uses the specific streaming behaviors of the previous version (especially in Watch or Logs APIs) will break. This automated PR does not include the necessary code migrations required for this major version bump. "@kubernetes/client-node": "^1.0.0", Type Definition Conflict 🟡 [minor] @kubernetes/client-node@1.0.0 incorrectly includes @types/node: ^22.0.0 in its runtime dependencies. Since this project already depends on @types/node: ^20.17.52 at the root, this will result in two different versions of Node.js global type definitions being present in the dependency tree. This typically causes 'Duplicate identifier' errors during TypeScript compilation (tsc), preventing the project from building successfully. "@types/node": "^22.0.0",

📚 Repository Context Analyzed This review considered 15 relevant code sections from 2 files (average relevance: 0.75) package-lock.json (14 segments, lines 2323-2528) package.json (lines 1-119)