chore(deps): bump install-dynamic-plugins to 0.4.0

[jonkoops]

Bump @red-hat-developer-hub/cli-module-install-dynamic-plugins to 0.4.0, which adds ref:// plugin reference resolution (rhdh-plugins#4110).

This enables package: ref://plugin-name syntax in dynamic-plugins.yaml, resolving plugin references by name against the defaults catalog — decoupling plugin configuration from the full OCI registry path. Needed for wrapper removal (RHDHPLAN-934).

Refs: RHIDP-15873

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rhdh-qodo-merge]

PR Summary by Qodo

Bump install-dynamic-plugins to 0.4.0 (ref:// plugin references)

⚙️ Configuration changes ✨ Enhancement 🕐 10-20 Minutes

AI Description

• Bump install-dynamic-plugins CLI module to 0.4.0 in backend and local harness.
• Enable ref:// plugin reference resolution via the updated CLI implementation.
• Refresh yarn.lock to reflect updated transitive dependencies (e.g., tar).

Diagram

graph TD
  A["Backend package"] --> C["install-dynamic-plugins 0.4.0"] --> D["ref:// resolution"]
  B["Local harness"] --> C --> D
  E["dynamic-plugins.yaml"] --> D --> F["Defaults catalog"]
  G["yarn.lock"] --> C

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Centralize CLI version pinning

• ➕ Avoids backend vs local harness version drift over time
• ➕ Makes upgrades a single-change operation (e.g., one config/file)
• ➖ Requires additional wiring (script reads from package.json or a shared env file)
• ➖ Slightly increases indirection for local harness users

2. Use a semver range (e.g., ^0.4.0) for the backend dependency

• ➕ Allows automatic patch/minor updates without manual bumps
• ➕ Potentially reduces churn for small upstream fixes
• ➖ Reduces reproducibility across environments unless lockfile discipline is strict
• ➖ Can introduce unexpected behavior changes if upstream releases quickly

Recommendation: The PR’s approach (explicitly pinning 0.4.0 in both the backend dependency and the local harness) is the safest path to ensure consistent behavior and to unlock ref:// resolution. Consider a follow-up to centralize the version pin so local and CI tooling cannot drift.

Files changed (3) +22 / -9

Other (3) +22 / -9

populate.shPin local harness CLI to install-dynamic-plugins 0.4.0 +1/-1

Pin local harness CLI to install-dynamic-plugins 0.4.0

• Updates the pinned CLI version used by the local E2E harness from 0.2.0 to 0.4.0 to match CI/expected behavior and pick up ref:// resolution support.

e2e-tests/local-harness/populate.sh

package.jsonBump backend dependency on cli-module-install-dynamic-plugins to 0.4.0 +1/-1

Bump backend dependency on cli-module-install-dynamic-plugins to 0.4.0

• Upgrades @red-hat-developer-hub/cli-module-install-dynamic-plugins from 0.3.0 to 0.4.0, enabling ref:// plugin reference resolution capabilities through the newer CLI module.

packages/backend/package.json

yarn.lockRefresh lockfile for install-dynamic-plugins 0.4.0 and updated tar +20/-7

Refresh lockfile for install-dynamic-plugins 0.4.0 and updated tar

• Updates yarn.lock to reflect the 0.4.0 resolution of the CLI module and the resulting transitive updates (including tar version range and resolved version/checksum changes).

yarn.lock

[rhdh-qodo-merge]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

[github-actions]

Image was built and published successfully. It is available at:

• quay.io/rhdh-community/rhdh:pr-5208
• quay.io/rhdh-community/rhdh:pr-5208-4d61c361

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 59.96%. Comparing base (84072ae) to head (4d61c36).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5208      +/-   ##
==========================================
- Coverage   63.69%   59.96%   -3.74%     
==========================================
  Files         123      111      -12     
  Lines        2424     2198     -226     
  Branches      572      546      -26     
==========================================
- Hits         1544     1318     -226     
  Misses        879      879              
  Partials        1        1              

Flag	Coverage Δ
rhdh	59.96% <ø> (-3.74%)	⬇️

Components	Coverage Δ
Backend plugins	∅ <ø> (∅)
Backend app	66.66% <ø> (ø)
Frontend app	58.89% <ø> (ø)
Plugin utils	∅ <ø> (∅)
Dynamic plugins utils	∅ <ø> (∅)

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 84072ae...4d61c36. Read the comment docs.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.