add changesets, bump to jose 5

Signed-off-by: Fredrik Adelöw <freben@gmail.com>

.changeset/big-yaks-film.md

@@ -0,0 +1,7 @@
+---
+'@backstage/backend-test-utils': patch
+---
+
+Added support for the new [`auth`](https://backstage.io/docs/backend-system/core-services/auth/) and [`httpAuth`](https://backstage.io/docs/backend-system/core-services/http-auth) services that were created as part of [BEP-0003](https://github.com/backstage/backstage/tree/master/beps/0003-auth-architecture-evolution). These services will be present by default in test apps, and you can access mocked versions of their features under `mockServices.auth` and `mockServices.httpAuth` if you want to inspect or replace their behaviors.
+
+There is also a new `mockCredentials` that you can use for acquiring mocks of the various types of credentials that are used in the new system.

.changeset/eleven-cows-learn.md

@@ -0,0 +1,9 @@
+---
+'@backstage/backend-plugin-api': patch
+---
+
+Added the new [`auth`](https://backstage.io/docs/backend-system/core-services/auth/), [`httpAuth`](https://backstage.io/docs/backend-system/core-services/http-auth), and [`userInfo`](https://backstage.io/docs/backend-system/core-services/user-info) services that were created as part of [BEP-0003](https://github.com/backstage/backstage/tree/master/beps/0003-auth-architecture-evolution) to the `coreServices`.
+
+At the same time, the [`httpRouter`](https://backstage.io/docs/backend-system/core-services/http-router) service gained a new `addAuthPolicy` method that lets your plugin declare exemptions to the default auth policy - for example if you want to allow unauthenticated or cookie-based access to some subset of your feature routes.
+
+If you have migrated to the new backend system, please see the [Auth Service Migration tutorial](https://backstage.io/docs/tutorials/auth-service-migration) for more information on how to move toward using these services.

.changeset/smart-owls-tease.md

@@ -0,0 +1,7 @@
+---
+'@backstage/backend-app-api': minor
+---
+
+**BREAKING**: For users that have migrated to the new backend system, incoming requests will now be rejected if they are not properly authenticated (e.g. with a Backstage bearer token or a backend token). Please see the [Auth Service Migration tutorial](https://backstage.io/docs/tutorials/auth-service-migration) for more information on how to circumvent this behavior in the short term and how to properly leverage it in the longer term.
+
+Added service factories for the new [`auth`](https://backstage.io/docs/backend-system/core-services/auth/), [`httpAuth`](https://backstage.io/docs/backend-system/core-services/http-auth), and [`userInfo`](https://backstage.io/docs/backend-system/core-services/user-info) services that were created as part of [BEP-0003](https://github.com/backstage/backstage/tree/master/beps/0003-auth-architecture-evolution).

.changeset/thirty-shirts-allow.md

@@ -0,0 +1,7 @@
+---
+'@backstage/backend-common': patch
+---
+
+Added a `createLegacyAuthAdapters` function that can be used as a compatibility adapter for backend plugins who want to start using the new [`auth`](https://backstage.io/docs/backend-system/core-services/auth/) and [`httpAuth`](https://backstage.io/docs/backend-system/core-services/http-auth) services that were created as part of [BEP-0003](https://github.com/backstage/backstage/tree/master/beps/0003-auth-architecture-evolution).
+
+See the [Auth Service Migration tutorial](https://backstage.io/docs/tutorials/auth-service-migration) for more information on the usage of this adapter.

packages/backend-app-api/package.json

@@ -66,7 +66,7 @@
     "express-promise-router": "^4.1.0",
     "fs-extra": "^11.2.0",
     "helmet": "^6.0.0",
-    "jose": "^4.6.0",
+    "jose": "^5.0.0",
     "lodash": "^4.17.21",
     "logform": "^2.3.2",
     "minimatch": "^5.0.0",

yarn.lock

@@ -3251,7 +3251,7 @@ __metadata:
     fs-extra: ^11.2.0
     helmet: ^6.0.0
     http-errors: ^2.0.0
-    jose: ^4.6.0
+    jose: ^5.0.0
     lodash: ^4.17.21
     logform: ^2.3.2
     minimatch: ^5.0.0
@@ -32127,7 +32127,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"jose@npm:^4.15.4, jose@npm:^4.6.0":
+"jose@npm:^4.15.4":
   version: 4.15.4
   resolution: "jose@npm:4.15.4"
   checksum: dccad91cb3357f36423774a0b89ad830dd84b31090de65cd139b85488439f16a00f8c59c0773825e8a1adb0dd9d13ad725ad66e6ea33880ecb3959bb99e1ea5b