[zjy365]

Why

All workspaces were pinned to the deprecated 0.18.x / 0.21.x line of @kubernetes/client-node, which still depends on the unmaintained request library (deprecated since 2020). Versions were also inconsistent across the monorepo (0.18.0, ^0.18.1, ^0.21.0), resulting in multiple instances in the pnpm lockfile.

Target is 1.4.0 — the latest stable line that supports Node 20 (the repo pins Node 20.20.2 in .nvmrc, engines, and the deploy image). Upstream 2.x drops Node 20 support, so it is out of scope until the repo moves to Node 22+.

What changed

Dependency unification

• desktop, providers/license, providers/costcenter: ^1.4.0 (single instance)
• packages/client-sdk, packages/metrics-sdk: devDeps to ^1.4.0; peer ranges narrowed to >=1.0.0 <2.0.0 since their compiled code now requires the 1.x object-args API
• packages/mcp-sdk: peer keeps >=0.18.1 <2.0.0 (it never calls the library, types only)

API migration (0.18 → 1.x breaking changes)

• Generated APIs moved from positional args to object args (listNamespacedPod(ns, ...) → listNamespacedPod({ namespace, ... }))
• Methods now return resources directly — removed all .body unwrapping on success responses, including call sites that tsc could not catch because the wrapper return type is any (payment status, notification list, guide update, default/installed apps)
• PatchUtils → PatchStrategy; patch Content-Type (JSON patch / strategic-merge) is now passed via request middleware, since the object-args API no longer accepts a headers option
• HttpError → ApiException (statusCode → code); .body on error objects is preserved
• applytoHTTPSOptions → applyToHTTPSOptions
• packages/metrics-sdk: migrated createSelfSubjectAccessReview to object args (would have thrown RequiredError at runtime otherwise)

Compatibility notes

• Node: no change required. 1.4.0's CI matrix covers Node 18/20/22/23/24, and neither the package nor any transitive dependency declares an engine constraint above Node 18. Verified end-to-end on Node 20.20.2.
• ESM: @kubernetes/client-node is ESM-only since 1.0.0. All consumers here go through Next.js webpack or vitest, both verified working.
• Downstream SDK consumers: apps consuming sealos-desktop-sdk / @sealos/metrics-sdk must upgrade their own @kubernetes/client-node to >= 1.0.0 when they pick up this version (peer range now enforces it).

Verification

• tsc --noEmit: desktop / license / client-sdk / metrics-sdk — 0 errors; costcenter — 1 pre-existing error, identical to main (unrelated Mock typing)
• vitest run --project unit (desktop): 38 files, 281 tests passed
• next build (desktop): success — confirms the ESM-only package bundles fine
• pnpm run build-packages: all workspace packages build
• Runtime smoke test on Node 20.20.2: ESM import + KubeConfig.loadFromDefault + makeApiClient(CoreV1Api / CustomObjectsApi) OK
• Lockfile audit: only the k8s client dependency tree changed, no unrelated bumps

Follow-ups (not in this PR)

• Node 20 is EOL (2026-04-30). Plan the Node 22 bump; after that, moving to client 2.x is essentially a version-only change (API shape is identical to 1.x).