[Backport 1.3] [1.x backport] Bump joi to v14 to avoid the possibility of prototype poisoning in a nested dependency

[opensearch-trigger-bot]

Backport 4626066 from #4211.

[codecov]

Codecov Report

Merging #4345 (6f96484) into 1.3 (b3c3fd7) will increase coverage by 0.04%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##              1.3    #4345      +/-   ##
==========================================
+ Coverage   67.45%   67.50%   +0.04%     
==========================================
  Files        3044     3044              
  Lines       58692    58692              
  Branches     8902     8902              
==========================================
+ Hits        39591    39619      +28     
+ Misses      16947    16925      -22     
+ Partials     2154     2148       -6     

Flag	Coverage Δ
Linux	67.45% <ø> (+<0.01%)	⬆️
Windows	67.45% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

see 6 files with indirect coverage changes

[AMoo-Miki]

I am not happy to see joi@13.x.x still there.

[joshuarrrr]

This is a major version bump - I didn't see any analysis about how/why this is safe to backport to the 1.x line - can we provide that here?

[ashwin-pc]

here are the breaking changes for going from 13 to 14 hapijs/joi#1615

• stripUnknown: only one use and does not affect us
• Stricter and safer parsing of numbers: Again should not affect us
• Fixed output result of Joi.string().valid(...).insensitive(): Does not affect us
• Nested paths on object.or/nand/and/xor/with/without(): We dont seem to be using these operations
• Examples are now validated again and can be replaced: We dont use .example()
• Lazy schemas are now less lazy by default : We dont use lazy schemas
• array.min/max/length will be overridden by last call: We dont use array().min/max/length
• object.pattern and string.regex now preserve most of the flags: None of our uses use any of the regex flags
• Single year is now parsed correctly for ISO dates: We dont use this
• Correctly apply labels to alternatives schemas: We dont use this
• Error message override is also applied to individual errors: only affects the error details to be more consistent. Does not affect our uses of JOI.

Based on this i think this is safe to backport to 1.3