Stop using bluebird but keep in release for extenders

[1000TurquoisePogs]

Proposed changes

Remove the bluebird library (3.7.2) from production dependencies and replace all usages with native Node.js async/await and the built-in Promise. Node.js 18+ provides a standards-compliant Promise implementation that covers all of the functionality bluebird was being used for in this codebase.

What changed

Files with coroutine conversions (19 Promise.coroutine / generator functions converted to async/await)

File	Coroutines converted
lib/plugin-loader.js	loadPlugins, installPlugins
lib/index.js	start, loadPlugins
lib/util.js	uniqueIps
lib/webserver.js	validateAndPreprocessConfig, startListening
lib/webapp.js	installPlugin, _makeRouter, _installDataServices
lib/webauth.js	restorePluginHaSession, _doLogoutInner, _passwordResetInner, _authenticateOrRefresh, semiAuthenticatedMiddleware.authenticate, middleware.authenticate
lib/swagger-catalog.js	getSwaggerDocs
lib/reader.js	unitTest (dead code block)
lib/apiml.js	setBestIpFromConfig
lib/auth-manager.ts	loadAuthenticators
plugins/sso-auth/lib/zssHandler.js	authorized

Files with import-only removals (bluebird was imported but unused)

• lib/jsonUtils.js
• lib/javaManager.ts
• lib/javaTypes.ts
• utils/packaging-utils.js
• utils/install-app.js
• plugins/sso-auth/lib/apimlHandler.js
• plugins/sso-auth/lib/ssoAuth.js
• plugins/config/lib/configService.js
• plugins/terminal-proxy/lib/terminalProxy.js
• test/webapp/agent-connectivity.js

Supporting changes

• lib/auth-manager.ts: Added configuration: any; class field declaration. Previously set via Object.assign(this, options) which hid it from TypeScript; now required since the coroutine (which used this via the bluebird coroutine binding) became a proper class method.
• package.json: Removed "bluebird": "3.7.2" from dependencies.

Conversion pattern applied

// Before — bluebird coroutine
const BBPromise = require('bluebird');

someMethod = BBPromise.coroutine(function*(arg1, arg2) {
  const result = yield asyncOperation(arg1);
  const value  = yield* generatorDelegate(result);
  return value;
});

// After — native async/await
async someMethod(arg1, arg2) {
  const result = await asyncOperation(arg1);
  const value  = await generatorDelegate(result);
  return value;
}

Consequences

Performance

• Eliminated startup overhead: bluebird patches and wraps Promises at load time, adding measurable startup cost. Native Promises require no such initialization.
• Reduced heap allocations: bluebird wraps every resolved value in its own PromiseArray or Promise subclass. Node.js native Promises are allocated and collected by V8's built-in garbage collector using optimized internal paths.
• Better JIT optimization: V8 has dedicated fast paths for native async/await (using microtask queue intrinsics). bluebird coroutines run through generator protocol machinery, which prevents certain V8 optimizations such as inlining and escape analysis on the returned promise objects.

Capabilities / behavior changes

• Promise.coroutine removed: This is bluebird's generator-based async primitive. All call sites have been converted to native async/await — no functionality is lost.
• No other bluebird features were in use: The codebase did not use bluebird's Promise.map, .each, .promisify, .promisifyAll, cancellation, progress callbacks, or any other bluebird extension.

Testing

1. Start the Zowe app-server and confirm server startup log shows no errors related to authentication plugin loading (loadAuthenticators) or plugin installation (installPlugins).
2. Log in through the Zowe Desktop to exercise the webauth.js async paths (_authenticateOrRefresh, middleware, etc.).
3. Navigate to an app that uses a dataservice to exercise webapp.js router installation (installPlugin, _makeRouter, _installDataServices).
4. If an SSO/APIML environment is available, confirm SSO login and ZSS-proxied calls work (exercises zssHandler.js authorized and apiml.js setBestIpFromConfig).

[1000TurquoisePogs]

I'm aware of extenders that use bluebird due to our history of including it, so I won't remove it from the package, just mark it as a 'devdep' in that WE dont use it anymore in this PR. It'll still ship.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud