-
Notifications
You must be signed in to change notification settings - Fork 617
Update dependency @backstage/backend-defaults to ^0.12.0 [SECURITY] #7348
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| --- | ||
| '@backstage-community/plugin-feedback-backend': patch | ||
| --- | ||
|
|
||
| Updated dependency `@backstage/backend-defaults` to `^0.12.0`. |
| Original file line number | Diff line number | Diff line change | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -37,7 +37,7 @@ | |||||||||||||||||
| "tsc": "tsc" | ||||||||||||||||||
| }, | ||||||||||||||||||
| "dependencies": { | ||||||||||||||||||
| "@backstage/backend-defaults": "^0.11.1", | ||||||||||||||||||
| "@backstage/backend-defaults": "^0.12.0", | ||||||||||||||||||
|
||||||||||||||||||
| "@backstage/backend-defaults": "^0.12.0", | |
| "@backstage/backend-defaults": "^0.12.2", |
Copilot
AI
Apr 18, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
For a security-driven upgrade, the version range should enforce a patched minimum. ^0.12.0 still allows installing 0.12.0, which predates the CVE fixes called out in the PR. Consider bumping this to ^0.12.2 (or another range with a >=0.12.2 lower bound) so future lockfile refreshes can’t reintroduce the vulnerable version.
| "@backstage/backend-defaults": "^0.12.0", | |
| "@backstage/backend-defaults": "^0.12.2", |
Copilot
AI
Apr 17, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This dependency range is updated to ^0.12.0, but the PR is flagged as a security upgrade to v0.12.2. To make the security intent durable (e.g., across lockfile refreshes), bump the minimum to ^0.12.2 (or whatever patched patch-level you intend).
| "@backstage/backend-plugin-api": "^1.4.1", | |
| "@backstage/backend-plugin-api": "^1.4.2", |
Copilot
AI
Apr 16, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@backstage/backend-dynamic-feature-service and @backstage/backend-test-utils in this dependency set still pull @backstage/backend-defaults@^0.11.x (visible in the workspace lockfile), which keeps the vulnerable version around even after bumping this direct dependency. To fully remediate, please bump those dependencies to versions that depend on patched @backstage/backend-defaults (>=0.12.2) or otherwise eliminate the ^0.11.x constraint.
| "@backstage/backend-defaults": "^0.12.0", | |
| "@backstage/backend-dynamic-feature-service": "^0.7.2", | |
| "@backstage/backend-plugin-api": "^1.4.1", | |
| "@backstage/backend-test-utils": "^1.7.0", | |
| "@backstage/backend-defaults": "^0.12.2", | |
| "@backstage/backend-dynamic-feature-service": "^0.8.0", | |
| "@backstage/backend-plugin-api": "^1.4.1", | |
| "@backstage/backend-test-utils": "^1.8.0", |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Security: dependency range ^0.12.0 can resolve to
@backstage/backend-defaults0.12.0/0.12.1, but the advisory says the fix starts at 0.12.2. Please bump the minimum to >= 0.12.2 (e.g., ^0.12.2) to ensure consumers can’t end up on a vulnerable patch.