Update dependency @backstage/plugin-scaffolder-backend to v3.1.5 [SECURITY]

[backstage-goalie]

This PR contains the following updates:

Package	Change	Age	Confidence
@backstage/plugin-scaffolder-backend (source)	3.1.4 → 3.1.5

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

@​backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint

CVE-2026-32237 / GHSA-8wq8-6859-qx77

More information

Details

Impact

Authenticated users with permission to execute scaffolder dry-runs can gain access to server-configured environment secrets through the dry-run API response. Secrets are properly
redacted in log output but not in all parts of the response payload.

Deployments that have configured scaffolder.defaultEnvironment.secrets are affected.

Patches

This is patched in @backstage/plugin-scaffolder-backend version 3.1.5

Workarounds

Remove or empty the scaffolder.defaultEnvironment.secrets configuration from app-config.yaml. Alternatively, restrict access to the scaffolder dry-run functionality via the
permissions framework.

References

• Backstage Scaffolder Backend documentation

Severity

• CVSS Score: 4.4 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/backstage/backstage/security/advisories/GHSA-8wq8-6859-qx77
• https://nvd.nist.gov/vuln/detail/CVE-2026-32237
• https://github.com/backstage/backstage/commit/3b62dd2d6bf7623ebd23e4b5a6dceb209f98dfce
• https://github.com/backstage/backstage

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

backstage/backstage (@​backstage/plugin-scaffolder-backend)

v3.1.5

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[backstage-service]

👋 Reminder: This Renovate patch/minor PR has been open for 7 days.

Please review and merge if the changes look good. If no action is taken, this PR will be labeled force-merge in 7 days.