Skip to content

Update dependency @backstage/plugin-auth-backend to v0.27.1 [SECURITY] #8113

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
backstage-goalie wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update dependency @backstage/plugin-auth-backend to v0.27.1 [SECURITY] #8113

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
277 changes: 162 additions & 115 deletions workspaces/apiiro/yarn.lock
View file
Open in desktop

Large diffs are not rendered by default.

5 changes: 5 additions & 0 deletions workspaces/azure-sites/.changeset/renovate-8a83864.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
'@backstage-community/plugin-azure-sites-backend': patch
---

Updated dependency `@backstage/plugin-auth-backend` to `^0.27.0`.
2 changes: 1 addition & 1 deletion workspaces/azure-sites/plugins/azure-sites-backend/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,7 @@
"devDependencies": {
"@backstage/backend-defaults": "^0.15.1",
"@backstage/cli": "^0.35.3",
"@backstage/plugin-auth-backend": "^0.26.0",
"@backstage/plugin-auth-backend": "^0.27.0",
Copy link

Copilot AI Apr 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The dependency is updated to ^0.27.0, which still permits 0.27.0. Given the PR is addressing vulnerabilities patched in 0.27.1+, raise the minimum version (e.g., ^0.27.1) to ensure the vulnerable release can’t be selected in future installs.

Suggested change
"@backstage/plugin-auth-backend": "^0.27.0",
"@backstage/plugin-auth-backend": "^0.27.1",

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Apr 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The PR description says the patch is in 0.27.1+, but ^0.27.0 still allows 0.27.0. To ensure only patched versions are permitted, change this to ^0.27.1 (or >=0.27.1 <0.28.0).

Suggested change
"@backstage/plugin-auth-backend": "^0.27.0",
"@backstage/plugin-auth-backend": "^0.27.1",

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Apr 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same security concern: ^0.27.0 includes the vulnerable 0.27.0; the patch is in 0.27.1+. Please bump the range to ^0.27.1 (or higher).

Suggested change
"@backstage/plugin-auth-backend": "^0.27.0",
"@backstage/plugin-auth-backend": "^0.27.1",

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Apr 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Because this PR is addressing CVEs fixed in @backstage/plugin-auth-backend >= 0.27.1, using the semver range "^0.27.0" still allows installing 0.27.0 (vulnerable). Bump the minimum to at least "^0.27.1" (or pin to the patched patch-level you intend, e.g. "^0.27.3") so downstream consumers can’t resolve the vulnerable version.

Suggested change
"@backstage/plugin-auth-backend": "^0.27.0",
"@backstage/plugin-auth-backend": "^0.27.1",

Copilot uses AI. Check for mistakes.
"@backstage/plugin-auth-backend-module-guest-provider": "^0.2.15",
"@types/supertest": "^7.0.0"
},
Expand Down
300 changes: 210 additions & 90 deletions workspaces/azure-sites/yarn.lock
View file
Open in desktop

Large diffs are not rendered by default.

273 changes: 160 additions & 113 deletions workspaces/blackduck/yarn.lock
View file
Open in desktop

Large diffs are not rendered by default.

5 changes: 5 additions & 0 deletions workspaces/feedback/.changeset/renovate-8a83864.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
'@backstage-community/plugin-feedback-backend': patch
---

Updated dependency `@backstage/plugin-auth-backend` to `^0.27.0`.
2 changes: 1 addition & 1 deletion workspaces/feedback/plugins/feedback-backend/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@
},
"devDependencies": {
"@backstage/cli": "^0.33.1",
"@backstage/plugin-auth-backend": "^0.25.2",
"@backstage/plugin-auth-backend": "^0.27.0",
Copy link

Copilot AI Apr 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The dependency range ^0.27.0 includes the vulnerable 0.27.0. Since the security advisory is fixed in 0.27.1+, update the constraint to at least ^0.27.1 so lockfile regenerations can’t pick 0.27.0.

Suggested change
"@backstage/plugin-auth-backend": "^0.27.0",
"@backstage/plugin-auth-backend": "^0.27.1",

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Apr 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This security update is patched starting in @backstage/plugin-auth-backend 0.27.1, but the declared range is ^0.27.0 which still allows installing the vulnerable 0.27.0. Bump the minimum to ^0.27.1 (or higher) to ensure the patched version is always selected, and keep the changeset text in sync.

Suggested change
"@backstage/plugin-auth-backend": "^0.27.0",
"@backstage/plugin-auth-backend": "^0.27.1",

Copilot uses AI. Check for mistakes.
"@backstage/plugin-auth-backend-module-guest-provider": "^0.2.10",
"@backstage/plugin-catalog-backend": "^3.0.0",
Comment on lines 58 to 62
Copy link

Copilot AI Apr 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The dependency range ^0.27.0 still permits selecting 0.27.0, but the PR description indicates the security fixes are in 0.27.1+. Consider bumping this to ^0.27.1 (or equivalent) to enforce the patched minimum.

Copilot uses AI. Check for mistakes.
"@types/nodemailer": "7.0.11",
Expand Down
Loading