Skip to content

[Snyk] Security upgrade @backstage/types from 0.0.0-use.local to 0.1.1 #10483

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
q1blue wants to merge 1 commit into from
Closed

[Snyk] Security upgrade @backstage/types from 0.0.0-use.local to 0.1.1 #10483

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion packages/errors/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@
"clean": "backstage-cli package clean"
},
"dependencies": {
"@backstage/types": "workspace:^",
"@backstage/types": "0.1.1",
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot Jan 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

This change downgrades the @backstage/types dependency from the workspace version (which is 1.1.0) to a pinned version 0.1.1 from the registry. This is problematic for several reasons:

  1. Breaks Monorepo Integrity: In a Yarn workspace-based monorepo, using workspace:^ ensures that local packages depend on each other's source code within the repository. Pinning to a specific version from the npm registry breaks this linkage, potentially causing inconsistencies and bugs if other packages use the workspace version.
  2. Significant Downgrade: The current version of @backstage/types in this repository is 1.1.0. This change downgrades it to 0.1.1, which is a very old version and will likely cause compilation errors or runtime issues due to API incompatibilities.
  3. Incorrect Vulnerability Fix: While the intent is to fix security vulnerabilities, this approach is incorrect. The vulnerabilities should be addressed in the current version of @backstage/types (1.1.0) by updating its transitive dependencies, not by downgrading it.

It is strongly recommended to revert this change and keep using the workspace dependency. If there are vulnerabilities in @backstage/types, they should be fixed within that package directly.

Suggested change
"@backstage/types": "0.1.1",
"@backstage/types": "workspace:^",

"cross-fetch": "^3.1.5",
"serialize-error": "^8.0.1"
},
Expand Down
Loading