Skip to content

[Snyk] Fix for 3 vulnerabilities #12088

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
q1blue wants to merge 1 commit into from
Closed

[Snyk] Fix for 3 vulnerabilities #12088

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions plugins/entity-feedback-backend/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,15 +22,15 @@
"postpack": "backstage-cli package postpack"
},
"dependencies": {
"@backstage/backend-common": "workspace:^",
"@backstage/backend-common": "0.24.1",
"@backstage/backend-plugin-api": "workspace:^",
"@backstage/catalog-client": "workspace:^",
"@backstage/catalog-model": "workspace:^",
"@backstage/catalog-client": "0.2.0",
"@backstage/catalog-model": "0.1.1",
"@backstage/config": "workspace:^",
"@backstage/plugin-auth-node": "workspace:^",
"@backstage/plugin-auth-node": "0.6.0",
"@backstage/plugin-entity-feedback-common": "workspace:^",
"@types/express": "*",
"express": "^4.18.1",
"express": "^4.22.0",
Comment on lines +25 to +33
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot Feb 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

These dependency updates are incorrect and will likely break the application for several reasons:

  1. Improper Pinning of Workspace Dependencies: The change from workspace:^ to pinned versions is an anti-pattern in a Yarn workspace monorepo. It bypasses the intended local package linking, which can lead to multiple versions of the same package and hard-to-diagnose bugs. The correct way to update these is to update the package versions at their source within the monorepo.

  2. Major Package Downgrades: Some of the pinned versions are severe downgrades from the versions available in the workspace:

    • @backstage/catalog-client is downgraded from version 1.4.3 to 0.2.0.
    • @backstage/catalog-model is downgraded from version 1.4.1 to 0.1.1.
      These are major version downgrades that are almost certain to introduce breaking changes and cause application failures.

  3. Missing yarn.lock Update: The PR description notes that the yarn.lock file has not been updated. Any change to dependencies in package.json must be accompanied by a corresponding update to the lock file to ensure deterministic and correct installs across all environments.

Given these critical issues, these changes should be rejected.

"express-promise-router": "^4.1.0",
"knex": "^2.0.0",
"node-fetch": "^2.6.7",
Expand Down
Loading