Skip to content

[Snyk] Fix for 2 vulnerabilities #12449

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
q1blue wants to merge 1 commit into from
+5 −5
Closed

[Snyk] Fix for 2 vulnerabilities #12449

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions plugins/catalog-backend-module-openapi/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,12 +33,12 @@
},
"dependencies": {
"@apidevtools/json-schema-ref-parser": "^9.0.6",
"@backstage/backend-common": "workspace:^",
"@backstage/catalog-model": "workspace:^",
"@backstage/config": "workspace:^",
"@backstage/backend-common": "0.24.1",
"@backstage/catalog-model": "0.1.1",
"@backstage/config": "0.1.1",
"@backstage/integration": "workspace:^",
"@backstage/plugin-catalog-backend": "workspace:^",
"@backstage/plugin-catalog-common": "workspace:^",
"@backstage/plugin-catalog-backend": "2.0.0",
"@backstage/plugin-catalog-common": "0.1.0",
Comment on lines +36 to +41
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot Feb 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

This automated change from Snyk is incorrect and will likely break your application. It should not be merged as is.

Here's why:

  1. Breaks Monorepo Dependency Linking: The change replaces workspace:^ dependencies with fixed versions from the public registry. In a monorepo using Yarn workspaces, this is a critical error. It breaks the linkage between local packages, meaning this package will use outdated, published code instead of the current code from your local workspace. This will lead to major inconsistencies and break local development workflows.

  2. Major Version Downgrades: Several of the pinned versions are severe downgrades from what's in your workspace, which will almost certainly introduce breaking API changes:

    • @backstage/catalog-model: Pinned to 0.1.1, but the workspace version appears to be 1.4.1.
    • @backstage/config: Pinned to 0.1.1, but the workspace version appears to be 1.0.8.
    • @backstage/plugin-catalog-common: Pinned to 0.1.0, but the workspace version appears to be 1.0.15.

Correct Way to Fix This

The goal is to fix vulnerabilities in ajv and qs. Instead of these disruptive changes, the vulnerabilities should be addressed at the source:

  • Use Yarn Resolutions: The recommended approach is to add a resolutions field to the root package.json of your monorepo to force non-vulnerable versions of the transitive dependencies across all packages. For example:

    "resolutions": {
  "ajv": "^8.12.0",
  "qs": "^6.5.3"
}

    After adding this, run yarn install to update the yarn.lock file. This will fix the security vulnerabilities without breaking your monorepo's dependency structure.

"@backstage/plugin-catalog-node": "workspace:^",
"@backstage/types": "workspace:^",
"winston": "^3.2.1",
Expand Down
Loading