Update dependency @azure/identity to v4 [SECURITY]#12480
Update dependency @azure/identity to v4 [SECURITY]#12480renovate[bot] wants to merge 1 commit intomasterfrom
Conversation
Review or Edit in CodeSandboxOpen the branch in Web Editor • VS Code • Insiders |
EntelligenceAI PR SummaryUpgrades
Confidence Score: 2/5 - Changes NeededNot safe to merge — this PR upgrades Key Findings:
Files requiring special attention
|
![entelligence-ai-pr-reviews[bot]](https://avatars.githubusercontent.com/in/932812?s=60&v=4){kind=small}
There was a problem hiding this comment.
Walkthrough
This PR upgrades the @azure/identity dependency from ^3.2.1 to ^4.0.0 across five packages in the monorepo. The yarn.lock file reflects the resolved version as v4.13.1 and includes cascading updates to related Azure SDK packages, MSAL libraries, and several other transitive dependencies, along with pinned Backstage package versions for compatibility.
Changes
| File(s) | Summary |
|---|---|
packages/integration/package.json |
|
plugins/azure-sites-backend/package.json |
|
plugins/catalog-backend-module-msgraph/package.json |
|
plugins/kubernetes-backend/package.json |
|
plugins/techdocs-node/package.json |
Bumps @azure/identity dependency from ^3.2.1 to ^4.0.0 (major version upgrade). |
yarn.lock |
Resolves @azure/identity to v4.13.1; updates cascading Azure SDK packages (@azure/core-auth, @azure/core-client, @azure/core-rest-pipeline, @azure/core-tracing, @azure/core-util, @azure/logger); upgrades MSAL libraries (@azure/msal-browser v5, @azure/msal-common v16, @azure/msal-node v5); adds @typespec/ts-http-runtime; pins several @backstage/* packages to older versions; upgrades node-fetch to 2.7.0, cross-fetch to 3.2.0, core-js to 3.49.0, tslib to 2.8.1, dompurify to 2.5.9, react-syntax-highlighter to 15.6.6, and open to v10; adds large set of new transitive dependencies for older Backstage component versions. |
Sequence Diagram
This diagram shows the interactions between components:
sequenceDiagram
title @azure/identity v3 -> v4 Upgrade Across Backstage Packages
participant Integration as "@backstage/integration"
participant AzSites as "azure-sites-backend"
participant MsGraph as "catalog-backend-module-msgraph"
participant K8s as "kubernetes-backend"
participant TechDocs as "techdocs-node"
participant Identity as "@azure/identity ^4.0.0"
participant MSALNode as "@azure/msal-node ^5.1.0"
participant MSALBrowser as "@azure/msal-browser ^5.5.0"
participant MSALCommon as "@azure/msal-common 16.4.1"
participant CoreRest as "@azure/core-rest-pipeline ^1.22.0"
participant TypeSpec as "@typespec/ts-http-runtime ^0.3.4"
participant OpenPkg as "open ^10.1.0"
Note over Integration, TechDocs: All 5 packages upgrade @azure/identity 3.2.1 -> 4.0.0
Integration->>Identity: depends on
AzSites->>Identity: depends on
MsGraph->>Identity: depends on
K8s->>Identity: depends on
TechDocs->>Identity: depends on
Note over Identity: @azure/identity ^4.0.0 (was ^3.2.1)
Identity->>MSALNode: @azure/msal-node ^5.1.0
Note over MSALNode: was ^1.17.3
Identity->>MSALBrowser: @azure/msal-browser ^5.5.0
Note over MSALBrowser: was ^2.37.1
MSALNode-->>MSALCommon: @azure/msal-common 16.4.1
MSALBrowser-->>MSALCommon: @azure/msal-common 16.4.1
Note over MSALCommon: was 13.1.0
Identity->>CoreRest: @azure/core-rest-pipeline ^1.22.0
Note over CoreRest: was ^1.1.0
CoreRest->>TypeSpec: @typespec/ts-http-runtime ^0.3.4
Note over TypeSpec: NEW — replaces direct http/https-proxy-agent deps
TypeSpec->>TypeSpec: http-proxy-agent ^7.0.0
TypeSpec->>TypeSpec: https-proxy-agent ^7.0.0
Identity->>OpenPkg: open ^10.1.0
Note over OpenPkg: was ^8.0.0
Note over OpenPkg: New transitive deps: default-browser, is-inside-container, wsl-utils
Note over Identity: Removed: jws, stoppable, events, uuid (direct deps)
🔗 Cross-Repository Impact Analysis
Enable automatic detection of breaking changes across your dependent repositories. → Set up now
Learn more about Cross-Repository Analysis
What It Does
- Automatically identifies repositories that depend on this code
- Analyzes potential breaking changes across your entire codebase
- Provides risk assessment before merging to prevent cross-repo issues
How to Enable
- Visit Settings → Code Management
- Configure repository dependencies
- Future PRs will automatically include cross-repo impact analysis!
Benefits
- 🛡️ Prevent breaking changes across repositories
- 🔍 Catch integration issues before they reach production
- 📊 Better visibility into your multi-repo architecture
| "@aws-sdk/node-http-handler": "^3.350.0", | ||
| "@aws-sdk/types": "^3.347.0", | ||
| "@azure/identity": "^3.2.1", | ||
| "@azure/identity": "^4.0.0", |
There was a problem hiding this comment.
Correctness: Upgrading @azure/identity from ^3.2.1 to ^4.0.0 is a major version bump — v4 introduced breaking changes including removal/renaming of certain credential classes and options. The PR includes no source code changes (only package.json and yarn.lock), so any usage of removed APIs in the codebase will break at runtime without corresponding code updates.
🤖 AI Agent Prompt for Cursor/Windsurf
📋 Copy this prompt to your AI coding assistant (Cursor, Windsurf, etc.) to get help fixing this issue
In plugins/techdocs-node/package.json at line 47, `@azure/identity` was bumped from `^3.2.1` to `^4.0.0`. This is a major version upgrade with breaking changes. Search all source files in plugins/techdocs-node/src that import from `@azure/identity` and verify they are compatible with the v4 API (e.g., check for renamed or removed credential classes such as `InteractiveBrowserCredential` options changes, `TokenCredentialOptions` restructuring, etc.). Update any incompatible usages to match the v4 API surface.
🤖 Augment PR SummarySummary: This PR upgrades the Azure Identity client library used across the repo to the v4 major line, in response to a reported security vulnerability. Changes:
Technical Notes: This is a major-version upgrade; consumers should validate Azure auth flows and any Node/runtime requirements introduced by the new major. 🤖 Was this summary useful? React with 👍 or 👎 |
![augmentcode[bot]](https://avatars.githubusercontent.com/in/1027498?s=60&v=4){kind=small}
| }, | ||
| "dependencies": { | ||
| "@azure/identity": "^3.2.1", | ||
| "@azure/identity": "^4.0.0", |
There was a problem hiding this comment.
@azure/identity v4 has an upstream breaking change of requiring Node.js >= 18; this repo still declares engines.node as 16 || 18, so Node 16 installs/runs are likely to fail once this is merged.
Severity: high
Other Locations
plugins/azure-sites-backend/package.json:37plugins/catalog-backend-module-msgraph/package.json:48plugins/kubernetes-backend/package.json:55plugins/techdocs-node/package.json:47
🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate
Bot
force-pushed
the
renovate/npm-azure-identity-vulnerability
branch
from
c9979de to
64fb6b9
Compare
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
This PR contains the following updates:
^3.2.1→^4.0.0Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability
CVE-2024-35255 / GHSA-m5vv-6r4h-3vj9
More information
Details
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability.
Severity
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
Azure/azure-sdk-for-js (@azure/identity)
v4.2.1Compare Source
v4.2.0Compare Source
v4.1.0Compare Source
4.1.0 (2024-08-07)
Features Added
RequestOptions. docsresponse.correlatedActivityId.v3for features up to the v3 release, andv4for features up to the v4 release.Vector Search
allowUnboundedNonStreamingQueriesin query FeedOptions. Also added an internal buffer size check to prevent excessive memory consumption, throwing errors if the buffer size exceeds the default. The max buffer size can be increased using thevectorSearchBufferSizeoption from query FeedOptions.Change Feed - All versions and deletes mode
ChangeFeedStartFrom.NowandChangeFeedStartFrom.Continuation.changeFeedModein changeFeedIteratorOptions:Bypassing Integrated Cache
bypassIntegratedCachein RequestOptions.Computed Properties
Composite Indexing
HttpClientwhen constructing aCosmosClient.Breaking Changes
Dropped Support for TypeScript 4.1
Bugs Fixed
v4.0.1Compare Source
v4.0.0Compare Source
v3.4.2Compare Source
v3.4.1Compare Source
v3.4.0Compare Source
v3.3.2Compare Source
v3.3.1Compare Source
v3.3.0Compare Source
v3.2.4Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.