[Snyk] Fix for 16 vulnerabilities#4531
Closed
snyk-io[bot] wants to merge 1 commit intomasterfrom
Closed
Conversation
…educe vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230 - https://snyk.io/vuln/SNYK-JS-IP-6240864 - https://snyk.io/vuln/SNYK-JS-TARFS-9535930 - https://snyk.io/vuln/SNYK-JS-BRACES-6838727 - https://snyk.io/vuln/SNYK-JS-OCTOKITREQUEST-8730853 - https://snyk.io/vuln/SNYK-JS-OCTOKITREQUESTERROR-8730854 - https://snyk.io/vuln/SNYK-JS-PATHTOREGEXP-7925106 - https://snyk.io/vuln/SNYK-JS-PATHTOREGEXP-8482416 - https://snyk.io/vuln/SNYK-JS-IP-7148531 - https://snyk.io/vuln/SNYK-JS-TAR-6476909 - https://snyk.io/vuln/SNYK-JS-INFLIGHT-6095116 - https://snyk.io/vuln/SNYK-JS-BODYPARSER-7926860 - https://snyk.io/vuln/SNYK-JS-GRAPHQL-5905181 - https://snyk.io/vuln/SNYK-JS-COOKIE-8163060 - https://snyk.io/vuln/SNYK-JS-SEND-7926862 - https://snyk.io/vuln/SNYK-JS-SERVESTATIC-7926865
Review or Edit in CodeSandboxOpen the branch in Web Editor • VS Code • Insiders |
|
No applications have been configured for previews targeting branch: master. To do so go to restack console and configure your applications for previews. |
Reviewer's Guide by SourceryThis pull request updates the versions of No diagrams generated as the changes look simple and do not need a visual representation. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
We have skipped reviewing this pull request. Here's why:
- It seems to have been created by a bot (hey, snyk-io[bot]!). We assume it knows what it's doing!
- It seems to have been created by a bot ('[Snyk]' found in title). We assume it knows what it's doing!
- We don't review packaging changes - Let us know if you'd like us to change this.
![graphite-app[bot]](https://avatars.githubusercontent.com/in/158384?s=60&v=4){kind=small}
Comment on lines
+50
to
+56
| "@backstage/backend-tasks": "0.6.1", | ||
| "@backstage/catalog-client": "workspace:^", | ||
| "@backstage/catalog-model": "workspace:^", | ||
| "@backstage/config": "workspace:^", | ||
| "@backstage/integration": "workspace:^", | ||
| "@backstage/plugin-bitbucket-cloud-common": "workspace:^", | ||
| "@backstage/plugin-catalog-common": "workspace:^", | ||
| "@backstage/plugin-bitbucket-cloud-common": "0.1.0", | ||
| "@backstage/plugin-catalog-common": "0.1.0", |
There was a problem hiding this comment.
Caution: Replacing workspace references with pinned versions
This change replaces workspace:^ references with specific version numbers (0.6.1 and 0.1.0), which fundamentally changes how dependencies are resolved in this Yarn workspace.
In a monorepo setup:
workspace:^ensures local development versions are used- Pinned versions fetch from external registry instead of using local code
This approach may cause:
- Version mismatches between local development and production
- Integration issues with other workspace packages
- Difficulty testing local changes across packages
Consider either:
- Maintaining the workspace references for development flexibility
- Ensuring these specific versions are fully compatible with all other packages in the monorepo
- Implementing a more comprehensive strategy for vulnerability management that preserves workspace integrity
Suggested change
| "@backstage/backend-tasks": "0.6.1", | |
| "@backstage/catalog-client": "workspace:^", | |
| "@backstage/catalog-model": "workspace:^", | |
| "@backstage/config": "workspace:^", | |
| "@backstage/integration": "workspace:^", | |
| "@backstage/plugin-bitbucket-cloud-common": "workspace:^", | |
| "@backstage/plugin-catalog-common": "workspace:^", | |
| "@backstage/plugin-bitbucket-cloud-common": "0.1.0", | |
| "@backstage/plugin-catalog-common": "0.1.0", | |
| "@backstage/backend-tasks": "workspace:^", | |
| "@backstage/catalog-client": "workspace:^", | |
| "@backstage/catalog-model": "workspace:^", | |
| "@backstage/config": "workspace:^", | |
| "@backstage/integration": "workspace:^", | |
| "@backstage/plugin-bitbucket-cloud-common": "workspace:^", | |
| "@backstage/plugin-catalog-common": "workspace:^", |
Spotted by Diamond
Is this helpful? React 👍 or 👎 to let us know.
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub ↗. |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Snyk has created this PR to fix 16 vulnerabilities in the yarn dependencies of this project.
Snyk changed the following file(s):
plugins/catalog-backend-module-bitbucket-cloud/package.jsonNote for zero-installs users
If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the
.yarn/cache/directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to runyarnto update the contents of the./yarn/cachedirectory.If you are not using zero-install you can ignore this as your flow should likely be unchanged.
Vulnerabilities that will be fixed with an upgrade:
SNYK-JS-CROSSSPAWN-8303230
SNYK-JS-IP-6240864
SNYK-JS-TARFS-9535930
SNYK-JS-BRACES-6838727
SNYK-JS-OCTOKITREQUEST-8730853
SNYK-JS-OCTOKITREQUESTERROR-8730854
SNYK-JS-PATHTOREGEXP-7925106
SNYK-JS-PATHTOREGEXP-8482416
SNYK-JS-IP-7148531
SNYK-JS-TAR-6476909
SNYK-JS-INFLIGHT-6095116
SNYK-JS-BODYPARSER-7926860
SNYK-JS-GRAPHQL-5905181
SNYK-JS-COOKIE-8163060
SNYK-JS-SEND-7926862
SNYK-JS-SERVESTATIC-7926865
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Cross-site Scripting (XSS)
🦉 Regular Expression Denial of Service (ReDoS)
🦉 Server-side Request Forgery (SSRF)
Summary by Sourcery
Update dependencies to fix multiple security vulnerabilities in the Backstage Bitbucket Cloud catalog backend module
Bug Fixes:
Enhancements: