[Snyk] Fix for 1 vulnerabilities#5128
Conversation
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-BABELRUNTIME-10044504
Review or Edit in CodeSandboxOpen the branch in Web Editor • VS Code • Insiders |
|
No applications have been configured for previews targeting branch: master. To do so go to restack console and configure your applications for previews. |
Reviewer's GuideThis pull request, automatically generated by Snyk, addresses a Regular Expression Denial of Service (ReDoS) vulnerability by updating the versions of three yarn dependencies in the Sequence Diagram: Snyk Automated Vulnerability Fix ProcesssequenceDiagram
actor Developer
participant Snyk
participant GitHubRepository as "GitHub Repository"
Snyk->>GitHubRepository: Scans for vulnerabilities in yarn dependencies
activate Snyk
activate GitHubRepository
GitHubRepository-->>Snyk: Provides dependency information
Snyk->>Snyk: Identifies ReDoS vulnerability (SNYK-JS-BABELRUNTIME-10044504)
Snyk->>GitHubRepository: Creates Pull Request with fix
note right of Snyk: Updates versions in plugins/code-climate/package.json:<br/>- @backstage/core-components: 0.1.0<br/>- @backstage/plugin-catalog-react: 0.0.1<br/>- @backstage/theme: 0.1.1
Snyk->>GitHubRepository: Attempts to update yarn.lock (fails as per PR warning)
deactivate Snyk
GitHubRepository->>Developer: Notifies of new PR from Snyk
deactivate GitHubRepository
Developer->>GitHubRepository: Reviews PR changes
activate Developer
activate GitHubRepository
Developer->>Developer: Manually updates yarn.lock file
Developer->>GitHubRepository: Merges PR
deactivate Developer
deactivate GitHubRepository
Class Diagram: Updates to package.json DependenciesclassDiagram
class PackageJsonFile {
<<File>>
filePath: "plugins/code-climate/package.json"
+name: String
+version: String
+dependencies: Map<String, String>
+devDependencies: Map<String, String>
}
note for PackageJsonFile "The 'dependencies' attribute has been updated:
- Key '@backstage/core-components': value changed from 'workspace:^' to '0.1.0'
- Key '@backstage/plugin-catalog-react': value changed from 'workspace:^' to '0.0.1'
- Key '@backstage/theme': value changed from 'workspace:^' to '0.1.1'"
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub. |
⛔ Snyk checks have failed. 1 issues have been found so far.
⛔ security/snyk check is complete. 1 issues have been found. (View Details) 💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
![graphite-app[bot]](https://avatars.githubusercontent.com/in/158384?s=60&v=4){kind=small}
| "@backstage/core-components": "0.1.0", | ||
| "@backstage/core-plugin-api": "workspace:^", | ||
| "@backstage/plugin-catalog-react": "workspace:^", | ||
| "@backstage/theme": "workspace:^", | ||
| "@backstage/plugin-catalog-react": "0.0.1", | ||
| "@backstage/theme": "0.1.1", |
There was a problem hiding this comment.
The proposed change replaces workspace dependencies with fixed, outdated versions which will likely cause compatibility issues with the rest of the Backstage application.
These specific versions (0.1.0, 0.0.1, 0.1.1) are extremely old compared to current Backstage releases. While addressing the ReDoS vulnerability is important, this approach will likely break the plugin's integration with the main application.
A better approach would be to:
- Maintain the
workspace:^references - Update the root
package.jsonto specify compatible versions that address the vulnerability - Run
yarn installto update the lockfile
This ensures the vulnerability is fixed while maintaining compatibility across the application.
| "@backstage/core-components": "0.1.0", | |
| "@backstage/core-plugin-api": "workspace:^", | |
| "@backstage/plugin-catalog-react": "workspace:^", | |
| "@backstage/theme": "workspace:^", | |
| "@backstage/plugin-catalog-react": "0.0.1", | |
| "@backstage/theme": "0.1.1", | |
| + "@backstage/core-components": "workspace:^", | |
| "@backstage/core-plugin-api": "workspace:^", | |
| + "@backstage/plugin-catalog-react": "workspace:^", | |
| + "@backstage/theme": "workspace:^", |
Spotted by Diamond
Is this helpful? React 👍 or 👎 to let us know.
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
Snyk has created this PR to fix 1 vulnerabilities in the yarn dependencies of this project.
Snyk changed the following file(s):
plugins/code-climate/package.jsonNote for zero-installs users
If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the
.yarn/cache/directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to runyarnto update the contents of the./yarn/cachedirectory.If you are not using zero-install you can ignore this as your flow should likely be unchanged.
Vulnerabilities that will be fixed with an upgrade:
SNYK-JS-BABELRUNTIME-10044504
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Regular Expression Denial of Service (ReDoS)
Summary by Sourcery
Update package dependencies to resolve a security vulnerability in @babel/runtime
Bug Fixes:
Enhancements: