[Snyk] Security upgrade @backstage/plugin-scaffolder-backend from 0.0.0-use.local to 1.15.0 #6576
Conversation
…ulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-OCTOKIT-6129525 - https://snyk.io/vuln/SNYK-JS-OCTOKITWEBHOOKS-6129527 - https://snyk.io/vuln/SNYK-JS-BACKSTAGEPLUGINSCAFFOLDERBACKEND-5730767
Review or Edit in CodeSandboxOpen the branch in Web Editor • VS Code • Insiders |
Reviewer's GuideUpgrades the @backstage/plugin-scaffolder-backend dependency from a local workspace reference to version 1.15.0 in package.json to remediate three Snyk-reported high-severity vulnerabilities; requires a manual yarn.lock update (and yarn cache refresh for zero-install setups) before merging. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
⛔ Snyk checks have failed. 83 issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
![graphite-app[bot]](https://avatars.githubusercontent.com/in/158384?s=60&v=4){kind=small}
| "@backstage/errors": "workspace:^", | ||
| "@backstage/integration": "workspace:^", | ||
| "@backstage/plugin-scaffolder-backend": "workspace:^", | ||
| "@backstage/plugin-scaffolder-backend": "1.15.0", |
There was a problem hiding this comment.
Dependency version inconsistency: Changing from 'workspace:^' to '1.15.0' for @backstage/plugin-scaffolder-backend creates a version mismatch with other Backstage dependencies that still use 'workspace:^'. This breaks the monorepo workspace dependency pattern and may cause version conflicts, build failures, or runtime incompatibilities. All Backstage dependencies should maintain consistent versioning strategy - either all use 'workspace:^' or all use specific versions.
| "@backstage/plugin-scaffolder-backend": "1.15.0", | |
| "@backstage/plugin-scaffolder-backend": "workspace:^", |
Spotted by Diamond
Is this helpful? React 👍 or 👎 to let us know.
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
Entelligence AI Vulnerability ScannerStatus: No security vulnerabilities found Your code passed our comprehensive security analysis. |
WalkthroughThis PR updates the dependency management for the Rails scaffolder backend module by pinning the Changes
Sequence DiagramThis diagram shows the interactions between components: sequenceDiagram
participant Build as Build System
participant Rails as scaffolder-backend-module-rails
participant Backend as plugin-scaffolder-backend
Note over Build,Backend: Dependency Resolution Change
alt Before (workspace:^)
Build->>Rails: Resolve dependencies
Rails->>Backend: Request workspace version
Backend-->>Rails: Return local workspace package
else After (1.15.0)
Build->>Rails: Resolve dependencies
Rails->>Backend: Request version 1.15.0
Backend-->>Rails: Return published package v1.15.0
end
Note over Rails,Backend: Rails module now uses<br/>fixed version instead of<br/>workspace reference
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
Snyk has created this PR to fix 3 vulnerabilities in the yarn dependencies of this project.
Snyk changed the following file(s):
plugins/scaffolder-backend-module-rails/package.jsonNote for zero-installs users
If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the
.yarn/cache/directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to runyarnto update the contents of the./yarn/cachedirectory.If you are not using zero-install you can ignore this as your flow should likely be unchanged.
Vulnerabilities that will be fixed with an upgrade:
SNYK-JS-OCTOKIT-6129525
SNYK-JS-OCTOKITWEBHOOKS-6129527
SNYK-JS-BACKSTAGEPLUGINSCAFFOLDERBACKEND-5730767
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Arbitrary Code Injection
Summary by Sourcery
Upgrade the scaffolder-backend plugin to version 1.15.0 to remediate multiple high severity security vulnerabilities
Bug Fixes:
Enhancements:
EntelligenceAI PR Summary
This PR pins the scaffolder backend dependency to version 1.15.0 in the Rails scaffolder backend module.
workspace:^) with fixed version (1.15.0) for@backstage/plugin-scaffolder-backend