[Snyk] Security upgrade @backstage/plugin-scaffolder-backend from 0.0.0-use.local to 1.15.0 #6649

snyk-io · 2025-07-19T06:50:30Z

EntelligenceAI PR Summary

This PR locks the scaffolder backend plugin dependency to a specific version instead of using the workspace reference.

Changed dependency resolution for @backstage/plugin-scaffolder-backend from workspace:^ to 1.15.0
Modified in packages/backend-next/package.json
Ensures version stability by using a published npm version rather than local workspace version
May impact dependency update workflow and deployment scenarios

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-OCTOKIT-6129525 - https://snyk.io/vuln/SNYK-JS-OCTOKITWEBHOOKS-6129527 - https://snyk.io/vuln/SNYK-JS-BACKSTAGEPLUGINSCAFFOLDERBACKEND-5730767

codesandbox · 2025-07-19T06:50:34Z

Review or Edit in CodeSandbox

Open the branch in Web Editor • VS Code • Insiders

Open Preview

sourcery-ai · 2025-07-19T06:50:35Z

Reviewer's Guide

Upgrades @backstage/plugin-scaffolder-backend from a local workspace reference to version 1.15.0 in package.json to address three high-severity security vulnerabilities (Octokit exceptional handling and arbitrary code injection), and flags the need for a manual yarn.lock update to support zero-installs workflows.

File-Level Changes

Change	Details	Files
Bump @backstage/plugin-scaffolder-backend dependency to 1.15.0	Replaced the workspace:^ version specifier with explicit 1.15.0 in package.json Resolves vulnerabilities SNYK-JS-OCTOKIT-6129525, SNYK-JS-OCTOKITWEBHOOKS-6129527, and SNYK-JS-BACKSTAGEPLUGINSCAFFOLDERBACKEND-5730767	`packages/backend-next/package.json`

Tips and commands

Interacting with Sourcery

Trigger a new review: Comment @sourcery-ai review on the pull request.
Continue discussions: Reply directly to Sourcery's review comments.
Generate a GitHub issue from a review comment: Ask Sourcery to create an
issue from a review comment by replying to it. You can also reply to a
review comment with @sourcery-ai issue to create an issue from it.
Generate a pull request title: Write @sourcery-ai anywhere in the pull
request title to generate a title at any time. You can also comment
@sourcery-ai title on the pull request to (re-)generate the title at any time.
Generate a pull request summary: Write @sourcery-ai summary anywhere in
the pull request body to generate a PR summary at any time exactly where you
want it. You can also comment @sourcery-ai summary on the pull request to
(re-)generate the summary at any time.
Generate reviewer's guide: Comment @sourcery-ai guide on the pull
request to (re-)generate the reviewer's guide at any time.
Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
pull request to resolve all Sourcery comments. Useful if you've already
addressed all the comments and don't want to see them anymore.
Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
request to dismiss all existing Sourcery reviews. Especially useful if you
want to start fresh with a new review - don't forget to comment
@sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

Enable or disable review features such as the Sourcery-generated pull request
summary, the reviewer's guide, and others.
Change the review language.
Add, remove or edit custom review instructions.
Adjust other review settings.

Getting Help

Contact our support team for questions or feedback.
Visit our documentation for detailed guides and information.
Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

snyk-io · 2025-07-19T06:50:44Z

⛔ Snyk checks have failed. 84 issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (84)
⛔	Open Source Security	16	26	37	5	84 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

socket-security · 2025-07-19T06:56:22Z

No dependency changes detected. Learn more about Socket for GitHub.

👍 No dependency changes detected in pull request

github-actions · 2025-07-26T07:16:59Z

This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution!

github-actions · 2025-09-03T19:26:53Z

This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution!

github-actions · 2025-09-10T19:45:26Z

This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution!

entelligence-ai-pr-reviews · 2025-11-28T05:38:09Z

Entelligence AI Vulnerability Scanner

Status: No security vulnerabilities found

Your code passed our comprehensive security analysis.

entelligence-ai-pr-reviews · 2025-11-28T05:38:11Z

Walkthrough

This pull request modifies the dependency management strategy for the Backstage scaffolder backend plugin in the backend-next package. The change transitions from using a workspace protocol reference (which points to the local monorepo version) to a pinned version (1.15.0) from the npm registry. This modification ensures that the backend-next package uses a specific, stable version of the scaffolder backend plugin rather than the workspace's current development version. This approach can provide version stability, resolve workspace-related dependency issues, or prepare the package for deployment scenarios where workspace dependencies are not available.

Changes

File(s)	Summary
`packages/backend-next/package.json`	Changed `@backstage/plugin-scaffolder-backend` dependency from workspace protocol (`workspace:^`) to pinned version `1.15.0`, locking to a specific published version instead of using the local workspace version.

Sequence Diagram

This diagram shows the interactions between components:

sequenceDiagram
    participant Dev as Developer
    participant PM as Package Manager
    participant WS as Workspace Packages
    participant NPM as NPM Registry
    participant App as Backend-Next App

    Note over Dev,App: Dependency Resolution Change

    Dev->>PM: Update package.json
    Note right of Dev: Change scaffolder-backend<br/>from workspace:^ to 1.15.0

    alt Before Change (workspace:^)
        PM->>WS: Resolve @backstage/plugin-scaffolder-backend
        WS-->>PM: Return local workspace version
        PM->>App: Install local package
    else After Change (1.15.0)
        PM->>NPM: Fetch @backstage/plugin-scaffolder-backend@1.15.0
        NPM-->>PM: Return published package
        PM->>App: Install npm package version 1.15.0
    end

    Note over App: Backend-Next now uses<br/>pinned scaffolder-backend version

▶️ ⚡ AI Code Reviews for VS Code, Cursor, Windsurf
Install the extension

Note for Windsurf

Please change the default marketplace provider to the following in the windsurf settings:

Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery

Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items

Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts below

Emoji Descriptions:

⚠️ Potential Issue - May require further investigation.
🔒 Security Vulnerability - Fix to ensure system safety.
💻 Code Improvement - Suggestions to enhance code quality.
🔨 Refactor Suggestion - Recommendations for restructuring code.
ℹ️ Others - General comments and information.

Interact with the Bot:

Send a message or request using the format:
@entelligenceai + *your message*

Example: @entelligenceai Can you suggest improvements for this code?

Help the Bot learn by providing feedback on its responses.
@entelligenceai + *feedback*

Example: @entelligenceai Do not comment on `save_auth` function !

Also you can trigger various commands with the bot by doing
@entelligenceai command

The current supported commands are

config - shows the current config
retrigger_review - retriggers the review

More commands to be added soon.

github-actions · 2025-12-23T22:58:49Z

This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution!

entelligence-ai-pr-reviews · 2025-12-29T16:34:12Z

Walkthrough

This pull request modifies the dependency management strategy for the Backstage scaffolder backend plugin in the backend-next package. The change transitions from using a workspace protocol reference (which points to the local monorepo version) to a pinned version (1.15.0) from the npm registry. This modification ensures that the backend-next package uses a specific, stable version of the scaffolder backend plugin rather than the workspace's current development version. This approach can provide version stability, resolve workspace-related dependency issues, or prepare the package for deployment scenarios where workspace dependencies are not available.

Changes

File(s)	Summary
`packages/backend-next/package.json`	Changed `@backstage/plugin-scaffolder-backend` dependency from workspace protocol (`workspace:^`) to pinned version `1.15.0`, locking to a specific published version instead of using the local workspace version.

Sequence Diagram

This diagram shows the interactions between components:

sequenceDiagram
    participant Dev as Developer
    participant PM as Package Manager
    participant WS as Workspace
    participant NPM as NPM Registry
    participant Backend as backend-next Package

    Dev->>PM: Install dependencies
    Note over Dev,PM: package.json specifies dependencies
    
    alt Before Change (workspace:^)
        PM->>WS: Resolve @backstage/plugin-scaffolder-backend
        WS->>PM: Return local workspace version
        PM->>Backend: Link local scaffolder-backend
        Note over Backend: Uses local development version
    else After Change (1.15.0)
        PM->>NPM: Fetch @backstage/plugin-scaffolder-backend@1.15.0
        NPM->>PM: Return version 1.15.0
        PM->>Backend: Install pinned version 1.15.0
        Note over Backend: Uses specific published version
    end
    
    PM->>Dev: Dependencies installed
    Note over Dev,Backend: backend-next now uses<br/>scaffolder-backend v1.15.0<br/>from NPM registry

▶️ ⚡ AI Code Reviews for VS Code, Cursor, Windsurf
Install the extension

Note for Windsurf

Please change the default marketplace provider to the following in the windsurf settings:

Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery

Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items

Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts below

Emoji Descriptions:

⚠️ Potential Issue - May require further investigation.
🔒 Security Vulnerability - Fix to ensure system safety.
💻 Code Improvement - Suggestions to enhance code quality.
🔨 Refactor Suggestion - Recommendations for restructuring code.
ℹ️ Others - General comments and information.

Interact with the Bot:

Send a message or request using the format:
@entelligenceai + *your message*

Example: @entelligenceai Can you suggest improvements for this code?

Help the Bot learn by providing feedback on its responses.
@entelligenceai + *feedback*

Example: @entelligenceai Do not comment on `save_auth` function !

Also you can trigger various commands with the bot by doing
@entelligenceai command

The current supported commands are

config - shows the current config
retrigger_review - retriggers the review

More commands to be added soon.

github-actions bot added the stale label Jul 26, 2025

github-actions bot closed this Aug 5, 2025

snyk-io bot reopened this Aug 24, 2025

github-actions bot removed the stale label Aug 24, 2025

github-actions bot added stale and removed stale labels Sep 3, 2025

github-actions bot added the stale label Sep 10, 2025

github-actions bot closed this Sep 15, 2025

snyk-io bot reopened this Nov 28, 2025

github-actions bot removed the stale label Nov 28, 2025

github-actions bot added the stale label Dec 23, 2025

github-actions bot closed this Dec 28, 2025

snyk-io bot reopened this Dec 29, 2025

github-actions bot removed the stale label Dec 29, 2025

[Snyk] Security upgrade @backstage/plugin-scaffolder-backend from 0.0.0-use.local to 1.15.0 #6649

Are you sure you want to change the base?

[Snyk] Security upgrade @backstage/plugin-scaffolder-backend from 0.0.0-use.local to 1.15.0 #6649

Conversation

snyk-io bot commented Jul 19, 2025 • edited by entelligence-ai-pr-reviews bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

EntelligenceAI PR Summary

Uh oh!

codesandbox bot commented Jul 19, 2025

Review or Edit in CodeSandbox

Uh oh!

sourcery-ai bot commented Jul 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviewer's Guide

File-Level Changes

Interacting with Sourcery

Customizing Your Experience

Getting Help

Uh oh!

snyk-io bot commented Jul 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⛔ Snyk checks have failed. 84 issues have been found so far.

Uh oh!

socket-security bot commented Jul 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jul 26, 2025

Uh oh!

github-actions bot commented Sep 3, 2025

Uh oh!

github-actions bot commented Sep 10, 2025

Uh oh!

entelligence-ai-pr-reviews bot commented Nov 28, 2025

Entelligence AI Vulnerability Scanner

Uh oh!

entelligence-ai-pr-reviews bot commented Nov 28, 2025

Walkthrough

Changes

Sequence Diagram

Emoji Descriptions:

Interact with the Bot:

Uh oh!

github-actions bot commented Dec 23, 2025

Uh oh!

entelligence-ai-pr-reviews bot commented Dec 29, 2025

Walkthrough

Changes

Sequence Diagram

Emoji Descriptions:

Interact with the Bot:

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

snyk-io bot commented Jul 19, 2025 •

edited by entelligence-ai-pr-reviews bot

Loading

sourcery-ai bot commented Jul 19, 2025 •

edited

Loading

snyk-io bot commented Jul 19, 2025 •

edited

Loading

socket-security bot commented Jul 19, 2025 •

edited

Loading