[Snyk] Security upgrade @backstage/plugin-techdocs from 0.0.0-use.local to 0.1.1 #6665
Conversation
…abilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-DOMPURIFY-7984421
Review or Edit in CodeSandboxOpen the branch in Web Editor • VS Code • Insiders |
Reviewer's GuideUpgrades the @backstage/plugin-techdocs dependency in the techdocs-addons-test-utils package to version 0.1.1 to address a high-severity Prototype Pollution vulnerability by replacing the workspace alias in package.json (lockfile update required). File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
⛔ Snyk checks have failed. 85 issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
|
No dependency changes detected. Learn more about Socket for GitHub. 👍 No dependency changes detected in pull request |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
|
🔒 Entelligence AI Vulnerability Scanner ✅ No security vulnerabilities found! Your code passed our comprehensive security analysis. |
WalkthroughThis PR updates the dependency configuration in the techdocs-addons-test-utils package by changing the '@backstage/plugin-techdocs' dependency from a workspace reference to a fixed version (0.1.1). This change pins the dependency to a specific version rather than allowing it to automatically update with workspace changes, which helps ensure consistent and predictable test behavior by preventing unintended version updates during development. Changes
Sequence DiagramThis diagram shows the interactions between components: sequenceDiagram
title TechDocs Addons Test Utils Dependency Flow
participant App as "Backstage App"
participant TestUtils as "techdocs-addons-test-utils"
participant TechDocsPlugin as "plugin-techdocs"
participant OtherDeps as "Other Dependencies"
Note over TestUtils, TechDocsPlugin: Before Change: Workspace Reference
App->>TestUtils: Import test utilities
activate TestUtils
TestUtils->>TechDocsPlugin: Import from workspace:^
Note right of TechDocsPlugin: Uses latest version<br/>from workspace
TechDocsPlugin-->>TestUtils: Provide functionality
TestUtils->>OtherDeps: Import other dependencies
OtherDeps-->>TestUtils: Provide functionality
TestUtils-->>App: Return test utilities
deactivate TestUtils
Note over TestUtils, TechDocsPlugin: After Change: Fixed Version
App->>TestUtils: Import test utilities
activate TestUtils
TestUtils->>TechDocsPlugin: Import version 0.1.1
Note right of TechDocsPlugin: Uses fixed version 0.1.1<br/>regardless of workspace
TechDocsPlugin-->>TestUtils: Provide functionality
TestUtils->>OtherDeps: Import other dependencies
OtherDeps-->>TestUtils: Provide functionality
TestUtils-->>App: Return test utilities
deactivate TestUtils
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
|
LGTM 👍 |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
WalkthroughThis PR updates the dependency configuration in the techdocs-addons-test-utils package by changing the '@backstage/plugin-techdocs' dependency from a workspace reference to a fixed version. Instead of using 'workspace:^', which would dynamically reference the local workspace version during development, the dependency is now pinned to version '0.1.1'. This change ensures consistent test behavior by preventing automatic updates of the techdocs plugin that could potentially introduce unexpected changes during testing or development. Changes
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
|
LGTM 👍 |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
📝 WalkthroughThis PR attempts to address a security vulnerability (SNYK-JS-DOMPURIFY-7984421) in the TechDocs plugin. However, the approach taken is problematic - instead of updating to a patched version, it downgrades the This downgrade introduces significant security and compatibility risks. Version 0.1.1 dates back to October 2020 and is completely incompatible with the current Backstage architecture. This change would likely break the application and introduce numerous security vulnerabilities from the past 4+ years. 📊 Changes
🔒 Security Highlights
|
![entelligence-ai-pr-reviews[bot]](https://avatars.githubusercontent.com/in/932812?s=60&v=4){kind=small}
| "@backstage/plugin-catalog": "workspace:^", | ||
| "@backstage/plugin-search-react": "workspace:^", | ||
| "@backstage/plugin-techdocs": "workspace:^", | ||
| "@backstage/plugin-techdocs": "0.1.1", |
There was a problem hiding this comment.
Security: Critical security regression: Downgrading @backstage/plugin-techdocs from workspace:^ to version 0.1.1 (4+ years old) introduces numerous security vulnerabilities and compatibility issues
📝 Committable Code Suggestion
‼️ Ensure you review the code suggestion before committing it to the branch. Make sure it replaces the highlighted code, contains no missing lines, and has no issues with indentation.
| "@backstage/plugin-techdocs": "0.1.1", | |
| "@backstage/plugin-techdocs": "workspace:^", |
| "@backstage/plugin-catalog": "workspace:^", | ||
| "@backstage/plugin-search-react": "workspace:^", | ||
| "@backstage/plugin-techdocs": "workspace:^", | ||
| "@backstage/plugin-techdocs": "0.1.1", |
There was a problem hiding this comment.
Correctness: Breaking change: Version 0.1.1 from 2020 is completely incompatible with the current Backstage architecture, causing API incompatibilities and potential runtime failures
📝 Committable Code Suggestion
‼️ Ensure you review the code suggestion before committing it to the branch. Make sure it replaces the highlighted code, contains no missing lines, and has no issues with indentation.
| "@backstage/plugin-techdocs": "0.1.1", | |
| "@backstage/plugin-techdocs": "workspace:^", |
| "@backstage/plugin-catalog": "workspace:^", | ||
| "@backstage/plugin-search-react": "workspace:^", | ||
| "@backstage/plugin-techdocs": "workspace:^", | ||
| "@backstage/plugin-techdocs": "0.1.1", |
There was a problem hiding this comment.
Security: Incorrect problem resolution: Downgrading to an ancient version is not the correct solution for the DOMPurify vulnerability SNYK-JS-DOMPURIFY-7984421
📝 Committable Code Suggestion
‼️ Ensure you review the code suggestion before committing it to the branch. Make sure it replaces the highlighted code, contains no missing lines, and has no issues with indentation.
| "@backstage/plugin-techdocs": "0.1.1", | |
| "@backstage/plugin-techdocs": "workspace:^", |
| "@backstage/plugin-catalog": "workspace:^", | ||
| "@backstage/plugin-search-react": "workspace:^", | ||
| "@backstage/plugin-techdocs": "workspace:^", | ||
| "@backstage/plugin-techdocs": "0.1.1", |
There was a problem hiding this comment.
Style: Inconsistent dependency management pattern: All other dependencies use workspace:^ pattern, but this change uses a hardcoded version
📝 Committable Code Suggestion
‼️ Ensure you review the code suggestion before committing it to the branch. Make sure it replaces the highlighted code, contains no missing lines, and has no issues with indentation.
| "@backstage/plugin-techdocs": "0.1.1", | |
| "@backstage/plugin-techdocs": "workspace:^", |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
WalkthroughThis PR updates the dependency management for the techdocs addons test utilities package. The change modifies how the Changes
Sequence DiagramThis diagram shows the interactions between components: sequenceDiagram
participant PM as Package Manager
participant Registry as NPM Registry
participant Workspace as Local Workspace
participant Plugin as techdocs-addons-test-utils
Note over PM,Plugin: Dependency Resolution Change
rect rgb(240, 240, 240)
Note over PM,Workspace: Before: workspace:^ reference
PM->>Workspace: Resolve @backstage/plugin-techdocs
Workspace-->>PM: Return local workspace version
PM->>Plugin: Install local dependency
end
rect rgb(220, 250, 220)
Note over PM,Registry: After: Version 0.1.1 reference
PM->>Registry: Request @backstage/plugin-techdocs@0.1.1
Registry-->>PM: Return published package v0.1.1
PM->>Plugin: Install registry dependency
end
Note over PM,Plugin: No runtime behavior changes<br/>Only affects build-time resolution
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
WalkthroughThis PR updates the dependency management for the techdocs addons test utilities package. The change modifies how the Changes
Sequence DiagramThis diagram shows the interactions between components: sequenceDiagram
participant PM as Package Manager
participant Registry as NPM Registry
participant Workspace as Local Workspace
participant Plugin as techdocs-addons-test-utils
Note over PM,Plugin: Dependency Resolution Change
rect rgb(240, 240, 240)
Note over PM,Workspace: Before: workspace:^ reference
PM->>Workspace: Resolve @backstage/plugin-techdocs
Workspace-->>PM: Return local workspace version
PM->>Plugin: Install local dependency
end
rect rgb(220, 250, 220)
Note over PM,Registry: After: Version 0.1.1 reference
PM->>Registry: Request @backstage/plugin-techdocs@0.1.1
Registry-->>PM: Return published package v0.1.1
PM->>Plugin: Install registry dependency
end
Note over PM,Plugin: No runtime behavior changes<br/>Only affects build-time resolution
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
WalkthroughThis PR updates the dependency management for the techdocs addons test utilities package. The change modifies how the Changes
Sequence DiagramThis diagram shows the interactions between components: sequenceDiagram
participant PM as Package Manager
participant Registry as NPM Registry
participant Workspace as Local Workspace
participant Plugin as techdocs-addons-test-utils
Note over PM,Plugin: Dependency Resolution Change
rect rgb(240, 240, 240)
Note over PM,Workspace: Before: workspace:^ reference
PM->>Workspace: Resolve @backstage/plugin-techdocs
Workspace-->>PM: Return local workspace version
PM->>Plugin: Install local dependency
end
rect rgb(220, 250, 220)
Note over PM,Registry: After: Version 0.1.1 reference
PM->>Registry: Request @backstage/plugin-techdocs@0.1.1
Registry-->>PM: Return published package v0.1.1
PM->>Plugin: Install registry dependency
end
Note over PM,Plugin: No runtime behavior changes<br/>Only affects build-time resolution
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
WalkthroughThis pull request modifies the dependency management for the techdocs-addons-test-utils plugin by changing how it references the techdocs plugin dependency. The change transitions from using a workspace protocol reference (which points to the local monorepo version) to a pinned version number (0.1.1). This modification locks the dependency to a specific version, which is typically done to ensure compatibility, stabilize testing environments, or prepare for package publication. The change affects dependency resolution behavior and may impact how the test utilities package is built and distributed. Changes
Sequence DiagramThis diagram shows the interactions between components: sequenceDiagram
participant PM as Package Manager
participant Registry as NPM Registry
participant Workspace as Local Workspace
participant TestUtils as techdocs-addons-test-utils
Note over PM,TestUtils: Dependency Resolution Change
rect rgb(240, 240, 240)
Note over PM,Workspace: Previous Behavior (workspace:^)
PM->>Workspace: Resolve @backstage/plugin-techdocs
Workspace-->>PM: Return local workspace version
PM->>TestUtils: Install local dependency
end
rect rgb(220, 250, 220)
Note over PM,Registry: New Behavior (version 0.1.1)
PM->>Registry: Request @backstage/plugin-techdocs@0.1.1
Registry-->>PM: Return published package v0.1.1
PM->>TestUtils: Install registry dependency
end
Note over TestUtils: Package now uses fixed version<br/>instead of workspace reference
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
EntelligenceAI PR Summary
This PR pins the @backstage/plugin-techdocs dependency to version 0.1.1 in the techdocs-addons-test-utils package.
workspace:^) with explicit version (0.1.1)plugins/techdocs-addons-test-utils/package.json