chore(deps): update dependency @backstage/backend-defaults to ^0.12.0 [security] - abandoned by backstage-goalie[bot] · Pull Request #11110 · backstage/community-plugins

backstage-goalie · 2026-09-18T20:17:32Z

This PR contains the following updates:

Package	Change	Age	Confidence
@backstage/backend-defaults (source)	`^0.7.0` → `^0.12.0`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Backstage has a Possible SSRF when reading from allowed URL's in `backend.reading.allow`

CVE-2026-24048 / GHSA-q2x5-4xjx-c6p9

More information

Details

Impact

The FetchUrlReader component, used by the catalog and other plugins to fetch content from URLs, followed HTTP redirects automatically. This allowed an attacker who controls a host listed in backend.reading.allow to redirect requests to internal or sensitive URLs that are not on the allowlist, bypassing the URL allowlist security control.

This is a Server-Side Request Forgery (SSRF) vulnerability that could allow access to internal resources, but it does not allow attackers to include additional request headers.

Patches

This vulnerability is fixed in @backstage/backend-defaults version 0.12.2, 0.13.2, 0.14.1, and 0.15.0. Users should upgrade to this version or later.

Workarounds

Restrict backend.reading.allow to only trusted hosts that you control and that do not issue redirects
Ensure allowed hosts do not have open redirect vulnerabilities
Use network-level controls to block access from Backstage to sensitive internal endpoints

References

OWASP SSRF Prevention Cheat Sheet

Severity

CVSS Score: 3.5 / 10 (Low)
Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Backstage has a Possible Symlink Path Traversal in Scaffolder Actions

CVE-2026-24046 / GHSA-rq6q-wr2q-7pgp

More information

Details

Impact

Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to:

Read arbitrary files via the debug:log action by creating a symlink pointing to sensitive files (e.g., /etc/passwd, configuration files, secrets)
Delete arbitrary files via the fs:delete action by creating symlinks pointing outside the workspace
Write files outside the workspace via archive extraction (tar/zip) containing malicious symlinks

This affects any Backstage deployment where users can create or execute Scaffolder templates.

Patches

This vulnerability is fixed in the following package versions:

@backstage/backend-defaults version 0.12.2, 0.13.2, 0.14.1, 0.15.0
@backstage/plugin-scaffolder-backend version 2.2.2, 3.0.2, 3.1.1
@backstage/plugin-scaffolder-node version 0.11.2, 0.12.3

Users should upgrade to these versions or later.

Workarounds

Follow the recommendation in the Backstage Threat Model to limit access to creating and updating templates
Restrict who can create and execute Scaffolder templates using the permissions framework
Audit existing templates for symlink usage
Run Backstage in a containerized environment with limited filesystem access

References

Severity

CVSS Score: 7.1 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

backstage/backstage (@backstage/backend-defaults)

`v0.12.2`

Compare Source

`v0.12.1`

Compare Source

Patch Changes

33bd4d0: Deduplicate discovered features discovered with discoveryFeatureLoader
4eda590: Fixed cache namespace and key prefix separator configuration to properly use configured values instead of hardcoded plugin ID. The cache manager now correctly combines the configured namespace with plugin IDs using the configured separator for Redis and Valkey. Memcache and memory store continue to use plugin ID as namespace.
f244e61: Add backend.logger config options to configure the RootLoggerService.

Read more about the new configuration options in the
Root Logger Service
documentation.
Updated dependencies
- @backstage/config-loader@1.10.3
- @backstage/plugin-auth-node@0.6.7
- @backstage/plugin-events-node@0.4.15
- @backstage/integration@1.18.0
- @backstage/types@1.2.2
- @backstage/backend-app-api@1.2.7
- @backstage/backend-plugin-api@1.4.3
- @backstage/plugin-permission-node@0.10.4

`v0.12.0`

Compare Source

Minor Changes

133519b: feat: new cache manager Infinispan Data Grid

Patch Changes

caee2eb: Fixed WinstonLogger throwing when redactions were null or undefined
ed74af5: Fixed bug in PackageDiscoveryService where packages with "exports" field caused ERR_PACKAGE_PATH_NOT_EXPORTED error during backend startup.
3a7dad9: Updated better-sqlite3 to v12
Updated dependencies
- @backstage/cli-node@0.2.14
- @backstage/backend-app-api@1.2.6
- @backstage/plugin-auth-node@0.6.6
- @backstage/plugin-permission-node@0.10.3
- @backstage/backend-plugin-api@1.4.2
- @backstage/plugin-events-node@0.4.14

`v0.11.1`

Compare Source

Patch Changes

ead925a: Add a standard toString on credentials objects
e0189b8: UrlReader: Fix handling of access tokens for GitLab readURL requests
d1e4a6d: Fixed bug where the GitLab user token and GitLab integration token were being merged together
Updated dependencies
- @backstage/config-loader@1.10.2
- @backstage/config@1.3.3
- @backstage/plugin-permission-node@0.10.2
- @backstage/integration@1.17.1
- @backstage/backend-app-api@1.2.5
- @backstage/backend-plugin-api@1.4.1
- @backstage/integration-aws-node@0.1.17
- @backstage/plugin-auth-node@0.6.5
- @backstage/plugin-events-node@0.4.13

`v0.11.0`

Compare Source

Minor Changes

3ccb7fc: Enhanced error handling in the auditor service factory to pass errors as objects. Aligned WinstonRootAuditorService with the default service factory's error handling.

Patch Changes

1220cf8: Added new rate limit middleware to allow rate limiting requests to the backend

If you are using the configure callback of the root HTTP router service and do NOT call applyDefaults() inside it, please see the relevant changes that were made, to see if you want to apply them as well to your custom configuration.
Rate limiting can be turned on by adding the following configuration to app-config.yaml:
```
backend:
  rateLimit:
    window: 6s
    incomingRequestLimit: 100
```
Plugin specific rate limiting can be configured by adding the following configuration to app-config.yaml:
```
backend:
  rateLimit:
    global: false # This will disable the global rate limiting
    plugin:
      catalog:
        window: 6s
        incomingRequestLimit: 100
```
c999c25: Added some default implementations for the experimental ActionsService and ActionsRegistryService under /alpha that allow registration of actions for a particular plugin.
Updated dependencies
- @backstage/plugin-auth-node@0.6.4
- @backstage/backend-app-api@1.2.4
- @backstage/backend-plugin-api@1.4.0
- @backstage/backend-dev-utils@0.1.5
- @backstage/cli-node@0.2.13
- @backstage/config@1.3.2
- @backstage/config-loader@1.10.1
- @backstage/errors@1.2.7
- @backstage/integration@1.17.0
- @backstage/integration-aws-node@0.1.16
- @backstage/types@1.2.1
- @backstage/plugin-events-node@0.4.12
- @backstage/plugin-permission-node@0.10.1

`v0.10.0`

Compare Source

Minor Changes

d385854: BREAKING: The DefaultSchedulerService constructor options now requires RootLifecycleService, HttpRouterService, and PluginMetadataService fields.

The scheduler will register a REST API for listing and triggering tasks. Please see the scheduler documentation for more details about this API.

Patch Changes

1e06afd: GithubUrlReader's search detects glob-patterns supported by minimatch, instead of just detecting
* and ? characters.

For example, this allows to search for patterns like {C,c}atalog-info.yaml.
acea1d4: update documentation
72d019d: Removed various typos
c6bc67d: Added Valkey support alongside Redis in backend-defaults cache clients, using the new Keyv Valkey package. Also extended backend-test-utils to support Valkey in tests.
36f77e9: Bug fix: Pass user provided token through to gitlab url resolvers
0e7a640: The GithubUrlReader will now use the token from options when fetching repo details
Updated dependencies
- @backstage/integration@1.17.0
- @backstage/backend-app-api@1.2.3
- @backstage/plugin-auth-node@0.6.3
- @backstage/backend-plugin-api@1.3.1
- @backstage/plugin-permission-node@0.10.0
- @backstage/config-loader@1.10.1
- @backstage/integration-aws-node@0.1.16
- @backstage/cli-node@0.2.13
- @backstage/config@1.3.2
- @backstage/backend-dev-utils@0.1.5
- @backstage/errors@1.2.7
- @backstage/types@1.2.1
- @backstage/plugin-events-node@0.4.11

`v0.9.0`

Compare Source

Minor Changes

1daedce: Remove Throttle of Bitbucket Server API calls
01edf6e: Allow pass through of redis client and cluster options to Cache core service
cf4eb13: Added actor property to BackstageUserPrincipal containing the subject of the last service (if any) who performed authentication on behalf of the user.

Patch Changes

7c6740e: Implemented SRV lookup support in the default HostDiscovery. You can now specify internal URLs on the form http+srv://some-srv-name/api/{{pluginId}} and they will be resolved in real time.
939116c: Added an optional backend.trustProxy app config value, which sets the
corresponding Express.js trust proxy setting. This lets
you easily configure proxy trust without making a custom configure callback
for the rootHttpRouter service.

If you already are using a custom configure callback, and if that also does not call applyDefaults(), you may want to add the following to it:
```
const trustProxy = config.getOptional('backend.trustProxy');
if (trustProxy !== undefined) {
  app.set('trust proxy', trustProxy);
}
```
175528c: Adds backend.auditor.severityLogLevelMappings to map severity levels to log levels.
Updated dependencies
- @backstage/backend-plugin-api@1.3.0
- @backstage/integration@1.16.3
- @backstage/backend-app-api@1.2.2
- @backstage/plugin-auth-node@0.6.2
- @backstage/plugin-permission-node@0.9.1
- @backstage/backend-dev-utils@0.1.5
- @backstage/cli-node@0.2.13
- @backstage/config@1.3.2
- @backstage/config-loader@1.10.0
- @backstage/errors@1.2.7
- @backstage/integration-aws-node@0.1.15
- @backstage/types@1.2.1
- @backstage/plugin-events-node@0.4.10

`v0.8.2`

Compare Source

Patch Changes

e293b66: The default auditor service implementation will now log low severity events with debug level instead of info.
f422984: Remove unused dependencies
ecb9bab: Explicitly stringify extra logger fields with JSON.stringify to prevent [object Object] errors.
12f8e01: The discovery.endpoints configuration no longer requires both internal and external target when using the object form, instead falling back to the default.
89db8b8: GerritUrlReader is now able to search files matching a given pattern URL (using minimatch glob patterns).

This allows the Gerrit Discovery to find all Backstage manifests inside a repository using the **/catalog-info.yaml pattern.
Updated dependencies
- @backstage/config-loader@1.10.0
- @backstage/integration@1.16.2
- @backstage/plugin-permission-node@0.9.0
- @backstage/plugin-auth-node@0.6.1
- @backstage/plugin-events-node@0.4.9
- @backstage/backend-app-api@1.2.1
- @backstage/integration-aws-node@0.1.15
- @backstage/backend-dev-utils@0.1.5
- @backstage/backend-plugin-api@1.2.1
- @backstage/cli-node@0.2.13
- @backstage/config@1.3.2
- @backstage/errors@1.2.7
- @backstage/types@1.2.1

`v0.8.1`

Compare Source

Release a newer version of @backstage/techdocs-common including a bug fix #4088.

`v0.8.0`

Compare Source

Minor Changes

a4aa244: This change introduces the auditor service implementation details.

Patch Changes

f866b86: Internal refactor to use explicit require for lazy-loading dependency.
92a56f6: Internal refactor to stop importing the removed FeatureDiscoveryService from @backstage/backend-plugin-api.
a19cb2b: Added default implementation for the new PermissionsRegistryService.
0d39029: Do not send etag or If-Modified-Since headers for gitlab artifact urls
c7609de: Allow passing IP type to use with cloud-sql-connector
3740229: In the different UrlReadersService, the search method have been updated to use the readUrl if the given URL doesn't contain a pattern.
For UrlReaders that didn't implement the search method, readUrl is now called internally and throws if the given URL doesn't contain a pattern.
72cddf2: Updated PermissionsRegistryService to use PermissionResourceRefs and added the getPermissionRuleset method.
Updated dependencies
- @backstage/cli-node@0.2.13
- @backstage/plugin-permission-node@0.8.8
- @backstage/config-loader@1.9.6
- @backstage/backend-plugin-api@1.2.0
- @backstage/plugin-auth-node@0.6.0
- @backstage/backend-app-api@1.2.0
- @backstage/backend-dev-utils@0.1.5
- @backstage/cli-common@0.1.15
- @backstage/config@1.3.2
- @backstage/errors@1.2.7
- @backstage/integration@1.16.1
- @backstage/integration-aws-node@0.1.15
- @backstage/types@1.2.1
- @backstage/plugin-events-node@0.4.8

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

Signed-off-by: Renovate Bot <bot@renovateapp.com>

backstage-goalie · 2026-09-18T20:19:01Z

Changed Packages

Package Name	Package Path	Changeset Bump	Current Version
@backstage-community/plugin-growthbook-backend	workspaces/growthbook-flags/plugins/growthbook-backend	patch	`v0.1.1`

backstage-goalie · 2026-09-18T21:11:52Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

backstage-goalie · 2026-09-21T15:25:36Z

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.

backstage-service · 2026-09-26T06:24:47Z

👋 Reminder: This Renovate patch/minor PR has been open for 7 days.

Please review and merge if the changes look good. If no action is taken, this PR will be labeled force-merge in 7 days.

Update dependency @backstage/backend-defaults to ^0.12.0 [SECURITY]

3a7bce6

Signed-off-by: Renovate Bot <bot@renovateapp.com>

backstage-goalie Bot added the dependencies Pull requests that update a dependency file label Sep 18, 2026

backstage-goalie Bot requested a review from zaki-hanafiah as a code owner September 18, 2026 20:17

backstage-goalie Bot added the security label Sep 18, 2026

backstage-goalie Bot requested a review from a team as a code owner September 18, 2026 20:17

backstage-goalie Bot requested a review from 04kash September 18, 2026 20:17

backstage-service added the workspace/growthbook-flags label Sep 18, 2026

backstage-goalie Bot changed the title ~~chore(deps): update dependency @backstage/backend-defaults to ^0.12.0 [security]~~ chore(deps): update dependency @backstage/backend-defaults to ^0.12.0 [security] - abandoned Sep 21, 2026

backstage-service added the force-merge label Oct 3, 2026

Navigation Menu

Repository navigation

chore(deps): update dependency @backstage/backend-defaults to ^0.12.0 [security] - abandoned - #11110

chore(deps): update dependency @backstage/backend-defaults to ^0.12.0 [security] - abandoned#11110
backstage-goalie[bot] wants to merge 1 commit into
mainfrom
renovate/workspace-growthbook-flags/npm-backstage-backend-defaults-vulnerability

backstage-goalie Bot commented Sep 18, 2026

Uh oh!

backstage-goalie Bot commented Sep 18, 2026

Uh oh!

backstage-goalie Bot commented Sep 18, 2026

Uh oh!

backstage-goalie Bot commented Sep 21, 2026

Uh oh!

backstage-service commented Sep 26, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

backstage-goalie Bot commented Sep 18, 2026

Backstage has a Possible SSRF when reading from allowed URL's in backend.reading.allow

Details

Impact

Patches

Workarounds

References

Severity

References

Backstage has a Possible Symlink Path Traversal in Scaffolder Actions

Details

Impact

Patches

Workarounds

References

Severity

References

Release Notes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Configuration

Uh oh!

backstage-goalie Bot commented Sep 18, 2026

Changed Packages

Uh oh!

backstage-goalie Bot commented Sep 18, 2026

Edited/Blocked Notification

Uh oh!

backstage-goalie Bot commented Sep 21, 2026

Autoclosing Skipped

Uh oh!

backstage-service commented Sep 26, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Backstage has a Possible SSRF when reading from allowed URL's in `backend.reading.allow`