Skip to content

fix(deps): update dependency @backstage/backend-defaults to ^0.17.0 [security] - abandoned - #11539

Open
backstage-goalie[bot] wants to merge 1 commit into
mainfrom
renovate/workspace-azure-sites/npm-backstage-backend-defaults-vulnerability
Open

fix(deps): update dependency @backstage/backend-defaults to ^0.17.0 [security] - abandoned#11539
backstage-goalie[bot] wants to merge 1 commit into
mainfrom
renovate/workspace-azure-sites/npm-backstage-backend-defaults-vulnerability

Conversation

@backstage-goalie

@backstage-goalie backstage-goalie Bot commented Oct 8, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
@backstage/backend-defaults (source) ^0.15.1 → ^0.17.0 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Backstage: Improper input validation in cloud storage URL readers

CVE-2026-106494 / GHSA-7649-wm97-w3j3

More information

Details

Impact

An attacker with write access to a cloud storage bucket used by Backstage could craft object names that could collide with protected files in the output directory. In certain deployment configurations, this could lead to content injection.

Patches

Patched in @backstage/backend-defaults version 0.17.8

Severity

  • CVSS Score: 4.4 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Backstage: Improper preservation of access restrictions during service credential delegation

CVE-2026-106492 / GHSA-cq7v-rfgc-5c7v

More information

Details

Impact

An external service credential configured with access restrictions (e.g., read-only) could bypass those restrictions by routing requests through plugin delegation paths. This could allow a restricted service to perform operations beyond its intended scope, including write operations on plugins it was restricted to read-only access for.

Patches

Patched in @backstage/backend-defaults version 0.17.8

Workarounds

If you're unable to upgrade immediately:

  • If practical, replace restricted credentials with separate, purpose-specific unrestricted credentials scoped to trusted consumers.
  • Restrict network-level access to Backstage backend API endpoints to trusted callers only.

Severity

  • CVSS Score: 7.6 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Backstage: Cloud storage catalog locations may cross configured storage boundaries

CVE-2026-106493 / GHSA-xvh9-35w9-42m4

More information

Details

Impact

Catalog entity providers for Azure Blob Storage and AWS S3 did not sufficiently validate storage object paths, which could allow catalog descriptors to be read from outside the intended storage boundary. Access is limited to locations reachable by the backend's configured credentials.

Patches
  • @backstage/plugin-catalog-backend-module-azure version 0.3.21
  • @backstage/plugin-catalog-backend-module-aws version 0.4.27
  • @backstage/backend-defaults version 0.7.18
Workarounds
  • Restrict blob and object creation or renaming in configured catalog storage sources to trusted principals.
  • Scope Backstage's Azure and AWS reader credentials and network access to the intended storage boundaries.
  • Disable an affected catalog provider if those restrictions cannot be enforced.

Severity

  • CVSS Score: 3.0 / 10 (Low)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

backstage/backstage (@​backstage/backend-defaults)

v0.17.8

Compare Source

v0.17.7

Compare Source

Patch Changes

v0.17.6

Compare Source

Patch Changes

v0.17.5

Compare Source

Patch Changes
  • aaa7d65: Improved readability of the AWS S3 URL parser by splitting the single monolithic regex into two separate patterns (standard S3 and VPC PrivateLink) with named capture groups. Also made the VPC endpoint region mandatory in the regex, fixing a potential mis-parse when the region segment was absent.
  • d62c384: Fixed a bug where scheduled tasks that were initially registered with a manual trigger and later re-registered with a duration or cron cadence would never be scheduled to run.
  • 8419f51: Added support for AWS PrivateLink for Amazon S3.
  • a624fa3: The connection config option for the Redis cache store now accepts either a string URL or an object with additional connection options that are passed directly to the underlying client. The object form is only supported when backend.cache.store is redis; other stores require a plain string. This allows configuring options like pingInterval without needing dedicated config fields. For clustered Redis, the connection object properties are merged into cluster defaults. Fixes #​31813, #​31742.
  • Updated dependencies

v0.17.4

Compare Source

Patch Changes

v0.17.3

Compare Source

Patch Changes
  • 4f4bcf5: Upgraded infinispan from ^0.12.0 to ^0.13.0 to address known vulnerabilities.
  • a07e6a3: Updated AzureBlobStorageUrlReader to reference the correctly-named AzureBlobStorageIntegration type from @backstage/integration. The previously-used AzureBlobStorageIntergation is now an alias for the new type and remains a valid argument to the constructor.
  • b75158b: Adapted Azure-related tests for the Azure SDK upgrade to ESM-style exports. The AzureBlobStorageUrlReader now accepts an optional createContainerClient dependency for testability without needing to mock the @azure/storage-blob module.
  • 89a95ca: Fixed the task worker retry loop to respect the abort signal. Previously, when a task worker encountered an unexpected error, the retry loop would continue indefinitely even after the worker was signaled to stop. The retry loop now checks the abort signal before retrying and passes it to the retry delay, allowing the worker to shut down gracefully.
  • def82d4: Fixed the built-in rate limiter throwing a validation error and refusing to start when backend.rateLimit is enabled. Requests are now keyed using the address normalization helper from express-rate-limit, which is required by newer versions of that library and ensures IPv6 clients are grouped by their address block rather than by individual address.
  • 0211390: Added a new v2 invoke endpoint (/.backstage/actions/v2/actions/:id/invoke) that accepts a wrapped body format { input, secrets } with secrets validation. The existing v1 invoke endpoint remains unchanged for backward compatibility. Updated DefaultActionsService to use the v2 endpoint. Updated DefaultActionsRegistryService to expose secrets schema in the actions list response and validate secrets on invocation.
  • 34f21c3: Fix gitlabUrlReader issue with retrieving the repository archive tree
  • Updated dependencies

v0.17.2

Compare Source

Patch Changes

v0.17.1

Compare Source

Patch Changes
  • 90b572e: Adds an alpha TracingService to provide a unified interface for emitting trace spans across Backstage plugins.
  • 97d3bd4: Fixed a race condition in CachedUserInfoService where a failed request could incorrectly evict a newer cache entry for the same token. The error handler now verifies the map entry is still the same promise before deleting it.
  • 3595c97: Exported defaultServiceFactories to allow use with createSpecializedBackend for advanced configuration like extensionPointFactoryMiddleware.
  • 89d3248: Fixed scheduler sleep firing immediately for durations longer than ~24.8 days, caused by Node.js setTimeout overflowing its 32-bit millisecond limit.
  • d00a44b: Fixed Valkey cluster mode to use iovalkey's Cluster class instead of
    createCluster from @keyv/redis. The previous implementation passed a
    @redis/client RedisCluster instance to @keyv/valkey, which expects an
    iovalkey Cluster instance. This caused the cluster client to not be
    recognized correctly, as the two libraries have incompatible object models.
  • 2f0519c: Added a new CachedUserInfoService decorator that wraps DefaultUserInfoService with a 5-second TTL cache and in-flight request coalescing. The decorator is wired in via userInfoServiceFactory using a shared root-level cache. Repeated getUserInfo() calls for the same user token within the TTL window return the cached result without making an HTTP call to the auth backend. Note that custom UserInfoService implementations registered via their own factory will not benefit from this cache automatically.
  • 744fa1f: Removed duplicated entries that appeared in both dependencies and devDependencies.
  • e9b78e9: Removed the uuid dependency and replaced usage with the built-in crypto.randomUUID().
  • 6209065: Added context and propagation to the alpha TracingService. Plugins can bridge OpenTelemetry context across async boundaries via tracing.propagation.extract(tracing.context.active(), carrier) followed by tracing.context.with(ctx, fn), and read propagated baggage via tracing.propagation.getActiveBaggage() or tracing.propagation.getBaggage(ctx).
  • Updated dependencies

v0.17.0

Compare Source

Minor Changes
  • c69e03c: Added support for AWS RDS IAM authentication for PostgreSQL connections. Set connection.type: rds along with host, user, and region to use short-lived IAM tokens instead of a static password. Requires the @aws-sdk/rds-signer package and an IAM role with rds-db:connect permission.
Patch Changes

v0.16.1

Compare Source

Patch Changes

v0.16.0

Compare Source

Minor Changes
  • 42960f1: The actions registry invoke endpoint now accepts direct user credentials in addition to service principals, enabling CLI and other direct user clients to invoke actions.
  • 0e7d8f9: The scheduler service now uses the metrics service to create metrics, providing plugin-scoped attribution.
  • 527cf88: BREAKING Removed deprecated BitbucketUrlReader. Use the BitbucketCloudUrlReader or the BitbucketServerUrlReader instead.
Patch Changes
  • cc8348e: Added permissions integration to the actions registry. Actions registered with a visibilityPermission field are now checked against the permissions framework when listing and invoking. Denied actions are filtered from list results, and invoking a denied action returns a 404 Not Found as if the action does not exist. Permissions are automatically registered with the PermissionsRegistryService so they appear in the permission policy system.
  • dee4283: Added pluginId field to ActionsServiceAction type, populated from the registering plugin's metadata.
  • 015668c: Added cancelTask method to the SchedulerService interface and implementation, allowing cancellation of currently running scheduled tasks. For global tasks, the database lock is released and a periodic liveness check aborts the running task function. For local tasks, the task's abort signal is triggered directly. A new POST /.backstage/scheduler/v1/tasks/:id/cancel endpoint is also available.
  • 638e6c7: chore(deps): bump yauzl from 3.2.0 to 3.2.1
  • 6738cf0: build(deps): bump minimatch from 9.0.5 to 10.2.1
  • 62f0a53: Fixed error forwarding in the actions registry so that known errors like InputError and NotFoundError thrown by actions preserve their original status codes and messages instead of being wrapped in ForwardedError and coerced to 500.
  • d933f62: Add configurable throttling and retry mechanism for GitLab integration.
  • b99158a: Fixed yarn backstage-cli config:check --strict --config app-config.yaml config validation error by adding
    an optional default type discriminator to PostgreSQL connection configuration,
    allowing config:check to properly validate default connection configurations.
  • 1ee5b28: Adds an alpha MetricsService to provide a unified interface for metrics instrumentation across Backstage plugins.
  • 5fcbef2: Updated dependency express-rate-limit to ^8.0.0.
  • a49a40d: Updated dependency zod to ^3.25.76 || ^4.0.0 & migrated to /v3 or /v4 imports.
  • Updated dependencies

v0.15.2

Compare Source

Patch Changes

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

@backstage-goalie backstage-goalie Bot added dependencies Pull requests that update a dependency file security labels Oct 8, 2026
@backstage-goalie
backstage-goalie Bot requested a review from a team as a code owner October 8, 2026 11:42
@backstage-goalie backstage-goalie Bot added the dependencies Pull requests that update a dependency file label Oct 8, 2026
@backstage-goalie Github changeset workflow
fix(deps): update dependency @backstage/backend-defaults to ^0.17.0 […
c553d14 
…security]

Signed-off-by: Renovate Bot <bot@renovateapp.com>
@backstage-service
backstage-service force-pushed the renovate/workspace-azure-sites/npm-backstage-backend-defaults-vulnerability branch from abd2aba to c553d14 Compare October 8, 2026 11:42
@backstage-goalie

backstage-goalie Bot commented Oct 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Changed Packages

Package Name Package Path Changeset Bump Current Version
@backstage-community/plugin-azure-sites-backend workspaces/azure-sites/plugins/azure-sites-backend patch v0.16.0

@backstage-goalie

backstage-goalie Bot commented Oct 8, 2026

Copy link
Copy Markdown
Contributor Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@backstage-goalie backstage-goalie Bot changed the title fix(deps): update dependency @backstage/backend-defaults to ^0.17.0 [security] fix(deps): update dependency @backstage/backend-defaults to ^0.17.0 [security] - abandoned Oct 13, 2026
@backstage-goalie

backstage-goalie Bot commented Oct 13, 2026

Copy link
Copy Markdown
Contributor Author

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.

@backstage-service

backstage-service commented Oct 16, 2026

Copy link
Copy Markdown
Collaborator

👋 Reminder: This Renovate patch/minor PR has been open for 7 days.

Please review and merge if the changes look good. If no action is taken, this PR will be labeled force-merge in 7 days.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@deepan10 deepan10 Awaiting requested review from deepan10 deepan10 is a code owner
@Sarabadu Sarabadu Awaiting requested review from Sarabadu Sarabadu is a code owner
@hopehadfield hopehadfield Awaiting requested review from hopehadfield hopehadfield is a code owner automatically assigned from backstage/community-plugins-maintainers

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file force-merge security workspace/azure-sites

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@backstage-service