Repository navigation
fix(deps): update dependency @backstage/backend-defaults to ^0.18.0 [security] - abandoned - #11588
Open
backstage-goalie[bot] wants to merge 1 commit into
Conversation
…security] Signed-off-by: Renovate Bot <bot@renovateapp.com>
backstage-goalie
Bot
requested review from
aljesusg and
josunect
as code owners
October 13, 2026 22:38
backstage-goalie
Bot
added
the
dependencies
backstage-goalie
Bot
added
dependencies
Contributor
Author
Changed Packages
|
Contributor
Author
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
backstage-goalie
Bot
changed the title
Contributor
Author
Autoclosing SkippedThis PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error. |
Collaborator
|
👋 Reminder: This Renovate patch/minor PR has been open for 7 days. Please review and merge if the changes look good. If no action is taken, this PR will be labeled |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^0.17.7→^0.18.0Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Backstage: Improper input validation in cloud storage URL readers
CVE-2026-106494 / GHSA-7649-wm97-w3j3
More information
Details
Impact
An attacker with write access to a cloud storage bucket used by Backstage could craft object names that could collide with protected files in the output directory. In certain deployment configurations, this could lead to content injection.
Patches
Patched in
@backstage/backend-defaultsversion0.17.8Severity
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Backstage: Improper preservation of access restrictions during service credential delegation
CVE-2026-106492 / GHSA-cq7v-rfgc-5c7v
More information
Details
Impact
An external service credential configured with access restrictions (e.g., read-only) could bypass those restrictions by routing requests through plugin delegation paths. This could allow a restricted service to perform operations beyond its intended scope, including write operations on plugins it was restricted to read-only access for.
Patches
Patched in
@backstage/backend-defaultsversion0.17.8Workarounds
If you're unable to upgrade immediately:
Severity
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:LReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Backstage: Cloud storage catalog locations may cross configured storage boundaries
CVE-2026-106493 / GHSA-xvh9-35w9-42m4
More information
Details
Impact
Catalog entity providers for Azure Blob Storage and AWS S3 did not sufficiently validate storage object paths, which could allow catalog descriptors to be read from outside the intended storage boundary. Access is limited to locations reachable by the backend's configured credentials.
Patches
@backstage/plugin-catalog-backend-module-azureversion0.3.21@backstage/plugin-catalog-backend-module-awsversion0.4.27@backstage/backend-defaultsversion0.7.18Workarounds
Severity
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
backstage/backstage (@backstage/backend-defaults)
v0.18.0Compare Source
Minor Changes
2e07985: Add schemaPrefix configuration for pluginDivisionMode: schema. Allows prefixing PostgreSQL schema names to avoid conflicts with existing schemas.Patch Changes
fe6ace6: FixedAwsS3UrlReaderandAwsCodeCommitUrlReaderto resolve account-specific AWS credentials when an assume role ARN is configured, enabling support forwebIdentityTokenFileandaccountDefaultsin environments without default AWS credentials.45d760b: Improve action handling consistency.8d71644: Reduced PostgreSQL connection churn during backend startup when many plugins initialize databases or schemas.416be1b: Updated Harness URL reading to validate cross-origin redirect destinationsagainst
backend.reading.allow.c59472e: Plugin route registration now rejects paths that differ only by letter casing,and HTTP credentials are resolved independently for each plugin service instance.
5aac521: Improved service credential handling during plugin-to-plugin delegation.61449ae: Reduced PostgreSQL startup connections when multiple plugins share a database by reusing the database existence check.55f30b8: Reduced scheduler database polling overhead by batching readiness checks for global tasks registered by each plugin into one query per poll cycle on each backend instance.8b3c83e: Improved input validation and path handling for cloud storage URL readers.61d97c0: Improved input validation for cloud storage URL readers.e895def: Fixed handling of GitLab URLs for instances configured with a relative base path.f6f339e: Fixed redundant signing-key requests when concurrently authenticating the first incoming requests from a plugin. Concurrent requests now share the same key cache, including when retrying after an initial fetch failure.e13e278: Updated URL reader allow list matching so configured paths match either the exact path or paths below it at a segment boundary.e3b587c: Improve authentication reliability during signing key rotation by performing budgeted JWKS reloads when a newly published key is requested during the remote key set cooldown.Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.