Repository navigation
Update dependency @backstage/plugin-catalog-backend to v3.9.2 [SECURITY] - #11791
Open
backstage-goalie[bot] wants to merge 1 commit into
Open
backstage-goalie[bot] wants to merge 1 commit into
backstage-goalie[bot] wants to merge 1 commit into
Conversation
backstage-goalie
Bot
added
dependencies
backstage-goalie
Bot
requested review from
a team,
deshmukhmayur,
riginoommen and
yashoswalyo
as code owners
October 28, 2026 16:33
backstage-goalie
Bot
force-pushed
the
renovate/workspace-feedback/npm-backstage-plugin-catalog-backend-vulnerability
branch
2 times, most recently
from
October 28, 2026 19:31
5163668 to
ee71359
Compare
backstage-goalie
Bot
changed the title
backstage-goalie
Bot
force-pushed
the
renovate/workspace-feedback/npm-backstage-plugin-catalog-backend-vulnerability
branch
2 times, most recently
from
October 29, 2026 07:29
78af038 to
b64ed83
Compare
Signed-off-by: Renovate Bot <bot@renovateapp.com>
backstage-goalie
Bot
force-pushed
the
renovate/workspace-feedback/npm-backstage-plugin-catalog-backend-vulnerability
branch
from
October 29, 2026 14:30
b64ed83 to
49273f4
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
3.8.1→3.9.2Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Backstage: Inconsistent enforcement of allowed location types during catalog processing
CVE-2026-106496 / GHSA-pcmq-25r3-5w9v
More information
Details
Impact
Under certain configurations, the catalog backend could process location types that were not intended to be allowed, potentially leading to unintended file access on the backend host.
Patches
Patched in
@backstage/plugin-catalog-backendversion3.9.1Workarounds
No practical workarounds are available. Upgrade to the patched version.
Severity
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Backstage: Improper URL validation in catalog entity placeholder resolution
CVE-2026-106498 / GHSA-qgvj-qcf8-xq73
More information
Details
Impact
An authenticated Backstage user could craft a catalog entity with placeholder directives that reference resources outside the entity's source repository. Under certain configurations, this could allow access to data not intended to be available to the user.
Patches
Patched in
@backstage/plugin-catalog-backendversion3.9.1Workarounds
If you're not able to update immediately:
Severity
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Backstage catalog rules can be bypassed for URL locations using encoded path segments
CVE-2026-115923 / GHSA-w658-mh9p-ww8f
More information
Details
Summary
@backstage/plugin-catalog-backendmatches URL-type locations againstcatalog.ruleslocation patterns using the raw URL string submitted by the user, while URL readers resolve that same string in canonical form when fetching the location's content. A URL can therefore be crafted so that it appears to belong to a trusted location scope during rule evaluation, but is fetched from a different scope.Details
When a deployment restricts catalog kinds to trusted URL prefixes using
catalog.ruleslocation patterns,DefaultCatalogRulesEnforcerapplies glob matching directly to the rawlocation.targetstring. The URL readers used for ingestion resolve the same target in canonical form, including normalizing percent-encoded dot segments. A registered location such ashttps://<host>/trusted/%2e%2e/attacker/repo/blob/main/catalog-info.yamlmatches ahttps://<host>/trusted/**pattern as a raw string, but resolves to and is fetched fromhttps://<host>/attacker/repo/...when its content is read.An authenticated user with permission to register catalog locations (
catalog.location.create) can use this to have an entity from an untrusted source admitted as if it originated from a trusted location scope.Impact
The crossed boundary is the operator-configured catalog ingestion policy: entity content from outside the trusted location scope is ingested as if it were within it. Downstream consequences depend on deployment configuration, for example actions taken with integration credentials by processors or scaffolder when acting on the ingested entity. The assessment of this report found no basis for impact claims beyond the ingestion policy boundary itself.
Patches
This is fixed in
@backstage/plugin-catalog-backend3.9.2 (Backstage release 1.54.10) and 4.0.2 (Backstage release 1.56.1). Version 4.0.1 as published is not fixed.Workarounds
No complete workaround is available for deployments that rely on URL location patterns to restrict catalog kinds. Restricting location registration permissions reduces exposure.
Severity
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
backstage/backstage (@backstage/plugin-catalog-backend)
v3.9.2Compare Source
Patch Changes
7761a50: Improved path validation for catalog entity placeholders.fda0ef1: Correct catalog property permission matching.e363ae2: Allowed location type restrictions are now applied consistently during catalog processing.v3.9.1Compare Source
v3.9.0Compare Source
Minor Changes
c7c0ec3: Added arefresh-catalog-entityaction so agents and MCP clients can re-queue a single entity for processing after creating or updating it — useful for reading back fresh data immediately after a scaffolder run without waiting for the next scheduled processing loop.Patch Changes
aa318d0: Migrated internal query filter handling fromEntityFiltertoFilterPredicate, simplifying the filter parsing and query application pipeline.10f0713: Replaced the delete-all and reinsert pattern for therelationstable with a diff-based sync that only touches rows that actually changed. In steady state (the common case), zero writes occur, eliminating write churn, dead tuples, and WAL traffic from the processing path. Stitching is now also skipped for relation neighbors that did not change.ee40136: Fixed a missing promise return in a database migration rollback function.eb6dff2: Fixed an issue where PostgreSQL deadlock errors during entity provider mutations were silently swallowed, causing entities to be dropped until the next full refresh. Transactions are now automatically retried on deadlock with exponential back-off.dd562f0: Fixed a potential MySQL deadlock during concurrent entity processing by retrying theupdateProcessedEntitytransaction on deadlock errors.b031a48: Fixed an issue where SCMlocation.movedevents would generate new locations in the database for files that were not actively tracked.b7650ad: Simplified internal router setup by removing unnecessary conditional guards around route registrations.v3.8.2Compare Source
Patch Changes
ee40136: Fixed a missing promise return in a database migration rollback function.b7650ad: Simplified internal router setup by removing unnecessary conditional guards around route registrations.Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.