[Snyk] Security upgrade @backstage/plugin-scaffolder-backend from 0.0.0-use.local to 1.15.0 #6576
Conversation
…ulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-OCTOKIT-6129525 - https://snyk.io/vuln/SNYK-JS-OCTOKITWEBHOOKS-6129527 - https://snyk.io/vuln/SNYK-JS-BACKSTAGEPLUGINSCAFFOLDERBACKEND-5730767
Review or Edit in CodeSandboxOpen the branch in Web Editor • VS Code • Insiders |
Reviewer's GuideUpgrades the @backstage/plugin-scaffolder-backend dependency from a local workspace reference to version 1.15.0 in package.json to remediate three Snyk-reported high-severity vulnerabilities; requires a manual yarn.lock update (and yarn cache refresh for zero-install setups) before merging. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
⛔ Snyk checks have failed. 88 issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
![graphite-app[bot]](https://avatars.githubusercontent.com/in/158384?s=60&v=4){kind=small}
| "@backstage/errors": "workspace:^", | ||
| "@backstage/integration": "workspace:^", | ||
| "@backstage/plugin-scaffolder-backend": "workspace:^", | ||
| "@backstage/plugin-scaffolder-backend": "1.15.0", |
There was a problem hiding this comment.
Dependency version inconsistency: Changing from 'workspace:^' to '1.15.0' for @backstage/plugin-scaffolder-backend creates a version mismatch with other Backstage dependencies that still use 'workspace:^'. This breaks the monorepo workspace dependency pattern and may cause version conflicts, build failures, or runtime incompatibilities. All Backstage dependencies should maintain consistent versioning strategy - either all use 'workspace:^' or all use specific versions.
| "@backstage/plugin-scaffolder-backend": "1.15.0", | |
| "@backstage/plugin-scaffolder-backend": "workspace:^", |
Spotted by Diamond
Is this helpful? React 👍 or 👎 to let us know.
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
Entelligence AI Vulnerability ScannerStatus: No security vulnerabilities found Your code passed our comprehensive security analysis. |
WalkthroughThis PR updates the dependency management for the Rails scaffolder backend module by pinning the Changes
Sequence DiagramThis diagram shows the interactions between components: sequenceDiagram
participant Build as Build System
participant Rails as scaffolder-backend-module-rails
participant Backend as plugin-scaffolder-backend
Note over Build,Backend: Dependency Resolution Change
alt Before (workspace:^)
Build->>Rails: Resolve dependencies
Rails->>Backend: Request workspace version
Backend-->>Rails: Return local workspace package
else After (1.15.0)
Build->>Rails: Resolve dependencies
Rails->>Backend: Request version 1.15.0
Backend-->>Rails: Return published package v1.15.0
end
Note over Rails,Backend: Rails module now uses<br/>fixed version instead of<br/>workspace reference
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
WalkthroughThis pull request updates the dependency management for the scaffolder backend module in the Rails plugin. The change transitions from using a workspace protocol reference to a pinned version (1.15.0) for the @backstage/plugin-scaffolder-backend dependency. This modification ensures version stability by locking the module to a specific version of the scaffolder backend plugin rather than relying on the local workspace version. The change affects dependency resolution behavior and may be necessary to maintain compatibility with a specific API surface or to ensure consistent behavior across different environments. Changes
Sequence DiagramThis diagram shows the interactions between components: sequenceDiagram
participant Build as Build System
participant Rails as scaffolder-backend-module-rails
participant ScaffolderBackend as plugin-scaffolder-backend
Note over Build,ScaffolderBackend: Dependency Resolution Change
Build->>Rails: Resolve dependencies
alt Before Change (workspace:^)
Rails->>Build: Request local workspace version
Build->>ScaffolderBackend: Use local workspace package
ScaffolderBackend-->>Rails: Provide workspace version
else After Change (1.15.0)
Rails->>Build: Request version 1.15.0
Build->>ScaffolderBackend: Use fixed version 1.15.0
ScaffolderBackend-->>Rails: Provide version 1.15.0
end
Note over Rails,ScaffolderBackend: Runtime behavior unchanged<br/>Only dependency resolution affected
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
WalkthroughChangesSequence DiagramThis diagram shows the interactions between components: sequenceDiagram
participant PM as Package Manager
participant Rails as scaffolder-backend-module-rails
participant SB as @backstage/plugin-scaffolder-backend
participant WS as Workspace
Note over PM,WS: Dependency Resolution Change
rect rgb(240, 240, 240)
Note over PM,Rails: BEFORE: workspace:^ reference
PM->>Rails: Install dependencies
Rails->>WS: Request plugin-scaffolder-backend (workspace:^)
WS-->>Rails: Return local workspace version
Note over Rails,WS: Uses local development version
end
rect rgb(220, 250, 220)
Note over PM,Rails: AFTER: Fixed version 1.15.0
PM->>Rails: Install dependencies
Rails->>SB: Request plugin-scaffolder-backend@1.15.0
SB-->>Rails: Return specific version 1.15.0
Note over Rails,SB: Uses pinned registry version
end
Note over PM,SB: Impact: Dependency now resolved from<br/>package registry instead of local workspace
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
EntelligenceAI PR Summary
This PR pins the scaffolder backend plugin dependency to version 1.15.0 in the Rails scaffolder backend module.
@backstage/plugin-scaffolder-backenddependency fromworkspace:^to1.15.0