[Snyk] Security upgrade @backstage/plugin-techdocs from 0.0.0-use.local to 0.1.1 #6665
Conversation
…abilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-DOMPURIFY-7984421
Review or Edit in CodeSandboxOpen the branch in Web Editor • VS Code • Insiders |
Reviewer's GuideUpgrades the @backstage/plugin-techdocs dependency in the techdocs-addons-test-utils package to version 0.1.1 to address a high-severity Prototype Pollution vulnerability by replacing the workspace alias in package.json (lockfile update required). File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
⛔ Snyk checks have failed. 89 issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
|
No dependency changes detected. Learn more about Socket for GitHub. 👍 No dependency changes detected in pull request |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
|
🔒 Entelligence AI Vulnerability Scanner ✅ No security vulnerabilities found! Your code passed our comprehensive security analysis. |
WalkthroughThis PR updates the dependency configuration in the techdocs-addons-test-utils package by changing the '@backstage/plugin-techdocs' dependency from a workspace reference to a fixed version (0.1.1). This change pins the dependency to a specific version rather than allowing it to automatically update with workspace changes, which helps ensure consistent and predictable test behavior by preventing unintended version updates during development. Changes
Sequence DiagramThis diagram shows the interactions between components: sequenceDiagram
title TechDocs Addons Test Utils Dependency Flow
participant App as "Backstage App"
participant TestUtils as "techdocs-addons-test-utils"
participant TechDocsPlugin as "plugin-techdocs"
participant OtherDeps as "Other Dependencies"
Note over TestUtils, TechDocsPlugin: Before Change: Workspace Reference
App->>TestUtils: Import test utilities
activate TestUtils
TestUtils->>TechDocsPlugin: Import from workspace:^
Note right of TechDocsPlugin: Uses latest version<br/>from workspace
TechDocsPlugin-->>TestUtils: Provide functionality
TestUtils->>OtherDeps: Import other dependencies
OtherDeps-->>TestUtils: Provide functionality
TestUtils-->>App: Return test utilities
deactivate TestUtils
Note over TestUtils, TechDocsPlugin: After Change: Fixed Version
App->>TestUtils: Import test utilities
activate TestUtils
TestUtils->>TechDocsPlugin: Import version 0.1.1
Note right of TechDocsPlugin: Uses fixed version 0.1.1<br/>regardless of workspace
TechDocsPlugin-->>TestUtils: Provide functionality
TestUtils->>OtherDeps: Import other dependencies
OtherDeps-->>TestUtils: Provide functionality
TestUtils-->>App: Return test utilities
deactivate TestUtils
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
|
LGTM 👍 |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
WalkthroughThis PR updates the dependency configuration in the techdocs-addons-test-utils package by changing the '@backstage/plugin-techdocs' dependency from a workspace reference to a fixed version. Instead of using 'workspace:^', which would dynamically reference the local workspace version during development, the dependency is now pinned to version '0.1.1'. This change ensures consistent test behavior by preventing automatic updates of the techdocs plugin that could potentially introduce unexpected changes during testing or development. Changes
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
|
LGTM 👍 |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
WalkthroughThis PR updates the dependency management for the techdocs addons test utilities package. The change modifies how the Changes
Sequence DiagramThis diagram shows the interactions between components: sequenceDiagram
participant PM as Package Manager
participant Registry as NPM Registry
participant Workspace as Local Workspace
participant Plugin as techdocs-addons-test-utils
Note over PM,Plugin: Dependency Resolution Change
rect rgb(240, 240, 240)
Note over PM,Workspace: Before: workspace:^ reference
PM->>Workspace: Resolve @backstage/plugin-techdocs
Workspace-->>PM: Return local workspace version
PM->>Plugin: Install local dependency
end
rect rgb(220, 250, 220)
Note over PM,Registry: After: Version 0.1.1 reference
PM->>Registry: Request @backstage/plugin-techdocs@0.1.1
Registry-->>PM: Return published package v0.1.1
PM->>Plugin: Install registry dependency
end
Note over PM,Plugin: No runtime behavior changes<br/>Only affects build-time resolution
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
WalkthroughThis PR updates the dependency management for the techdocs addons test utilities package. The change modifies how the Changes
Sequence DiagramThis diagram shows the interactions between components: sequenceDiagram
participant PM as Package Manager
participant Registry as NPM Registry
participant Workspace as Local Workspace
participant Plugin as techdocs-addons-test-utils
Note over PM,Plugin: Dependency Resolution Change
rect rgb(240, 240, 240)
Note over PM,Workspace: Before: workspace:^ reference
PM->>Workspace: Resolve @backstage/plugin-techdocs
Workspace-->>PM: Return local workspace version
PM->>Plugin: Install local dependency
end
rect rgb(220, 250, 220)
Note over PM,Registry: After: Version 0.1.1 reference
PM->>Registry: Request @backstage/plugin-techdocs@0.1.1
Registry-->>PM: Return published package v0.1.1
PM->>Plugin: Install registry dependency
end
Note over PM,Plugin: No runtime behavior changes<br/>Only affects build-time resolution
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
WalkthroughThis PR updates the dependency management for the techdocs addons test utilities package. The change modifies how the Changes
Sequence DiagramThis diagram shows the interactions between components: sequenceDiagram
participant PM as Package Manager
participant Registry as NPM Registry
participant Workspace as Local Workspace
participant Plugin as techdocs-addons-test-utils
Note over PM,Plugin: Dependency Resolution Change
rect rgb(240, 240, 240)
Note over PM,Workspace: Before: workspace:^ reference
PM->>Workspace: Resolve @backstage/plugin-techdocs
Workspace-->>PM: Return local workspace version
PM->>Plugin: Install local dependency
end
rect rgb(220, 250, 220)
Note over PM,Registry: After: Version 0.1.1 reference
PM->>Registry: Request @backstage/plugin-techdocs@0.1.1
Registry-->>PM: Return published package v0.1.1
PM->>Plugin: Install registry dependency
end
Note over PM,Plugin: No runtime behavior changes<br/>Only affects build-time resolution
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
WalkthroughThis pull request modifies the dependency management for the techdocs-addons-test-utils plugin by changing how it references the techdocs plugin dependency. The change transitions from using a workspace protocol reference (which points to the local monorepo version) to a pinned version number (0.1.1). This modification locks the dependency to a specific version, which is typically done to ensure compatibility, stabilize testing environments, or prepare for package publication. The change affects dependency resolution behavior and may impact how the test utilities package is built and distributed. Changes
Sequence DiagramThis diagram shows the interactions between components: sequenceDiagram
participant PM as Package Manager
participant Registry as NPM Registry
participant Workspace as Local Workspace
participant TestUtils as techdocs-addons-test-utils
Note over PM,TestUtils: Dependency Resolution Change
rect rgb(240, 240, 240)
Note over PM,Workspace: Previous Behavior (workspace:^)
PM->>Workspace: Resolve @backstage/plugin-techdocs
Workspace-->>PM: Return local workspace version
PM->>TestUtils: Install local dependency
end
rect rgb(220, 250, 220)
Note over PM,Registry: New Behavior (version 0.1.1)
PM->>Registry: Request @backstage/plugin-techdocs@0.1.1
Registry-->>PM: Return published package v0.1.1
PM->>TestUtils: Install registry dependency
end
Note over TestUtils: Package now uses fixed version<br/>instead of workspace reference
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
WalkthroughChangesSequence DiagramThis diagram shows the interactions between components: sequenceDiagram
participant PM as Package Manager
participant TATU as techdocs-addons-test-utils
participant WS as Local Workspace
participant NPM as NPM Registry
participant TD as plugin-techdocs
Note over PM,TD: Before: workspace:^ dependency
PM->>TATU: Install dependencies
TATU->>PM: Request plugin-techdocs (workspace:^)
PM->>WS: Resolve from local workspace
WS->>PM: Return local plugin-techdocs
PM->>TATU: Link local dependency
Note over PM,TD: After: 0.1.1 version dependency
PM->>TATU: Install dependencies
TATU->>PM: Request plugin-techdocs@0.1.1
PM->>NPM: Fetch plugin-techdocs@0.1.1
NPM->>PM: Return published package
PM->>TATU: Install versioned dependency
Note over TATU,TD: Dependency now points to<br/>published version instead of<br/>local workspace
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
EntelligenceAI PR Summary
This PR pins the @backstage/plugin-techdocs dependency to version 0.1.1 in the techdocs-addons-test-utils package.
workspace:^) with explicit version (0.1.1)plugins/techdocs-addons-test-utils/package.json