[Snyk] Security upgrade @backstage/plugin-scaffolder-backend from 0.0.0-use.local to 1.15.0 #6891
Conversation
…educe vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-OCTOKIT-6129525 - https://snyk.io/vuln/SNYK-JS-OCTOKITWEBHOOKS-6129527 - https://snyk.io/vuln/SNYK-JS-BACKSTAGEPLUGINSCAFFOLDERBACKEND-5730767
Review or Edit in CodeSandboxOpen the branch in Web Editor • VS Code • Insiders |
Reviewer's GuideThe PR upgrades the @backstage/plugin-scaffolder-backend dependency from a local workspace reference to version 1.15.0 in the scaffolder module’s package.json to remediate three high-severity vulnerabilities flagged by Snyk. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
⛔ Snyk checks have failed. 88 issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
Entelligence AI Vulnerability ScannerStatus: No security vulnerabilities found Your code passed our comprehensive security analysis. |
WalkthroughThis pull request modifies the dependency management for the Cookiecutter scaffolder backend module by pinning the Changes
Sequence DiagramThis diagram shows the interactions between components: sequenceDiagram
participant PM as Package Manager
participant CookieCutter as scaffolder-backend-module-cookiecutter
participant ScaffolderBackend as @backstage/plugin-scaffolder-backend
Note over PM,ScaffolderBackend: Dependency Resolution Change
alt Before: workspace:^ protocol
PM->>PM: Resolve from local workspace
PM->>CookieCutter: Link to local scaffolder-backend
Note over PM,CookieCutter: Uses local development version
else After: Fixed version 1.15.0
PM->>PM: Resolve from npm registry
PM->>ScaffolderBackend: Fetch version 1.15.0
ScaffolderBackend-->>PM: Return package
PM->>CookieCutter: Install scaffolder-backend@1.15.0
Note over PM,CookieCutter: Uses specific published version
end
Note over CookieCutter,ScaffolderBackend: Runtime behavior unchanged<br/>Only dependency resolution differs
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
WalkthroughThis pull request modifies the dependency management for the cookiecutter scaffolder backend module by pinning the Changes
Sequence DiagramThis diagram shows the interactions between components: sequenceDiagram
participant Dev as Developer
participant Module as scaffolder-backend-module-cookiecutter
participant Registry as NPM Registry
participant Backend as @backstage/plugin-scaffolder-backend
Note over Module,Backend: Dependency Version Change: workspace:^ → 1.15.0
Dev->>Module: Update package.json dependency
Note right of Module: Change from workspace reference<br/>to fixed version 1.15.0
Module->>Registry: Request scaffolder-backend@1.15.0
Registry-->>Module: Return published package
Note over Module,Backend: Module now depends on<br/>published version instead of<br/>local workspace version
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
|
No dependency changes detected. Learn more about Socket for GitHub. 👍 No dependency changes detected in pull request |
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
WalkthroughChangesSequence DiagramThis diagram shows the interactions between components: sequenceDiagram
participant Dev as Developer
participant Package as scaffolder-backend-module-cookiecutter
participant Dep as @backstage/plugin-scaffolder-backend
participant Workspace as Local Workspace
participant Registry as NPM Registry
Note over Package,Dep: Dependency Version Change
rect rgb(240, 240, 240)
Note over Dev,Registry: BEFORE: Using workspace reference
Dev->>Package: Build/Install dependencies
Package->>Workspace: Resolve workspace:^ dependency
Workspace-->>Package: Return local version
end
rect rgb(220, 250, 220)
Note over Dev,Registry: AFTER: Using pinned version
Dev->>Package: Build/Install dependencies
Package->>Registry: Resolve version 1.15.0
Registry-->>Package: Return v1.15.0 from registry
end
Note over Package,Dep: Module behavior remains unchanged<br/>Only dependency resolution changes
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
EntelligenceAI PR Summary
This PR pins the scaffolder backend plugin dependency to a specific version instead of using the workspace reference.
@backstage/plugin-scaffolder-backenddependency fromworkspace:^to1.15.0in the cookiecutter module