Skip to content

[Snyk] Fix for 3 vulnerabilities #9910

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
q1blue wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 3 vulnerabilities #9910

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions packages/techdocs-cli-embedded-app/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,21 +11,21 @@
"@backstage/catalog-model": "workspace:^",
"@backstage/cli": "workspace:^",
"@backstage/config": "workspace:^",
"@backstage/core-app-api": "workspace:^",
"@backstage/core-app-api": "1.1.0",
Copy link

@augmentcode augmentcode bot Jan 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pinning @backstage/* dependencies here to older published versions (e.g. @backstage/core-app-api 1.1.0) while the rest remain workspace:^ will likely make Yarn pull registry packages that don’t match the workspace versions, leading to duplicate Backstage deps and potential build/runtime breakage. Consider keeping these as workspace:^ or otherwise ensuring the specified versions satisfy the local workspace package versions (also applies to the other pinned @backstage/* entries in this file).

Fix This in Augment

🤖 Was this useful? React with 👍 or 👎

"@backstage/core-components": "workspace:^",
"@backstage/core-plugin-api": "workspace:^",
"@backstage/integration-react": "workspace:^",
"@backstage/integration-react": "0.1.1",
"@backstage/plugin-catalog": "workspace:^",
"@backstage/plugin-techdocs": "workspace:^",
"@backstage/plugin-techdocs-react": "workspace:^",
"@backstage/plugin-techdocs": "0.1.1",
"@backstage/plugin-techdocs-react": "0.1.0",
"@backstage/test-utils": "workspace:^",
"@backstage/theme": "workspace:^",
"@material-ui/core": "^4.12.2",
"@material-ui/icons": "^4.9.1",
"history": "^5.0.0",
"react": "^17.0.2",
"react-dom": "^17.0.2",
"react-router-dom": "^6.3.0",
"react-router-dom": "^6.30.3",
Copy link

@augmentcode augmentcode bot Jan 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The PR description notes yarn.lock wasn’t updated; without a lockfile refresh the repo may still resolve the vulnerable transitive versions and builds can be non-reproducible. Consider running yarn and committing the resulting lockfile update alongside this dependency bump.

Fix This in Augment

🤖 Was this useful? React with 👍 or 👎

"react-use": "^17.2.4"
},
"devDependencies": {
Expand Down
Loading