[Snyk] Fix for 4 vulnerabilities #9914
Conversation
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-REMIXRUNROUTER-14908530 - https://snyk.io/vuln/SNYK-JS-REACTROUTER-14908286 - https://snyk.io/vuln/SNYK-JS-REMIXRUNROUTER-14908287 - https://snyk.io/vuln/SNYK-JS-JSYAML-13961110
Review or Edit in CodeSandboxOpen the branch in Web Editor • VS Code • Insiders |
WalkthroughChangesSequence DiagramThis diagram shows the interactions between components: sequenceDiagram
participant Dev as Developer
participant PN as package.json
participant PM as Package Manager
participant WS as Workspace Packages
participant NPM as NPM Registry
Note over Dev,NPM: Dependency Version Pinning Change
Dev->>PN: Update 4 dependencies
Note over PN: backend-tasks: workspace:^ → 0.6.1<br/>app-backend: workspace:^ → 0.1.1<br/>catalog-backend: workspace:^ → 0.1.1<br/>scaffolder-backend: workspace:^ → 0.1.1
alt Installation (Before Change)
PM->>WS: Resolve workspace:^ dependencies
WS-->>PM: Return local workspace versions
else Installation (After Change)
PM->>NPM: Fetch pinned versions (0.6.1, 0.1.1)
NPM-->>PM: Return specific package versions
end
PM->>PN: Install dependencies
Note over PM: Dependencies now locked to<br/>specific versions from NPM
Note for WindsurfPlease change the default marketplace provider to the following in the windsurf settings:Marketplace Extension Gallery Service URL: https://marketplace.visualstudio.com/_apis/public/gallery Marketplace Gallery Item URL: https://marketplace.visualstudio.com/items Entelligence.ai can learn from your feedback. Simply add 👍 / 👎 emojis to teach it your preferences. More shortcuts belowEmoji Descriptions:
Interact with the Bot:
Also you can trigger various commands with the bot by doing The current supported commands are
More commands to be added soon. |
⛔ Snyk checks have failed. 3 issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
🤖 Augment PR SummarySummary: Pins a few 🤖 Was this summary useful? React with 👍 or 👎 |
![augmentcode[bot]](https://avatars.githubusercontent.com/in/1027498?s=60&v=4){kind=small}
| "dependencies": { | ||
| "@backstage/backend-defaults": "workspace:^", | ||
| "@backstage/backend-tasks": "workspace:^", | ||
| "@backstage/backend-tasks": "0.6.1", |
There was a problem hiding this comment.
Switching from workspace:^ to a published version here can introduce version skew/duplicate installs in the monorepo; is it intended for example-backend-next to stop consuming local workspace packages? (Also applies to the other pinned @backstage/* deps in this PR.)
🤖 Was this useful? React with 👍 or 👎
| "@backstage/backend-tasks": "0.6.1", | ||
| "@backstage/plugin-adr-backend": "workspace:^", | ||
| "@backstage/plugin-app-backend": "workspace:^", | ||
| "@backstage/plugin-app-backend": "0.1.1", |
There was a problem hiding this comment.
This PR changes dependency versions but the description indicates yarn.lock couldn’t be updated; merging without a lockfile update can lead to non-reproducible installs/CI failures, so it’d be good to update it before merge.
🤖 Was this useful? React with 👍 or 👎
Snyk has created this PR to fix 4 vulnerabilities in the yarn dependencies of this project.
Snyk changed the following file(s):
packages/backend-next/package.jsonNote for zero-installs users
If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the
.yarn/cache/directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to runyarnto update the contents of the./yarn/cachedirectory.If you are not using zero-install you can ignore this as your flow should likely be unchanged.
Vulnerabilities that will be fixed with an upgrade:
SNYK-JS-REMIXRUNROUTER-14908530
SNYK-JS-REACTROUTER-14908286
SNYK-JS-REMIXRUNROUTER-14908287
SNYK-JS-JSYAML-13961110
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Prototype Pollution
🦉 Open Redirect
🦉 Cross-site Scripting (XSS)