Skip to content

chore(deps): bump the backstage group across 1 directory with 13 updates - #202

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/backstage-e16b337cf4
Open

chore(deps): bump the backstage group across 1 directory with 13 updates#202
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/backstage-e16b337cf4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the backstage group with 9 updates in the / directory:

Package From To
@backstage/catalog-model 1.7.6 1.9.0
@backstage/config 1.3.6 1.3.8
@backstage/core-compat-api 0.5.7 0.5.13
@backstage/frontend-defaults 0.3.6 0.5.4
@backstage/frontend-plugin-api 0.13.4 0.17.3
@backstage/cli 0.35.4 0.36.4
@backstage/dev-utils 1.1.19 1.1.25
@backstage/eslint-plugin 0.2.1 0.3.1
@backstage/test-utils 1.7.14 1.7.20

Updates @backstage/catalog-model from 1.7.6 to 1.9.0

Changelog

Sourced from @​backstage/catalog-model's changelog.

1.9.0

Minor Changes

  • 3664148: Introduced the AiResource catalog entity kind. Entity types, validators, type guards, and the model layer are exported from @backstage/catalog-model/alpha. Install @backstage/plugin-catalog-backend-module-ai-model in your backend to register the kind with the catalog.
  • be71476: Added spec.type: 'mcp-server' as a structured subtype of the API kind under v1alpha1/v1beta1. MCP server entities carry a spec.remotes list instead of a string definition, for representing Model Context Protocol servers in the catalog. See RFC #32062. New public exports: McpServerApiEntity, McpServerRemote, mcpServerApiEntityValidator, and isMcpServerApiEntity. Also adds addKindVersion to CatalogModelLayerBuilder (alpha) so layers can add new versions or spec types to existing kinds.

Patch Changes

  • ab1cdbb: Removed a handful of internal imports that referenced the package by its own name. Value imports were switched to relative paths, and type-only imports to import type. These self-referential imports could trigger circular initialization errors in bundled ESM and when the package was loaded via jest.requireActual — most visibly Cannot access '_AppRootElementBlueprintesm' before initialization from @backstage/frontend-plugin-api. There are no user-facing API changes.
  • Updated dependencies
    • @​backstage/errors@​1.3.1

1.8.1-next.1

Patch Changes

  • ab1cdbb: Removed a handful of internal imports that referenced the package by its own name. Value imports were switched to relative paths, and type-only imports to import type. These self-referential imports could trigger circular initialization errors in bundled ESM and when the package was loaded via jest.requireActual — most visibly Cannot access '_AppRootElementBlueprintesm' before initialization from @backstage/frontend-plugin-api. There are no user-facing API changes.

1.8.1-next.0

Patch Changes

  • Updated dependencies
    • @​backstage/errors@​1.3.1-next.0
    • @​backstage/types@​1.2.2

1.8.0

Minor Changes

  • e5fcfcb: Added a new catalog model layer system that allows plugins to declare and extend catalog entity kinds, annotations, labels, tags, and relations using JSON Schema. The new createCatalogModelLayer API provides a builder for composing model definitions, and a compileCatalogModel function validates and merges them into a unified model. Built-in entity kinds now include model layer definitions.

Patch Changes

  • Updated dependencies
    • @​backstage/errors@​1.3.0

1.7.8-next.0

Patch Changes

  • Updated dependencies
    • @​backstage/errors@​1.3.0-next.0

1.7.7

Patch Changes

  • a49a40d: Updated dependency zod to ^3.25.76 || ^4.0.0 & migrated to /v3 or /v4 imports.
Commits

Updates @backstage/config from 1.3.6 to 1.3.8

Changelog

Sourced from @​backstage/config's changelog.

1.3.8

Patch Changes

  • Updated dependencies
    • @​backstage/errors@​1.3.1

1.3.8-next.0

Patch Changes

  • Updated dependencies
    • @​backstage/errors@​1.3.1-next.0
    • @​backstage/types@​1.2.2

1.3.7

Patch Changes

  • Updated dependencies
    • @​backstage/errors@​1.3.0

1.3.7-next.0

Patch Changes

  • Updated dependencies
    • @​backstage/errors@​1.3.0-next.0
Commits

Updates @backstage/core-compat-api from 0.5.7 to 0.5.13

Changelog

Sourced from @​backstage/core-compat-api's changelog.

0.5.13

Patch Changes

  • Updated dependencies
    • @​backstage/frontend-plugin-api@​0.17.3
    • @​backstage/plugin-catalog-react@​3.2.0
    • @​backstage/filter-predicates@​0.1.4
    • @​backstage/core-plugin-api@​1.12.8
    • @​backstage/plugin-app-react@​0.2.5

0.5.13-next.0

Patch Changes

  • Updated dependencies
    • @​backstage/plugin-catalog-react@​3.2.0-next.0
    • @​backstage/filter-predicates@​0.1.4-next.0
    • @​backstage/frontend-plugin-api@​0.17.3-next.0
    • @​backstage/core-plugin-api@​1.12.8-next.0
    • @​backstage/plugin-app-react@​0.2.5-next.0

0.5.12

Patch Changes

  • Updated dependencies
    • @​backstage/plugin-catalog-react@​3.1.0
    • @​backstage/frontend-plugin-api@​0.17.2
    • @​backstage/core-plugin-api@​1.12.7
    • @​backstage/plugin-app-react@​0.2.4

0.5.12-next.1

Patch Changes

  • Updated dependencies
    • @​backstage/frontend-plugin-api@​0.17.2-next.0
    • @​backstage/core-plugin-api@​1.12.7-next.0
    • @​backstage/plugin-app-react@​0.2.4-next.0
    • @​backstage/plugin-catalog-react@​3.0.1-next.1

0.5.12-next.0

Patch Changes

  • Updated dependencies
    • @​backstage/plugin-catalog-react@​3.0.1-next.0

0.5.11

... (truncated)

Commits

Updates @backstage/core-components from 0.18.6 to 0.18.12

Changelog

Sourced from @​backstage/core-components's changelog.

0.18.12

Patch Changes

  • 120e7c3: chore(deps): bump js-yaml from 4.1.1 to 4.2.0
  • 9efce7d: Fixed the table filters sidebar rendering a stray 0 when no filters are configured.
  • 7ceeaad: Migrated CopyTextButton component from Material-UI to Backstage UI (BUI). Replaced MUI IconButton and Tooltip with BUI ButtonIcon and TooltipTrigger/Tooltip components. This is an internal refactoring that maintains backward compatibility - the component API remains unchanged.
  • Updated dependencies
    • @​backstage/ui@​0.17.0
    • @​backstage/core-plugin-api@​1.12.8

0.18.12-next.1

Patch Changes

  • 7ceeaad: Migrated CopyTextButton component from Material-UI to Backstage UI (BUI). Replaced MUI IconButton and Tooltip with BUI ButtonIcon and TooltipTrigger/Tooltip components. This is an internal refactoring that maintains backward compatibility - the component API remains unchanged.

0.18.12-next.0

Patch Changes

  • Updated dependencies
    • @​backstage/core-plugin-api@​1.12.8-next.0

0.18.11

Patch Changes

  • e0889a3: chore(deps): bump qs from 6.15.1 to 6.15.2
  • a07e6a3: Added the correctly-spelled 'header' literal to the TableFiltersClassKey union type and deprecated the previous typoed 'heder' literal. The generated CSS class with the old key is preserved for backwards compatibility; switch to 'header' to avoid future removal.
  • c161e1c: Lazy-load react-syntax-highlighter and @dagrejs/dagre so they are no longer pulled in eagerly through the barrel export. This reduces the upfront module cost of importing from @backstage/core-components by roughly 10 MB. The public API is unchanged.
  • dbe93a7: Fix autologout not working correctly when closing all tabs
  • 8add9b9: Fixed the proxy-based sign-in page failing to read the session token when the proxy issues a token whose payload is encoded using the URL-safe base64 alphabet. Such tokens are now decoded correctly so sign-in no longer breaks.
  • f35372d: Fixed text clipping in SidebarSubmenuItem by correcting line-height from 1 to 1.5
  • Updated dependencies
    • @​backstage/core-plugin-api@​1.12.7

0.18.11-next.2

Patch Changes

  • c161e1c: Lazy-load react-syntax-highlighter and @dagrejs/dagre so they are no longer pulled in eagerly through the barrel export. This reduces the upfront module cost of importing from @backstage/core-components by roughly 10 MB. The public API is unchanged.

0.18.11-next.1

Patch Changes

  • dbe93a7: Fix autologout not working correctly when closing all tabs
  • Updated dependencies
    • @​backstage/core-plugin-api@​1.12.7-next.0

... (truncated)

Commits

Updates @backstage/core-plugin-api from 1.12.2 to 1.12.8

Changelog

Sourced from @​backstage/core-plugin-api's changelog.

1.12.8

Patch Changes

  • Updated dependencies
    • @​backstage/frontend-plugin-api@​0.17.3

1.12.8-next.0

Patch Changes

  • Updated dependencies
    • @​backstage/frontend-plugin-api@​0.17.3-next.0

1.12.7

Patch Changes

  • Updated dependencies
    • @​backstage/frontend-plugin-api@​0.17.2

1.12.7-next.0

Patch Changes

  • Updated dependencies
    • @​backstage/frontend-plugin-api@​0.17.2-next.0

1.12.6

Patch Changes

  • ab1cdbb: Removed a handful of internal imports that referenced the package by its own name. Value imports were switched to relative paths, and type-only imports to import type. These self-referential imports could trigger circular initialization errors in bundled ESM and when the package was loaded via jest.requireActual — most visibly Cannot access '_AppRootElementBlueprintesm' before initialization from @backstage/frontend-plugin-api. There are no user-facing API changes.
  • Updated dependencies
    • @​backstage/errors@​1.3.1
    • @​backstage/frontend-plugin-api@​0.17.0
    • @​backstage/config@​1.3.8

1.12.6-next.1

Patch Changes

  • ab1cdbb: Removed a handful of internal imports that referenced the package by its own name. Value imports were switched to relative paths, and type-only imports to import type. These self-referential imports could trigger circular initialization errors in bundled ESM and when the package was loaded via jest.requireActual — most visibly Cannot access '_AppRootElementBlueprintesm' before initialization from @backstage/frontend-plugin-api. There are no user-facing API changes.
  • Updated dependencies
    • @​backstage/frontend-plugin-api@​0.17.0-next.1

1.12.6-next.0

Patch Changes

... (truncated)

Commits

Updates @backstage/frontend-defaults from 0.3.6 to 0.5.4

Changelog

Sourced from @​backstage/frontend-defaults's changelog.

0.5.4

Patch Changes

  • Updated dependencies
    • @​backstage/frontend-plugin-api@​0.17.3
    • @​backstage/plugin-app@​0.5.1
    • @​backstage/core-components@​0.18.12
    • @​backstage/frontend-app-api@​0.16.6

0.5.4-next.0

Patch Changes

  • Updated dependencies
    • @​backstage/frontend-app-api@​0.16.5-next.0
    • @​backstage/plugin-app@​0.5.1-next.0
    • @​backstage/frontend-plugin-api@​0.17.3-next.0
    • @​backstage/core-components@​0.18.12-next.0

0.5.3

Patch Changes

  • Updated dependencies
    • @​backstage/plugin-app@​0.5.0
    • @​backstage/core-components@​0.18.11
    • @​backstage/frontend-plugin-api@​0.17.2
    • @​backstage/frontend-app-api@​0.16.4

0.5.3-next.1

Patch Changes

  • Updated dependencies
    • @​backstage/frontend-plugin-api@​0.17.2-next.0
    • @​backstage/core-components@​0.18.11-next.1
    • @​backstage/frontend-app-api@​0.16.4-next.1
    • @​backstage/plugin-app@​0.4.7-next.1

0.5.3-next.0

Patch Changes

  • Updated dependencies
    • @​backstage/core-components@​0.18.11-next.0
    • @​backstage/plugin-app@​0.4.7-next.0
    • @​backstage/frontend-app-api@​0.16.4-next.0

0.5.2

... (truncated)

Commits

Updates @backstage/frontend-plugin-api from 0.13.4 to 0.17.3

Changelog

Sourced from @​backstage/frontend-plugin-api's changelog.

0.17.3

Patch Changes

  • a5b2811: Adds useBreadcrumbEntries hook, BreadcrumbEntry component, and BreadcrumbsRegistryProvider for managing breadcrumb trails across the component tree for plugins using new frontend system. Completes wiring so that new frontend system plugin Pages and SubPages get automatic-population of PluginHeader breadcrumbs.

    • The app plugin's PageLayout registers a root breadcrumb for each plugin page and passes the breadcrumb trail to PluginHeader
    • PageBlueprint automatically wraps each sub-page route element with BreadcrumbEntry, so sub-pages contribute to the PluginHeader breadcrumb trail without extra wiring.
    • Plugin authors who need breadcrumbs for internal routes within a sub-page can wrap their route content with BreadcrumbEntry manually.
      • plugin-scaffolder internal routes have been wrapped as an example

  • Updated dependencies

    • @​backstage/filter-predicates@​0.1.4

0.17.3-next.1

Patch Changes

  • a5b2811: Adds useBreadcrumbEntries hook, BreadcrumbEntry component, and BreadcrumbsRegistryProvider for managing breadcrumb trails across the component tree for plugins using new frontend system. Completes wiring so that new frontend system plugin Pages and SubPages get automatic-population of PluginHeader breadcrumbs.

    • The app plugin's PageLayout registers a root breadcrumb for each plugin page and passes the breadcrumb trail to PluginHeader
    • PageBlueprint automatically wraps each sub-page route element with BreadcrumbEntry, so sub-pages contribute to the PluginHeader breadcrumb trail without extra wiring.
    • Plugin authors who need breadcrumbs for internal routes within a sub-page can wrap their route content with BreadcrumbEntry manually.
      • plugin-scaffolder internal routes have been wrapped as an example

0.17.3-next.0

Patch Changes

  • Updated dependencies
    • @​backstage/filter-predicates@​0.1.4-next.0

0.17.2

Patch Changes

  • 378784e: Moved dependencies that are re-exported in the public API from devDependencies to dependencies. These were incorrectly demoted in #33936 because the source code only uses type imports, but the types still appear in the published API surface and need to be resolvable by consumers at build time.

0.17.2-next.0

Patch Changes

  • 378784e: Moved dependencies that are re-exported in the public API from devDependencies to dependencies. These were incorrectly demoted in #33936 because the source code only uses type imports, but the types still appear in the published API surface and need to be resolvable by consumers at build time.

0.17.0

Minor Changes

  • 44d77e9: BREAKING: Removed the deprecated NavItemBlueprint. Navigation items are now discovered from PageBlueprint extensions based on their title and icon params.

... (truncated)

Commits

Updates @backstage/theme from 0.7.1 to 0.7.3

Changelog

Sourced from @​backstage/theme's changelog.

0.7.3

Patch Changes

  • a0100d4: Fixes occasional duplication of v5 class name prefix for MUI 5 components.

    Documentation added to explain how to resolve missing v5 prefix in class names when using MUI 5 components in main app.

0.7.3-next.0

Patch Changes

  • a0100d4: Fixes occasional duplication of v5 class name prefix for MUI 5 components.

    Documentation added to explain how to resolve missing v5 prefix in class names when using MUI 5 components in main app.

0.7.2

Patch Changes

  • 1c52dcc: add square shape
  • a7e0d50: Updated react-router-dom peer dependency to ^6.30.2 and explicitly disabled v7 future flags to suppress deprecation warnings.

0.7.2-next.1

Patch Changes

  • a7e0d50: Prepare for React Router v7 migration by updating to v6.30.2 across all NFS packages and enabling v7 future flags. Convert routes from splat paths to parent/child structure with Outlet components.

0.7.2-next.0

Patch Changes

  • 1c52dcc: add square shape
Commits

Updates @backstage/cli from 0.35.4 to 0.36.4

Changelog

Sourced from @​backstage/cli's changelog.

0.36.4

Patch Changes

  • 61d4881: The shared ESLint configuration now reports unused imports in config.d.ts configuration schema files. These declaration files are not covered by the TypeScript compiler's unused-variable checks, which previously allowed a stray import to slip through. Such an import can resolve during local development but break configuration schema loading for consumers of the published package, so it is now caught at lint time.
  • Updated dependencies
    • @​backstage/cli-module-build@​0.1.5
    • @​backstage/cli-common@​0.3.0
    • @​backstage/cli-defaults@​0.1.4
    • @​backstage/cli-module-test-jest@​0.1.4
    • @​backstage/cli-node@​0.3.4

0.36.4-next.2

Patch Changes

  • Updated dependencies
    • @​backstage/cli-common@​0.3.0-next.0
    • @​backstage/cli-module-build@​0.1.5-next.2
    • @​backstage/cli-module-test-jest@​0.1.4-next.0
    • @​backstage/cli-node@​0.3.4-next.0
    • @​backstage/cli-defaults@​0.1.4-next.1

0.36.4-next.1

Patch Changes

  • 61d4881: The shared ESLint configuration now reports unused imports in config.d.ts configuration schema files. These declaration files are not covered by the TypeScript compiler's unused-variable checks, which previously allowed a stray import to slip through. Such an import can resolve during local development but break configuration schema loading for consumers of the published package, so it is now caught at lint time.
  • Updated dependencies
    • @​backstage/cli-module-build@​0.1.5-next.1

0.36.4-next.0

Patch Changes

  • Updated dependencies
    • @​backstage/cli-module-build@​0.1.5-next.0
    • @​backstage/cli-defaults@​0.1.4-next.0

0.36.3

Patch Changes

  • b521571: Improved validation of conflicting CLI module commands, including conflicts between parent and nested command paths.
  • Updated dependencies
    • @​backstage/cli-module-build@​0.1.4
    • @​backstage/cli-module-test-jest@​0.1.3
    • @​backstage/cli-node@​0.3.3
    • @​backstage/eslint-plugin@​0.3.1
    • @​backstage/cli-defaults@​0.1.3

... (truncated)

Commits

Updates @backstage/core-app-api from 1.19.4 to 1.20.3

Changelog

Sourced from @​backstage/core-app-api's changelog.

1.20.3

Patch Changes

  • 3ef5974: Added support for wildcard plugin entries in frontend discovery endpoints, matching the backend discovery behavior.
  • 6172725: Fixed the default fetch API to support discovery endpoints that only define an internal target.
  • Updated dependencies
    • @​backstage/ui@​0.17.0
    • @​backstage/core-plugin-api@​1.12.8

1.20.3-next.0

Patch Changes

  • Updated dependencies
    • @​backstage/ui@​0.17.0-next.0
    • @​backstage/core-plugin-api@​1.12.8-next.0

1.20.2

Patch Changes

  • Updated dependencies
    • @​backstage/ui@​0.16.0
    • @​backstage/core-plugin-api@​1.12.7

1.20.2-next.0

Patch Changes

  • Updated dependencies
    • @​backstage/ui@​0.15.1-next.0
    • @​backstage/core-plugin-api@​1.12.7-next.0

1.20.1

Patch Changes

  • Updated dependencies
    • @​backstage/ui@​0.15.0
    • @​backstage/core-plugin-api@​1.12.6
    • @​backstage/config@​1.3.8

1.20.1-next.0

Patch Changes

  • Updated dependencies
    • @​backstage/ui@​0.15.0-next.0
    • @​backstage/config@​1.3.8-next.0

... (truncated)

Commits
  • c8a8aac Version Packages
  • ce632aa fix
  • 8345a35 Version Packages (next)
  • 91f340c Merge pull request #20653 from szubster/add-default-scopes-on-refresh
  • 56baf87 core-app-api: test fixes for including default scopes in initial refresh
  • 9ab0572 core-app-api: add core.type markers for AppRouter and FlatRoutes
  • 89d13e5 Add current and defaultScopes when refreshing session
  • ec1dde6 switch to @​testing-library/react 14
  • aa2ff48 switch react version ranges to full format
  • fb7a94f packages: rtl 13 fixes for tests
  • Additional commits viewable in compare view

Updates @backstage/dev-utils from 1.1.19 to 1.1.25

Changelog

Sourced from @​backstage/dev-utils's changelog.

1.1.25

Patch Changes

  • Updated dependencies
    • @​backstage/ui@​0.17.0
    • @​backstage/plugin-catalog-react@​3.2.0
    • @​backstage/core-components@​0.18.12
    • @​backstage/core-app-api@​1.20.3
    • @​backstage/app-defaults@​1.7.10
    • @​backstage/core-plugin-api@​1.12.8
    • @​backstage/integration-react@​1.2.20

1.1.25-next.0

Patch Changes

  • Updated dependencies
    • @​backstage/plugin-catalog-react@​3.2.0-next.0
    • @​backstage/ui@​0.17.0-next.0
    • @​backstage/core-app-api@​1.20.3-next.0
    • @​backstage/app-defaults@​1.7.10-next.0
    • @​backstage/core-components@​0.18.12-next.0
    • @​backstage/core-plugin-api@​1.12.8-next.0
    • @​backstage/integration-react@​1.2.20-next.0

1.1.24

Patch Changes

  • Updated dependencies
    • @​backstage/app-defaults@​1.7.9
    • @​backstage/plugin-catalog-react@​3.1.0
    • @​backstage/core-components@​0.18.11
    • @​backstage/ui@​0.16.0
    • @​backstage/core-app-api@​1.20.2
    • @​backstage/core-plugin-api@​1.12.7
    • @​backstage/integration-react@​1.2.19

1.1.24-next.1

Patch Changes

  • Updated dependencies
    • @​backstage/app-defaults@​1.7.9-next.1
    • @​backstage/core-components@​0.18.11-next.1
    • @​backstage/ui@​0.15.1-next.0
    • @​backstage/core-plugin-api@​1.12.7-next.0
    • @​backstage/plugin-catalog-react@​3.0.1-next.1
    • @​backstage/core-app-api@​1.20.2-next.0

... (truncated)

Commits

Updates @backstage/eslint-plugin from 0.2.1 to 0.3.1

Changelog

Sourced from @​backstage/eslint-plugin's changelog.

0.3.1

Patch Changes

  • 5d80f77: Adds a new @backstage/no-deprecated-bui-tokens lint rule that warns when a deprecated @backstage/ui CSS token is referenced in a JavaScript or TypeScript file (including CSS-in-JS patterns and template literals). The rule is included in the recommended config, so plugin authors using plugin:@backstage/recommended will receive warnings automatically when using tokens that have been superseded by the new semantic color families. Note that plain CSS and CSS module files are outside ESLint's scope and are not covered by this rule.

0.3.1-next.0

Patch Changes

  • 5d80f77: Adds a new @backstage/no-deprecated-bui-tokens lint rule that warns when a deprecated @backstage/ui CSS token is referenced in a JavaScript or TypeScript file (including CSS-in-JS patterns and template literals). The rule is included in the recommended config, so plugin authors using plugin:@backstage/recommended will receive warnings automatically when using tokens that have been superseded by the new semantic color families. Note that plain CSS and CSS module files are outside ESLint's scope and are not covered by this rule.

0.3.0

Minor Changes

  • ab1cdbb: Added a new no-self-package-imports lint rule, enabled as error in the recommended config, that reports when a package imports itself by its own name instead of using a relative path. This pattern causes circular initialization errors in bundled ESM and with jest.requireActual.

0.3.0-next.0

Minor Changes

  • ab1cdbb: Added a new no-self-package-imports lint rule, enabled as error in the recommended config, that reports when a package imports itself by its own name instead of using a relative path. This pattern causes circular initialization errors in bundled ESM and with jest.requireActual.

0.2.3

Patch Changes

  • df43b0e: Fixed no-mixed-plugin-imports rule to return null from non-fixable suggestion handlers and added an explicit SuggestionReportDescriptor[] type annotation, matching the stricter type checking in TypeScript 6.0.

0.2.3-next.0

Patch Changes

  • df43b0e: Fixed no-mixed-plugin-imports rule to return null from non-fixable suggestion handlers and added an explicit SuggestionReportDescriptor[] type annotation, matching the stricter type checking in TypeScript 6.0.

0.2.2

Patch Changes

  • 6738cf0: build(deps): bump minimatch from 9.0.5 to 10.2.1

0.2.2-next.0

Patch Changes

  • 6738cf0: build(deps): bump minimatch from 9.0.5 to 10.2.1
Commits

Updates @backstage/test-utils from 1.7.14 to 1.7.20

Changelog

Sourced from @​backstage/test-utils's changelog.

1.7.20

Patch Changes

  • Updated dependencies
    • @​backstage/core-app-api@​1.20.3
    • @​backstage/core-plugin-api@​1.12.8
    • @​backstage/plugin-permission-react@​0.5.3

1.7.20-next.0

Patch Changes

  • Updated dependencies
    • @​backstage/core-app-api@​1.20.3-next.0
    • @​backstage/core-plugin-api@​1.12.8-next.0
    • @​backstage/plugin-permission-react@​0.5.3-next.0

1.7.19

Patch Changes

  • Updated dependencies
    • @​backstage/core-app-api@​1.20.2
    • @​backstage/core-plugin-api@​1.12.7
    • @​backstage/plugin-permission-react@​0.5.2

1.7.19-next.0

Patch Changes

  • Updated dependencies
    • @​backstage/core-plugin-api@​1.12.7-next.0
    • @​backstage/core-app-api@​1.20.2-next.0
    • @​backstage/plugin-permission-react@​0.5.2-next.0

1.7.18

Patch Changes

  • Updated dependencies
    • @​backstage/core-plugin-api@​1.12.6
    • @​backstage/plugin-permission-common@​0.9.9
    • @​backstage/config@​1.3.8
    • @​backstage/core-app-api@​1.20.1
    • @​backstage/plugin-permission-react@​0.5.1

1.7.18-next.0

Patch Changes

... (truncated)

Commits

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Apr 18, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner April 18, 2026 03:07
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Apr 18, 2026
@socket-security

socket-security Bot commented Apr 18, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Added@​backstage/​frontend-defaults@​0.5.4991007198100
Updated@​backstage/​core-compat-api@​0.5.7 ⏵ 0.5.139910075 +198100
Updated@​backstage/​config@​1.3.6 ⏵ 1.3.8100 +110075 +195100
Updated@​backstage/​dev-utils@​1.1.19 ⏵ 1.1.25991007698100
Added@​backstage/​frontend-plugin-api@​0.17.3991007698100
Updated@​backstage/​theme@​0.7.1 ⏵ 0.7.39910076 +191 -2100
Updated@​backstage/​core-plugin-api@​1.12.2 ⏵ 1.12.899 +110077 +198100
Updated@​backstage/​test-utils@​1.7.14 ⏵ 1.7.2099 +11007798100
Updated@​backstage/​core-app-api@​1.19.4 ⏵ 1.20.39810079 +198100
Updated@​backstage/​catalog-model@​1.7.6 ⏵ 1.9.010010079 +295100
Updated@​backstage/​cli@​0.35.4 ⏵ 0.36.497 +710079 -298100
Updated@​backstage/​core-components@​0.18.6 ⏵ 0.18.129710080 +198100
Updated@​backstage/​eslint-plugin@​0.2.1 ⏵ 0.3.1100 +110086 +197 -1100

View full report

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/backstage-e16b337cf4 branch 2 times, most recently from 7438f80 to 60df0ea Compare April 29, 2026 00:55
@mcncl

mcncl commented Apr 29, 2026

Copy link
Copy Markdown
Collaborator

@dependabot rebase

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/backstage-e16b337cf4 branch from 60df0ea to 100715d Compare April 29, 2026 01:19
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/backstage-e16b337cf4 branch from 100715d to 08dc138 Compare May 9, 2026 03:06
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/backstage-e16b337cf4 branch from 08dc138 to 715cb72 Compare May 16, 2026 03:07
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/backstage-e16b337cf4 branch from 715cb72 to 418802d Compare June 6, 2026 03:05
@socket-security

socket-security Bot commented Jun 6, 2026 •
edited
Loading

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Potentially malicious package (AI signal): npm @module-federation/sdk is 60.0% likely malicious

Notes: This code is a high-risk remote code execution loader. It fetches JavaScript from attacker-influenceable HTTP(S) URLs and executes it inside Node using vm (runInThisContext for script code and SourceTextModule.evaluate for ESM), while explicitly providing a real require function via eval('require') to the executed payload. It also exposes loaded contexts on globalThis under a computed key derived from attrs. Unless upstream strictly authenticates/allowlists remote origins and locks down loaderHook/attrs inputs, this represents a serious supply-chain/remote-execution threat.

Confidence: 0.60

Severity: 0.90

From: yarn.lock → npm/@backstage/cli@0.36.4 → npm/@module-federation/sdk@2.8.1

ℹ Read more on: This package | This alert | What is AI-detected potential malware?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Given the AI system's identification of this package as malware, extreme caution is advised. It is recommended to avoid downloading or installing this package until the threat is confirmed or flagged as a false positive.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@module-federation/sdk@2.8.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm webpack is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: yarn.lock → npm/@backstage/cli@0.36.4 → npm/webpack@5.105.4

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/webpack@5.105.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/backstage-e16b337cf4 branch from 418802d to b7d6860 Compare July 25, 2026 03:07
buildsworth-bk-app[bot]
buildsworth-bk-app Bot requested changes Jul 25, 2026
View reviewed changes

@buildsworth-bk-app buildsworth-bk-app Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The dependency versions aren't aligned, and the package no longer type-checks; details inline.

Want to dig deeper?

Paste this into your agent to explore the findings from this review's Buildkite build:

Download the buildsworth logs from build 8196, then answer my questions about the findings.

Install the reading-buildsworth-logs skill to run this.

About buildsworth

Model: gpt-5.6-sol with xhigh thinking.

How to request a review: Comment @buildsworth-bk review on the PR, or request buildsworth-bk as a reviewer.

Risk labels (how buildsworth classifies risk) — buildsworth classifies risk itself from the diff. To let it approve, grant L2 approval by mentioning @buildsworth-bk (see L2 approval grant):

  • L1 — Low risk (dep bumps, docs/copy, lockfiles, small presentational fixes). buildsworth may approve by default.
  • L2 — Standard risk (new UI, additive API fields, refactors). Approved only with an L2 grant; otherwise comment-only.
  • L3 — High risk (auth, migrations, payments, secrets, perf-critical paths). Human review always required.

Comment thread package.json
"@backstage/frontend-defaults": "^0.3.1",
"@backstage/frontend-plugin-api": "^0.13.1",
"@backstage/frontend-defaults": "^0.5.4",
"@backstage/frontend-plugin-api": "^0.17.3",

@buildsworth-bk-app buildsworth-bk-app Bot Jul 25, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Blocking: This upgrades the frontend API to 0.17.3 but leaves @backstage/plugin-catalog-react@^1.21.2 on frontend API 0.13.4. That gives EntityContentBlueprint a nested, incompatible API type, and yarn tsc now fails at src/alpha.tsx:88 and :102 with TS2742; the parent commit passes. Aligning plugin-catalog-react with this Backstage release (3.2.0 in the generated lockfile) makes yarn tsc pass.

@buildsworth-bk-app buildsworth-bk-app Bot Jul 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Still open — @backstage/plugin-catalog-react remains on ^1.21.2, and yarn tsc still fails with the same TS2742 errors.

@petetomasik

petetomasik commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

@dependabot recreate

@dependabot
chore(deps): bump the backstage group across 1 directory with 13 updates
d82cc76 
Bumps the backstage group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@backstage/catalog-model](https://github.com/backstage/backstage/tree/HEAD/packages/catalog-model) | `1.7.6` | `1.9.0` |
| [@backstage/config](https://github.com/backstage/backstage/tree/HEAD/packages/config) | `1.3.6` | `1.3.8` |
| [@backstage/core-compat-api](https://github.com/backstage/backstage/tree/HEAD/packages/core-compat-api) | `0.5.7` | `0.5.13` |
| [@backstage/frontend-defaults](https://github.com/backstage/backstage/tree/HEAD/packages/frontend-defaults) | `0.3.6` | `0.5.4` |
| [@backstage/frontend-plugin-api](https://github.com/backstage/backstage/tree/HEAD/packages/frontend-plugin-api) | `0.13.4` | `0.17.3` |
| [@backstage/cli](https://github.com/backstage/backstage/tree/HEAD/packages/cli) | `0.35.4` | `0.36.4` |
| [@backstage/dev-utils](https://github.com/backstage/backstage/tree/HEAD/packages/dev-utils) | `1.1.19` | `1.1.25` |
| [@backstage/eslint-plugin](https://github.com/backstage/backstage/tree/HEAD/packages/eslint-plugin) | `0.2.1` | `0.3.1` |
| [@backstage/test-utils](https://github.com/backstage/backstage/tree/HEAD/packages/test-utils) | `1.7.14` | `1.7.20` |



Updates `@backstage/catalog-model` from 1.7.6 to 1.9.0
- [Release notes](https://github.com/backstage/backstage/releases)
- [Changelog](https://github.com/backstage/backstage/blob/master/packages/catalog-model/CHANGELOG.md)
- [Commits](https://github.com/backstage/backstage/commits/v1.9.0/packages/catalog-model)

Updates `@backstage/config` from 1.3.6 to 1.3.8
- [Release notes](https://github.com/backstage/backstage/releases)
- [Changelog](https://github.com/backstage/backstage/blob/master/packages/config/CHANGELOG.md)
- [Commits](https://github.com/backstage/backstage/commits/HEAD/packages/config)

Updates `@backstage/core-compat-api` from 0.5.7 to 0.5.13
- [Release notes](https://github.com/backstage/backstage/releases)
- [Changelog](https://github.com/backstage/backstage/blob/master/packages/core-compat-api/CHANGELOG.md)
- [Commits](https://github.com/backstage/backstage/commits/HEAD/packages/core-compat-api)

Updates `@backstage/core-components` from 0.18.6 to 0.18.12
- [Release notes](https://github.com/backstage/backstage/releases)
- [Changelog](https://github.com/backstage/backstage/blob/master/packages/core-components/CHANGELOG.md)
- [Commits](https://github.com/backstage/backstage/commits/HEAD/packages/core-components)

Updates `@backstage/core-plugin-api` from 1.12.2 to 1.12.8
- [Release notes](https://github.com/backstage/backstage/releases)
- [Changelog](https://github.com/backstage/backstage/blob/master/packages/core-plugin-api/CHANGELOG.md)
- [Commits](https://github.com/backstage/backstage/commits/HEAD/packages/core-plugin-api)

Updates `@backstage/frontend-defaults` from 0.3.6 to 0.5.4
- [Release notes](https://github.com/backstage/backstage/releases)
- [Changelog](https://github.com/backstage/backstage/blob/master/packages/frontend-defaults/CHANGELOG.md)
- [Commits](https://github.com/backstage/backstage/commits/HEAD/packages/frontend-defaults)

Updates `@backstage/frontend-plugin-api` from 0.13.4 to 0.17.3
- [Release notes](https://github.com/backstage/backstage/releases)
- [Changelog](https://github.com/backstage/backstage/blob/master/packages/frontend-plugin-api/CHANGELOG.md)
- [Commits](https://github.com/backstage/backstage/commits/v0.17.3/packages/frontend-plugin-api)

Updates `@backstage/theme` from 0.7.1 to 0.7.3
- [Release notes](https://github.com/backstage/backstage/releases)
- [Changelog](https://github.com/backstage/backstage/blob/master/packages/theme/CHANGELOG.md)
- [Commits](https://github.com/backstage/backstage/commits/HEAD/packages/theme)

Updates `@backstage/cli` from 0.35.4 to 0.36.4
- [Release notes](https://github.com/backstage/backstage/releases)
- [Changelog](https://github.com/backstage/backstage/blob/master/packages/cli/CHANGELOG.md)
- [Commits](https://github.com/backstage/backstage/commits/HEAD/packages/cli)

Updates `@backstage/core-app-api` from 1.19.4 to 1.20.3
- [Release notes](https://github.com/backstage/backstage/releases)
- [Changelog](https://github.com/backstage/backstage/blob/master/packages/core-app-api/CHANGELOG.md)
- [Commits](https://github.com/backstage/backstage/commits/v1.20.3/packages/core-app-api)

Updates `@backstage/dev-utils` from 1.1.19 to 1.1.25
- [Release notes](https://github.com/backstage/backstage/releases)
- [Changelog](https://github.com/backstage/backstage/blob/master/packages/dev-utils/CHANGELOG.md)
- [Commits](https://github.com/backstage/backstage/commits/HEAD/packages/dev-utils)

Updates `@backstage/eslint-plugin` from 0.2.1 to 0.3.1
- [Release notes](https://github.com/backstage/backstage/releases)
- [Changelog](https://github.com/backstage/backstage/blob/master/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/backstage/backstage/commits/v0.3.1/packages/eslint-plugin)

Updates `@backstage/test-utils` from 1.7.14 to 1.7.20
- [Release notes](https://github.com/backstage/backstage/releases)
- [Changelog](https://github.com/backstage/backstage/blob/master/packages/test-utils/CHANGELOG.md)
- [Commits](https://github.com/backstage/backstage/commits/HEAD/packages/test-utils)

---
updated-dependencies:
- dependency-name: "@backstage/catalog-model"
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backstage
- dependency-name: "@backstage/cli"
  dependency-version: 0.36.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: backstage
- dependency-name: "@backstage/config"
  dependency-version: 1.3.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backstage
- dependency-name: "@backstage/core-app-api"
  dependency-version: 1.20.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: backstage
- dependency-name: "@backstage/core-compat-api"
  dependency-version: 0.5.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backstage
- dependency-name: "@backstage/core-components"
  dependency-version: 0.18.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backstage
- dependency-name: "@backstage/core-plugin-api"
  dependency-version: 1.12.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backstage
- dependency-name: "@backstage/dev-utils"
  dependency-version: 1.1.22
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: backstage
- dependency-name: "@backstage/eslint-plugin"
  dependency-version: 0.2.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: backstage
- dependency-name: "@backstage/frontend-defaults"
  dependency-version: 0.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backstage
- dependency-name: "@backstage/frontend-plugin-api"
  dependency-version: 0.16.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backstage
- dependency-name: "@backstage/test-utils"
  dependency-version: 1.7.17
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: backstage
- dependency-name: "@backstage/theme"
  dependency-version: 0.7.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backstage
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/backstage-e16b337cf4 branch from b7d6860 to d82cc76 Compare July 31, 2026 16:08
buildsworth-bk-app[bot]
buildsworth-bk-app Bot requested changes Jul 31, 2026
View reviewed changes

@buildsworth-bk-app buildsworth-bk-app Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The existing dependency-alignment blocker is still open; no new findings this pass.

Want to dig deeper?

Paste this into your agent to explore the findings from this review's Buildkite build:

Download the buildsworth logs from build 10608, then answer my questions about the findings.

Install the reading-buildsworth-logs skill to run this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@buildsworth-bk-app buildsworth-bk-app[bot] buildsworth-bk-app[bot] requested changes

Requested changes must be addressed to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@mcncl @petetomasik