fix(deps): update dependency @backstage/backend-defaults to ^0.12.0 [security] by renovate[bot] · Pull Request #85 · liatrio/backstage-plugin-autogov

renovate · 2026-01-21T22:41:49Z

This PR contains the following updates:

Package	Change	Age	Confidence
@backstage/backend-defaults (source)	`^0.7.0` → `^0.12.0`

GitHub Vulnerability Alerts

CVE-2026-24046

Impact

Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to:

Read arbitrary files via the debug:log action by creating a symlink pointing to sensitive files (e.g., /etc/passwd, configuration files, secrets)
Delete arbitrary files via the fs:delete action by creating symlinks pointing outside the workspace
Write files outside the workspace via archive extraction (tar/zip) containing malicious symlinks

This affects any Backstage deployment where users can create or execute Scaffolder templates.

Patches

This vulnerability is fixed in the following package versions:

@backstage/backend-defaults version 0.12.2, 0.13.2, 0.14.1, 0.15.0
@backstage/plugin-scaffolder-backend version 2.2.2, 3.0.2, 3.1.1
@backstage/plugin-scaffolder-node version 0.11.2, 0.12.3

Users should upgrade to these versions or later.

Workarounds

Follow the recommendation in the Backstage Threat Model to limit access to creating and updating templates
Restrict who can create and execute Scaffolder templates using the permissions framework
Audit existing templates for symlink usage
Run Backstage in a containerized environment with limited filesystem access

References

CVE-2026-24048

Impact

The FetchUrlReader component, used by the catalog and other plugins to fetch content from URLs, followed HTTP redirects automatically. This allowed an attacker who controls a host listed in backend.reading.allow to redirect requests to internal or sensitive URLs that are not on the allowlist, bypassing the URL allowlist security control.

This is a Server-Side Request Forgery (SSRF) vulnerability that could allow access to internal resources, but it does not allow attackers to include additional request headers.

Patches

This vulnerability is fixed in @backstage/backend-defaults version 0.12.2, 0.13.2, 0.14.1, and 0.15.0. Users should upgrade to this version or later.

Workarounds

Restrict backend.reading.allow to only trusted hosts that you control and that do not issue redirects
Ensure allowed hosts do not have open redirect vulnerabilities
Use network-level controls to block access from Backstage to sensitive internal endpoints

References

OWASP SSRF Prevention Cheat Sheet

Release Notes

backstage/backstage (@backstage/backend-defaults)

`v0.12.2`

Compare Source

`v0.12.1`

Compare Source

Patch Changes

33bd4d0: Deduplicate discovered features discovered with discoveryFeatureLoader
4eda590: Fixed cache namespace and key prefix separator configuration to properly use configured values instead of hardcoded plugin ID. The cache manager now correctly combines the configured namespace with plugin IDs using the configured separator for Redis and Valkey. Memcache and memory store continue to use plugin ID as namespace.
f244e61: Add backend.logger config options to configure the RootLoggerService.

Read more about the new configuration options in the
Root Logger Service
documentation.
Updated dependencies
- @backstage/config-loader@1.10.3
- @backstage/plugin-auth-node@0.6.7
- @backstage/plugin-events-node@0.4.15
- @backstage/integration@1.18.0
- @backstage/types@1.2.2
- @backstage/backend-app-api@1.2.7
- @backstage/backend-plugin-api@1.4.3
- @backstage/plugin-permission-node@0.10.4

`v0.12.0`

Compare Source

Minor Changes

133519b: feat: new cache manager Infinispan Data Grid

Patch Changes

caee2eb: Fixed WinstonLogger throwing when redactions were null or undefined
ed74af5: Fixed bug in PackageDiscoveryService where packages with "exports" field caused ERR_PACKAGE_PATH_NOT_EXPORTED error during backend startup.
3a7dad9: Updated better-sqlite3 to v12
Updated dependencies
- @backstage/cli-node@0.2.14
- @backstage/backend-app-api@1.2.6
- @backstage/plugin-auth-node@0.6.6
- @backstage/plugin-permission-node@0.10.3
- @backstage/backend-plugin-api@1.4.2
- @backstage/plugin-events-node@0.4.14

`v0.11.1`

Compare Source

Patch Changes

ead925a: Add a standard toString on credentials objects
e0189b8: UrlReader: Fix handling of access tokens for GitLab readURL requests
d1e4a6d: Fixed bug where the GitLab user token and GitLab integration token were being merged together
Updated dependencies
- @backstage/config-loader@1.10.2
- @backstage/config@1.3.3
- @backstage/plugin-permission-node@0.10.2
- @backstage/integration@1.17.1
- @backstage/backend-app-api@1.2.5
- @backstage/backend-plugin-api@1.4.1
- @backstage/integration-aws-node@0.1.17
- @backstage/plugin-auth-node@0.6.5
- @backstage/plugin-events-node@0.4.13

`v0.11.0`

Compare Source

Minor Changes

3ccb7fc: Enhanced error handling in the auditor service factory to pass errors as objects. Aligned WinstonRootAuditorService with the default service factory's error handling.

Patch Changes

1220cf8: Added new rate limit middleware to allow rate limiting requests to the backend

If you are using the configure callback of the root HTTP router service and do NOT call applyDefaults() inside it, please see the relevant changes that were made, to see if you want to apply them as well to your custom configuration.
Rate limiting can be turned on by adding the following configuration to app-config.yaml:
```
backend:
  rateLimit:
    window: 6s
    incomingRequestLimit: 100
```
Plugin specific rate limiting can be configured by adding the following configuration to app-config.yaml:
```
backend:
  rateLimit:
    global: false # This will disable the global rate limiting
    plugin:
      catalog:
        window: 6s
        incomingRequestLimit: 100
```
c999c25: Added some default implementations for the experimental ActionsService and ActionsRegistryService under /alpha that allow registration of actions for a particular plugin.
Updated dependencies
- @backstage/plugin-auth-node@0.6.4
- @backstage/backend-app-api@1.2.4
- @backstage/backend-plugin-api@1.4.0
- @backstage/backend-dev-utils@0.1.5
- @backstage/cli-node@0.2.13
- @backstage/config@1.3.2
- @backstage/config-loader@1.10.1
- @backstage/errors@1.2.7
- @backstage/integration@1.17.0
- @backstage/integration-aws-node@0.1.16
- @backstage/types@1.2.1
- @backstage/plugin-events-node@0.4.12
- @backstage/plugin-permission-node@0.10.1

`v0.10.0`

Compare Source

Minor Changes

d385854: BREAKING: The DefaultSchedulerService constructor options now requires RootLifecycleService, HttpRouterService, and PluginMetadataService fields.

The scheduler will register a REST API for listing and triggering tasks. Please see the scheduler documentation for more details about this API.

Patch Changes

1e06afd: GithubUrlReader's search detects glob-patterns supported by minimatch, instead of just detecting
* and ? characters.

For example, this allows to search for patterns like {C,c}atalog-info.yaml.
acea1d4: update documentation
72d019d: Removed various typos
c6bc67d: Added Valkey support alongside Redis in backend-defaults cache clients, using the new Keyv Valkey package. Also extended backend-test-utils to support Valkey in tests.
36f77e9: Bug fix: Pass user provided token through to gitlab url resolvers
0e7a640: The GithubUrlReader will now use the token from options when fetching repo details
Updated dependencies
- @backstage/integration@1.17.0
- @backstage/backend-app-api@1.2.3
- @backstage/plugin-auth-node@0.6.3
- @backstage/backend-plugin-api@1.3.1
- @backstage/plugin-permission-node@0.10.0
- @backstage/config-loader@1.10.1
- @backstage/integration-aws-node@0.1.16
- @backstage/cli-node@0.2.13
- @backstage/config@1.3.2
- @backstage/backend-dev-utils@0.1.5
- @backstage/errors@1.2.7
- @backstage/types@1.2.1
- @backstage/plugin-events-node@0.4.11

`v0.9.0`

Compare Source

Minor Changes

1daedce: Remove Throttle of Bitbucket Server API calls
01edf6e: Allow pass through of redis client and cluster options to Cache core service
cf4eb13: Added actor property to BackstageUserPrincipal containing the subject of the last service (if any) who performed authentication on behalf of the user.

Patch Changes

7c6740e: Implemented SRV lookup support in the default HostDiscovery. You can now specify internal URLs on the form http+srv://some-srv-name/api/{{pluginId}} and they will be resolved in real time.
939116c: Added an optional backend.trustProxy app config value, which sets the
corresponding Express.js trust proxy setting. This lets
you easily configure proxy trust without making a custom configure callback
for the rootHttpRouter service.

If you already are using a custom configure callback, and if that also does not call applyDefaults(), you may want to add the following to it:
```
const trustProxy = config.getOptional('backend.trustProxy');
if (trustProxy !== undefined) {
  app.set('trust proxy', trustProxy);
}
```
175528c: Adds backend.auditor.severityLogLevelMappings to map severity levels to log levels.
Updated dependencies
- @backstage/backend-plugin-api@1.3.0
- @backstage/integration@1.16.3
- @backstage/backend-app-api@1.2.2
- @backstage/plugin-auth-node@0.6.2
- @backstage/plugin-permission-node@0.9.1
- @backstage/backend-dev-utils@0.1.5
- @backstage/cli-node@0.2.13
- @backstage/config@1.3.2
- @backstage/config-loader@1.10.0
- @backstage/errors@1.2.7
- @backstage/integration-aws-node@0.1.15
- @backstage/types@1.2.1
- @backstage/plugin-events-node@0.4.10

`v0.8.2`

Compare Source

Patch Changes

e293b66: The default auditor service implementation will now log low severity events with debug level instead of info.
f422984: Remove unused dependencies
ecb9bab: Explicitly stringify extra logger fields with JSON.stringify to prevent [object Object] errors.
12f8e01: The discovery.endpoints configuration no longer requires both internal and external target when using the object form, instead falling back to the default.
89db8b8: GerritUrlReader is now able to search files matching a given pattern URL (using minimatch glob patterns).

This allows the Gerrit Discovery to find all Backstage manifests inside a repository using the **/catalog-info.yaml pattern.
Updated dependencies
- @backstage/config-loader@1.10.0
- @backstage/integration@1.16.2
- @backstage/plugin-permission-node@0.9.0
- @backstage/plugin-auth-node@0.6.1
- @backstage/plugin-events-node@0.4.9
- @backstage/backend-app-api@1.2.1
- @backstage/integration-aws-node@0.1.15
- @backstage/backend-dev-utils@0.1.5
- @backstage/backend-plugin-api@1.2.1
- @backstage/cli-node@0.2.13
- @backstage/config@1.3.2
- @backstage/errors@1.2.7
- @backstage/types@1.2.1

`v0.8.1`

Compare Source

Release a newer version of @backstage/techdocs-common including a bug fix #4088.

`v0.8.0`

Compare Source

Minor Changes

a4aa244: This change introduces the auditor service implementation details.

Patch Changes

f866b86: Internal refactor to use explicit require for lazy-loading dependency.
92a56f6: Internal refactor to stop importing the removed FeatureDiscoveryService from @backstage/backend-plugin-api.
a19cb2b: Added default implementation for the new PermissionsRegistryService.
0d39029: Do not send etag or If-Modified-Since headers for gitlab artifact urls
c7609de: Allow passing IP type to use with cloud-sql-connector
3740229: In the different UrlReadersService, the search method have been updated to use the readUrl if the given URL doesn't contain a pattern.
For UrlReaders that didn't implement the search method, readUrl is now called internally and throws if the given URL doesn't contain a pattern.
72cddf2: Updated PermissionsRegistryService to use PermissionResourceRefs and added the getPermissionRuleset method.
Updated dependencies
- @backstage/cli-node@0.2.13
- @backstage/plugin-permission-node@0.8.8
- @backstage/config-loader@1.9.6
- @backstage/backend-plugin-api@1.2.0
- @backstage/plugin-auth-node@0.6.0
- @backstage/backend-app-api@1.2.0
- @backstage/backend-dev-utils@0.1.5
- @backstage/cli-common@0.1.15
- @backstage/config@1.3.2
- @backstage/errors@1.2.7
- @backstage/integration@1.16.1
- @backstage/integration-aws-node@0.1.15
- @backstage/types@1.2.1
- @backstage/plugin-events-node@0.4.8

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

…security]

renovate bot force-pushed the renovate/npm-backstage-backend-defaults-vulnerability branch from 7c20620 to f044b44 Compare February 2, 2026 16:01

fix(deps): update dependency @backstage/backend-defaults to ^0.12.0 […

bdc606c

…security]

renovate bot force-pushed the renovate/npm-backstage-backend-defaults-vulnerability branch from f044b44 to bdc606c Compare February 12, 2026 12:30

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update dependency @backstage/backend-defaults to ^0.12.0 [security]#85

fix(deps): update dependency @backstage/backend-defaults to ^0.12.0 [security]#85
renovate[bot] wants to merge 1 commit intomainfrom
renovate/npm-backstage-backend-defaults-vulnerability

renovate bot commented Jan 21, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate bot commented Jan 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

GitHub Vulnerability Alerts

Impact

Patches

Workarounds

References

Impact

Patches

Workarounds

References

Release Notes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate bot commented Jan 21, 2026 •

edited

Loading