Skip to content

Update dependency @backstage/backend-defaults to ^0.12.0 [SECURITY] - #10

Open
renovate-wibrow[bot] wants to merge 1 commit into
mainfrom
renovate/npm-backstage-backend-defaults-vulnerability
Open

Update dependency @backstage/backend-defaults to ^0.12.0 [SECURITY]#10
renovate-wibrow[bot] wants to merge 1 commit into
mainfrom
renovate/npm-backstage-backend-defaults-vulnerability

Conversation

@renovate-wibrow

@renovate-wibrow renovate-wibrow Bot commented Sep 19, 2026 •
edited
Loading

Copy link
Copy Markdown

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
@backstage/backend-defaults (source) dependencies minor ^0.3.0 → ^0.12.0

Backstage has a Possible Symlink Path Traversal in Scaffolder Actions

CVE-2026-24046 / GHSA-rq6q-wr2q-7pgp

More information

Details

Impact

Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to:

  1. Read arbitrary files via the debug:log action by creating a symlink pointing to sensitive files (e.g., /etc/passwd, configuration files, secrets)
  2. Delete arbitrary files via the fs:delete action by creating symlinks pointing outside the workspace
  3. Write files outside the workspace via archive extraction (tar/zip) containing malicious symlinks

This affects any Backstage deployment where users can create or execute Scaffolder templates.

Patches

This vulnerability is fixed in the following package versions:

  • @backstage/backend-defaults version 0.12.2, 0.13.2, 0.14.1, 0.15.0
  • @backstage/plugin-scaffolder-backend version 2.2.2, 3.0.2, 3.1.1
  • @backstage/plugin-scaffolder-node version 0.11.2, 0.12.3

Users should upgrade to these versions or later.

Workarounds
  • Follow the recommendation in the Backstage Threat Model to limit access to creating and updating templates
  • Restrict who can create and execute Scaffolder templates using the permissions framework
  • Audit existing templates for symlink usage
  • Run Backstage in a containerized environment with limited filesystem access
References

Severity

  • CVSS Score: 7.1 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Backstage has a Possible SSRF when reading from allowed URL's in backend.reading.allow

CVE-2026-24048 / GHSA-q2x5-4xjx-c6p9

More information

Details

Impact

The FetchUrlReader component, used by the catalog and other plugins to fetch content from URLs, followed HTTP redirects automatically. This allowed an attacker who controls a host listed in backend.reading.allow to redirect requests to internal or sensitive URLs that are not on the allowlist, bypassing the URL allowlist security control.

This is a Server-Side Request Forgery (SSRF) vulnerability that could allow access to internal resources, but it does not allow attackers to include additional request headers.

Patches

This vulnerability is fixed in @backstage/backend-defaults version 0.12.2, 0.13.2, 0.14.1, and 0.15.0. Users should upgrade to this version or later.

Workarounds
  • Restrict backend.reading.allow to only trusted hosts that you control and that do not issue redirects
  • Ensure allowed hosts do not have open redirect vulnerabilities
  • Use network-level controls to block access from Backstage to sensitive internal endpoints
References

Severity

  • CVSS Score: 3.5 / 10 (Low)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

backstage/backstage (@​backstage/backend-defaults)

v0.12.2

Compare Source

v0.12.1

Compare Source

Patch Changes

v0.12.0

Compare Source

Minor Changes
  • 133519b: feat: new cache manager Infinispan Data Grid
Patch Changes

v0.11.1

Compare Source

Patch Changes

v0.11.0

Compare Source

Minor Changes
  • 3ccb7fc: Enhanced error handling in the auditor service factory to pass errors as objects. Aligned WinstonRootAuditorService with the default service factory's error handling.
Patch Changes

v0.10.0

Compare Source

Minor Changes

  • d385854: BREAKING: The DefaultSchedulerService constructor options now requires RootLifecycleService, HttpRouterService, and PluginMetadataService fields.

    The scheduler will register a REST API for listing and triggering tasks. Please see the scheduler documentation for more details about this API.

Patch Changes

v0.9.0

Compare Source

Minor Changes
  • 1daedce: Remove Throttle of Bitbucket Server API calls
  • 01edf6e: Allow pass through of redis client and cluster options to Cache core service
  • cf4eb13: Added actor property to BackstageUserPrincipal containing the subject of the last service (if any) who performed authentication on behalf of the user.
Patch Changes

v0.8.2

Compare Source

Patch Changes

v0.8.1

Compare Source

Release a newer version of @backstage/techdocs-common including a bug fix #​4088.

v0.8.0

Compare Source

Minor Changes
  • a4aa244: This change introduces the auditor service implementation details.
Patch Changes

v0.7.0

Compare Source

Minor Changes

  • ec547b8: Ensure that an error handler middleware exists at the end of each plugin httpRouter handler chain. This makes it so that exceptions thrown by plugin routes are caught and encoded in the standard error format.

    If you were using the standard MiddlewareFactory just to put an error middleware in you router, you can now remove that at your earliest convenience since it's redundant. If you have custom error handlers in your plugin router, those will continue to function as previously. If you were relying on thrown errors propagating all the way down to the root HTTP router, you will find that they no longer do that, and may want to hoist your error handling up to the plugin level instead.

Patch Changes

v0.6.2

Compare Source

v0.6.1

Compare Source

v0.6.0

Compare Source

Minor Changes

  • fd5d337: Added a new backend.health.headers configuration that can be used to set additional headers to include in health check responses.

    BREAKING CONSUMERS: As part of this change the createHealthRouter function exported from @backstage/backend-defaults/rootHttpRouter now requires the root config service to be passed through the config option.

  • 3f34ea9: Throttles Bitbucket Server API calls

  • de6f280: BREAKING Upgraded @​keyv/redis and keyv packages to resolve a bug related to incorrect resolution of cache keys.

    This is a breaking change for clients using the redis store for cache with useRedisSets option set to false since cache keys will be calculated differently (without the sets:namespace: prefix). For clients with default configuration (or useRedisSets set to false) the cache keys will stay the same, but since @​keyv/redis library no longer supports redis sets they won't be utilised anymore.

    If you were using useRedisSets option in configuration make sure to remove it from app-config.yaml:

    backend:
  cache:
    store: redis
    connection: redis://user:pass@cache.example.com:6379
-   useRedisSets: false

  • 29180ec: BREAKING PRODUCERS: The LifecycleMiddlewareOptions.startupRequestPauseTimeout has been removed. Use the backend.lifecycle.startupRequestPauseTimeout setting in your app-config.yaml file to customize how the createLifecycleMiddleware function should behave. Also the root config service is required as an option when calling the createLifecycleMiddleware function:

    - createLifecycleMiddleware({ lifecycle, startupRequestPauseTimeout })
+ createLifecycleMiddleware({ config,  lifecycle })

  • 277092a: Implemented AzureBlobStorageUrlReader to read from the url of committed location from the entity provider

  • 18a2c00: All middleware used by the default coreServices.http is now exported for use by custom implementations.

Patch Changes

v0.5.3

Compare Source

Patch Changes

v0.5.2

Compare Source

v0.5.1

Compare Source

Patch Changes

v0.5.0

Compare Source

Minor Changes

  • a4bac3c: BREAKING: You can no longer supply a basePath option to the host discovery implementation. In the new backend system, the ability to choose this path has been removed anyway at the plugin router level.

  • 359fcd7: BREAKING: The backwards compatibility with plugins using legacy auth through the token manager service has been removed. This means that instead of falling back to using the old token manager, requests towards plugins that don't support the new auth system will simply fail. Please make sure that all plugins in your deployment are hosted within a backend instance from the new backend system.

  • baeef13: BREAKING Removed createLifecycleMiddleware and LifecycleMiddlewareOptions to clean up API surface. These exports have no external usage and do not provide value in its current form. If you were using these exports, please reach out to the maintainers to discuss your use case.

  • d425fc4: BREAKING: The return values from createBackendPlugin, createBackendModule, and createServiceFactory are now simply BackendFeature and ServiceFactory, instead of the previously deprecated form of a function that returns them. For this reason, createServiceFactory also no longer accepts the callback form where you provide direct options to the service. This also affects all coreServices.* service refs.

    This may in particular affect tests; if you were effectively doing createBackendModule({...})() (note the parentheses), you can now remove those extra parentheses at the end. You may encounter cases of this in your packages/backend/src/index.ts too, where you add plugins, modules, and services. If you were using createServiceFactory with a function as its argument for the purpose of passing in options, this pattern has been deprecated for a while and is no longer supported. You may want to explore the new multiton patterns to achieve your goals, or moving settings to app-config.

    As part of this change, the IdentityFactoryOptions type was removed, and can no longer be used to tweak that service. The identity service was also deprecated some time ago, and you will want to migrate to the new auth system if you still rely on it.

  • 19ff127: BREAKING: The default backend instance no longer provides implementations for the identity and token manager services, which have been removed from @backstage/backend-plugin-api.

    If you rely on plugins that still require these services, you can add them to your own backend by re-creating the service reference and factory.

    The following can be used to implement the identity service:

    import {
  coreServices,
  createServiceFactory,
  createServiceRef,
} from '@backstage/backend-plugin-api';
import {
  DefaultIdentityClient,
  IdentityApi,
} from '@backstage/plugin-auth-node';

backend.add(
  createServiceFactory({
    service: createServiceRef<IdentityApi>({ id: 'core.identity' }),
    deps: {
      discovery: coreServices.discovery,
    },
    async factory({ discovery }) {
      return DefaultIdentityClient.create({ discovery });
    },
  }),
);

    The following can be used to implement the token manager service:

    import { ServerTokenManager, TokenManager } from '@backstage/backend-common';
import { createBackend } from '@backstage/backend-defaults';
import {
  coreServices,
  createServiceFactory,
  createServiceRef,
} from '@backstage/backend-plugin-api';

backend.add(
  createServiceFactory({
    service: createServiceRef<TokenManager>({ id: 'core.tokenManager' }),
    deps: {
      config: coreServices.rootConfig,
      logger: coreServices.rootLogger,
    },
    createRootContext({ config, logger }) {
      return ServerTokenManager.fromConfig(config, {
        logger,
        allowDisabledTokenManager: true,
      });
    },
    async factory(_deps, tokenManager) {
      return tokenManager;
    },
  }),
);

  • 055b75b: BREAKING: Simplifications and cleanup as part of the Backend System 1.0 work.

    For the /database subpath exports:

    • The deprecated dropDatabase function has now been removed, without replacement.
    • The deprecated LegacyRootDatabaseService type has now been removed.
    • The return type from DatabaseManager.forPlugin is now directly a DatabaseService, as arguably expected.
    • DatabaseManager.forPlugin now requires the deps argument, with the logger and lifecycle services.

    For the /cache subpath exports:

    • The PluginCacheManager type has been removed. You can still import it from @backstage/backend-common, but it's deprecated there, and you should move off of that package by migrating fully to the new backend system.
    • Accordingly, CacheManager.forPlugin immediately returns a CacheService instead of a PluginCacheManager. The outcome of this is that you no longer need to make the extra .getClient() call. The old CacheManager with the old behavior still exists on @backstage/backend-common, but the above recommendations apply.
Patch Changes

v0.4.4

Compare Source

@​backstage/backend-common@0.4.2

Patch Changes
  • 5ecd50f: Fix HTTPS certificate generation and add new config switch, enabling it simply by setting backend.https = true. Also introduces caching of generated certificates in order to avoid having to add a browser override every time the backend is restarted.
  • 00042e7: Moving the Git actions to isomorphic-git instead of the node binding version of nodegit
  • 0829ff1: Tweaked development log formatter to include extra fields at the end of each log line
  • 036a843: Provide support for on-prem azure devops
  • Updated dependencies [ad5c56f]
  • Updated dependencies [036a843]

@​backstage/cli@0.4.5

Patch Changes
  • 37a7d26: Use consistent file extensions for JS output when building packages.
  • 818d45e: Fix detection of external package child directories
  • 0588be0: Add backend:bundle command for bundling a backend package with dependencies into a deployment archive.
  • b8abdda: Add color to output from versions:bump in order to make it easier to spot changes. Also highlight possible breaking changes and link to changelogs.
  • Updated dependencies [ad5c56f]

@​backstage/config-loader@0.4.1

Patch Changes

  • ad5c56f: Deprecate $data and replace it with $include which allows for any type of json value to be read from external files. In addition, $include can be used without a path, which causes the value at the root of the file to be loaded.

    Most usages of $data can be directly replaced with $include, except if the referenced value is not a string, in which case the value needs to be changed. For example:

    # app-config.yaml
foo:
  $data: foo.yaml#myValue # replacing with $incl

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants