Repository navigation
Update dependency @backstage/plugin-catalog-backend to v1.26.0 [SECURITY] - #12
Open
renovate-wibrow[bot] wants to merge 1 commit into
Open
renovate-wibrow[bot] wants to merge 1 commit into
renovate-wibrow[bot] wants to merge 1 commit into
Conversation
renovate-wibrow
Bot
force-pushed
the
renovate/npm-backstage-plugin-catalog-backend-vulnerability
branch
3 times, most recently
from
September 30, 2026 06:10
5b2549b to
f9a740d
Compare
renovate-wibrow
Bot
force-pushed
the
renovate/npm-backstage-plugin-catalog-backend-vulnerability
branch
from
October 9, 2026 06:34
f9a740d to
ceff957
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.23.2→1.26.0@backstage/plugin-catalog-backend Prototype Pollution vulnerability
CVE-2024-45815 / GHSA-3x3f-jcp3-g22j
More information
Details
Impact
A malicious actor with authenticated access to a Backstage instance with the catalog backend plugin installed is able to interrupt the service using a specially crafted query to the catalog API.
Patches
This has been fixed in the
1.26.0release of the@backstage/plugin-catalog-backendpackage.References
If you have any questions or comments about this advisory:
Open an issue in the Backstage repository
Visit our Discord, linked to in Backstage README
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
backstage/backstage (@backstage/plugin-catalog-backend)
v1.26.0Compare Source
Minor Changes
74acf06: AdddependencyOfprop to catalog model for Component kind to enable building relationship graphs with both directions usingdependsOnanddependencyOf.78475c3: Allow offset mode paging in entity list providerbd35cdb: Theanalyze-locationendpoint is now protected by thecatalog.location.analyzepermission.The
validate-entityendpoint is now protected by thecatalog.entity.validatepermission.Patch Changes
1882cfe: MovedgetEntitiesordering to utilize database instead of having it inside catalog clientPlease note that the latest version of
@backstage/catalog-clientwill not order the entities in the same way as before. This is because the ordering is now done in the database query instead of in the client. If you rely on the ordering of the entities, you may need to update your backend plugin or code to handle this change.d425fc4: Modules, plugins, and services are nowBackendFeature, not a function that returns a feature.c2b63ab: Updated dependencysupertestto^7.0.0.53cce86: Fixed an issue with the by-query call, where ordering by a field that does not exist on all entities led to not all results being returnedUpdated dependencies
v1.25.2Compare Source
This release fixes an issue where requests for the public
httproutes for theevents-backendwere authenticated causing 401 errors.v1.25.1Compare Source
This release fixes an bug where the kubernetes plugin would crash reading
credentialsfromundefined.v1.25.0Compare Source
Minor Changes
163ba08: DeprecatedRouterOptions,CatalogBuilder, andCatalogEnvironment. Please make sure to upgrade to the new backend system.fc24d9e: Stop using@backstage/backend-tasksas it will be deleted in near future.Patch Changes
776eb56:ProcessorOutputCollectorreturns an error when receiving deferred entities that have an invalidmetadata.annotationsformat.This allows to return an error on an actual validation issue instead of reporting that the location annotations are missing afterwards, which is misleading for the users.
389f5a4: Update deprecated url-reader-related imports.93095ee: Make sure node-fetch is version 2.7.0 or greatera629fb2: Added setAllowedLocationTypes while introducing a new extension point called CatalogLocationsExtensionPoint51240ee: Preserve defaultallowedLocationTypeswhensetAllowedLocationTypes()ofCatalogLocationsExtensionPointis not called.Updated dependencies
v1.24.0Compare Source
Minor Changes
b9ed1bb: bumped better-sqlite3 from ^9.0.0 to ^11.0.0Patch Changes
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.