AAP-92537: fix: bump compression to ^1.8.2 for CVE-2026-87776

[sshedmake]

Summary

• Add "compression": "^1.8.2" yarn resolution to upgrade transitive compression from 1.8.1 to 1.8.2.
• Affected dependency paths: @backstage/backend-defaults, webpack-dev-server, @rspack/dev-server.

CVE Details

• CVE-2026-87776: Denial of Service via memory leak on premature response close in the compression middleware. When a client aborts a connection while a compressed response is still being sent, the zlib stream is never destroyed, leaking native memory. Fixed in compression 1.8.2.
• CVSS: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Related Issues

• AAP-92537
• AAP-92536
• CVE-2026-87776

Test plan

• yarn install completes successfully
• yarn why compression resolves all instances to 1.8.2
• CI passes

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 9d3066a9-5ab0-40e1-a5f3-4e66194573f6

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.74%. Comparing base (9a0a00f) to head (1cb8e24).

@@           Coverage Diff           @@
##             main     #690   +/-   ##
=======================================
  Coverage   95.74%   95.74%           
=======================================
  Files         241      241           
  Lines       14587    14587           
  Branches     4013     3938   -75     
=======================================
  Hits        13966    13966           
- Misses        581      607   +26     
+ Partials       40       14   -26     

Flag	Coverage Δ
plugins	95.74% <ø> (ø)
see 15 files with indirect coverage changes

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 9a0a00f...1cb8e24. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[patchback]

Backport to release-2.1: 💔 cherry-picking failed — conflicts found

❌ Failed to cleanly apply edb3da9 on top of patchback/backports/release-2.1/edb3da9538eed4acc5ca34524b57c9fc2ffb8ebb/pr-690

Backporting merged PR #690 into main

1. Ensure you have a local repo clone of your fork. Unless you cloned it
   from the upstream, this would be your origin remote.
2. Make sure you have an upstream repo added as a remote too. In these
   instructions you'll refer to it by the name upstream. If you don't
   have it, here's how you can add it:

   git remote add upstream https://github.com/ansible/ansible-backstage-plugins.git
   

3. Ensure you have the latest copy of upstream and prepare a branch
   that will hold the backported code:

   git fetch upstream
   git checkout -b patchback/backports/release-2.1/edb3da9538eed4acc5ca34524b57c9fc2ffb8ebb/pr-690 upstream/release-2.1
   

4. Now, cherry-pick PR AAP-92537: fix: bump compression to ^1.8.2 for CVE-2026-87776 #690 contents into that branch:

   git cherry-pick -x edb3da9538eed4acc5ca34524b57c9fc2ffb8ebb
   

   If it'll yell at you with something like fatal: Commit edb3da9538eed4acc5ca34524b57c9fc2ffb8ebb is a merge but no -m option was given., add -m 1 as follows instead:

   git cherry-pick -m1 -x edb3da9538eed4acc5ca34524b57c9fc2ffb8ebb
   

5. At this point, you'll encounter some merge conflicts. You must
   resolve them in order to preserve the patch from PR AAP-92537: fix: bump compression to ^1.8.2 for CVE-2026-87776 #690 as close to the
   original as possible.
6. Once conflicts are resolved and git added, run:

   git cherry-pick --continue
   

7. Push this branch to your fork on GitHub:

   git push origin patchback/backports/release-2.1/edb3da9538eed4acc5ca34524b57c9fc2ffb8ebb/pr-690
   

8. Create a PR, ensure that the CI is green. If it's not — update it so that
   the tests and any other checks pass. This is it!
   Now relax and wait for the maintainers to process your pull request
   when they have some cycles to do reviews. Don't worry — they'll tell you if
   any improvements are necessary when the time comes!

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.

[patchback]

Backport to release-2.2: 💔 cherry-picking failed — conflicts found

❌ Failed to cleanly apply edb3da9 on top of patchback/backports/release-2.2/edb3da9538eed4acc5ca34524b57c9fc2ffb8ebb/pr-690

Backporting merged PR #690 into main

1. Ensure you have a local repo clone of your fork. Unless you cloned it
   from the upstream, this would be your origin remote.
2. Make sure you have an upstream repo added as a remote too. In these
   instructions you'll refer to it by the name upstream. If you don't
   have it, here's how you can add it:

   git remote add upstream https://github.com/ansible/ansible-backstage-plugins.git
   

3. Ensure you have the latest copy of upstream and prepare a branch
   that will hold the backported code:

   git fetch upstream
   git checkout -b patchback/backports/release-2.2/edb3da9538eed4acc5ca34524b57c9fc2ffb8ebb/pr-690 upstream/release-2.2
   

4. Now, cherry-pick PR AAP-92537: fix: bump compression to ^1.8.2 for CVE-2026-87776 #690 contents into that branch:

   git cherry-pick -x edb3da9538eed4acc5ca34524b57c9fc2ffb8ebb
   

   If it'll yell at you with something like fatal: Commit edb3da9538eed4acc5ca34524b57c9fc2ffb8ebb is a merge but no -m option was given., add -m 1 as follows instead:

   git cherry-pick -m1 -x edb3da9538eed4acc5ca34524b57c9fc2ffb8ebb
   

5. At this point, you'll encounter some merge conflicts. You must
   resolve them in order to preserve the patch from PR AAP-92537: fix: bump compression to ^1.8.2 for CVE-2026-87776 #690 as close to the
   original as possible.
6. Once conflicts are resolved and git added, run:

   git cherry-pick --continue
   

7. Push this branch to your fork on GitHub:

   git push origin patchback/backports/release-2.2/edb3da9538eed4acc5ca34524b57c9fc2ffb8ebb/pr-690
   

8. Create a PR, ensure that the CI is green. If it's not — update it so that
   the tests and any other checks pass. This is it!
   Now relax and wait for the maintainers to process your pull request
   when they have some cycles to do reviews. Don't worry — they'll tell you if
   any improvements are necessary when the time comes!

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.