Repository navigation
fix: Clear medium dependency advisories - #100
Merged
Merged
Conversation
Seventeen advisories were open after the high ones were patched. Most sit in packages the lockfile can move inside their ranges. Three nested copies pin older majors and need resolutions. Key changes: - Refresh hono, fast-uri, fast-copy, mysql2 and webpack-dev-server. - Resolve refractor to prismjs 1.30 and postcss-selector-parser to 7. - Resolve uuid 11 for the packages that use named imports. The material-table copy stays on uuid 3 because it calls the default export, which uuid 11 removed.
Contributor
Author
|
Remaining 13 after this PR:
Majors taken: uuid 11 for dockerode, gaxios, google-gax, mockttp, sockjs and teeny-request; postcss-selector-parser 7 for the CSS tooling. |
kevwilliams
approved these changes
Oct 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backstage has 35 open dependency advisories: 3 high, 28 medium and 4 low. They cover the web framework, the file-upload and body parsers, and URL and CSS parsing, so the portal backend is exposed to known denial-of-service and request-handling flaws.
This clears 22 of them (19 medium, 3 low) with patched releases. Build, type check, lint and the 17 tests pass. The 13 left need a blocked release, a framework major or have no fix.
The release age gate holds body-parser 2.4.0 and multer 2.5.0 until about 2026-10-25 11:39 UTC, so two of the three highs follow in a second change once it opens.