Repository navigation
fix: Patch 18 of 21 high dependency advisories - #99
Conversation
Dependabot reports 21 high advisories on the Backstage portal. This update takes every one that has a patched release old enough to pass the 3-day package age gate. Remaining: body-parser, multer (released 2026-10-22, clear after 2026-10-25 11:39 UTC) and node-forge (no patched release exists). Key changes: - Refresh the lockfile within current ranges for techdocs-node, grpc-js, the MCP SDK, follow-redirects, compression, launch-editor, markdown-it, http-cache-semantics, source-map-js and undici. - Add resolutions where a parent pins an old version: @azure/msal-node ^7.1.0 (two majors above the parent's range, no fix in 5.x or 6.x), @graphql-tools/utils ^12.1.0, basic-ftp ^6.2.2, and undici under the module federation DTS plugin.
|
Detail Lockfile refresh within current ranges: Resolutions added because a parent pins an old version: |
kevwilliams
left a comment
kevwilliams
left a comment
There was a problem hiding this comment.
Verified no app-config or workspace package configures Azure or FTP, so the forced msal-node 7 and basic-ftp 6 majors sit on code paths production never runs.
The Backstage portal has 21 open high advisories in its dependencies. They cover the MCP SDK, archive and FTP handling, HTTP proxy and redirect code, markdown rendering, and the Azure auth library.
This update fixes 18 of the 21 inside the portal's current major versions, except one Azure auth library step called out in the comment. The backend and app build, the type check passes, and the 17 unit tests pass.
Three stay open:
yarn up -Rafter that.The open major-version updates #91 (react-router) and #97 (Node 24) are not needed for any of these advisories and are left alone.