[Snyk] Fix for 2 vulnerabilities #6347
Conversation
…educe vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-PBKDF2-10495496 - https://snyk.io/vuln/SNYK-JS-PBKDF2-10495498
Review or Edit in CodeSandboxOpen the branch in Web Editor • VS Code • Insiders |
Reviewer's GuideThis PR replaces workspace references with specific patched versions of three Backstage plugins in the Bitbucket Cloud backend module to remediate two critical PBKDF2 vulnerabilities. Class diagram for updated dependencies in package.jsonclassDiagram
class CatalogBackendModuleBitbucketCloud {
- @backstage/plugin-bitbucket-cloud-common: 0.1.0
- @backstage/plugin-catalog-common: 0.1.0
- @backstage/plugin-catalog-node: 1.0.0
}
class PluginBitbucketCloudCommon {
<<external>>
version: 0.1.0
}
class PluginCatalogCommon {
<<external>>
version: 0.1.0
}
class PluginCatalogNode {
<<external>>
version: 1.0.0
}
CatalogBackendModuleBitbucketCloud --> PluginBitbucketCloudCommon : depends on
CatalogBackendModuleBitbucketCloud --> PluginCatalogCommon : depends on
CatalogBackendModuleBitbucketCloud --> PluginCatalogNode : depends on
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
🎉 Snyk checks have passed. No issues have been found so far.✅ security/snyk check is complete. No issues have been found. (View Details) |
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
![graphite-app[bot]](https://avatars.githubusercontent.com/in/158384?s=60&v=4){kind=small}
| "@backstage/plugin-bitbucket-cloud-common": "0.1.0", | ||
| "@backstage/plugin-catalog-common": "0.1.0", | ||
| "@backstage/plugin-catalog-node": "1.0.0", |
There was a problem hiding this comment.
Replacing workspace:^ references with fixed versions breaks the monorepo dependency management pattern. This approach can lead to dependency duplication and version conflicts when multiple versions of the same package exist in the dependency tree.
For Backstage monorepos, the recommended approach is to:
- Update the vulnerable dependencies at their source within the monorepo
- Maintain the
workspace:^references to ensure consistent versioning - If needed, update the root
package.jsonto specify newer versions of transitive dependencies
This preserves the benefits of the workspace pattern while addressing the security vulnerabilities in a more sustainable way.
| "@backstage/plugin-bitbucket-cloud-common": "0.1.0", | |
| "@backstage/plugin-catalog-common": "0.1.0", | |
| "@backstage/plugin-catalog-node": "1.0.0", | |
| "@backstage/plugin-bitbucket-cloud-common": "workspace:^", | |
| "@backstage/plugin-catalog-common": "workspace:^", | |
| "@backstage/plugin-catalog-node": "workspace:^", |
Spotted by Diamond
Is this helpful? React 👍 or 👎 to let us know.
| "@backstage/plugin-bitbucket-cloud-common": "0.1.0", | ||
| "@backstage/plugin-catalog-common": "0.1.0", | ||
| "@backstage/plugin-catalog-node": "1.0.0", |
There was a problem hiding this comment.
The PR shows that the yarn.lock update failed during the automated fix process. This is concerning because pinning these dependencies to specific versions without a corresponding lock file update could lead to dependency resolution conflicts or incompatibilities with other packages in the project.
Before merging, it's important to:
- Manually run
yarnto update the lock file - Verify that the updated dependencies work correctly with the rest of the codebase
- Consider whether pinning to exact versions (rather than using workspace references) is the right long-term approach for these packages
The vulnerability fixes are important, but ensuring proper dependency resolution is critical for maintaining a stable build. The warning in the PR description should not be overlooked.
Spotted by Diamond
Is this helpful? React 👍 or 👎 to let us know.
|
This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution! |
Snyk has created this PR to fix 2 vulnerabilities in the yarn dependencies of this project.
Snyk changed the following file(s):
plugins/catalog-backend-module-bitbucket-cloud/package.jsonNote for zero-installs users
If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the
.yarn/cache/directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to runyarnto update the contents of the./yarn/cachedirectory.If you are not using zero-install you can ignore this as your flow should likely be unchanged.
Vulnerabilities that will be fixed with an upgrade:
SNYK-JS-PBKDF2-10495496
SNYK-JS-PBKDF2-10495498
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.
Summary by Sourcery
Upgrade Backstage plugins in the catalog-backend-module-bitbucket-cloud package to address critical PBKDF2 vulnerabilities.
Bug Fixes:
Enhancements:
Chores: