fix(deps): update dependency @backstage/backend-defaults to ^0.12.0 [security] - autoclosed by backstage-goalie[bot] · Pull Request #9749 · backstage/community-plugins

backstage-goalie · 2026-07-03T18:34:52Z

This PR contains the following updates:

Package	Change	Age	Confidence
@backstage/backend-defaults (source)	`^0.11.1` → `^0.12.0`
@backstage/backend-defaults (source)	`^0.7.0` → `^0.12.0`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Backstage has a Possible SSRF when reading from allowed URL's in `backend.reading.allow`

CVE-2026-24048 / GHSA-q2x5-4xjx-c6p9

More information

Details

Impact

The FetchUrlReader component, used by the catalog and other plugins to fetch content from URLs, followed HTTP redirects automatically. This allowed an attacker who controls a host listed in backend.reading.allow to redirect requests to internal or sensitive URLs that are not on the allowlist, bypassing the URL allowlist security control.

This is a Server-Side Request Forgery (SSRF) vulnerability that could allow access to internal resources, but it does not allow attackers to include additional request headers.

Patches

This vulnerability is fixed in @backstage/backend-defaults version 0.12.2, 0.13.2, 0.14.1, and 0.15.0. Users should upgrade to this version or later.

Workarounds

Restrict backend.reading.allow to only trusted hosts that you control and that do not issue redirects
Ensure allowed hosts do not have open redirect vulnerabilities
Use network-level controls to block access from Backstage to sensitive internal endpoints

References

OWASP SSRF Prevention Cheat Sheet

Severity

CVSS Score: 3.5 / 10 (Low)
Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Backstage has a Possible Symlink Path Traversal in Scaffolder Actions

CVE-2026-24046 / GHSA-rq6q-wr2q-7pgp

More information

Details

Impact

Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to:

Read arbitrary files via the debug:log action by creating a symlink pointing to sensitive files (e.g., /etc/passwd, configuration files, secrets)
Delete arbitrary files via the fs:delete action by creating symlinks pointing outside the workspace
Write files outside the workspace via archive extraction (tar/zip) containing malicious symlinks

This affects any Backstage deployment where users can create or execute Scaffolder templates.

Patches

This vulnerability is fixed in the following package versions:

@backstage/backend-defaults version 0.12.2, 0.13.2, 0.14.1, 0.15.0
@backstage/plugin-scaffolder-backend version 2.2.2, 3.0.2, 3.1.1
@backstage/plugin-scaffolder-node version 0.11.2, 0.12.3

Users should upgrade to these versions or later.

Workarounds

Follow the recommendation in the Backstage Threat Model to limit access to creating and updating templates
Restrict who can create and execute Scaffolder templates using the permissions framework
Audit existing templates for symlink usage
Run Backstage in a containerized environment with limited filesystem access

References

Severity

CVSS Score: 7.1 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

backstage/backstage (@backstage/backend-defaults)

`v0.12.2`

Compare Source

`v0.12.1`

Compare Source

Patch Changes

33bd4d0: Deduplicate discovered features discovered with discoveryFeatureLoader
4eda590: Fixed cache namespace and key prefix separator configuration to properly use configured values instead of hardcoded plugin ID. The cache manager now correctly combines the configured namespace with plugin IDs using the configured separator for Redis and Valkey. Memcache and memory store continue to use plugin ID as namespace.
f244e61: Add backend.logger config options to configure the RootLoggerService.

Read more about the new configuration options in the
Root Logger Service
documentation.
Updated dependencies
- @backstage/config-loader@1.10.3
- @backstage/plugin-auth-node@0.6.7
- @backstage/plugin-events-node@0.4.15
- @backstage/integration@1.18.0
- @backstage/types@1.2.2
- @backstage/backend-app-api@1.2.7
- @backstage/backend-plugin-api@1.4.3
- @backstage/plugin-permission-node@0.10.4

`v0.12.0`

Compare Source

Minor Changes

133519b: feat: new cache manager Infinispan Data Grid

Patch Changes

caee2eb: Fixed WinstonLogger throwing when redactions were null or undefined
ed74af5: Fixed bug in PackageDiscoveryService where packages with "exports" field caused ERR_PACKAGE_PATH_NOT_EXPORTED error during backend startup.
3a7dad9: Updated better-sqlite3 to v12
Updated dependencies
- @backstage/cli-node@0.2.14
- @backstage/backend-app-api@1.2.6
- @backstage/plugin-auth-node@0.6.6
- @backstage/plugin-permission-node@0.10.3
- @backstage/backend-plugin-api@1.4.2
- @backstage/plugin-events-node@0.4.14

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

Copilot

Copilot can't review bot-authored pull requests automatically. A user with Copilot access can request a review manually.

backstage-goalie · 2026-07-03T18:35:19Z

Changed Packages

Package Name	Package Path	Changeset Bump	Current Version
@backstage-community/plugin-feedback-backend	workspaces/feedback/plugins/feedback-backend	patch	`v2.1.7`
@backstage-community/plugin-growthbook-backend	workspaces/growthbook-flags/plugins/growthbook-backend	patch	`v0.1.1`
backend	workspaces/report-portal/packages/backend	none	`v0.0.7`
@backstage-community/plugin-report-portal-backend	workspaces/report-portal/plugins/report-portal-backend	patch	`v1.1.2`

Copilot

Copilot can't review bot-authored pull requests automatically. A user with Copilot access can request a review manually.

Copilot

Pull request overview

Copilot reviewed 7 out of 10 changed files in this pull request and generated 8 comments.

  },
  "dependencies": {
-    "@backstage/backend-defaults": "^0.11.1",
+    "@backstage/backend-defaults": "^0.12.0",


  },
  "devDependencies": {
-    "@backstage/backend-defaults": "^0.11.1",
+    "@backstage/backend-defaults": "^0.12.0",


    "@backstage-community/plugin-report-portal-backend": "workspace:^",
    "@backstage-community/plugin-search-backend-module-report-portal": "workspace:^",
-    "@backstage/backend-defaults": "^0.11.1",
+    "@backstage/backend-defaults": "^0.12.0",


  },
  "devDependencies": {
-    "@backstage/backend-defaults": "^0.7.0",
+    "@backstage/backend-defaults": "^0.12.0",


  },
  "dependencies": {
-    "@backstage/backend-defaults": "^0.11.1",
+    "@backstage/backend-defaults": "^0.12.0",


+'@backstage-community/plugin-report-portal-backend': patch
+---
+
+Updated dependency `@backstage/backend-defaults` to `^0.12.0`.


+'@backstage-community/plugin-growthbook-backend': patch
+---
+
+Updated dependency `@backstage/backend-defaults` to `^0.12.0`.


+'@backstage-community/plugin-feedback-backend': patch
+---
+
+Updated dependency `@backstage/backend-defaults` to `^0.12.0`.


Copilot

Pull request overview

Copilot reviewed 7 out of 10 changed files in this pull request and generated 9 comments.

  },
  "dependencies": {
-    "@backstage/backend-defaults": "^0.11.1",
+    "@backstage/backend-defaults": "^0.12.0",


  },
  "devDependencies": {
-    "@backstage/backend-defaults": "^0.11.1",
+    "@backstage/backend-defaults": "^0.12.0",


    "@backstage-community/plugin-report-portal-backend": "workspace:^",
    "@backstage-community/plugin-search-backend-module-report-portal": "workspace:^",
-    "@backstage/backend-defaults": "^0.11.1",
+    "@backstage/backend-defaults": "^0.12.0",


  },
  "devDependencies": {
-    "@backstage/backend-defaults": "^0.7.0",
+    "@backstage/backend-defaults": "^0.12.0",


  },
  "dependencies": {
-    "@backstage/backend-defaults": "^0.11.1",
+    "@backstage/backend-defaults": "^0.12.0",


  },
  "dependencies": {
-    "@backstage/backend-defaults": "^0.11.1",
+    "@backstage/backend-defaults": "^0.12.0",


+'@backstage-community/plugin-report-portal-backend': patch
+---
+
+Updated dependency `@backstage/backend-defaults` to `^0.12.0`.


+'@backstage-community/plugin-growthbook-backend': patch
+---
+
+Updated dependency `@backstage/backend-defaults` to `^0.12.0`.


+'@backstage-community/plugin-feedback-backend': patch
+---
+
+Updated dependency `@backstage/backend-defaults` to `^0.12.0`.


Copilot

Pull request overview

Copilot reviewed 7 out of 10 changed files in this pull request and generated 8 comments.

  "dependencies": {
-    "@backstage/backend-defaults": "^0.11.1",
+    "@backstage/backend-defaults": "^0.12.0",
    "@backstage/backend-plugin-api": "^1.4.1",


  "devDependencies": {
-    "@backstage/backend-defaults": "^0.11.1",
+    "@backstage/backend-defaults": "^0.12.0",
    "@backstage/backend-test-utils": "^1.7.0",


    "@backstage-community/plugin-report-portal-backend": "workspace:^",
    "@backstage-community/plugin-search-backend-module-report-portal": "workspace:^",
-    "@backstage/backend-defaults": "^0.11.1",
+    "@backstage/backend-defaults": "^0.12.0",
    "@backstage/config": "^1.3.3",


+'@backstage-community/plugin-report-portal-backend': patch
+---
+
+Updated dependency `@backstage/backend-defaults` to `^0.12.0`.


  "devDependencies": {
-    "@backstage/backend-defaults": "^0.7.0",
+    "@backstage/backend-defaults": "^0.12.0",
    "@backstage/backend-test-utils": "^1.10.4",


+'@backstage-community/plugin-growthbook-backend': patch
+---
+
+Updated dependency `@backstage/backend-defaults` to `^0.12.0`.


  "dependencies": {
-    "@backstage/backend-defaults": "^0.11.1",
+    "@backstage/backend-defaults": "^0.12.0",
    "@backstage/backend-dynamic-feature-service": "^0.7.2",


+'@backstage-community/plugin-feedback-backend': patch
+---
+
+Updated dependency `@backstage/backend-defaults` to `^0.12.0`.


Copilot

Pull request overview

Copilot reviewed 7 out of 10 changed files in this pull request and generated 8 comments.

  },
  "dependencies": {
-    "@backstage/backend-defaults": "^0.11.1",
+    "@backstage/backend-defaults": "^0.12.0",


  },
  "devDependencies": {
-    "@backstage/backend-defaults": "^0.11.1",
+    "@backstage/backend-defaults": "^0.12.0",


    "@backstage-community/plugin-report-portal-backend": "workspace:^",
    "@backstage-community/plugin-search-backend-module-report-portal": "workspace:^",
-    "@backstage/backend-defaults": "^0.11.1",
+    "@backstage/backend-defaults": "^0.12.0",


  },
  "devDependencies": {
-    "@backstage/backend-defaults": "^0.7.0",
+    "@backstage/backend-defaults": "^0.12.0",


  },
  "dependencies": {
-    "@backstage/backend-defaults": "^0.11.1",
+    "@backstage/backend-defaults": "^0.12.0",


+'@backstage-community/plugin-report-portal-backend': patch
+---
+
+Updated dependency `@backstage/backend-defaults` to `^0.12.0`.


+'@backstage-community/plugin-growthbook-backend': patch
+---
+
+Updated dependency `@backstage/backend-defaults` to `^0.12.0`.


+'@backstage-community/plugin-feedback-backend': patch
+---
+
+Updated dependency `@backstage/backend-defaults` to `^0.12.0`.


Copilot

Pull request overview

Copilot reviewed 7 out of 10 changed files in this pull request and generated 8 comments.

  "dependencies": {
-    "@backstage/backend-defaults": "^0.11.1",
+    "@backstage/backend-defaults": "^0.12.0",
    "@backstage/backend-plugin-api": "^1.4.1",


  "devDependencies": {
-    "@backstage/backend-defaults": "^0.11.1",
+    "@backstage/backend-defaults": "^0.12.0",
    "@backstage/backend-test-utils": "^1.7.0",


    "@backstage-community/plugin-report-portal-backend": "workspace:^",
    "@backstage-community/plugin-search-backend-module-report-portal": "workspace:^",
-    "@backstage/backend-defaults": "^0.11.1",
+    "@backstage/backend-defaults": "^0.12.0",
    "@backstage/config": "^1.3.3",


  "devDependencies": {
-    "@backstage/backend-defaults": "^0.7.0",
+    "@backstage/backend-defaults": "^0.12.0",
    "@backstage/backend-test-utils": "^1.10.4",


  "dependencies": {
-    "@backstage/backend-defaults": "^0.11.1",
+    "@backstage/backend-defaults": "^0.12.0",
    "@backstage/backend-dynamic-feature-service": "^0.7.2",


+'@backstage-community/plugin-report-portal-backend': patch
+---
+
+Updated dependency `@backstage/backend-defaults` to `^0.12.0`.


+'@backstage-community/plugin-growthbook-backend': patch
+---
+
+Updated dependency `@backstage/backend-defaults` to `^0.12.0`.


+'@backstage-community/plugin-feedback-backend': patch
+---
+
+Updated dependency `@backstage/backend-defaults` to `^0.12.0`.


…security] Signed-off-by: Renovate Bot <bot@renovateapp.com>

Copilot

Pull request overview

Copilot reviewed 7 out of 10 changed files in this pull request and generated 8 comments.

  "dependencies": {
-    "@backstage/backend-defaults": "^0.11.1",
+    "@backstage/backend-defaults": "^0.12.0",
    "@backstage/backend-plugin-api": "^1.4.1",


  "devDependencies": {
-    "@backstage/backend-defaults": "^0.11.1",
+    "@backstage/backend-defaults": "^0.12.0",
    "@backstage/backend-test-utils": "^1.7.0",


    "@backstage-community/plugin-report-portal-backend": "workspace:^",
    "@backstage-community/plugin-search-backend-module-report-portal": "workspace:^",
-    "@backstage/backend-defaults": "^0.11.1",
+    "@backstage/backend-defaults": "^0.12.0",
    "@backstage/config": "^1.3.3",


  "dependencies": {
-    "@backstage/backend-defaults": "^0.11.1",
+    "@backstage/backend-defaults": "^0.12.0",
    "@backstage/backend-dynamic-feature-service": "^0.7.2",
    "@backstage/backend-plugin-api": "^1.4.1",


  "devDependencies": {
-    "@backstage/backend-defaults": "^0.7.0",
+    "@backstage/backend-defaults": "^0.12.0",
    "@backstage/backend-test-utils": "^1.10.4",
    "@backstage/cli": "^0.35.3",


+'@backstage-community/plugin-report-portal-backend': patch
+---
+
+Updated dependency `@backstage/backend-defaults` to `^0.12.0`.


+'@backstage-community/plugin-growthbook-backend': patch
+---
+
+Updated dependency `@backstage/backend-defaults` to `^0.12.0`.


+'@backstage-community/plugin-feedback-backend': patch
+---
+
+Updated dependency `@backstage/backend-defaults` to `^0.12.0`.


Copilot AI review requested due to automatic review settings July 3, 2026 18:34

backstage-goalie Bot added dependencies Pull requests that update a dependency file security labels Jul 3, 2026

backstage-goalie Bot requested review from a team, deshmukhmayur, riginoommen, yashoswalyo and zaki-hanafiah as code owners July 3, 2026 18:34

backstage-goalie Bot added the dependencies Pull requests that update a dependency file label Jul 3, 2026

backstage-goalie Bot requested a review from Parsifal-M July 3, 2026 18:34

backstage-goalie Bot added the security label Jul 3, 2026

Copilot AI reviewed Jul 3, 2026

backstage-service added workspace/report-portal workspace/feedback workspace/growthbook-flags labels Jul 3, 2026

backstage-service force-pushed the renovate/npm-backstage-backend-defaults-vulnerability branch from 1302673 to 0e3782f Compare July 3, 2026 18:35

backstage-goalie Bot changed the title ~~fix(deps): update dependency @backstage/backend-defaults to ^0.12.0 [security]~~ fix(deps): update dependency @backstage/backend-defaults to ^0.12.0 [security] - autoclosed Jul 5, 2026

backstage-goalie Bot closed this Jul 5, 2026

backstage-goalie Bot deleted the renovate/npm-backstage-backend-defaults-vulnerability branch July 5, 2026 00:37

backstage-goalie Bot changed the title ~~fix(deps): update dependency @backstage/backend-defaults to ^0.12.0 [security] - autoclosed~~ fix(deps): update dependency @backstage/backend-defaults to ^0.12.0 [security] Jul 6, 2026

backstage-goalie Bot reopened this Jul 6, 2026

backstage-goalie Bot force-pushed the renovate/npm-backstage-backend-defaults-vulnerability branch 2 times, most recently from 0e3782f to 211fcbf Compare July 6, 2026 11:38

Copilot AI review requested due to automatic review settings July 6, 2026 11:38

Copilot AI reviewed Jul 6, 2026

backstage-service force-pushed the renovate/npm-backstage-backend-defaults-vulnerability branch 2 times, most recently from 4eea895 to dfbcaa8 Compare July 6, 2026 11:39

backstage-goalie Bot force-pushed the renovate/npm-backstage-backend-defaults-vulnerability branch from dfbcaa8 to b83a619 Compare July 6, 2026 13:21

Copilot AI review requested due to automatic review settings July 6, 2026 13:21

Copilot started reviewing on behalf of backstage-service July 6, 2026 15:29 View session

Copilot AI reviewed Jul 6, 2026

View reviewed changes

backstage-goalie Bot force-pushed the renovate/npm-backstage-backend-defaults-vulnerability branch from c20adce to 0760b34 Compare July 6, 2026 17:08

Copilot AI review requested due to automatic review settings July 6, 2026 17:08

backstage-service force-pushed the renovate/npm-backstage-backend-defaults-vulnerability branch from 0760b34 to 009f1fe Compare July 6, 2026 17:08

Copilot started reviewing on behalf of backstage-service July 6, 2026 17:09 View session

Copilot AI reviewed Jul 6, 2026

View reviewed changes

backstage-goalie Bot force-pushed the renovate/npm-backstage-backend-defaults-vulnerability branch from 009f1fe to 366777b Compare July 7, 2026 09:12

Copilot AI review requested due to automatic review settings July 7, 2026 09:12

backstage-service force-pushed the renovate/npm-backstage-backend-defaults-vulnerability branch from 366777b to 71de3ee Compare July 7, 2026 09:12

Copilot started reviewing on behalf of backstage-service July 7, 2026 09:13 View session

Copilot AI reviewed Jul 7, 2026

View reviewed changes

backstage-goalie Bot force-pushed the renovate/npm-backstage-backend-defaults-vulnerability branch from 71de3ee to a93e5c8 Compare July 7, 2026 15:14

Copilot AI review requested due to automatic review settings July 7, 2026 15:41

backstage-service force-pushed the renovate/npm-backstage-backend-defaults-vulnerability branch from a93e5c8 to f141383 Compare July 7, 2026 15:41

Copilot started reviewing on behalf of backstage-service July 7, 2026 15:50 View session

Copilot AI reviewed Jul 7, 2026

View reviewed changes

backstage-goalie Bot force-pushed the renovate/npm-backstage-backend-defaults-vulnerability branch from f141383 to 84acb62 Compare July 7, 2026 17:05

Copilot AI review requested due to automatic review settings July 7, 2026 17:14

backstage-service force-pushed the renovate/npm-backstage-backend-defaults-vulnerability branch from 84acb62 to 527a1e6 Compare July 7, 2026 17:14

Copilot started reviewing on behalf of backstage-service July 7, 2026 17:18 View session

Copilot AI reviewed Jul 7, 2026

View reviewed changes

backstage-goalie Bot force-pushed the renovate/npm-backstage-backend-defaults-vulnerability branch from 527a1e6 to d41a2b5 Compare July 7, 2026 20:42

fix(deps): update dependency @backstage/backend-defaults to ^0.12.0 […

9d75fc5

…security] Signed-off-by: Renovate Bot <bot@renovateapp.com>

Copilot AI review requested due to automatic review settings July 7, 2026 20:43

backstage-service force-pushed the renovate/npm-backstage-backend-defaults-vulnerability branch from d41a2b5 to 9d75fc5 Compare July 7, 2026 20:43

Copilot started reviewing on behalf of backstage-service July 7, 2026 20:43 View session

Copilot AI reviewed Jul 7, 2026

View reviewed changes

backstage-goalie Bot changed the title ~~fix(deps): update dependency @backstage/backend-defaults to ^0.12.0 [security]~~ fix(deps): update dependency @backstage/backend-defaults to ^0.12.0 [security] - autoclosed Jul 8, 2026

backstage-goalie Bot closed this Jul 8, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(deps): update dependency @backstage/backend-defaults to ^0.12.0 [security] - autoclosed#9749

fix(deps): update dependency @backstage/backend-defaults to ^0.12.0 [security] - autoclosed#9749
backstage-goalie[bot] wants to merge 1 commit into
mainfrom
renovate/npm-backstage-backend-defaults-vulnerability

backstage-goalie Bot commented Jul 3, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

backstage-goalie Bot commented Jul 3, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

backstage-goalie Bot commented Jul 3, 2026

Backstage has a Possible SSRF when reading from allowed URL's in backend.reading.allow

Details

Impact

Patches

Workarounds

References

Severity

References

Backstage has a Possible Symlink Path Traversal in Scaffolder Actions

Details

Impact

Patches

Workarounds

References

Severity

References

Release Notes

v0.12.2

v0.12.1

Patch Changes

v0.12.0

Minor Changes

Patch Changes

Configuration

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

backstage-goalie Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changed Packages

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Backstage has a Possible SSRF when reading from allowed URL's in `backend.reading.allow`

`v0.12.2`

`v0.12.1`

`v0.12.0`

backstage-goalie Bot commented Jul 3, 2026 •

edited

Loading