Bump the npm_and_yarn group across 1 directory with 4 updates by dependabot[bot] · Pull Request #102 · codeuniversity/code-idp

dependabot · 2026-03-17T23:36:50Z

Bumps the npm_and_yarn group with 4 updates in the /packages/backend directory: @backstage/backend-defaults, @backstage/plugin-auth-backend, @backstage/plugin-permission-backend and @backstage/plugin-scaffolder-backend.

Updates @backstage/backend-defaults from 0.5.3 to 0.16.0

Changelog

Sourced from @backstage/backend-defaults's changelog.

0.16.0

Minor Changes

42960f1: The actions registry invoke endpoint now accepts direct user credentials in addition to service principals, enabling CLI and other direct user clients to invoke actions.

0e7d8f9: The scheduler service now uses the metrics service to create metrics, providing plugin-scoped attribution.

527cf88: BREAKING Removed deprecated BitbucketUrlReader. Use the BitbucketCloudUrlReader or the BitbucketServerUrlReader instead.

Patch Changes

cc8348e: Added permissions integration to the actions registry. Actions registered with a visibilityPermission field are now checked against the permissions framework when listing and invoking. Denied actions are filtered from list results, and invoking a denied action returns a 404 Not Found as if the action does not exist. Permissions are automatically registered with the PermissionsRegistryService so they appear in the permission policy system.

dee4283: Added pluginId field to ActionsServiceAction type, populated from the registering plugin's metadata.

015668c: Added cancelTask method to the SchedulerService interface and implementation, allowing cancellation of currently running scheduled tasks. For global tasks, the database lock is released and a periodic liveness check aborts the running task function. For local tasks, the task's abort signal is triggered directly. A new POST /.backstage/scheduler/v1/tasks/:id/cancel endpoint is also available.

638e6c7: chore(deps): bump yauzl from 3.2.0 to 3.2.1

6738cf0: build(deps): bump minimatch from 9.0.5 to 10.2.1

62f0a53: Fixed error forwarding in the actions registry so that known errors like InputError and NotFoundError thrown by actions preserve their original status codes and messages instead of being wrapped in ForwardedError and coerced to 500.

d933f62: Add configurable throttling and retry mechanism for GitLab integration.

b99158a: Fixed yarn backstage-cli config:check --strict --config app-config.yaml config validation error by adding an optional default type discriminator to PostgreSQL connection configuration, allowing config:check to properly validate default connection configurations.

1ee5b28: Adds an alpha MetricsService to provide a unified interface for metrics instrumentation across Backstage plugins.

5fcbef2: Updated dependency express-rate-limit to ^8.0.0.

a49a40d: Updated dependency zod to ^3.25.76 || ^4.0.0 & migrated to /v3 or /v4 imports.

Updated dependencies

@backstage/backend-plugin-api@1.8.0

@backstage/cli-node@0.3.0

@backstage/integration@2.0.0

@backstage/config-loader@1.10.9

@backstage/plugin-permission-common@0.9.7

@backstage/plugin-permission-node@0.10.11

@backstage/plugin-auth-node@0.6.14

@backstage/backend-app-api@1.6.0

@backstage/plugin-events-node@0.4.20

0.16.0-next.2

Patch Changes

015668c: Added cancelTask method to the SchedulerService interface and implementation, allowing cancellation of currently running scheduled tasks. For global tasks, the database lock is released and a periodic liveness check aborts the running task function. For local tasks, the task's abort signal is triggered directly. A new POST /.backstage/scheduler/v1/tasks/:id/cancel endpoint is also available.

5fcbef2: Updated dependency express-rate-limit to ^8.0.0.

Updated dependencies

@backstage/backend-plugin-api@1.8.0-next.1

@backstage/integration@2.0.0-next.2

@backstage/backend-app-api@1.6.0-next.1

@backstage/plugin-auth-node@0.6.14-next.2

@backstage/plugin-events-node@0.4.20-next.1

@backstage/plugin-permission-node@0.10.11-next.1

0.16.0-next.1

... (truncated)

Commits

See full diff in compare view

Updates @backstage/plugin-auth-backend from 0.24.5 to 0.27.2

Changelog

Sourced from @backstage/plugin-auth-backend's changelog.

0.27.2

Patch Changes

1ccad86: Added who-am-i action to the auth backend actions registry. Returns the catalog entity and user info for the currently authenticated user.

d0f4cd2: Added optional client metadata document endpoint at /.well-known/oauth-client/cli.json relative to the auth backend base URL for CLI authentication. Enabled when auth.experimentalClientIdMetadataDocuments.enabled is set to true.

6738cf0: build(deps): bump minimatch from 9.0.5 to 10.2.1

e9b6e97: Fixed a security vulnerability where the CIMD metadata fetch could follow HTTP redirects to internal hosts, bypassing SSRF protections.

0f9d673: Improved redirect URI validation in the experimental OIDC provider to match against normalized URLs rather than raw strings.

a49a40d: Updated dependency zod to ^3.25.76 || ^4.0.0 & migrated to /v3 or /v4 imports.

634eded: Fixed a foreign key constraint violation when issuing refresh tokens for CIMD clients, and prevented a failed refresh token issuance from failing the entire token exchange. Fixed AWS ALB auth provider incorrectly returning HTTP 500 instead of 401 for JWT validation failures, which caused retry loops and memory pressure under load.

619be54: Update migrations to be reversible

Updated dependencies

@backstage/backend-plugin-api@1.8.0

@backstage/plugin-catalog-node@2.1.0

@backstage/catalog-model@1.7.7

@backstage/plugin-auth-node@0.6.14

0.27.1-next.2

Patch Changes

d0f4cd2: Added optional client metadata document endpoint at /.well-known/oauth-client/cli.json relative to the auth backend base URL for CLI authentication. Enabled when auth.experimentalClientIdMetadataDocuments.enabled is set to true.

Updated dependencies

@backstage/backend-plugin-api@1.8.0-next.1

@backstage/plugin-auth-node@0.6.14-next.2

@backstage/plugin-catalog-node@2.1.0-next.2

0.27.1-next.1

Patch Changes

1ccad86: Added who-am-i action to the auth backend actions registry. Returns the catalog entity and user info for the currently authenticated user.

Updated dependencies

@backstage/plugin-auth-node@0.6.14-next.1

@backstage/plugin-catalog-node@2.1.0-next.1

@backstage/backend-plugin-api@1.7.1-next.0

@backstage/catalog-model@1.7.6

@backstage/config@1.3.6

@backstage/errors@1.2.7

@backstage/types@1.2.2

0.27.1-next.0

Patch Changes

6738cf0: build(deps): bump minimatch from 9.0.5 to 10.2.1

... (truncated)

Commits

See full diff in compare view

Updates @backstage/plugin-permission-backend from 0.5.55 to 0.7.9

Changelog

Sourced from @backstage/plugin-permission-backend's changelog.

0.7.9

Patch Changes

7455dae: Use node prefix on native imports

69d880e: Bump to latest zod to ensure it has the latest features

Updated dependencies

@backstage/backend-plugin-api@1.7.0

@backstage/plugin-auth-node@0.6.13

@backstage/plugin-permission-common@0.9.6

@backstage/plugin-permission-node@0.10.10

0.7.8-next.0

Patch Changes

7455dae: Use node prefix on native imports

69d880e: Bump to latest zod to ensure it has the latest features

Updated dependencies

@backstage/backend-plugin-api@1.7.0-next.0

@backstage/plugin-auth-node@0.6.12-next.0

@backstage/plugin-permission-common@0.9.5-next.0

@backstage/plugin-permission-node@0.10.9-next.0

@backstage/config@1.3.6

@backstage/errors@1.2.7

0.7.7

Patch Changes

de96a60: chore(deps): bump express from 4.21.2 to 4.22.0

Updated dependencies

@backstage/plugin-auth-node@0.6.10

@backstage/plugin-permission-node@0.10.7

@backstage/backend-plugin-api@1.6.0

0.7.7-next.1

Patch Changes

de96a60: chore(deps): bump express from 4.21.2 to 4.22.0

Updated dependencies

@backstage/plugin-auth-node@0.6.10-next.1

@backstage/plugin-permission-node@0.10.7-next.1

@backstage/backend-plugin-api@1.6.0-next.1

@backstage/config@1.3.6

@backstage/errors@1.2.7

@backstage/plugin-permission-common@0.9.3

0.7.7-next.0

... (truncated)

Commits

See full diff in compare view

Updates @backstage/plugin-scaffolder-backend from 1.33.0 to 3.1.5

Release notes

Sourced from @backstage/plugin-scaffolder-backend's releases.

v1.49.0-next.2

See docs/releases/v1.49.0-next.2-changelog.md for more information.

v1.49.0-next.1

See docs/releases/v1.49.0-next.1-changelog.md for more information.

v1.49.0-next.0

See docs/releases/v1.49.0-next.0-changelog.md for more information.

v1.48.5

This release contains security fixes for @backstage/plugin-auth-backend and @backstage/plugin-scaffolder-backend

v1.48.4

This release contains security fixes for @backstage/plugin-techdocs-node @backstage/integration and @backstage/plugin-scaffolder-backend

v1.48.3

This patch release fixes the following issues:

Fixes the @mui/material/styles shared dependency key by removing a trailing slash that caused module resolution failures with MUI package exports.

Fixes entity page tab groups not respecting the ordering from the groups configuration.

v1.48.2

This patch release includes the following fixes:

Updated @microsoft/api-extractor to 7.57.3 (#32950)

Add back formFieldsApiRef and ScaffolderFormFieldsApi alpha exports from @backstage/plugin-scaffolder (#32969)

Perform search on first navigate (#32973)

v1.48.1

This patch release fixes the following issues:

Add missing sharing extensions sidebar item in frontend system architecture docs

Fix type compatibility for older plugins in FrontendFeature type

v1.48.0

These are the release notes for the v1.48.0 release of Backstage.

A huge thanks to the whole team of maintainers and contributors as well as the amazing Backstage Community for the hard work in getting this release developed and done.

Highlights

BREAKING ALPHA: Catalog extension points graduated

If you are providing custom processors and entity providers into the catalog, you will now note that several (but not quite all!) of those extension points have graduated out of alpha and into the regular stable exports.

Thus, if you are importing for example catalogProcessingExtensionPoint from @backstage/plugin-catalog-node/alpha, you now want to remove that /alpha suffix.

BREAKING: API restrictions in New Frontend System

In the 1.47 release a new behavior was introduced to the New Frontend System that limits the ability for plugins and modules to provide APIs to plugins other than themselves. For example, the scaffolder plugin could no longer install a custom CatalogApi implementation. This also applies to modules, where you now need to use a module explicitly targeting the 'app' plugin to for example override the ErrorApi.

... (truncated)

Changelog

Sourced from @backstage/plugin-scaffolder-backend's changelog.

@backstage/plugin-scaffolder-backend

3.2.0

Minor Changes

c9b11eb: Added a new list-scaffolder-tasks action that allows querying scaffolder tasks with optional ownership filtering and pagination support

1b42218: Adds a new get-scaffolder-task-logs action to @backstage/plugin-scaffolder-backend that retrieves log events for a given scaffolder task, with optional support for retrieving only new events after a given event ID.

0fbcf23: Migrated OpenAPI schemas to 3.1.

7695dd2: Added a new list-scaffolder-actions action that returns all installed scaffolder actions with their schemas and examples

e8736ea: Added secrets schema validation for task creation, retry, and dry-run endpoints. When a template defines spec.secrets.schema, the API validates provided secrets against the schema and returns a 400 error if validation fails.

Patch Changes

e27bd4e: Removed @backstage/plugin-scaffolder-backend-module-bitbucket from package.json as the package itself has been deprecated and the code deleted.

4f5ed06: Fixed a security vulnerability where server-configured environment secrets were exposed through the scaffolder dry-run endpoint.

30ff981: Fixed a security vulnerability where secrets could bypass log redaction when transformed through Nunjucks filters in scaffolder templates.

4e39e63: Removed unused dependencies

a49a40d: Updated dependency zod to ^3.25.76 || ^4.0.0 & migrated to /v3 or /v4 imports.

ccc20cf: create scaffolder MCP action to dry run a provided scaffolder template

Updated dependencies

@backstage/backend-plugin-api@1.8.0

@backstage/plugin-scaffolder-node@0.13.0

@backstage/integration@2.0.0

@backstage/plugin-catalog-node@2.1.0

@backstage/plugin-scaffolder-common@2.0.0

@backstage/plugin-permission-common@0.9.7

@backstage/plugin-permission-node@0.10.11

@backstage/catalog-model@1.7.7

@backstage/backend-openapi-utils@0.6.7

@backstage/plugin-events-node@0.4.20

3.2.0-next.2

Minor Changes

e8736ea: Added secrets schema validation for task creation, retry, and dry-run endpoints. When a template defines spec.secrets.schema, the API validates provided secrets against the schema and returns a 400 error if validation fails.

Patch Changes

30ff981: Fixed a security vulnerability where secrets could bypass log redaction when transformed through Nunjucks filters in scaffolder templates.

Updated dependencies

@backstage/backend-plugin-api@1.8.0-next.1

@backstage/integration@2.0.0-next.2

@backstage/plugin-scaffolder-common@2.0.0-next.2

@backstage/backend-openapi-utils@0.6.7-next.1

@backstage/plugin-catalog-node@2.1.0-next.2

@backstage/plugin-events-node@0.4.20-next.1

@backstage/plugin-permission-node@0.10.11-next.1

@backstage/plugin-scaffolder-node@0.13.0-next.2

... (truncated)

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 4 updates in the /packages/backend directory: [@backstage/backend-defaults](https://github.com/backstage/backstage/tree/HEAD/packages/backend-defaults), [@backstage/plugin-auth-backend](https://github.com/backstage/backstage/tree/HEAD/plugins/auth-backend), [@backstage/plugin-permission-backend](https://github.com/backstage/backstage/tree/HEAD/plugins/permission-backend) and [@backstage/plugin-scaffolder-backend](https://github.com/backstage/backstage/tree/HEAD/plugins/scaffolder-backend). Updates `@backstage/backend-defaults` from 0.5.3 to 0.16.0 - [Release notes](https://github.com/backstage/backstage/releases) - [Changelog](https://github.com/backstage/backstage/blob/master/packages/backend-defaults/CHANGELOG.md) - [Commits](https://github.com/backstage/backstage/commits/v0.16.0/packages/backend-defaults) Updates `@backstage/plugin-auth-backend` from 0.24.5 to 0.27.2 - [Release notes](https://github.com/backstage/backstage/releases) - [Changelog](https://github.com/backstage/backstage/blob/master/plugins/auth-backend/CHANGELOG.md) - [Commits](https://github.com/backstage/backstage/commits/HEAD/plugins/auth-backend) Updates `@backstage/plugin-permission-backend` from 0.5.55 to 0.7.9 - [Release notes](https://github.com/backstage/backstage/releases) - [Changelog](https://github.com/backstage/backstage/blob/master/plugins/permission-backend/CHANGELOG.md) - [Commits](https://github.com/backstage/backstage/commits/HEAD/plugins/permission-backend) Updates `@backstage/plugin-scaffolder-backend` from 1.33.0 to 3.1.5 - [Release notes](https://github.com/backstage/backstage/releases) - [Changelog](https://github.com/backstage/backstage/blob/master/plugins/scaffolder-backend/CHANGELOG.md) - [Commits](https://github.com/backstage/backstage/commits/HEAD/plugins/scaffolder-backend) --- updated-dependencies: - dependency-name: "@backstage/backend-defaults" dependency-version: 0.16.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@backstage/plugin-auth-backend" dependency-version: 0.27.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@backstage/plugin-permission-backend" dependency-version: 0.7.9 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@backstage/plugin-scaffolder-backend" dependency-version: 3.1.5 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 17, 2026

dependabot bot mentioned this pull request Mar 17, 2026

Bump the npm_and_yarn group across 1 directory with 4 updates #101

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the npm_and_yarn group across 1 directory with 4 updates#102

Bump the npm_and_yarn group across 1 directory with 4 updates#102
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/packages/backend/npm_and_yarn-a8a0a83f91

dependabot bot commented on behalf of github Mar 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Mar 17, 2026

0.16.0

Minor Changes

Patch Changes

0.16.0-next.2

Patch Changes

0.16.0-next.1

0.27.2

Patch Changes

0.27.1-next.2

Patch Changes

0.27.1-next.1

Patch Changes

0.27.1-next.0

Patch Changes

0.7.9

Patch Changes

0.7.8-next.0

Patch Changes

0.7.7

Patch Changes

0.7.7-next.1

Patch Changes

0.7.7-next.0

v1.49.0-next.2

v1.49.0-next.1

v1.49.0-next.0

v1.48.5

v1.48.4

v1.48.3

v1.48.2

v1.48.1

v1.48.0

Highlights

BREAKING ALPHA: Catalog extension points graduated

BREAKING: API restrictions in New Frontend System

@​backstage/plugin-scaffolder-backend

3.2.0

Minor Changes

Patch Changes

3.2.0-next.2

Minor Changes

Patch Changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`@backstage/plugin-scaffolder-backend`