chore(deps): update dependency @backstage/plugin-app-backend to v0.3.75 [security] by renovate[bot] · Pull Request #294 · Oriflame/backstage-plugins

renovate · 2024-10-03T17:43:20Z

This PR contains the following updates:

Package	Change	Age	Confidence
@backstage/plugin-app-backend (source)	`0.3.57` → `0.3.75`

Unexpected visibility of environment variable configurations in @backstage/plugin-app-backend

CVE-2024-47762 / GHSA-qc4v-xq2m-65wc

More information

Details

Impact

Configuration supplied through APP_CONFIG_* environment variables, for example APP_CONFIG_backend_listen_port=7007, where unexpectedly ignoring the visibility defined in configuration schema. This occurred even if the configuration schema specified that they should have backend or secret visibility. This was an intended feature of the APP_CONFIG_* way of supplying configuration, but now clearly goes against the expected behavior of the configuration system. This behavior leads to a risk of potentially exposing sensitive configuration details intended to remain private or restricted to backend processes.

Patches

The issue has been resolved in version 0.3.75 of the @backstage/plugin-app-backend package. Users are encouraged to upgrade to this version to mitigate the vulnerability.

Workarounds

As a temporary measure, avoid supplying secrets using the APP_CONFIG_ configuration pattern. Consider alternative methods for setting secrets, such as the environment substitution available for Backstage configuration.

References

If you have any questions or comments about this advisory:

Open an issue in the Backstage repository
Visit our Discord, linked to in Backstage README

Severity

CVSS Score: 6.9 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

backstage/backstage (@backstage/plugin-app-backend)

Patch Changes

72a8c7b: Return HTTP status 400 rather than 500 when receiving an unknown POST request.
d3f79d1: Fixing dependency metadata with the new @backstage/plugin-app package
590fb2d: BREAKING: The app backend now supports the new index.html.tmpl output from @backstage/cli. If available, the index.html will be templated at runtime with the current configuration of the app backend.

This is marked as a breaking change because you must now supply the app build-time configuration to the backend. This change also affects the public path behavior, where it is no longer necessary to build the app with the correct public path upfront. You now only need to supply a correct app.baseUrl to the app backend plugin at runtime.

An effect that this change has is that the index.html will now contain and present the frontend configuration in an easily readable way, which can aid in debugging. This data was always available in the frontend, but it was injected and hidden in the static bundle.

This templating behavior is enabled by default, but it can be disabled by setting the app.disableConfigInjection configuration option to true.
d425fc4: Modules, plugins, and services are now BackendFeature, not a function that returns a feature.
c2b63ab: Updated dependency supertest to ^7.0.0.
Updated dependencies
- @backstage/backend-common@0.25.0
- @backstage/backend-plugin-api@1.0.0
- @backstage/plugin-auth-node@0.5.2
- @backstage/plugin-app-node@0.1.25
- @backstage/config-loader@1.9.1
- @backstage/config@1.2.0
- @backstage/errors@1.2.4
- @backstage/types@1.1.1

`v0.3.73`

Compare Source

`v0.3.72`

Compare Source

Patch Changes

93095ee: Make sure node-fetch is version 2.7.0 or greater
6bd6fda: Deprecate createRouter and its options in favour of the new backend system.
Updated dependencies
- @backstage/backend-plugin-api@0.8.0
- @backstage/backend-common@0.24.0
- @backstage/config-loader@1.9.0
- @backstage/plugin-auth-node@0.5.0
- @backstage/config@1.2.0
- @backstage/errors@1.2.4
- @backstage/types@1.1.1
- @backstage/plugin-app-node@0.1.23

`v0.3.71`

Compare Source

Patch Changes

Updated dependencies
- @backstage/backend-plugin-api@0.7.0
- @backstage/backend-common@0.23.3
- @backstage/plugin-auth-node@0.4.17
- @backstage/plugin-app-node@0.1.22
- @backstage/config-loader@1.8.1
- @backstage/config@1.2.0
- @backstage/errors@1.2.4
- @backstage/types@1.1.1

`v0.3.70`

Compare Source

Patch Changes

Updated dependencies
- @backstage/backend-plugin-api@0.6.21-next.0
- @backstage/backend-common@0.23.2-next.0
- @backstage/plugin-app-node@0.1.21-next.0
- @backstage/plugin-auth-node@0.4.16-next.0
- @backstage/config@1.2.0
- @backstage/config-loader@1.8.1
- @backstage/errors@1.2.4
- @backstage/types@1.1.1

`v0.3.69`

Compare Source

`v0.3.68`

Compare Source

Patch Changes

8869b8e: Updated local development setup.
78a0b08: Internal refactor to handle BackendFeature contract change.
82c2b90: Restore the support of external config schema in the router of the app-backend plugin, which was broken in release 1.26.0.
This support is critical for dynamic frontend plugins to have access to their config values.
d44a20a: Added additional plugin metadata to package.json.
Updated dependencies
- @backstage/backend-common@0.23.0
- @backstage/backend-plugin-api@0.6.19
- @backstage/plugin-auth-node@0.4.14
- @backstage/plugin-app-node@0.1.19
- @backstage/config-loader@1.8.1
- @backstage/config@1.2.0
- @backstage/errors@1.2.4
- @backstage/types@1.1.1

`v0.3.67`

Compare Source

`v0.3.66`

Compare Source

Patch Changes

d229dc4: Move path utilities from backend-common to the backend-plugin-api package.
Updated dependencies
- @backstage/backend-common@0.22.0
- @backstage/backend-plugin-api@0.6.18
- @backstage/plugin-auth-node@0.4.13
- @backstage/plugin-app-node@0.1.18

`v0.3.65`

Compare Source

Patch Changes

d5a1fe1: Replaced winston logger with LoggerService
c884b9a: Track assets namespace in the cache store, implement a cookie authentication for when the public entry is enabled and used with the new auth services.
Updated dependencies
- @backstage/backend-common@0.21.7
- @backstage/config-loader@1.8.0
- @backstage/backend-plugin-api@0.6.17
- @backstage/plugin-auth-node@0.4.12
- @backstage/plugin-app-node@0.1.17
- @backstage/config@1.2.0
- @backstage/errors@1.2.4
- @backstage/types@1.1.1

`v0.3.64`

Compare Source

Patch Changes

Updated dependencies
- @backstage/backend-common@0.21.6
- @backstage/backend-plugin-api@0.6.16
- @backstage/config@1.2.0
- @backstage/config-loader@1.7.0
- @backstage/types@1.1.1
- @backstage/plugin-app-node@0.1.16

`v0.3.63`

Compare Source

Patch Changes

Updated dependencies
- @backstage/backend-common@0.21.5
- @backstage/backend-plugin-api@0.6.15
- @backstage/config@1.2.0
- @backstage/config-loader@1.7.0
- @backstage/types@1.1.1
- @backstage/plugin-app-node@0.1.15

`v0.3.62`

Compare Source

Patch Changes

52e43f2: Disable default auth policy, allowing unauthenticated access to app bundle.
Updated dependencies
- @backstage/backend-common@0.21.4
- @backstage/config@1.2.0
- @backstage/backend-plugin-api@0.6.14
- @backstage/config-loader@1.7.0
- @backstage/types@1.1.1
- @backstage/plugin-app-node@0.1.14

`v0.3.61`

Compare Source

Patch Changes

Updated dependencies
- @backstage/backend-common@0.21.3-next.0
- @backstage/backend-plugin-api@0.6.13-next.0
- @backstage/config-loader@1.6.3-next.0
- @backstage/config@1.1.2-next.0
- @backstage/plugin-app-node@0.1.13-next.0
- @backstage/types@1.1.1

`v0.3.60`

Compare Source

`v0.3.59`

Compare Source

`v0.3.58`

Compare Source

Patch Changes

9aac2b0: Use --cwd as the first yarn argument
998ccf6: Support injecting config multiple times in a single bundle
6bb6f3e: Updated dependency fs-extra to ^11.2.0.
Updated dependency @types/fs-extra to ^11.0.0.
54ad8e1: Allow the app-backend plugin to use a global configuration schema provided externally through an extension.
9dfd57d: Do not force caching of the Javascript asset that contains the injected config.
Updated dependencies
- @backstage/backend-common@0.21.0
- @backstage/backend-plugin-api@0.6.10
- @backstage/config-loader@1.6.2
- @backstage/plugin-app-node@0.1.10
- @backstage/config@1.1.1
- @backstage/types@1.1.1

Configuration

📅 Schedule: (UTC)

Branch creation
- ""
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

…75 [security]

renovate Bot added dependencies packages labels Oct 3, 2024

renovate Bot force-pushed the renovate/npm-backstage-plugin-app-backend-vulnerability branch 2 times, most recently from 0d7c059 to a802392 Compare October 3, 2024 18:21

renovate Bot force-pushed the renovate/npm-backstage-plugin-app-backend-vulnerability branch 2 times, most recently from 7aa801a to cbdbb49 Compare January 30, 2025 19:37

renovate Bot force-pushed the renovate/npm-backstage-plugin-app-backend-vulnerability branch 3 times, most recently from 1074bd8 to fcc986d Compare February 10, 2025 16:57

renovate Bot force-pushed the renovate/npm-backstage-plugin-app-backend-vulnerability branch from fcc986d to c93c455 Compare March 3, 2025 16:37

renovate Bot force-pushed the renovate/npm-backstage-plugin-app-backend-vulnerability branch 2 times, most recently from 2dc9f0a to 4da0c8e Compare March 17, 2025 16:43

renovate Bot force-pushed the renovate/npm-backstage-plugin-app-backend-vulnerability branch from 4da0c8e to bf93d7d Compare April 1, 2025 11:58

renovate Bot force-pushed the renovate/npm-backstage-plugin-app-backend-vulnerability branch from bf93d7d to ccb24f4 Compare April 8, 2025 13:02

renovate Bot force-pushed the renovate/npm-backstage-plugin-app-backend-vulnerability branch from ccb24f4 to 99e9f4e Compare April 24, 2025 08:42

renovate Bot force-pushed the renovate/npm-backstage-plugin-app-backend-vulnerability branch from 99e9f4e to 94053d7 Compare May 19, 2025 21:12

renovate Bot force-pushed the renovate/npm-backstage-plugin-app-backend-vulnerability branch 2 times, most recently from d32f16f to 6f3c799 Compare June 4, 2025 09:58

renovate Bot force-pushed the renovate/npm-backstage-plugin-app-backend-vulnerability branch from 6f3c799 to 4177bd0 Compare June 22, 2025 14:53

renovate Bot force-pushed the renovate/npm-backstage-plugin-app-backend-vulnerability branch from 4177bd0 to be0f3ae Compare July 2, 2025 17:58

renovate Bot assigned jvilimek Jul 21, 2025

renovate Bot force-pushed the renovate/npm-backstage-plugin-app-backend-vulnerability branch from be0f3ae to d58ddcf Compare August 2, 2025 22:04

renovate Bot force-pushed the renovate/npm-backstage-plugin-app-backend-vulnerability branch from d58ddcf to 8d6e0ca Compare August 10, 2025 15:09

renovate Bot force-pushed the renovate/npm-backstage-plugin-app-backend-vulnerability branch from 8d6e0ca to 017b49f Compare August 19, 2025 19:12

renovate Bot force-pushed the renovate/npm-backstage-plugin-app-backend-vulnerability branch from 017b49f to 27cfe1c Compare August 31, 2025 13:36

renovate Bot force-pushed the renovate/npm-backstage-plugin-app-backend-vulnerability branch from 27cfe1c to fa9a052 Compare September 25, 2025 15:08

renovate Bot changed the title ~~fix(deps): update dependency @backstage/plugin-app-backend to v0.3.75 [security]~~ chore(deps): update dependency @backstage/plugin-app-backend to v0.3.75 [security] Sep 25, 2025

renovate Bot force-pushed the renovate/npm-backstage-plugin-app-backend-vulnerability branch from fa9a052 to 24e93de Compare October 21, 2025 11:10

renovate Bot force-pushed the renovate/npm-backstage-plugin-app-backend-vulnerability branch from 24e93de to c3f8617 Compare November 10, 2025 20:44

renovate Bot force-pushed the renovate/npm-backstage-plugin-app-backend-vulnerability branch from c3f8617 to 7515f1b Compare December 3, 2025 17:52

renovate Bot force-pushed the renovate/npm-backstage-plugin-app-backend-vulnerability branch from 7515f1b to 60b6d03 Compare December 31, 2025 17:27

renovate Bot force-pushed the renovate/npm-backstage-plugin-app-backend-vulnerability branch from 60b6d03 to 53b2ea7 Compare January 8, 2026 18:37

renovate Bot force-pushed the renovate/npm-backstage-plugin-app-backend-vulnerability branch from 53b2ea7 to 1d3a17d Compare January 19, 2026 16:27

renovate Bot force-pushed the renovate/npm-backstage-plugin-app-backend-vulnerability branch from 1d3a17d to 116ce83 Compare February 2, 2026 19:48

renovate Bot force-pushed the renovate/npm-backstage-plugin-app-backend-vulnerability branch 2 times, most recently from 5639041 to 92f2047 Compare February 17, 2026 19:15

renovate Bot force-pushed the renovate/npm-backstage-plugin-app-backend-vulnerability branch from 92f2047 to 4f005b2 Compare March 5, 2026 15:59

renovate Bot force-pushed the renovate/npm-backstage-plugin-app-backend-vulnerability branch from 4f005b2 to 68e5b4a Compare March 13, 2026 16:36

renovate Bot changed the title ~~chore(deps): update dependency @backstage/plugin-app-backend to v0.3.75 [security]~~ chore(deps): update dependency @backstage/plugin-app-backend to v0.3.75 [security] - autoclosed Mar 27, 2026

renovate Bot closed this Mar 27, 2026

renovate Bot deleted the renovate/npm-backstage-plugin-app-backend-vulnerability branch March 27, 2026 05:23

renovate Bot changed the title ~~chore(deps): update dependency @backstage/plugin-app-backend to v0.3.75 [security] - autoclosed~~ chore(deps): update dependency @backstage/plugin-app-backend to v0.3.75 [security] Mar 30, 2026

renovate Bot reopened this Mar 30, 2026

renovate Bot force-pushed the renovate/npm-backstage-plugin-app-backend-vulnerability branch 2 times, most recently from 55978bb to 5c5b0b0 Compare April 1, 2026 17:59

renovate Bot force-pushed the renovate/npm-backstage-plugin-app-backend-vulnerability branch from 5c5b0b0 to 175d9fe Compare April 8, 2026 14:40

renovate Bot force-pushed the renovate/npm-backstage-plugin-app-backend-vulnerability branch from 175d9fe to ef0d4b5 Compare April 29, 2026 10:05

renovate Bot force-pushed the renovate/npm-backstage-plugin-app-backend-vulnerability branch from ef0d4b5 to d0e18e2 Compare May 12, 2026 10:05

chore(deps): update dependency @backstage/plugin-app-backend to v0.3.…

044f9f0

…75 [security]

renovate Bot force-pushed the renovate/npm-backstage-plugin-app-backend-vulnerability branch from d0e18e2 to 044f9f0 Compare May 18, 2026 14:41

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update dependency @backstage/plugin-app-backend to v0.3.75 [security]#294

chore(deps): update dependency @backstage/plugin-app-backend to v0.3.75 [security]#294
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-backstage-plugin-app-backend-vulnerability

renovate Bot commented Oct 3, 2024 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented Oct 3, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Unexpected visibility of environment variable configurations in @​backstage/plugin-app-backend

Details

Impact

Patches

Workarounds

References

Severity

References

Release Notes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate Bot commented Oct 3, 2024 •

edited

Loading

Unexpected visibility of environment variable configurations in @backstage/plugin-app-backend