Skip to content

[Snyk] Security upgrade @backstage/errors from 0.0.0-use.local to 0.1.1 #10364

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
q1blue wants to merge 1 commit into
base: master
Choose a base branch
from
+1 −1
Open

[Snyk] Security upgrade @backstage/errors from 0.0.0-use.local to 0.1.1 #10364

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion packages/backend-openapi-utils/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@
"dist"
],
"dependencies": {
"@backstage/errors": "workspace:^",
"@backstage/errors": "0.1.1",
Copy link

@gemini-code-assist gemini-code-assist bot Jan 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

This change replaces the workspace reference workspace:^ with a pinned, outdated version 0.1.1. This is problematic in a monorepo for several reasons:

  1. Breaks Monorepo Integrity: It forces this package to use a published, old version of @backstage/errors instead of the current version within this repository, defeating the purpose of a monorepo.
  2. Introduces Version Skew: The current version of @backstage/errors in this repository is 1.2.1. Pinning to 0.1.1 will cause this package to use a significantly older version, which could lead to bugs, inconsistencies, and missing security fixes.

The correct way to fix the underlying security vulnerability is to keep the workspace:^ reference and update the yarn.lock file at the root of the repository. This will ensure the transitive dependency is updated to a secure version while maintaining the integrity of the monorepo's internal dependencies.

Suggested change
"@backstage/errors": "0.1.1",
"@backstage/errors": "workspace:^",

"@types/express": "^4.17.6",
"@types/express-serve-static-core": "^4.17.5",
"express": "^4.17.1",
Expand Down
Loading