Update dependency @backstage/plugin-catalog-backend-module-unprocessed to v0.6.11 - abandoned#51
Open
mend-on-mend[bot] wants to merge 1 commit into
Conversation
…d to v0.6.11 Signed-off-by: mend-on-mend[bot] <mend-on-mend[bot]@users.noreply.github.com>
Author
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
mend-on-mend
Bot
changed the title
Author
Autoclosing SkippedThis PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
0.6.1→0.6.11Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks
CVE-2026-44374 / GHSA-p7g9-rp3g-mgfg
More information
Details
Impact
The unprocessed entities read endpoints in
@backstage/plugin-catalog-backend-module-unprocesseddo not enforce permission authorization checks. Any authenticated user can access unprocessed entity records regardless of ownership. This isan information disclosure vulnerability affecting Backstage installations using this module.
Patches
This is patched in
@backstage/plugin-catalog-backend-module-unprocessedversion 0.6.11,@backstage/plugin-catalog-unprocessed-entities-commonversion 0.0.15 and@backstage/plugin-catalog-unprocessed-entitiesversion 0.2.30. Users should upgrade all packages.Workarounds
If users cannot upgrade, they can remove the
@backstage/plugin-catalog-backend-module-unprocessedmodule from their backend until the patch is applied. There is no configuration-based workaround to add permission checks to these endpointswithout upgrading.
Severity
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
backstage/backstage (@backstage/plugin-catalog-backend-module-unprocessed)
v0.6.11Compare Source
Patch Changes
v0.6.10Compare Source
Patch Changes
v0.6.9Compare Source
Patch Changes
v0.6.8Compare Source
Patch Changes
v0.6.7Compare Source
Patch Changes
v0.6.6Compare Source
Patch Changes
05f60e1: Refactored constructor parameter properties to explicit property declarations for compatibility with TypeScript'serasableSyntaxOnlysetting. This internal refactoring maintains all existing functionality while ensuring TypeScript compilation compatibility.v0.6.5Compare Source
Patch Changes
v0.6.4Compare Source
Patch Changes
v0.6.3Compare Source
Patch Changes
v0.6.2Compare Source
Patch Changes
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.