Skip to content

fix(deps): update dependency @backstage/plugin-scaffolder-backend to v3.1.5 [security]#4405

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/npm-backstage-plugin-scaffolder-backend-vulnerability
Open

fix(deps): update dependency @backstage/plugin-scaffolder-backend to v3.1.5 [security]#4405
renovate[bot] wants to merge 1 commit intomainfrom
renovate/npm-backstage-plugin-scaffolder-backend-vulnerability

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Mar 13, 2026

This PR contains the following updates:

Package Change Age Confidence
@backstage/plugin-scaffolder-backend (source) 3.1.3 → 3.1.5 age confidence

GitHub Vulnerability Alerts

CVE-2026-32237

Impact

Authenticated users with permission to execute scaffolder dry-runs can gain access to server-configured environment secrets through the dry-run API response. Secrets are properly
redacted in log output but not in all parts of the response payload.

Deployments that have configured scaffolder.defaultEnvironment.secrets are affected.

Patches

This is patched in @backstage/plugin-scaffolder-backend version 3.1.5

Workarounds

Remove or empty the scaffolder.defaultEnvironment.secrets configuration from app-config.yaml. Alternatively, restrict access to the scaffolder dry-run functionality via the
permissions framework.

References

Release Notes

backstage/backstage (@​backstage/plugin-scaffolder-backend)

v3.1.5

Compare Source

v3.1.4

Compare Source

Patch Changes

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested a review from a team March 13, 2026 07:05
@openshift-ci
Copy link

openshift-ci bot commented Mar 13, 2026

Hi @renovate[bot]. Thanks for your PR.

I'm waiting for a redhat-developer member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@github-actions
Copy link
Contributor

github-actions bot commented Mar 13, 2026

Image was built and published successfully. It is available at:

@renovate renovate bot force-pushed the renovate/npm-backstage-plugin-scaffolder-backend-vulnerability branch from bcfe435 to 159dd7d Compare March 13, 2026 21:08
@github-actions
Copy link
Contributor

github-actions bot commented Mar 13, 2026

Image was built and published successfully. It is available at:

@renovate renovate bot force-pushed the renovate/npm-backstage-plugin-scaffolder-backend-vulnerability branch from 159dd7d to d717bb7 Compare March 16, 2026 04:07
@github-actions
Copy link
Contributor

github-actions bot commented Mar 16, 2026

Image was built and published successfully. It is available at:

@renovate renovate bot force-pushed the renovate/npm-backstage-plugin-scaffolder-backend-vulnerability branch from d717bb7 to f1b884f Compare March 16, 2026 10:51
@github-actions
Copy link
Contributor

github-actions bot commented Mar 16, 2026

Image was built and published successfully. It is available at:

@renovate renovate bot force-pushed the renovate/npm-backstage-plugin-scaffolder-backend-vulnerability branch from f1b884f to 28fc407 Compare March 16, 2026 17:09
@github-actions
Copy link
Contributor

github-actions bot commented Mar 16, 2026

Image was built and published successfully. It is available at:

@renovate renovate bot force-pushed the renovate/npm-backstage-plugin-scaffolder-backend-vulnerability branch from 28fc407 to 3e3c78f Compare March 17, 2026 17:03
@github-actions
Copy link
Contributor

github-actions bot commented Mar 17, 2026

Image was built and published successfully. It is available at:

@renovate renovate bot force-pushed the renovate/npm-backstage-plugin-scaffolder-backend-vulnerability branch from 3e3c78f to 2bcb7cd Compare March 18, 2026 05:39
@github-actions
Copy link
Contributor

github-actions bot commented Mar 18, 2026

Image was built and published successfully. It is available at:

@renovate renovate bot force-pushed the renovate/npm-backstage-plugin-scaffolder-backend-vulnerability branch from 2bcb7cd to 8ea24cb Compare March 18, 2026 15:23
@github-actions
Copy link
Contributor

github-actions bot commented Mar 18, 2026

Image was built and published successfully. It is available at:

@renovate renovate bot force-pushed the renovate/npm-backstage-plugin-scaffolder-backend-vulnerability branch from 8ea24cb to 675722d Compare March 18, 2026 19:05
@github-actions
Copy link
Contributor

github-actions bot commented Mar 18, 2026

Image was built and published successfully. It is available at:

@renovate renovate bot force-pushed the renovate/npm-backstage-plugin-scaffolder-backend-vulnerability branch from 675722d to 81b2f8c Compare March 19, 2026 12:17
@github-actions
Copy link
Contributor

github-actions bot commented Mar 19, 2026

Image was built and published successfully. It is available at:

@renovate renovate bot force-pushed the renovate/npm-backstage-plugin-scaffolder-backend-vulnerability branch from 81b2f8c to 07d91fe Compare March 20, 2026 12:49
@github-actions
Copy link
Contributor

github-actions bot commented Mar 20, 2026

Image was built and published successfully. It is available at:

@renovate
fix(deps): update dependency @backstage/plugin-scaffolder-backend to …
c500e87 
…v3.1.5 [security]

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@renovate renovate bot force-pushed the renovate/npm-backstage-plugin-scaffolder-backend-vulnerability branch from 07d91fe to c500e87 Compare March 20, 2026 22:50
@sonarqubecloud
Copy link

sonarqubecloud bot commented Mar 20, 2026

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@github-actions
Copy link
Contributor

github-actions bot commented Mar 20, 2026

Image was built and published successfully. It is available at:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@christoph-jerolimov christoph-jerolimov Awaiting requested review from christoph-jerolimov

@rm3l rm3l Awaiting requested review from rm3l

Assignees

No one assigned

Labels

kind/dependency upgrade kind/security needs-ok-to-test

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants