Repository navigation
chore(deps): update dependency @backstage/plugin-catalog-backend to v3.9.1 [security] - #184
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
changed the title
renovate
Bot
deleted the
renovate/npm-backstage-plugin-catalog-backend-vulnerability
branch
October 22, 2026 16:32
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/npm-backstage-plugin-catalog-backend-vulnerability
branch
2 times, most recently
from
October 22, 2026 22:26
975830d to
2aa6156
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
3.8.1→3.9.1Backstage: Inconsistent enforcement of allowed location types during catalog processing
CVE-2026-106496 / GHSA-pcmq-25r3-5w9v
More information
Details
Impact
Under certain configurations, the catalog backend could process location types that were not intended to be allowed, potentially leading to unintended file access on the backend host.
Patches
Patched in
@backstage/plugin-catalog-backendversion3.9.1Workarounds
No practical workarounds are available. Upgrade to the patched version.
Severity
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Backstage: Improper URL validation in catalog entity placeholder resolution
CVE-2026-106498 / GHSA-qgvj-qcf8-xq73
More information
Details
Impact
An authenticated Backstage user could craft a catalog entity with placeholder directives that reference resources outside the entity's source repository. Under certain configurations, this could allow access to data not intended to be available to the user.
Patches
Patched in
@backstage/plugin-catalog-backendversion3.9.1Workarounds
If you're not able to update immediately:
Severity
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
backstage/backstage (@backstage/plugin-catalog-backend)
v3.9.1Compare Source
v3.9.0Compare Source
Minor Changes
c7c0ec3: Added arefresh-catalog-entityaction so agents and MCP clients can re-queue a single entity for processing after creating or updating it — useful for reading back fresh data immediately after a scaffolder run without waiting for the next scheduled processing loop.Patch Changes
aa318d0: Migrated internal query filter handling fromEntityFiltertoFilterPredicate, simplifying the filter parsing and query application pipeline.10f0713: Replaced the delete-all and reinsert pattern for therelationstable with a diff-based sync that only touches rows that actually changed. In steady state (the common case), zero writes occur, eliminating write churn, dead tuples, and WAL traffic from the processing path. Stitching is now also skipped for relation neighbors that did not change.ee40136: Fixed a missing promise return in a database migration rollback function.eb6dff2: Fixed an issue where PostgreSQL deadlock errors during entity provider mutations were silently swallowed, causing entities to be dropped until the next full refresh. Transactions are now automatically retried on deadlock with exponential back-off.dd562f0: Fixed a potential MySQL deadlock during concurrent entity processing by retrying theupdateProcessedEntitytransaction on deadlock errors.b031a48: Fixed an issue where SCMlocation.movedevents would generate new locations in the database for files that were not actively tracked.b7650ad: Simplified internal router setup by removing unnecessary conditional guards around route registrations.v3.8.2Compare Source
Patch Changes
ee40136: Fixed a missing promise return in a database migration rollback function.b7650ad: Simplified internal router setup by removing unnecessary conditional guards around route registrations.Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.