Releases

Check if affected (1)

• securitySecurity fixes for Backstage catalog packages

  Applies if you use any of @backstage/plugin-catalog-backend-module-unprocessed, @backstage/plugin-catalog-unprocessed-entities-common version, or @backstage/plugin-catalog-unprocessed-entities.

Check if affected (1)

• breakingRequired audience field on the GCR Receiver secret

  Applies if you configure the audience field on the GCR Receiver secret.

Check if affected (1)

• breakingConfiguration schema values replaced

  Applies if you use existing extensions and blueprints.

Action needed (4)

• securityhighThe glob and rollup dependencies, upgraded

  The glob dependency was upgraded from v7, v8, and v11 to v13 to address security vulnerabilities in older versions. rollup was upgraded from v4.27 to v4.59+ to fix the path traversal vulnerability identified by GHSA-mw96-cpmx-2vgc.

• securityThe glob dependency, upgraded to v13

  The glob dependency was upgraded from v7, v8, and v11 to v13 to address security vulnerabilities in older versions.

• securityThe rollup dependency, upgraded to v4.59+

  rollup was upgraded from v4.27 to v4.59+ to fix the path traversal vulnerability identified by GHSA-mw96-cpmx-2vgc.

• securityThe .well-known/oauth-protected-resource URL

  The .well-known/oauth-protected-resource resource URL was fixed to comply with RFC 9728 Section 7.3. Dynamic resource paths are enabled.

Check if affected (1)

• breakingFractional pseudorandom bucketing assignments

  Applies if you use providers.