fix(deps): update dependency @backstage/backend-defaults to ^0.12.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@backstage/backend-defaults (source)	^0.7.0 → ^0.12.0

---

Backstage has a Possible Symlink Path Traversal in Scaffolder Actions

CVE-2026-24046 / GHSA-rq6q-wr2q-7pgp

More information

Details

Impact

Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to:

1. Read arbitrary files via the debug:log action by creating a symlink pointing to sensitive files (e.g., /etc/passwd, configuration files, secrets)
2. Delete arbitrary files via the fs:delete action by creating symlinks pointing outside the workspace
3. Write files outside the workspace via archive extraction (tar/zip) containing malicious symlinks

This affects any Backstage deployment where users can create or execute Scaffolder templates.

Patches

This vulnerability is fixed in the following package versions:

• @backstage/backend-defaults version 0.12.2, 0.13.2, 0.14.1, 0.15.0
• @backstage/plugin-scaffolder-backend version 2.2.2, 3.0.2, 3.1.1
• @backstage/plugin-scaffolder-node version 0.11.2, 0.12.3

Users should upgrade to these versions or later.

Workarounds

• Follow the recommendation in the Backstage Threat Model to limit access to creating and updating templates
• Restrict who can create and execute Scaffolder templates using the permissions framework
• Audit existing templates for symlink usage
• Run Backstage in a containerized environment with limited filesystem access

References

• CWE-59: Improper Link Resolution Before File Access
• OWASP Path Traversal

Severity

• CVSS Score: 7.1 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L

References

• https://github.com/backstage/backstage/security/advisories/GHSA-rq6q-wr2q-7pgp
• https://github.com/backstage/backstage/commit/c641c147ab371a9a8a2f5f67fdb7cb9c97ef345d
• https://nvd.nist.gov/vuln/detail/CVE-2026-24046
• https://github.com/advisories/GHSA-rq6q-wr2q-7pgp

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Backstage has a Possible SSRF when reading from allowed URL's in backend.reading.allow

CVE-2026-24048 / GHSA-q2x5-4xjx-c6p9

More information

Details

Impact

The FetchUrlReader component, used by the catalog and other plugins to fetch content from URLs, followed HTTP redirects automatically. This allowed an attacker who controls a host listed in backend.reading.allow to redirect requests to internal or sensitive URLs that are not on the allowlist, bypassing the URL allowlist security control.

This is a Server-Side Request Forgery (SSRF) vulnerability that could allow access to internal resources, but it does not allow attackers to include additional request headers.

Patches

This vulnerability is fixed in @backstage/backend-defaults version 0.12.2, 0.13.2, 0.14.1, and 0.15.0. Users should upgrade to this version or later.

Workarounds

• Restrict backend.reading.allow to only trusted hosts that you control and that do not issue redirects
• Ensure allowed hosts do not have open redirect vulnerabilities
• Use network-level controls to block access from Backstage to sensitive internal endpoints

References

• OWASP SSRF Prevention Cheat Sheet

Severity

• CVSS Score: 3.5 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N

References

• https://github.com/backstage/backstage/security/advisories/GHSA-q2x5-4xjx-c6p9
• https://github.com/backstage/backstage/commit/27f9061d24affd1b9212fe0abd476bfc3fbaedcb
• https://nvd.nist.gov/vuln/detail/CVE-2026-24048
• https://github.com/advisories/GHSA-q2x5-4xjx-c6p9

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

backstage/backstage (@​backstage/backend-defaults)

v0.12.2

Compare Source

v0.12.1

Compare Source

Patch Changes

• 33bd4d0: Deduplicate discovered features discovered with discoveryFeatureLoader

• 4eda590: Fixed cache namespace and key prefix separator configuration to properly use configured values instead of hardcoded plugin ID. The cache manager now correctly combines the configured namespace with plugin IDs using the configured separator for Redis and Valkey. Memcache and memory store continue to use plugin ID as namespace.

• f244e61: Add backend.logger config options to configure the RootLoggerService.

  Read more about the new configuration options in the
  Root Logger Service
  documentation.

• Updated dependencies

  • @​backstage/config-loader@​1.10.3
  • @​backstage/plugin-auth-node@​0.6.7
  • @​backstage/plugin-events-node@​0.4.15
  • @​backstage/integration@​1.18.0
  • @​backstage/types@​1.2.2
  • @​backstage/backend-app-api@​1.2.7
  • @​backstage/backend-plugin-api@​1.4.3
  • @​backstage/plugin-permission-node@​0.10.4

v0.12.0

Compare Source

Minor Changes

• 133519b: feat: new cache manager Infinispan Data Grid

Patch Changes

• caee2eb: Fixed WinstonLogger throwing when redactions were null or undefined
• ed74af5: Fixed bug in PackageDiscoveryService where packages with "exports" field caused ERR_PACKAGE_PATH_NOT_EXPORTED error during backend startup.
• 3a7dad9: Updated better-sqlite3 to v12
• Updated dependencies
  • @​backstage/cli-node@​0.2.14
  • @​backstage/backend-app-api@​1.2.6
  • @​backstage/plugin-auth-node@​0.6.6
  • @​backstage/plugin-permission-node@​0.10.3
  • @​backstage/backend-plugin-api@​1.4.2
  • @​backstage/plugin-events-node@​0.4.14

v0.11.1

Compare Source

Patch Changes

• ead925a: Add a standard toString on credentials objects
• e0189b8: UrlReader: Fix handling of access tokens for GitLab readURL requests
• d1e4a6d: Fixed bug where the GitLab user token and GitLab integration token were being merged together
• Updated dependencies
  • @​backstage/config-loader@​1.10.2
  • @​backstage/config@​1.3.3
  • @​backstage/plugin-permission-node@​0.10.2
  • @​backstage/integration@​1.17.1
  • @​backstage/backend-app-api@​1.2.5
  • @​backstage/backend-plugin-api@​1.4.1
  • @​backstage/integration-aws-node@​0.1.17
  • @​backstage/plugin-auth-node@​0.6.5
  • @​backstage/plugin-events-node@​0.4.13

v0.11.0

Compare Source

Minor Changes

• 3ccb7fc: Enhanced error handling in the auditor service factory to pass errors as objects. Aligned WinstonRootAuditorService with the default service factory's error handling.

Patch Changes

• 1220cf8: Added new rate limit middleware to allow rate limiting requests to the backend

  If you are using the configure callback of the root HTTP router service and do NOT call applyDefaults() inside it, please see the relevant changes that were made, to see if you want to apply them as well to your custom configuration.
  Rate limiting can be turned on by adding the following configuration to app-config.yaml:

  backend:
    rateLimit:
      window: 6s
      incomingRequestLimit: 100

  Plugin specific rate limiting can be configured by adding the following configuration to app-config.yaml:

  backend:
    rateLimit:
      global: false # This will disable the global rate limiting
      plugin:
        catalog:
          window: 6s
          incomingRequestLimit: 100

• c999c25: Added some default implementations for the experimental ActionsService and ActionsRegistryService under /alpha that allow registration of actions for a particular plugin.

• Updated dependencies

  • @​backstage/plugin-auth-node@​0.6.4
  • @​backstage/backend-app-api@​1.2.4
  • @​backstage/backend-plugin-api@​1.4.0
  • @​backstage/backend-dev-utils@​0.1.5
  • @​backstage/cli-node@​0.2.13
  • @​backstage/config@​1.3.2
  • @​backstage/config-loader@​1.10.1
  • @​backstage/errors@​1.2.7
  • @​backstage/integration@​1.17.0
  • @​backstage/integration-aws-node@​0.1.16
  • @​backstage/types@​1.2.1
  • @​backstage/plugin-events-node@​0.4.12
  • @​backstage/plugin-permission-node@​0.10.1

v0.10.0

Compare Source

Minor Changes

• d385854: BREAKING: The DefaultSchedulerService constructor options now requires RootLifecycleService, HttpRouterService, and PluginMetadataService fields.

  The scheduler will register a REST API for listing and triggering tasks. Please see the scheduler documentation for more details about this API.

Patch Changes

• 1e06afd: GithubUrlReader's search detects glob-patterns supported by minimatch, instead of just detecting
  * and ? characters.

  For example, this allows to search for patterns like {C,c}atalog-info.yaml.

• acea1d4: update documentation

• 72d019d: Removed various typos

• c6bc67d: Added Valkey support alongside Redis in backend-defaults cache clients, using the new Keyv Valkey package. Also extended backend-test-utils to support Valkey in tests.

• 36f77e9: Bug fix: Pass user provided token through to gitlab url resolvers

• 0e7a640: The GithubUrlReader will now use the token from options when fetching repo details

• Updated dependencies

  • @​backstage/integration@​1.17.0
  • @​backstage/backend-app-api@​1.2.3
  • @​backstage/plugin-auth-node@​0.6.3
  • @​backstage/backend-plugin-api@​1.3.1
  • @​backstage/plugin-permission-node@​0.10.0
  • @​backstage/config-loader@​1.10.1
  • @​backstage/integration-aws-node@​0.1.16
  • @​backstage/cli-node@​0.2.13
  • @​backstage/config@​1.3.2
  • @​backstage/backend-dev-utils@​0.1.5
  • @​backstage/errors@​1.2.7
  • @​backstage/types@​1.2.1
  • @​backstage/plugin-events-node@​0.4.11

v0.9.0

Compare Source

Minor Changes

• 1daedce: Remove Throttle of Bitbucket Server API calls
• 01edf6e: Allow pass through of redis client and cluster options to Cache core service
• cf4eb13: Added actor property to BackstageUserPrincipal containing the subject of the last service (if any) who performed authentication on behalf of the user.

Patch Changes

• 7c6740e: Implemented SRV lookup support in the default HostDiscovery. You can now specify internal URLs on the form http+srv://some-srv-name/api/{{pluginId}} and they will be resolved in real time.

• 939116c: Added an optional backend.trustProxy app config value, which sets the
  corresponding Express.js trust proxy setting. This lets
  you easily configure proxy trust without making a custom configure callback
  for the rootHttpRouter service.

  If you already are using a custom configure callback, and if that also does not call applyDefaults(), you may want to add the following to it:

  const trustProxy = config.getOptional('backend.trustProxy');
  if (trustProxy !== undefined) {
    app.set('trust proxy', trustProxy);
  }

• 175528c: Adds backend.auditor.severityLogLevelMappings to map severity levels to log levels.

• Updated dependencies

  • @​backstage/backend-plugin-api@​1.3.0
  • @​backstage/integration@​1.16.3
  • @​backstage/backend-app-api@​1.2.2
  • @​backstage/plugin-auth-node@​0.6.2
  • @​backstage/plugin-permission-node@​0.9.1
  • @​backstage/backend-dev-utils@​0.1.5
  • @​backstage/cli-node@​0.2.13
  • @​backstage/config@​1.3.2
  • @​backstage/config-loader@​1.10.0
  • @​backstage/errors@​1.2.7
  • @​backstage/integration-aws-node@​0.1.15
  • @​backstage/types@​1.2.1
  • @​backstage/plugin-events-node@​0.4.10

v0.8.2

Compare Source

Patch Changes

• e293b66: The default auditor service implementation will now log low severity events with debug level instead of info.

• f422984: Remove unused dependencies

• ecb9bab: Explicitly stringify extra logger fields with JSON.stringify to prevent [object Object] errors.

• 12f8e01: The discovery.endpoints configuration no longer requires both internal and external target when using the object form, instead falling back to the default.

• 89db8b8: GerritUrlReader is now able to search files matching a given pattern URL (using minimatch glob patterns).

  This allows the Gerrit Discovery to find all Backstage manifests inside a repository using the **/catalog-info.yaml pattern.

• Updated dependencies

  • @​backstage/config-loader@​1.10.0
  • @​backstage/integration@​1.16.2
  • @​backstage/plugin-permission-node@​0.9.0
  • @​backstage/plugin-auth-node@​0.6.1
  • @​backstage/plugin-events-node@​0.4.9
  • @​backstage/backend-app-api@​1.2.1
  • @​backstage/integration-aws-node@​0.1.15
  • @​backstage/backend-dev-utils@​0.1.5
  • @​backstage/backend-plugin-api@​1.2.1
  • @​backstage/cli-node@​0.2.13
  • @​backstage/config@​1.3.2
  • @​backstage/errors@​1.2.7
  • @​backstage/types@​1.2.1

v0.8.1

Compare Source

Release a newer version of @backstage/techdocs-common including a bug fix #​4088.

v0.8.0

Compare Source

Minor Changes

• a4aa244: This change introduces the auditor service implementation details.

Patch Changes

• f866b86: Internal refactor to use explicit require for lazy-loading dependency.
• 92a56f6: Internal refactor to stop importing the removed FeatureDiscoveryService from @backstage/backend-plugin-api.
• a19cb2b: Added default implementation for the new PermissionsRegistryService.
• 0d39029: Do not send etag or If-Modified-Since headers for gitlab artifact urls
• c7609de: Allow passing IP type to use with cloud-sql-connector
• 3740229: In the different UrlReadersService, the search method have been updated to use the readUrl if the given URL doesn't contain a pattern.
  For UrlReaders that didn't implement the search method, readUrl is now called internally and throws if the given URL doesn't contain a pattern.
• 72cddf2: Updated PermissionsRegistryService to use PermissionResourceRefs and added the getPermissionRuleset method.
• Updated dependencies
  • @​backstage/cli-node@​0.2.13
  • @​backstage/plugin-permission-node@​0.8.8
  • @​backstage/config-loader@​1.9.6
  • @​backstage/backend-plugin-api@​1.2.0
  • @​backstage/plugin-auth-node@​0.6.0
  • @​backstage/backend-app-api@​1.2.0
  • @​backstage/backend-dev-utils@​0.1.5
  • @​backstage/cli-common@​0.1.15
  • @​backstage/config@​1.3.2
  • @​backstage/errors@​1.2.7
  • @​backstage/integration@​1.16.1
  • @​backstage/integration-aws-node@​0.1.15
  • @​backstage/types@​1.2.1
  • @​backstage/plugin-events-node@​0.4.8

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.