Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

update-backstage-1.12.1 #5

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

update-backstage-1.12.1 #5

wants to merge 1 commit into from

Conversation

danielgonzalez3
Copy link

  • update backstage dependencies + add yarn.lock

@socket-security
Copy link

New dependency changes detected. Learn more about Socket for GitHub ↗︎

🚨 Potential security issues found in this pull request. To accept the risk, merge this PR and you will not be notified again.

Bot Commands

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@* or ignore all packages with @SocketSecurity ignore-all

  • @SocketSecurity ignore msw@0.48.3
  • @SocketSecurity ignore esbuild@0.16.17
  • @SocketSecurity ignore esbuild@0.17.16
  • @SocketSecurity ignore jest@29.5.0
  • @SocketSecurity ignore jest-cli@29.5.0
  • @SocketSecurity ignore @esbuild-kit/cjs-loader@2.4.2
  • @SocketSecurity ignore @esbuild-kit/core-utils@3.1.0
  • @SocketSecurity ignore @istanbuljs/load-nyc-config@1.1.0
  • @SocketSecurity ignore @jest/create-cache-key-function@27.5.1
  • @SocketSecurity ignore @nodelib/fs.stat@2.0.5
  • @SocketSecurity ignore @rollup/plugin-commonjs@23.0.7
  • @SocketSecurity ignore @rollup/plugin-node-resolve@13.3.0
  • @SocketSecurity ignore @svgr/rollup@6.5.1
  • @SocketSecurity ignore @swc/core@1.3.49
  • @SocketSecurity ignore @swc/jest@0.2.24
  • @SocketSecurity ignore @typescript-eslint/typescript-estree@5.58.0
  • @SocketSecurity ignore @yarnpkg/lockfile@1.1.0
  • @SocketSecurity ignore acorn@8.8.2
  • @SocketSecurity ignore address@1.2.2
  • @SocketSecurity ignore ajv@6.12.6
  • @SocketSecurity ignore argparse@1.0.10
  • @SocketSecurity ignore argparse@2.0.1
  • @SocketSecurity ignore babel-plugin-istanbul@6.1.1
  • @SocketSecurity ignore bfj@7.0.2
  • @SocketSecurity ignore browserslist@4.21.5
  • @SocketSecurity ignore buffer@4.9.2
  • @SocketSecurity ignore chardet@0.7.0
  • @SocketSecurity ignore chokidar@3.5.3
  • @SocketSecurity ignore chownr@2.0.0
  • @SocketSecurity ignore commander@2.20.3
  • @SocketSecurity ignore commander@7.2.0
  • @SocketSecurity ignore commander@9.5.0
  • @SocketSecurity ignore convert-source-map@1.9.0
  • @SocketSecurity ignore cosmiconfig@6.0.0
  • @SocketSecurity ignore cosmiconfig@7.1.0
  • @SocketSecurity ignore create-require@1.1.1
  • @SocketSecurity ignore cross-spawn@7.0.3
  • @SocketSecurity ignore debug@2.6.9
  • @SocketSecurity ignore debug@3.2.7
  • @SocketSecurity ignore debug@4.3.4
  • @SocketSecurity ignore destroy@1.2.0
  • @SocketSecurity ignore esbuild-loader@2.21.0
  • @SocketSecurity ignore escalade@3.1.1
  • @SocketSecurity ignore eslint@8.38.0
  • @SocketSecurity ignore eslint-formatter-friendly@7.0.0
  • @SocketSecurity ignore eslint-module-utils@2.7.4
  • @SocketSecurity ignore eslint-plugin-import@2.27.5
  • @SocketSecurity ignore eslint-plugin-jest@27.2.1
  • @SocketSecurity ignore eslint-plugin-react@7.32.2
  • @SocketSecurity ignore esprima@4.0.1
📜 Install scripts

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Package Script field Source
msw@0.48.3 (upgraded) postinstall package.json
esbuild@0.16.17 (upgraded) postinstall package.json via @backstage/cli@0.22.5
esbuild@0.17.16 (upgraded) postinstall package.json via @backstage/cli@0.22.5
😵‍💫 Bin script confusion

This package has multiple bin scripts with the same name. This can cause non-deterministic behavior when installing or could be a sign of a supply chain attack

Consider removing one of the conflicting packages. Packages should only export bin scripts with their name

Package Bin script Source
jest@29.5.0 (upgraded) jest package.json via @backstage/cli@0.22.5
jest-cli@29.5.0 (upgraded) jest package.json via @backstage/cli@0.22.5
⚠️ Filesystem access

Accesses the file system, and could potentially read sensitive data.

If a package must read the file system, clarify what it will read and ensure it reads only what it claims to. If appropriate, packages can leave file system access to consumers and operate on data passed to it instead.

Package Module Location Source
@esbuild-kit/cjs-loader@2.4.2 (added) fs dist/index.js package.json via @backstage/cli@0.22.5
@esbuild-kit/core-utils@3.1.0 (added) fs dist/index.js package.json via @backstage/cli@0.22.5
@istanbuljs/load-nyc-config@1.1.0 (added) fs index.js package.json via @backstage/cli@0.22.5
@jest/create-cache-key-function@27.5.1 (added) fs build/index.js package.json via @backstage/cli@0.22.5
@nodelib/fs.stat@2.0.5 (added) fs out/adapters/fs.js package.json via @backstage/cli@0.22.5
@rollup/plugin-commonjs@23.0.7 (upgraded) fs dist/cjs/index.js package.json via @backstage/cli@0.22.5
@rollup/plugin-commonjs@23.0.7 (upgraded) fs dist/es/index.js package.json via @backstage/cli@0.22.5
@rollup/plugin-node-resolve@13.3.0 (added) fs dist/cjs/index.js package.json via @backstage/cli@0.22.5
@rollup/plugin-node-resolve@13.3.0 (added) fs dist/es/index.js package.json via @backstage/cli@0.22.5
@svgr/rollup@6.5.1 (upgraded) fs dist/index.js package.json via @backstage/cli@0.22.5
@swc/core@1.3.49 (added) fs binding.js package.json via @backstage/cli@0.22.5
@swc/jest@0.2.24 (added) fs index.js package.json via @backstage/cli@0.22.5
@typescript-eslint/typescript-estree@5.58.0 (added) fs dist/create-program/getWatchProgramsForProjects.js package.json via @backstage/cli@0.22.5
@typescript-eslint/typescript-estree@5.58.0 (added) fs dist/create-program/useProvidedPrograms.js package.json via @backstage/cli@0.22.5
@typescript-eslint/typescript-estree@5.58.0 (added) fs dist/parseSettings/getProjectConfigFiles.js package.json via @backstage/cli@0.22.5
@yarnpkg/lockfile@1.1.0 (added) fs index.js package.json via @backstage/cli@0.22.5
acorn@8.8.2 (upgraded) fs dist/bin.js package.json via @backstage/cli@0.22.5
address@1.2.2 (added) fs lib/address.js package.json via @backstage/cli@0.22.5
ajv@6.12.6 (added) fs scripts/bundle.js package.json via @backstage/cli@0.22.5
ajv@6.12.6 (added) fs scripts/compile-dots.js package.json via @backstage/cli@0.22.5
argparse@1.0.10 (added) fs lib/argument_parser.js package.json via @backstage/cli@0.22.5
argparse@2.0.1 (added) fs argparse.js package.json via @backstage/cli@0.22.5
babel-plugin-istanbul@6.1.1 (added) fs lib/index.js package.json via @backstage/cli@0.22.5
bfj@7.0.2 (added) fs src/read.js package.json via @backstage/cli@0.22.5
bfj@7.0.2 (added) fs src/write.js package.json via @backstage/cli@0.22.5
bfj@7.0.2 (added) fs test/integration.js package.json via @backstage/cli@0.22.5
bfj@7.0.2 (added) fs test/performance.js package.json via @backstage/cli@0.22.5
browserslist@4.21.5 (added) fs cli.js package.json via @backstage/cli@0.22.5
browserslist@4.21.5 (added) fs node.js package.json via @backstage/cli@0.22.5
buffer@4.9.2 (added) fs bin/download-node-tests.js package.json via @backstage/cli@0.22.5
buffer@4.9.2 (added) fs bin/test.js package.json via @backstage/cli@0.22.5
chardet@0.7.0 (added) fs index.js package.json via @backstage/cli@0.22.5, msw@0.48.3
chokidar@3.5.3 (added) fs index.js package.json via @backstage/cli@0.22.5, msw@0.48.3
chokidar@3.5.3 (added) fs lib/fsevents-handler.js package.json via @backstage/cli@0.22.5, msw@0.48.3
chokidar@3.5.3 (added) fs lib/nodefs-handler.js package.json via @backstage/cli@0.22.5, msw@0.48.3
chownr@2.0.0 (added) fs chownr.js package.json via @backstage/cli@0.22.5
commander@2.20.3 (added) fs index.js package.json via @backstage/cli@0.22.5
commander@7.2.0 (added) fs index.js package.json via @backstage/cli@0.22.5
commander@9.5.0 (added) fs lib/command.js package.json via @backstage/cli@0.22.5
convert-source-map@1.9.0 (added) fs index.js package.json via @backstage/cli@0.22.5
cosmiconfig@6.0.0 (added) fs dist/readFile.js package.json via @backstage/cli@0.22.5
cosmiconfig@7.1.0 (added) fs dist/readFile.js package.json via @backstage/cli@0.22.5
create-require@1.1.1 (added) fs create-require.js package.json via @backstage/cli@0.22.5
cross-spawn@7.0.3 (added) fs lib/util/readShebang.js package.json via @backstage/cli@0.22.5
debug@2.6.9 (added) fs src/node.js package.json via @backstage/cli@0.22.5
destroy@1.2.0 (added) fs index.js package.json via @backstage/cli@0.22.5
esbuild@0.16.17 (upgraded) fs install.js package.json via @backstage/cli@0.22.5
esbuild@0.16.17 (upgraded) fs install.js package.json via @backstage/cli@0.22.5
esbuild@0.16.17 (upgraded) fs lib/main.js package.json via @backstage/cli@0.22.5
esbuild@0.16.17 (upgraded) fs lib/main.js package.json via @backstage/cli@0.22.5
esbuild@0.17.16 (upgraded) fs install.js package.json via @backstage/cli@0.22.5
esbuild@0.17.16 (upgraded) fs install.js package.json via @backstage/cli@0.22.5
esbuild@0.17.16 (upgraded) fs lib/main.js package.json via @backstage/cli@0.22.5
esbuild@0.17.16 (upgraded) fs lib/main.js package.json via @backstage/cli@0.22.5
esbuild-loader@2.21.0 (added) fs dist/loader.js package.json via @backstage/cli@0.22.5
escalade@3.1.1 (added) fs dist/index.js package.json via @backstage/cli@0.22.5, msw@0.48.3
escalade@3.1.1 (added) fs dist/index.mjs package.json via @backstage/cli@0.22.5, msw@0.48.3
escalade@3.1.1 (added) fs sync/index.js package.json via @backstage/cli@0.22.5, msw@0.48.3
escalade@3.1.1 (added) fs sync/index.mjs package.json via @backstage/cli@0.22.5, msw@0.48.3
eslint@8.38.0 (added) fs lib/cli-engine/cli-engine.js package.json via @backstage/cli@0.22.5
eslint@8.38.0 (added) fs lib/cli-engine/file-enumerator.js package.json via @backstage/cli@0.22.5
eslint@8.38.0 (added) fs lib/cli-engine/lint-result-cache.js package.json via @backstage/cli@0.22.5
eslint@8.38.0 (added) fs lib/cli-engine/load-rules.js package.json via @backstage/cli@0.22.5
eslint@8.38.0 (added) fs lib/cli.js package.json via @backstage/cli@0.22.5
eslint@8.38.0 (added) fs lib/eslint/eslint-helpers.js package.json via @backstage/cli@0.22.5
eslint@8.38.0 (added) fs lib/eslint/eslint.js package.json via @backstage/cli@0.22.5
eslint@8.38.0 (added) fs lib/eslint/flat-eslint.js package.json via @backstage/cli@0.22.5
eslint-formatter-friendly@7.0.0 (added) fs index.js package.json via @backstage/cli@0.22.5
eslint-module-utils@2.7.4 (added) fs parse.js package.json via @backstage/cli@0.22.5
eslint-module-utils@2.7.4 (added) fs pkgUp.js package.json via @backstage/cli@0.22.5
eslint-module-utils@2.7.4 (added) fs readPkgUp.js package.json via @backstage/cli@0.22.5
eslint-module-utils@2.7.4 (added) fs resolve.js package.json via @backstage/cli@0.22.5
eslint-plugin-import@2.27.5 (added) fs lib/ExportMap.js package.json via @backstage/cli@0.22.5
eslint-plugin-import@2.27.5 (added) fs lib/rules/no-extraneous-dependencies.js package.json via @backstage/cli@0.22.5
eslint-plugin-jest@27.2.1 (added) fs lib/index.js package.json via @backstage/cli@0.22.5
eslint-plugin-react@7.32.2 (added) fs lib/util/version.js package.json via @backstage/cli@0.22.5
esprima@4.0.1 (added) fs bin/esparse.js package.json via @backstage/cli@0.22.5
esprima@4.0.1 (added) fs bin/esvalidate.js package.json via @backstage/cli@0.22.5
esprima@4.0.1 (added) fs bin/esvalidate.js package.json via @backstage/cli@0.22.5
etag@1.8.1 (added) fs index.js package.json via @backstage/cli@0.22.5
express@4.18.2 (added) fs lib/view.js package.json via @backstage/cli@0.22.5
external-editor@3.1.0 (added) fs main/index.js package.json via @backstage/cli@0.22.5, msw@0.48.3
file-entry-cache@6.0.1 (added) fs cache.js package.json via @backstage/cli@0.22.5
flat-cache@3.0.4 (added) fs src/cache.js package.json via @backstage/cli@0.22.5
flat-cache@3.0.4 (added) fs src/del.js package.json via @backstage/cli@0.22.5
flat-cache@3.0.4 (added) fs src/utils.js package.json via @backstage/cli@0.22.5
form-data@4.0.0 (upgraded) fs lib/form_data.js package.json via @backstage/cli@0.22.5
fs-extra@9.1.0 (added) fs lib/index.js package.json via @backstage/cli@0.22.5
fs-minipass@2.1.0 (added) fs index.js package.json via @backstage/cli@0.22.5
fs.realpath@1.0.0 (added) fs index.js package.json via @backstage/cli@0.22.5
fs.realpath@1.0.0 (added) fs old.js package.json via @backstage/cli@0.22.5
get-package-type@0.1.0 (added) fs async.cjs package.json via @backstage/cli@0.22.5
get-package-type@0.1.0 (added) fs sync.cjs package.json via @backstage/cli@0.22.5
get-tsconfig@4.5.0 (added) fs dist/index.cjs package.json via @backstage/cli@0.22.5
get-tsconfig@4.5.0 (added) fs dist/index.mjs package.json via @backstage/cli@0.22.5
glob@7.1.6 (added) fs glob.js package.json via @backstage/cli@0.22.5
glob@7.1.6 (added) fs sync.js package.json via @backstage/cli@0.22.5
glob@7.2.3 (added) fs common.js package.json via @backstage/cli@0.22.5
glob@8.1.0 (added) fs common.js package.json via @backstage/cli@0.22.5
global-prefix@3.0.0 (added) fs index.js package.json via @backstage/cli@0.22.5
gzip-size@6.0.0 (added) fs index.js package.json via @backstage/cli@0.22.5
handlebars@4.7.7 (added) fs dist/cjs/precompiler.js package.json via @backstage/cli@0.22.5
html-minifier-terser@6.1.0 (added) fs cli.js package.json via @backstage/cli@0.22.5
html-webpack-plugin@5.5.0 (added) fs index.js package.json via @backstage/cli@0.22.5
ignore-walk@5.0.1 (added) fs lib/index.js package.json via @backstage/cli@0.22.5
inline-style-prefixer@6.0.4 (added) fs es/generator/index.js package.json via @backstage/core-app-api@1.6.0, @backstage/core-components@0.12.5, @backstage/dev-utils@1.0.13, @backstage/plugin-catalog-react@1.4.0, @backstage/test-utils@1.2.6, react-use@17.4.0
inline-style-prefixer@6.0.4 (added) fs lib/generator/index.js package.json via @backstage/core-app-api@1.6.0, @backstage/core-components@0.12.5, @backstage/dev-utils@1.0.13, @backstage/plugin-catalog-react@1.4.0, @backstage/test-utils@1.2.6, react-use@17.4.0
is-docker@2.2.1 (added) fs index.js package.json via @backstage/cli@0.22.5
is-wsl@2.2.0 (added) fs index.js package.json via @backstage/cli@0.22.5
isexe@2.0.0 (added) fs index.js package.json via @backstage/cli@0.22.5
isexe@2.0.0 (added) fs mode.js package.json via @backstage/cli@0.22.5
isexe@2.0.0 (added) fs test/basic.js package.json via @backstage/cli@0.22.5
isexe@2.0.0 (added) fs windows.js package.json via @backstage/cli@0.22.5
istanbul-lib-report@3.0.0 (added) fs lib/context.js package.json via @backstage/cli@0.22.5
istanbul-lib-source-maps@4.0.1 (added) fs lib/map-store.js package.json via @backstage/cli@0.22.5
jest-haste-map@29.5.0 (upgraded) fs build/watchers/NodeWatcher.js package.json via @backstage/cli@0.22.5
joycon@3.1.1 (added) fs lib/index.js package.json via @backstage/cli@0.22.5
js-yaml@3.14.1 (added) fs bin/js-yaml.js package.json via @backstage/cli@0.22.5
jsdom@20.0.3 (upgraded) fs lib/api.js package.json via @backstage/cli@0.22.5
jsdom@20.0.3 (upgraded) fs lib/jsdom/browser/resources/resource-loader.js package.json via @backstage/cli@0.22.5
jsdom@20.0.3 (upgraded) fs lib/jsdom/living/xhr/xhr-utils.js package.json via @backstage/cli@0.22.5
json5@1.0.2 (added) fs lib/cli.js package.json via @backstage/cli@0.22.5
json5@1.0.2 (added) fs lib/register.js package.json via @backstage/cli@0.22.5
json5@2.2.3 (added) fs lib/cli.js [package.json](https://github.com/Weyn/backstage-teamcity/pull

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@danielgonzalez3