diff --git a/.changeset/blue-items-shop.md b/.changeset/blue-items-shop.md
new file mode 100644
index 0000000000000..fbf22878645c7
--- /dev/null
+++ b/.changeset/blue-items-shop.md
@@ -0,0 +1,6 @@
+---
+'@backstage/plugin-cost-insights': patch
+'@backstage/plugin-techdocs': patch
+---
+
+Bumped `canvas` dependency to the latest version, which has better Node.js v18 support.
diff --git a/.changeset/eighty-planets-train.md b/.changeset/eighty-planets-train.md
new file mode 100644
index 0000000000000..c4d5d57f6c1fc
--- /dev/null
+++ b/.changeset/eighty-planets-train.md
@@ -0,0 +1,6 @@
+---
+'@backstage/backend-common': patch
+'@backstage/cli': patch
+---
+
+Bumped `tar` dependency to `^6.1.12` in order to ensure Node.js v18 compatibility.
diff --git a/.changeset/silent-moles-chew.md b/.changeset/silent-moles-chew.md
new file mode 100644
index 0000000000000..be71272e288be
--- /dev/null
+++ b/.changeset/silent-moles-chew.md
@@ -0,0 +1,8 @@
+---
+'@backstage/backend-common': patch
+'@backstage/plugin-kubernetes': patch
+'@backstage/plugin-kubernetes-backend': patch
+'@backstage/plugin-kubernetes-common': patch
+---
+
+Pin `@kubernetes/client-node` version to `0.17.0`.
diff --git a/.changeset/thirty-deers-float.md b/.changeset/thirty-deers-float.md
new file mode 100644
index 0000000000000..198d6f909dbb0
--- /dev/null
+++ b/.changeset/thirty-deers-float.md
@@ -0,0 +1,19 @@
+---
+'@backstage/create-app': patch
+---
+
+Switched Node.js version to support version 16 & 18, rather than 14 & 16. To switch the Node.js version in your own project, apply the following change to the root `package.json`:
+
+```diff
+   "engines": {
+-    "node": "14 || 16"
++    "node": "16 || 18"
+   },
+```
+
+As well as the following change to `packages/app/package.json`:
+
+```diff
+-    "@types/node": "^14.14.32",
++    "@types/node": "^16.11.26",
+```
diff --git a/.changeset/two-timers-pump.md b/.changeset/two-timers-pump.md
new file mode 100644
index 0000000000000..e3c1ec2351cc3
--- /dev/null
+++ b/.changeset/two-timers-pump.md
@@ -0,0 +1,5 @@
+---
+'@backstage/cli': minor
+---
+
+Switched `tsconfig.json` to target and support `ES2021`, in line with the bump to Node.js 16 & 18.
diff --git a/.changeset/witty-carrots-live.md b/.changeset/witty-carrots-live.md
new file mode 100644
index 0000000000000..4bafd47dfa552
--- /dev/null
+++ b/.changeset/witty-carrots-live.md
@@ -0,0 +1,31 @@
+---
+'@backstage/create-app': patch
+---
+
+Fixed incorrect comments in the templated `app-config.yaml` and `app-config.production.yaml`. The `backend.listen` directive is not in fact needed to override the `backend.baseUrl`, the backend listens to all interfaces by default. The configuration has also been updated to listen to all interfaces, rather than just IPv4 ones, as this is required for Node.js v18. The production configuration now also shows the option to specify `backend.listen` as a single string.
+
+To apply this changes to an existing app, make the following change to `app-config.yaml`:
+
+```diff
+-    # Uncomment the following host directive to bind to all IPv4 interfaces and
+-    # not just the baseUrl hostname.
+-    # host: 0.0.0.0
++    # Uncomment the following host directive to bind to specific interfaces
++    # host: 127.0.0.1
+```
+
+And the following change to `app-config.production.yaml`:
+
+```diff
+-  listen:
+-    port: 7007
+-    # The following host directive binds to all IPv4 interfaces when its value
+-    # is "0.0.0.0". This is the most permissive setting. The right value depends
+-    # on your specific deployment. If you remove the host line entirely, the
+-    # backend will bind on the interface that corresponds to the backend.baseUrl
+-    # hostname.
+-    host: 0.0.0.0
++  # The listener can also be expressed as a single <host>:<port> string. In this case we bind to
++  # all interfaces, the most permissive setting. The right value depends on your specific deployment.
++  listen: ':7007'
+```
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2520b22a2da6e..7f506b42f5354 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,7 +17,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node-version: [14.x, 16.x]
+        node-version: [16.x, 18.x]
 
     env:
       CI: true
@@ -47,7 +47,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node-version: [14.x, 16.x]
+        node-version: [16.x, 18.x]
 
     env:
       CI: true
@@ -121,7 +121,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node-version: [14.x, 16.x]
+        node-version: [16.x, 18.x]
 
     services:
       postgres13:
diff --git a/.github/workflows/deploy_microsite.yml b/.github/workflows/deploy_microsite.yml
index af6f2223779a0..1f87c30af2b94 100644
--- a/.github/workflows/deploy_microsite.yml
+++ b/.github/workflows/deploy_microsite.yml
@@ -10,7 +10,7 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [14.x]
+        node-version: [16.x]
 
     env:
       CI: true
diff --git a/.github/workflows/deploy_nightly.yml b/.github/workflows/deploy_nightly.yml
index 476e5dd10b0ad..74dc60783a76a 100644
--- a/.github/workflows/deploy_nightly.yml
+++ b/.github/workflows/deploy_nightly.yml
@@ -11,7 +11,7 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [14.x]
+        node-version: [16.x]
 
     env:
       CI: true
diff --git a/.github/workflows/deploy_packages.yml b/.github/workflows/deploy_packages.yml
index f3736d93a25eb..56ff61c75bdd9 100644
--- a/.github/workflows/deploy_packages.yml
+++ b/.github/workflows/deploy_packages.yml
@@ -13,7 +13,7 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [14.x, 16.x]
+        node-version: [16.x, 18.x]
 
     services:
       postgres13:
@@ -130,7 +130,7 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [14.x]
+        node-version: [16.x]
 
     env:
       CI: 'true'
diff --git a/.github/workflows/sync_snyk-github-issues.yml b/.github/workflows/sync_snyk-github-issues.yml
index dd35ba26f39c6..de05c79300576 100644
--- a/.github/workflows/sync_snyk-github-issues.yml
+++ b/.github/workflows/sync_snyk-github-issues.yml
@@ -12,7 +12,7 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [14.x]
+        node-version: [16.x]
 
     steps:
       - uses: actions/checkout@v3
diff --git a/.github/workflows/verify_e2e-linux.yml b/.github/workflows/verify_e2e-linux.yml
index 3353a84f3bcf7..fefdd1fdd523b 100644
--- a/.github/workflows/verify_e2e-linux.yml
+++ b/.github/workflows/verify_e2e-linux.yml
@@ -31,7 +31,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest]
-        node-version: [14.x, 16.x]
+        node-version: [16.x, 18.x]
 
     env:
       CI: true
diff --git a/.github/workflows/verify_e2e-techdocs.yml b/.github/workflows/verify_e2e-techdocs.yml
index e1bb2246dc5a2..8d59d1589997e 100644
--- a/.github/workflows/verify_e2e-techdocs.yml
+++ b/.github/workflows/verify_e2e-techdocs.yml
@@ -18,7 +18,7 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [14.x, 16.x]
+        node-version: [16.x, 18.x]
 
     env:
       CI: true
diff --git a/.github/workflows/verify_e2e-tugboat.yml b/.github/workflows/verify_e2e-tugboat.yml
index 04d9e686e27a7..cb3a463a0d860 100644
--- a/.github/workflows/verify_e2e-tugboat.yml
+++ b/.github/workflows/verify_e2e-tugboat.yml
@@ -52,7 +52,7 @@ jobs:
       - uses: actions/checkout@v3
       - uses: actions/setup-node@v3
         with:
-          node-version: '14'
+          node-version: '16.x'
 
       - name: yarn install
         run: yarn --cwd cypress install
diff --git a/.github/workflows/verify_e2e-windows.yml b/.github/workflows/verify_e2e-windows.yml
index 4e8025f7d55bd..fc29c1f03bb1a 100644
--- a/.github/workflows/verify_e2e-windows.yml
+++ b/.github/workflows/verify_e2e-windows.yml
@@ -22,7 +22,7 @@ jobs:
     strategy:
       matrix:
         os: [windows-2019]
-        node-version: [14.x, 16.x]
+        node-version: [16.x, 18.x]
 
     env:
       CI: true
diff --git a/.github/workflows/verify_kubernetes.yml b/.github/workflows/verify_kubernetes.yml
index e64ddec586e51..e8c248699aece 100644
--- a/.github/workflows/verify_kubernetes.yml
+++ b/.github/workflows/verify_kubernetes.yml
@@ -12,7 +12,7 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [14.x, 16.x]
+        node-version: [16.x, 18.x]
 
     env:
       CI: true
diff --git a/.github/workflows/verify_microsite.yml b/.github/workflows/verify_microsite.yml
index 50c211609004a..3a24befa84c5e 100644
--- a/.github/workflows/verify_microsite.yml
+++ b/.github/workflows/verify_microsite.yml
@@ -12,7 +12,7 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [14.x]
+        node-version: [16.x]
 
     env:
       CI: true
diff --git a/.github/workflows/verify_windows.yml b/.github/workflows/verify_windows.yml
index 8bbaa645bf4b3..75a0633cbe352 100644
--- a/.github/workflows/verify_windows.yml
+++ b/.github/workflows/verify_windows.yml
@@ -13,7 +13,7 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [14.x, 16.x]
+        node-version: [16.x, 18.x]
 
     env:
       CI: true
diff --git a/contrib/docker/devops/Dockerfile b/contrib/docker/devops/Dockerfile
index a7c194618abd1..8703b2ab4858e 100644
--- a/contrib/docker/devops/Dockerfile
+++ b/contrib/docker/devops/Dockerfile
@@ -1,4 +1,4 @@
-ARG IMAGE_TAG=14-alpine
+ARG IMAGE_TAG=16-alpine
 
 FROM node:${IMAGE_TAG}
 
diff --git a/contrib/docker/frontend-with-nginx/Dockerfile.dockerbuild b/contrib/docker/frontend-with-nginx/Dockerfile.dockerbuild
index 41f931544f1a9..053b4fb4928e6 100644
--- a/contrib/docker/frontend-with-nginx/Dockerfile.dockerbuild
+++ b/contrib/docker/frontend-with-nginx/Dockerfile.dockerbuild
@@ -35,7 +35,7 @@
 
 
 
-FROM node:14-buster AS build
+FROM node:16-buster AS build
 
 RUN mkdir /app
 COPY . /app
diff --git a/cypress/tsconfig.json b/cypress/tsconfig.json
index d9b4869ecd249..9c4a63b76c52b 100644
--- a/cypress/tsconfig.json
+++ b/cypress/tsconfig.json
@@ -10,7 +10,7 @@
     "incremental": true,
     "isolatedModules": true,
     "jsx": "react",
-    "lib": ["DOM", "DOM.Iterable", "ScriptHost", "ES2020", "ESNext.Promise"],
+    "lib": ["DOM", "DOM.Iterable", "ScriptHost", "ES2021", "ESNext.Promise"],
     "module": "ESNext",
     "moduleResolution": "node",
     "noEmit": true,
@@ -31,7 +31,7 @@
     "strictNullChecks": true,
     "strictPropertyInitialization": true,
     "stripInternal": true,
-    "target": "ES2019",
+    "target": "ES2021",
     "types": ["node", "cypress"]
   }
 }
diff --git a/docs/features/search/how-to-guides.md b/docs/features/search/how-to-guides.md
index 01d85b8aa260f..5cc2ab5f0696b 100644
--- a/docs/features/search/how-to-guides.md
+++ b/docs/features/search/how-to-guides.md
@@ -171,6 +171,6 @@ const highlightOverride = {
 };
 ```
 
-[obj-mode]: https://nodejs.org/docs/latest-v14.x/api/stream.html#stream_object_mode
-[read-stream]: https://nodejs.org/docs/latest-v14.x/api/stream.html#stream_readable_streams
+[obj-mode]: https://nodejs.org/dist/latest-v16.x/docs/api/stream.html#stream_object_mode
+[read-stream]: https://nodejs.org/dist/latest-v16.x/docs/api/stream.html#readable-streams
 [async-gen]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of#iterating_over_async_generators
diff --git a/docs/getting-started/running-backstage-locally.md b/docs/getting-started/running-backstage-locally.md
index 7cc6f6be6a892..3e3e8b0727d43 100644
--- a/docs/getting-started/running-backstage-locally.md
+++ b/docs/getting-started/running-backstage-locally.md
@@ -21,12 +21,12 @@ This is made easy with a version manager such as
 # Installing current LTS release
 nvm install --lts
 > Installing latest LTS version.
-> Downloading and installing node v14.15.1...
-> Now using node v14.15.1 (npm v6.14.8)
+> Downloading and installing node v16.16.0...
+> Now using node v16.16.0 (npm v8.11.0)
 
 # Checking your version
 node --version
-> v14.15.1
+> v16.16.0
 ```
 
 - Yarn
diff --git a/docs/tutorials/quickstart-app-plugin.md b/docs/tutorials/quickstart-app-plugin.md
index d1ca61a11fa59..ea0a511c93ae9 100644
--- a/docs/tutorials/quickstart-app-plugin.md
+++ b/docs/tutorials/quickstart-app-plugin.md
@@ -20,7 +20,7 @@ title: Adding Custom Plugin to Existing Monorepo App
 > functionality, extend the Sidebar to make our life easy. Finally, we add
 > custom code to display GitHub repository information.
 >
-> This document assumes you have Node.js 14 active along with Yarn and Python.
+> This document assumes you have Node.js 16 active along with Yarn and Python.
 > Please note, that at the time of this writing, the current version is
 > 0.1.1-alpha.21. This guide can still be used with future versions, just,
 > verify as you go. If you run into issues, you can compare your setup with mine
diff --git a/package.json b/package.json
index 9f17e5ee36847..11e92b530bb13 100644
--- a/package.json
+++ b/package.json
@@ -2,7 +2,7 @@
   "name": "root",
   "private": true,
   "engines": {
-    "node": "14 || 16"
+    "node": "16 || 18"
   },
   "scripts": {
     "dev": "concurrently \"yarn start\" \"yarn start-backend\"",
@@ -73,6 +73,7 @@
     "husky": "^8.0.0",
     "lint-staged": "^13.0.0",
     "minimist": "^1.2.5",
+    "node-gyp": "^9.1.0",
     "prettier": "^2.2.1",
     "semver": "^7.3.2",
     "shx": "^0.3.2",
diff --git a/packages/backend-common/package.json b/packages/backend-common/package.json
index 94b2338ab0974..28a4f91aa2adf 100644
--- a/packages/backend-common/package.json
+++ b/packages/backend-common/package.json
@@ -42,7 +42,7 @@
     "@backstage/types": "workspace:^",
     "@google-cloud/storage": "^6.0.0",
     "@keyv/redis": "^2.2.3",
-    "@kubernetes/client-node": "^0.17.0",
+    "@kubernetes/client-node": "0.17.0",
     "@manypkg/get-packages": "^1.1.3",
     "@octokit/rest": "^19.0.3",
     "@types/cors": "^2.8.6",
@@ -80,7 +80,7 @@
     "request": "^2.88.2",
     "selfsigned": "^2.0.0",
     "stoppable": "^1.1.0",
-    "tar": "^6.1.2",
+    "tar": "^6.1.12",
     "uuid": "^8.3.2",
     "winston": "^3.2.1",
     "yauzl": "^2.10.0",
diff --git a/packages/cli/config/tsconfig.json b/packages/cli/config/tsconfig.json
index 33a8b0a9bd59e..5486f1900f408 100644
--- a/packages/cli/config/tsconfig.json
+++ b/packages/cli/config/tsconfig.json
@@ -11,7 +11,7 @@
     "incremental": true,
     "isolatedModules": true,
     "jsx": "react",
-    "lib": ["DOM", "DOM.Iterable", "ScriptHost", "ES2020"],
+    "lib": ["DOM", "DOM.Iterable", "ScriptHost", "ES2021"],
     "module": "ESNext",
     "moduleResolution": "node",
     "noEmit": false,
@@ -32,7 +32,7 @@
     "strictNullChecks": true,
     "strictPropertyInitialization": true,
     "stripInternal": true,
-    "target": "ES2019",
+    "target": "ES2021",
     "types": ["node", "jest", "webpack-env"],
     "useDefineForClassFields": true
   }
diff --git a/packages/cli/package.json b/packages/cli/package.json
index 9eb6bed3d6a04..be46d74a49841 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -117,7 +117,7 @@
     "style-loader": "^3.3.1",
     "sucrase": "^3.20.2",
     "swc-loader": "^0.2.3",
-    "tar": "^6.1.2",
+    "tar": "^6.1.12",
     "terser-webpack-plugin": "^5.1.3",
     "util": "^0.12.3",
     "webpack": "^5.70.0",
diff --git a/packages/create-app/templates/default-app/app-config.production.yaml b/packages/create-app/templates/default-app/app-config.production.yaml
index 6535d967d54ec..df09dac50a1db 100644
--- a/packages/create-app/templates/default-app/app-config.production.yaml
+++ b/packages/create-app/templates/default-app/app-config.production.yaml
@@ -9,14 +9,9 @@ backend:
   # callers. When its value is "http://localhost:7007", it's strictly private
   # and can't be reached by others.
   baseUrl: http://localhost:7007
-  listen:
-    port: 7007
-    # The following host directive binds to all IPv4 interfaces when its value
-    # is "0.0.0.0". This is the most permissive setting. The right value depends
-    # on your specific deployment. If you remove the host line entirely, the
-    # backend will bind on the interface that corresponds to the backend.baseUrl
-    # hostname.
-    host: 0.0.0.0
+  # The listener can also be expressed as a single <host>:<port> string. In this case we bind to
+  # all interfaces, the most permissive setting. The right value depends on your specific deployment.
+  listen: ':7007'
 
   # config options: https://node-postgres.com/api/client
   database:
diff --git a/packages/create-app/templates/default-app/app-config.yaml.hbs b/packages/create-app/templates/default-app/app-config.yaml.hbs
index 4a058deefd0a5..1a45d4015bdb7 100644
--- a/packages/create-app/templates/default-app/app-config.yaml.hbs
+++ b/packages/create-app/templates/default-app/app-config.yaml.hbs
@@ -15,9 +15,8 @@ backend:
   baseUrl: http://localhost:7007
   listen:
     port: 7007
-    # Uncomment the following host directive to bind to all IPv4 interfaces and
-    # not just the baseUrl hostname.
-    # host: 0.0.0.0
+    # Uncomment the following host directive to bind to specific interfaces
+    # host: 127.0.0.1
   csp:
     connect-src: ["'self'", 'http:', 'https:']
     # Content-Security-Policy directives follow the Helmet format: https://helmetjs.github.io/#reference
diff --git a/packages/create-app/templates/default-app/package.json.hbs b/packages/create-app/templates/default-app/package.json.hbs
index c5810d888020b..adcd3a57743a9 100644
--- a/packages/create-app/templates/default-app/package.json.hbs
+++ b/packages/create-app/templates/default-app/package.json.hbs
@@ -3,7 +3,7 @@
   "version": "1.0.0",
   "private": true,
   "engines": {
-    "node": "14 || 16"
+    "node": "16 || 18"
   },
   "scripts": {
     "dev": "concurrently \"yarn start\" \"yarn start-backend\"",
diff --git a/packages/e2e-test/src/commands/run.ts b/packages/e2e-test/src/commands/run.ts
index 3f9d28eadd1cf..f32d577cd4e79 100644
--- a/packages/e2e-test/src/commands/run.ts
+++ b/packages/e2e-test/src/commands/run.ts
@@ -507,6 +507,7 @@ async function testBackendStart(appDir: string, ...args: string[]) {
       // Skipping the whole block
       throw new Error(stderr);
     }
+    await new Promise(resolve => setTimeout(resolve, 500));
 
     print('Try to fetch entities from the backend');
     // Try fetch entities, should be ok
diff --git a/plugins/auth-backend/package.json b/plugins/auth-backend/package.json
index 4b3d7910e5715..67deb66b334da 100644
--- a/plugins/auth-backend/package.json
+++ b/plugins/auth-backend/package.json
@@ -60,7 +60,7 @@
     "morgan": "^1.10.0",
     "node-cache": "^5.1.2",
     "node-fetch": "^2.6.7",
-    "openid-client": "^5.1.3",
+    "openid-client": "^5.2.1",
     "passport": "^0.6.0",
     "passport-auth0": "^1.4.3",
     "passport-bitbucket-oauth2": "^0.1.2",
diff --git a/plugins/catalog-backend-module-github/src/lib/github.test.ts b/plugins/catalog-backend-module-github/src/lib/github.test.ts
index 25878c2005427..0002c4cef0e94 100644
--- a/plugins/catalog-backend-module-github/src/lib/github.test.ts
+++ b/plugins/catalog-backend-module-github/src/lib/github.test.ts
@@ -25,6 +25,11 @@ import {
   getOrganizationRepositories,
   QueryResponse,
 } from './github';
+import fetch from 'node-fetch';
+
+// Workaround for Node.js 18, where native fetch is available, but not yet picked up by msw
+// TODO(Rugvip): remove once https://github.com/mswjs/msw/issues/1388 is resolved
+(global as any).fetch = fetch;
 
 describe('github', () => {
   const server = setupServer();
diff --git a/plugins/cost-insights/package.json b/plugins/cost-insights/package.json
index b5859fa8867db..aac87aa10f7c4 100644
--- a/plugins/cost-insights/package.json
+++ b/plugins/cost-insights/package.json
@@ -71,7 +71,7 @@
     "@types/recharts": "^1.8.14",
     "@types/regression": "^2.0.0",
     "@types/yup": "^0.29.13",
-    "canvas": "^2.6.1",
+    "canvas": "^2.10.2",
     "cross-fetch": "^3.1.5",
     "msw": "^0.47.0"
   },
diff --git a/plugins/kubernetes-backend/package.json b/plugins/kubernetes-backend/package.json
index 4082bd5b3a627..ea6a1146a8284 100644
--- a/plugins/kubernetes-backend/package.json
+++ b/plugins/kubernetes-backend/package.json
@@ -43,7 +43,7 @@
     "@backstage/plugin-auth-node": "workspace:^",
     "@backstage/plugin-kubernetes-common": "workspace:^",
     "@google-cloud/container": "^4.0.0",
-    "@kubernetes/client-node": "^0.17.0",
+    "@kubernetes/client-node": "0.17.0",
     "@types/express": "^4.17.6",
     "@types/luxon": "^3.0.0",
     "aws-sdk": "^2.840.0",
diff --git a/plugins/kubernetes-common/package.json b/plugins/kubernetes-common/package.json
index 48c04fb222bf5..401341a0e8de1 100644
--- a/plugins/kubernetes-common/package.json
+++ b/plugins/kubernetes-common/package.json
@@ -39,7 +39,7 @@
   },
   "dependencies": {
     "@backstage/catalog-model": "workspace:^",
-    "@kubernetes/client-node": "^0.17.0"
+    "@kubernetes/client-node": "0.17.0"
   },
   "devDependencies": {
     "@backstage/cli": "workspace:^"
diff --git a/plugins/kubernetes/package.json b/plugins/kubernetes/package.json
index ee4da4b55f20d..0bed1a213b69e 100644
--- a/plugins/kubernetes/package.json
+++ b/plugins/kubernetes/package.json
@@ -40,7 +40,7 @@
     "@backstage/plugin-catalog-react": "workspace:^",
     "@backstage/plugin-kubernetes-common": "workspace:^",
     "@backstage/theme": "workspace:^",
-    "@kubernetes/client-node": "^0.17.0",
+    "@kubernetes/client-node": "0.17.0",
     "@material-ui/core": "^4.12.2",
     "@material-ui/icons": "^4.9.1",
     "@material-ui/lab": "4.0.0-alpha.57",
diff --git a/plugins/scaffolder-backend/scripts/build-nunjucks.js b/plugins/scaffolder-backend/scripts/build-nunjucks.js
index b195f96159d47..8b98ac43059a4 100755
--- a/plugins/scaffolder-backend/scripts/build-nunjucks.js
+++ b/plugins/scaffolder-backend/scripts/build-nunjucks.js
@@ -58,7 +58,7 @@ require('esbuild')
     bundle: true,
     format: 'cjs',
     platform: 'node',
-    target: 'node14',
+    target: 'node16',
     banner: { js: NUNJUCKS_LICENSE },
     external: ['fsevents'],
     outfile: path.resolve(__dirname, '../assets/nunjucks.js.txt'),
diff --git a/plugins/techdocs/package.json b/plugins/techdocs/package.json
index cb03cb9e3f836..9eb6f6af3aff5 100644
--- a/plugins/techdocs/package.json
+++ b/plugins/techdocs/package.json
@@ -76,7 +76,7 @@
     "@types/dompurify": "^2.2.2",
     "@types/event-source-polyfill": "^1.0.0",
     "@types/node": "^16.11.26",
-    "canvas": "^2.6.1",
+    "canvas": "^2.10.2",
     "cross-fetch": "^3.1.5",
     "msw": "^0.47.0"
   },
diff --git a/scripts/check-type-dependencies.js b/scripts/check-type-dependencies.js
index ba362bd5ff73d..ebad9b6dfcd97 100755
--- a/scripts/check-type-dependencies.js
+++ b/scripts/check-type-dependencies.js
@@ -136,10 +136,21 @@ function findTypesPackage(dep, pkg) {
         return undefined;
       } catch {
         try {
-          // Finally check if it's just a .d.ts file
+          // Check if it's just a .d.ts file
           require.resolve(`${dep}.d.ts`, { paths: [pkg.dir] });
           return undefined;
         } catch {
+          // And finally a naive lookup of the file directly, in case `require.resolve` fails us due to "exports"
+          if (fs.existsSync(resolvePath(pkg.dir, `node_modules/${dep}.d.ts`))) {
+            return undefined;
+          }
+          if (
+            fs.existsSync(
+              resolvePath(pkg.dir, `../../node_modules/${dep}.d.ts`),
+            )
+          ) {
+            return undefined;
+          }
           throw mkErr('MissingDepError', `No types for ${dep}`, { dep });
         }
       }
diff --git a/yarn.lock b/yarn.lock
index 909d52aaf6886..6e2d6fb8ebb66 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -3148,7 +3148,7 @@ __metadata:
     "@backstage/types": "workspace:^"
     "@google-cloud/storage": ^6.0.0
     "@keyv/redis": ^2.2.3
-    "@kubernetes/client-node": ^0.17.0
+    "@kubernetes/client-node": 0.17.0
     "@manypkg/get-packages": ^1.1.3
     "@octokit/rest": ^19.0.3
     "@types/archiver": ^5.1.0
@@ -3209,7 +3209,7 @@ __metadata:
     selfsigned: ^2.0.0
     stoppable: ^1.1.0
     supertest: ^6.1.3
-    tar: ^6.1.2
+    tar: ^6.1.12
     uuid: ^8.3.2
     winston: ^3.2.1
     yauzl: ^2.10.0
@@ -3474,7 +3474,7 @@ __metadata:
     style-loader: ^3.3.1
     sucrase: ^3.20.2
     swc-loader: ^0.2.3
-    tar: ^6.1.2
+    tar: ^6.1.12
     terser-webpack-plugin: ^5.1.3
     ts-node: ^10.0.0
     type-fest: ^2.0.0
@@ -4296,7 +4296,7 @@ __metadata:
     msw: ^0.47.0
     node-cache: ^5.1.2
     node-fetch: ^2.6.7
-    openid-client: ^5.1.3
+    openid-client: ^5.2.1
     passport: ^0.6.0
     passport-auth0: ^1.4.3
     passport-bitbucket-oauth2: ^0.1.2
@@ -5485,7 +5485,7 @@ __metadata:
     "@types/recharts": ^1.8.14
     "@types/regression": ^2.0.0
     "@types/yup": ^0.29.13
-    canvas: ^2.6.1
+    canvas: ^2.10.2
     classnames: ^2.2.6
     cross-fetch: ^3.1.5
     history: ^5.0.0
@@ -6220,7 +6220,7 @@ __metadata:
     "@backstage/plugin-auth-node": "workspace:^"
     "@backstage/plugin-kubernetes-common": "workspace:^"
     "@google-cloud/container": ^4.0.0
-    "@kubernetes/client-node": ^0.17.0
+    "@kubernetes/client-node": 0.17.0
     "@types/aws4": ^1.5.1
     "@types/express": ^4.17.6
     "@types/luxon": ^3.0.0
@@ -6249,7 +6249,7 @@ __metadata:
   dependencies:
     "@backstage/catalog-model": "workspace:^"
     "@backstage/cli": "workspace:^"
-    "@kubernetes/client-node": ^0.17.0
+    "@kubernetes/client-node": 0.17.0
   languageName: unknown
   linkType: soft
 
@@ -6268,7 +6268,7 @@ __metadata:
     "@backstage/plugin-kubernetes-common": "workspace:^"
     "@backstage/test-utils": "workspace:^"
     "@backstage/theme": "workspace:^"
-    "@kubernetes/client-node": ^0.17.0
+    "@kubernetes/client-node": 0.17.0
     "@material-ui/core": ^4.12.2
     "@material-ui/icons": ^4.9.1
     "@material-ui/lab": 4.0.0-alpha.57
@@ -7741,7 +7741,7 @@ __metadata:
     "@types/dompurify": ^2.2.2
     "@types/event-source-polyfill": ^1.0.0
     "@types/node": ^16.11.26
-    canvas: ^2.6.1
+    canvas: ^2.10.2
     cross-fetch: ^3.1.5
     dompurify: ^2.2.9
     event-source-polyfill: 1.0.25
@@ -10671,7 +10671,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@kubernetes/client-node@npm:^0.17.0":
+"@kubernetes/client-node@npm:0.17.0":
   version: 0.17.0
   resolution: "@kubernetes/client-node@npm:0.17.0"
   dependencies:
@@ -14332,11 +14332,11 @@ __metadata:
   linkType: hard
 
 "@types/minipass@npm:*":
-  version: 3.3.5
-  resolution: "@types/minipass@npm:3.3.5"
+  version: 3.1.2
+  resolution: "@types/minipass@npm:3.1.2"
   dependencies:
-    minipass: "*"
-  checksum: 160f4ae5416697c947e0c0ee1225fe25973acf73a30d01bdf202447f12bd32ba3ea33d2fc4f2517a038dc408022a5aff5f7a1d92da0157a9b04276d1b0209550
+    "@types/node": "*"
+  checksum: 0d01e11b5b959625385a482ad29ea16352be42506b459555b0f77fd82235e9c540946cc9c05a73fed1ae30b132914baaa4ccf257ed2cad20bc9773f0a06f4bac
   languageName: node
   linkType: hard
 
@@ -14394,7 +14394,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@types/node@npm:*, @types/node@npm:>= 8, @types/node@npm:>=12.12.47, @types/node@npm:>=13.7.0":
+"@types/node@npm:*, @types/node@npm:>=12.12.47, @types/node@npm:>=13.7.0":
   version: 18.11.9
   resolution: "@types/node@npm:18.11.9"
   checksum: cc0aae109e9b7adefc32eecb838d6fad931663bb06484b5e9cbbbf74865c721b03d16fd8d74ad90e31dbe093d956a7c2c306ba5429ba0c00f3f7505103d7a496
@@ -14408,6 +14408,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@types/node@npm:>= 8":
+  version: 18.7.4
+  resolution: "@types/node@npm:18.7.4"
+  checksum: 051d2147e4d8129fceb63ee9384259b2f224dbc4e4b0c46d96a6b61cbaad4e3fe4060950e7f4fc3d5692b1e6ea47e68ad03b61155754bfa169593747cfe3f8f4
+  languageName: node
+  linkType: hard
+
 "@types/node@npm:^10.1.0, @types/node@npm:^10.12.0":
   version: 10.17.60
   resolution: "@types/node@npm:10.17.60"
@@ -14754,14 +14761,14 @@ __metadata:
   linkType: hard
 
 "@types/request@npm:^2.47.1":
-  version: 2.48.5
-  resolution: "@types/request@npm:2.48.5"
+  version: 2.48.8
+  resolution: "@types/request@npm:2.48.8"
   dependencies:
     "@types/caseless": "*"
     "@types/node": "*"
     "@types/tough-cookie": "*"
     form-data: ^2.5.0
-  checksum: 02572a0558b9a95ae1a2fa3912b45c4c12f587e25773b2d9bdbf5dfa6f2da5e3787d22256ee0dc4836250f39cf2dcb39fc4ded5bf554c0f948a623c8772e8bd3
+  checksum: 0b7754941e08205dce51635d894ec524df276d2b83ca13b9aab723f9281acecf1108841e9554494cb1cb60f6d6ddbb47ebea97392bcf2bf607f035b3a9b4af45
   languageName: node
   linkType: hard
 
@@ -14952,11 +14959,11 @@ __metadata:
   linkType: hard
 
 "@types/stream-buffers@npm:^3.0.3":
-  version: 3.0.3
-  resolution: "@types/stream-buffers@npm:3.0.3"
+  version: 3.0.4
+  resolution: "@types/stream-buffers@npm:3.0.4"
   dependencies:
     "@types/node": "*"
-  checksum: c3456fa2a18f89d31c54fe169621d8288a9735fb7e92aba45786642659d93be26fa0b4caa5c1043b21f4cfaeeefc24d247fa833586a8a0f3aecedf03adb7b5ac
+  checksum: 5b432b2bf963d612747b79ac317562888236d6a9ea14414fb055c24e7be9643b5e3c7b7470841fa82802aa1c1c0d752a4ba935bbc0cfb12de6b89f7e1dadee92
   languageName: node
   linkType: hard
 
@@ -15086,9 +15093,9 @@ __metadata:
   linkType: hard
 
 "@types/underscore@npm:^1.8.9":
-  version: 1.10.23
-  resolution: "@types/underscore@npm:1.10.23"
-  checksum: 5e9458888e8c09a0f61f93f5958d4ce57e02e317b21444319f7e4a11796445e58a78d6c743dad17365aa8fb9c31fa23d5f4d30a9047fa2df30d446ccc5e42023
+  version: 1.11.4
+  resolution: "@types/underscore@npm:1.11.4"
+  checksum: db9f8486bc851b732259e51f42d62aad1ae2158be5724612dc125ece5f5d61c51447f9dea28284c2a0f79cb95e788d01cb5ce97709880019213e69fab0dd1696
   languageName: node
   linkType: hard
 
@@ -17984,7 +17991,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"canvas@npm:^2.6.1":
+"canvas@npm:^2.10.2":
   version: 2.10.2
   resolution: "canvas@npm:2.10.2"
   dependencies:
@@ -27150,14 +27157,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"jose@npm:^4.1.4":
-  version: 4.5.0
-  resolution: "jose@npm:4.5.0"
-  checksum: 51142150a9f571ca318842d34ac0daec49fb70bfb6034c68fd46d8c804a8325065876067202310c8ff3cbfc5ca8e44d4712467b4da0d3cadf1e47c96989ca4ca
-  languageName: node
-  linkType: hard
-
-"jose@npm:^4.6.0":
+"jose@npm:^4.10.0, jose@npm:^4.6.0":
   version: 4.10.4
   resolution: "jose@npm:4.10.4"
   checksum: 0e6caaae0b0303534c0ac23711d45eadfbdbff63d9aeed80965c668b5532c254ab25b48afddc3e1ecfcfd36b4275dee41174a097c5a47a25ce04268c78f3c130
@@ -30074,15 +30074,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"minipass@npm:*":
-  version: 3.3.4
-  resolution: "minipass@npm:3.3.4"
-  dependencies:
-    yallist: ^4.0.0
-  checksum: 5d95a7738c54852ba78d484141e850c792e062666a2d0c681a5ac1021275beb7e1acb077e59f9523ff1defb80901aea4e30fac10ded9a20a25d819a42916ef1b
-  languageName: node
-  linkType: hard
-
 "minipass@npm:^3.0.0, minipass@npm:^3.1.0, minipass@npm:^3.1.1, minipass@npm:^3.1.3, minipass@npm:^3.1.6":
   version: 3.1.6
   resolution: "minipass@npm:3.1.6"
@@ -30594,7 +30585,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"node-gyp@npm:latest":
+"node-gyp@npm:^9.1.0, node-gyp@npm:latest":
   version: 9.1.0
   resolution: "node-gyp@npm:9.1.0"
   dependencies:
@@ -31238,27 +31229,15 @@ __metadata:
   languageName: node
   linkType: hard
 
-"openid-client@npm:^5.1.3":
-  version: 5.1.10
-  resolution: "openid-client@npm:5.1.10"
-  dependencies:
-    jose: ^4.1.4
-    lru-cache: ^6.0.0
-    object-hash: ^2.0.1
-    oidc-token-hash: ^5.0.1
-  checksum: 38a4bf08ea4ee4576043968307cf53f0369df224bd025c1bc348b295152df36c47d2a836dfe1505d15c6b79c05f86aadefad798bd3ea3ccbe90834be01f2245c
-  languageName: node
-  linkType: hard
-
-"openid-client@npm:^5.1.6":
-  version: 5.1.9
-  resolution: "openid-client@npm:5.1.9"
+"openid-client@npm:^5.1.6, openid-client@npm:^5.2.1":
+  version: 5.2.1
+  resolution: "openid-client@npm:5.2.1"
   dependencies:
-    jose: ^4.1.4
+    jose: ^4.10.0
     lru-cache: ^6.0.0
     object-hash: ^2.0.1
     oidc-token-hash: ^5.0.1
-  checksum: 55390a7eceaafdc340a5f2ece576eb4863fcb4cd8840e4a7a1af66bbaf830623b18cf1dd0b8ce472c6f36c6313e78f92db48ca0c10eb8c681a81e5a3d607fc9f
+  checksum: b2e9ee8bafb30981fe8eb4446d86578649f05e61d6289abfe79c863578ef8ab24eb4430461c2b8dbb50cbaff89af01e77439df5ebb87c391ed1e336a0e69e590
   languageName: node
   linkType: hard
 
@@ -35450,6 +35429,7 @@ __metadata:
     husky: ^8.0.0
     lint-staged: ^13.0.0
     minimist: ^1.2.5
+    node-gyp: ^9.1.0
     prettier: ^2.2.1
     semver: ^7.3.2
     shx: ^0.3.2
@@ -37550,7 +37530,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"tar@npm:^6.1.2":
+"tar@npm:^6.1.12, tar@npm:^6.1.2":
   version: 6.1.12
   resolution: "tar@npm:6.1.12"
   dependencies: