From 5fcbef26279430eca5e23e9f9ada94b1a9635d7b Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Fri, 6 Mar 2026 19:48:28 +0000
Subject: [PATCH 1/2] fix(deps): update dependency express-rate-limit to v8
 [security]

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 .changeset/renovate-9a29a92.md         |  5 +++++
 packages/backend-defaults/package.json |  2 +-
 yarn.lock                              | 29 +++++++++-----------------
 3 files changed, 16 insertions(+), 20 deletions(-)
 create mode 100644 .changeset/renovate-9a29a92.md

diff --git a/.changeset/renovate-9a29a92.md b/.changeset/renovate-9a29a92.md
new file mode 100644
index 0000000000..5e8393e040
--- /dev/null
+++ b/.changeset/renovate-9a29a92.md
@@ -0,0 +1,5 @@
+---
+'@backstage/backend-defaults': patch
+---
+
+Updated dependency `express-rate-limit` to `^8.0.0`.
diff --git a/packages/backend-defaults/package.json b/packages/backend-defaults/package.json
index 4aaf0408b4..aaa3f05db9 100644
--- a/packages/backend-defaults/package.json
+++ b/packages/backend-defaults/package.json
@@ -164,7 +164,7 @@
     "cron": "^3.0.0",
     "express": "^4.22.0",
     "express-promise-router": "^4.1.0",
-    "express-rate-limit": "^7.5.0",
+    "express-rate-limit": "^8.0.0",
     "fs-extra": "^11.2.0",
     "git-url-parse": "^15.0.0",
     "helmet": "^6.0.0",
diff --git a/yarn.lock b/yarn.lock
index 68e68bb140..8747714b92 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -3016,7 +3016,7 @@ __metadata:
     cron: "npm:^3.0.0"
     express: "npm:^4.22.0"
     express-promise-router: "npm:^4.1.0"
-    express-rate-limit: "npm:^7.5.0"
+    express-rate-limit: "npm:^8.0.0"
     fs-extra: "npm:^11.2.0"
     get-port: "npm:^5.1.1"
     git-url-parse: "npm:^15.0.0"
@@ -31622,23 +31622,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"express-rate-limit@npm:^7.5.0":
-  version: 7.5.1
-  resolution: "express-rate-limit@npm:7.5.1"
-  peerDependencies:
-    express: ">= 4.11"
-  checksum: 10/357c3398450144ab7bbce2841d0bf4f93a0f3fd9d1d5ed9a0ee331b557af969cc790941dc37b47f8d9b5672964aa0e31666f770e1f48b334dc7d1e69f6433040
-  languageName: node
-  linkType: hard
-
-"express-rate-limit@npm:^8.2.1":
-  version: 8.2.1
-  resolution: "express-rate-limit@npm:8.2.1"
+"express-rate-limit@npm:^8.0.0, express-rate-limit@npm:^8.2.1":
+  version: 8.3.0
+  resolution: "express-rate-limit@npm:8.3.0"
   dependencies:
-    ip-address: "npm:10.0.1"
+    ip-address: "npm:10.1.0"
   peerDependencies:
     express: ">= 4.11"
-  checksum: 10/7cbf70df2e88e590e463d2d8f93380775b2ea181d97f2c50c2ff9f2c666c247f83109a852b21d9c99ccc5762119101f281f54a27252a2f1a0a918be6d71f955b
+  checksum: 10/e896a66fecc10639e65873186fdfb71f19d6af650220eb7ea5450725215c3eed8dc6ddcfa1e68a9db8c9facc3326fbc281512ad3ccd8f107f42a2466ce12c18c
   languageName: node
   linkType: hard
 
@@ -34966,10 +34957,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"ip-address@npm:10.0.1":
-  version: 10.0.1
-  resolution: "ip-address@npm:10.0.1"
-  checksum: 10/09731acda32cd8e14c46830c137e7e5940f47b36d63ffb87c737331270287d631cf25aa95570907a67d3f919fdb25f4470c404eda21e62f22e0a55927f4dd0fb
+"ip-address@npm:10.1.0":
+  version: 10.1.0
+  resolution: "ip-address@npm:10.1.0"
+  checksum: 10/a6979629d1ad9c1fb424bc25182203fad739b40225aebc55ec6243bbff5035faf7b9ed6efab3a097de6e713acbbfde944baacfa73e11852bb43989c45a68d79e
   languageName: node
   linkType: hard
 

From a0854012358bc1928c5a27a1d45fa2f78721e69c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fredrik=20Adel=C3=B6w?= <freben@gmail.com>
Date: Mon, 9 Mar 2026 11:14:54 +0100
Subject: [PATCH 2/2] Update packages/backend-defaults/package.json
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Fredrik Adelöw <freben@gmail.com>
---
 packages/backend-defaults/package.json | 2 +-
 yarn.lock                              | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/packages/backend-defaults/package.json b/packages/backend-defaults/package.json
index aaa3f05db9..95df1407ad 100644
--- a/packages/backend-defaults/package.json
+++ b/packages/backend-defaults/package.json
@@ -164,7 +164,7 @@
     "cron": "^3.0.0",
     "express": "^4.22.0",
     "express-promise-router": "^4.1.0",
-    "express-rate-limit": "^8.0.0",
+    "express-rate-limit": "^8.2.2",
     "fs-extra": "^11.2.0",
     "git-url-parse": "^15.0.0",
     "helmet": "^6.0.0",
diff --git a/yarn.lock b/yarn.lock
index 8747714b92..57514f8b00 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -3016,7 +3016,7 @@ __metadata:
     cron: "npm:^3.0.0"
     express: "npm:^4.22.0"
     express-promise-router: "npm:^4.1.0"
-    express-rate-limit: "npm:^8.0.0"
+    express-rate-limit: "npm:^8.2.2"
     fs-extra: "npm:^11.2.0"
     get-port: "npm:^5.1.1"
     git-url-parse: "npm:^15.0.0"
@@ -31622,7 +31622,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"express-rate-limit@npm:^8.0.0, express-rate-limit@npm:^8.2.1":
+"express-rate-limit@npm:^8.2.1, express-rate-limit@npm:^8.2.2":
   version: 8.3.0
   resolution: "express-rate-limit@npm:8.3.0"
   dependencies: