paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 42 Packages Projects Releases Wiki Activity

Bump glob to v13 and rollup to v4.59+ to fix security vulnerabilities

Browse Source 
Addresses the high severity rollup path traversal vulnerability
(GHSA-mw96-cpmx-2vgc) and the glob security advisory by upgrading
all instances across the monorepo. Updates code that used the legacy
callback-based glob API to use the modern promise/sync API.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
This commit is contained in:
Fredrik Adelöw
2026-03-30 23:02:37 +02:00
parent 0419acede2
commit 2e5c5f85b2
12 changed files with 158 additions and 155 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.changeset/bump-glob-rollup-security.md
+11
View File
@@ -0,0 +1,11 @@
---
'@backstage/plugin-catalog-backend': patch
'@backstage/cli-module-auth': patch
'@backstage/cli-module-build': patch
'@backstage/cli-module-test-jest': patch
'@backstage/cli': patch
'@backstage/ui': patch
'@backstage/repo-tools': patch
---
Bumped `glob` dependency from v7/v8/v11 to v13 to address security vulnerabilities in older versions. Bumped `rollup` from v4.27 to v4.59+ to fix a high severity path traversal vulnerability (GHSA-mw96-cpmx-2vgc).