@backstage/plugin-scaffolder-backend@3.3.1
Review before merging.
7 known advisories (worst: high), no fixed version found on this major.
Why this verdict
- 7 known advisories (worst: high), no fixed version found on this major.Evidence
Confidence 100% · algorithm v1 · computed 2026-10-23. How verdicts work
Supply chain and security
- Malware reports
- None known (OSV)
- Known advisories
- 7 known
- License
- Apache-2.0
- Install scripts
- None
- Build provenance
- No provenance
- Weekly downloads
- 126
- GHSA-29gx-h2m3-xw44Backstage's scaffolder credential handling may allow unintended GitHub authentication fallback
- GHSA-4xvq-3m68-h444Backstage has sensitive information exposure in scaffolder task logs
- GHSA-7hfw-grcm-cqm6Backstage: Incorrect authorization in scaffolder task listing
- GHSA-95p4-vv4g-jxxmBackstage may expose sensitive information in Scaffolder task failure events
- GHSA-mfvq-x7vr-rgqgBackstage: Secret-derived values may be exposed in scaffolder task logs
- GHSA-vwp5-f99x-x3rqBackstage has improper input validation in scaffolder task list ordering
- GHSA-xvgh-hmx8-9xxfBackstage: Improper task state validation in Scaffolder backend
Compatibility
No compatibility boundary is crossed: this is a patch or minor release on a stable major.
Check the official release notes below for behaviour changes before merging.
Release notes
Read the package page on npm for this version’s features and fixes.
Deprecations and deadlines
The maintainer has not deprecated this version on npm.