[Snyk] Fix for 1 vulnerabilities

[johnnyhuy]

User description

Snyk has created this PR to fix 1 vulnerabilities in the yarn dependencies of this project.

Snyk changed the following file(s):

• packages/backend/package.json

Note for zero-installs users

If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the .yarn/cache/ directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run yarn to update the contents of the ./yarn/cache directory.
If you are not using zero-install you can ignore this as your flow should likely be unchanged.

⚠️ Warning

Failed to update the yarn.lock, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Regular Expression Denial of Service (ReDoS) SNYK-JS-FASTXMLPARSER-7573289	559

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)

---

PR Type

Bug fix, Dependencies

---

Description

• Upgraded @backstage/backend-plugin-api from ^0.7.0 to ^0.8.0 to address vulnerabilities.
• Upgraded @backstage/plugin-auth-backend-module-github-provider from ^0.1.19 to ^0.1.20 to address vulnerabilities.
• Upgraded @backstage/plugin-techdocs-backend from ^1.10.8 to ^1.10.10 to address vulnerabilities.

---

Changes walkthrough 📝

	Relevant files
Dependencies	package.json Upgrade dependencies to fix vulnerabilities                            packages/backend/package.json Upgraded @backstage/backend-plugin-api from ^0.7.0 to ^0.8.0 Upgraded @backstage/plugin-auth-backend-module-github-provider from ^0.1.19 to ^0.1.20 Upgraded @backstage/plugin-techdocs-backend from ^1.10.8 to ^1.10.10 +3/-3

---

💡 PR-Agent usage:
Comment /help on the PR to get a list of all available PR-Agent tools and their descriptions

[echohello-codium-ai-pr-agent]

PR Review 🔍

⏱️ Estimated effort to review [1-5]	2, because the PR involves simple version updates in the package.json file, which are straightforward to review. However, the reviewer should verify that these updates address the security vulnerabilities mentioned and ensure compatibility with other packages.
🧪 Relevant tests	No
⚡ Possible issues	Dependency Compatibility: The updated versions of dependencies might introduce compatibility issues with other parts of the system.
	Manual Update Required: The PR mentions a failure to update the yarn.lock file, which needs to be manually updated before merging. This could lead to inconsistencies or unresolved dependencies.
🔒 Security concerns	No

[echohello-codium-ai-pr-agent]

PR Code Suggestions ✨

Category	Suggestion	Score
Possible issue	Verify compatibility of new auth module with existing modules Ensure that the newly added dependency @backstage/plugin-auth-backend-module-github-provider is compatible with other @backstage/plugin-auth-backend modules to avoid version conflicts or functionality issues. packages/backend/package.json [27] -"@backstage/plugin-auth-backend-module-github-provider": "^0.1.20", +"@backstage/plugin-auth-backend-module-github-provider": "^0.1.20", # Verify compatibility with other auth modules Suggestion importance[1-10]: 8 Why: Ensuring compatibility between modules is important to avoid potential conflicts or functionality issues, especially when introducing new dependencies.	8
	Confirm that the update of @backstage/backend-plugin-api introduces no breaking changes Review the necessity of updating @backstage/backend-plugin-api from 0.7.0 to 0.8.0 as major version changes might introduce breaking changes or require updates in other parts of the application. packages/backend/package.json [21] -"@backstage/backend-plugin-api": "^0.8.0", +"@backstage/backend-plugin-api": "^0.8.0", # Confirm no breaking changes Suggestion importance[1-10]: 8 Why: Major version updates can introduce breaking changes. It is crucial to verify that the update does not negatively impact other parts of the application.	8
Best practice	Pin the version of @backstage/plugin-techdocs-backend to a specific minor version Consider pinning the version of @backstage/plugin-techdocs-backend to a specific minor version instead of using the caret (^) version range. This can help ensure stability and predictability in your dependencies, especially for production builds. packages/backend/package.json [42] -"@backstage/plugin-techdocs-backend": "^1.10.10", +"@backstage/plugin-techdocs-backend": "1.10.10", Suggestion importance[1-10]: 7 Why: Pinning the version can help ensure stability and predictability, which is a good practice for production builds. However, it is not a critical issue.	7
Maintainability	Check for further necessary updates after dependency changes After updating dependencies, it's a good practice to ensure that all dependencies are up-to-date and no further updates are required to maintain compatibility across the application. packages/backend/package.json [42] -"@backstage/plugin-techdocs-backend": "^1.10.10", +"@backstage/plugin-techdocs-backend": "^1.10.10", # Check for further necessary updates Suggestion importance[1-10]: 6 Why: While it is good practice to ensure all dependencies are up-to-date, this suggestion is more of a general reminder and less critical than verifying specific compatibility or breaking changes.	6