[Snyk] Security upgrade @backstage/plugin-api-docs from 0.11.6 to 0.11.8

[johnnyhuy]

User description

Snyk has created this PR to fix 1 vulnerabilities in the yarn dependencies of this project.

Snyk changed the following file(s):

• packages/app/package.json

Note for zero-installs users

If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the .yarn/cache/ directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run yarn to update the contents of the ./yarn/cache directory.
If you are not using zero-install you can ignore this as your flow should likely be unchanged.

⚠️ Warning

Failed to update the yarn.lock, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Infinite loop SNYK-JS-MARKDOWNIT-6483324	696

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

---

PR Type

Bug fix, Dependencies

---

Description

• Updated the @backstage/plugin-api-docs dependency from version 0.11.6 to 0.11.8 to address a high severity vulnerability (SNYK-JS-MARKDOWNIT-6483324).
• This update is aimed at fixing an infinite loop vulnerability in the markdown-it package.
• Note: Users leveraging Yarn's zero-installs feature will need to run yarn to update the contents of the ./yarn/cache directory.

---

Changes walkthrough 📝

	Relevant files
Dependencies	package.json Update `@backstage/plugin-api-docs` to fix security vulnerability packages/app/package.json Updated @backstage/plugin-api-docs dependency version from 0.11.6 to 0.11.8. Addressed a high severity vulnerability related to markdown-it. +1/-1

---

💡 PR-Agent usage:
Comment /help on the PR to get a list of all available PR-Agent tools and their descriptions

[echohello-codium-ai-pr-agent]

PR Review 🔍

⏱️ Estimated effort to review [1-5]	1, because the PR involves a simple version bump in the package.json file, which is straightforward and typically low risk.
🧪 Relevant tests	No
⚡ Possible issues	Possible Dependency Issue: The PR mentions a failure to update the yarn.lock file, which could lead to inconsistencies or unresolved vulnerabilities if not addressed before merging.
🔒 Security concerns	No

[echohello-codium-ai-pr-agent]

PR Code Suggestions ✨

Category	Suggestion	Score
Best practice	Pin the version of @backstage/plugin-api-docs to a specific version to avoid unexpected upgrades Consider pinning the version of @backstage/plugin-api-docs to 0.11.8 instead of using the caret (^) version range. This can help ensure that the specific, reviewed version is used, which can prevent the introduction of unexpected changes through automatic minor version upgrades. packages/app/package.json [24] -"@backstage/plugin-api-docs": "^0.11.8", +"@backstage/plugin-api-docs": "0.11.8", Suggestion importance[1-10]: 8 Why: Pinning the version of @backstage/plugin-api-docs to a specific version can help ensure stability by preventing unexpected changes from automatic minor version upgrades. This is a best practice for maintaining consistent behavior in dependencies.	8