[kachawla]

Summary

Moves transitive dependencies with high severity advisories to patched versions. Most of it is a yarn.lock refresh within ranges the parents already allow. Two exact pins from @module-federation/dts-plugin@2.8.2 need narrow resolutions entries.

Reason for change

These advisories were open on adm-zip, brace-expansion, form-data, http-proxy-middleware, ip-address, js-cookie, js-yaml, mysql2, path-to-regexp, and undici. Dependabot security update runs for this repo have been failing, so these need a manual update.

Lockfile only, within existing ranges (first commit):

Package	Before	After	Notes
brace-expansion	2.0.2, 5.0.4	2.1.7, 5.0.12	1.1.21 is not affected
form-data	4.0.5	4.0.6	2.5.6 is not affected
http-proxy-middleware	3.0.5	3.0.7	Only used by @types/http-proxy-middleware (range *). Kept on 3.x instead of jumping to 4.x
ip-address	10.1.0	10.7.4	express-rate-limit 8.3.1 pinned 10.1.0. Refreshed it to 8.7.1 (within ^8.2.2), which uses ^10.2.0
js-cookie	2.2.1	removed	react-use 17.6.0 used js-cookie@^2. All react-use@^17 ranges now resolve to 17.6.1, which uses 3.0.8
js-yaml	4.3.1	4.3.2	3.15.2 is not affected
mysql2	3.20.0	3.24.6	Within the existing ^3 resolution
path-to-regexp	8.3.0	8.4.2	0.1.13 (express 4) is not affected
undici	7.29.0, 8.7.0	7.30.1, 8.12.2	^7 and ^8 ranges

Resolutions (second commit): @backstage/cli-module-build depends on @module-federation/enhanced@~2.8.2, which pulls in @module-federation/dts-plugin@2.8.2. That version pins adm-zip@0.6.0 and undici@7.29.0 exactly, and there is no newer 2.8.x. The resolutions are keyed to those exact descriptors and move them to the patch releases adm-zip@0.6.1 and undici@7.29.1, which are already in the lockfile through dts-plugin@2.9.2.

Not fixed here:

• basic-ftp 5.3.1 (via pac-proxy-agent > get-uri): the fix is only in 6.2.1, and even the latest get-uri still depends on basic-ftp@^5.
• @graphql-tools/utils 8.x (via @backstage/backend-openapi-utils > mockttp@3): the fix is only in 12.0.1. mockttp@4 still uses ^11.
• node-forge 1.4.0: no patched version is available yet.

How to test

1. Check out this branch and run yarn install --immutable. It should pass with no lockfile changes.
2. Run yarn why <pkg> for each package above. Only the "After" versions should show up, plus the unaffected major lines noted.
3. Run yarn tsc, yarn lint:all, yarn build:all, and yarn test:all. All should pass.

File change summary

File	Summary of change
yarn.lock	Refreshed the entries listed above. Dropped adm-zip@0.6.0, undici@7.29.0, js-cookie@2.2.1, react-use@17.6.0, and @types/js-cookie. Picked up new transitive deps of mysql2 3.24.6 (sql-escaper, iconv-lite).
package.json	Added resolutions for adm-zip@npm:0.6.0 and undici@npm:7.29.0.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details

Package	Version	Score	Details
npm/brace-expansion	2.1.7	🟢 7	Details Check Score Reason Code-Review ⚠️ 1 Found 3/17 approved changesets -- score normalized to 1 Maintained 🟢 10 18 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Packaging ⚠️ -1 packaging workflow not detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 9 license file detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/brace-expansion	5.0.12	🟢 7	Details Check Score Reason Code-Review ⚠️ 1 Found 3/17 approved changesets -- score normalized to 1 Maintained 🟢 10 18 commit(s) and 15 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Packaging ⚠️ -1 packaging workflow not detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 9 license file detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/express-rate-limit	8.7.1	Unknown	Unknown
npm/form-data	4.0.6	🟢 4.2	Details Check Score Reason Code-Review ⚠️ 0 Found 1/30 approved changesets -- score normalized to 0 Packaging ⚠️ -1 packaging workflow not detected Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Security-Policy ⚠️ 0 security policy file not detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/http-proxy-middleware	3.0.7	🟢 6.5	Details Check Score Reason Maintained 🟢 10 17 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Security-Policy 🟢 10 security policy file detected Code-Review ⚠️ 0 Found 0/30 approved changesets -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Packaging 🟢 10 packaging workflow detected Branch-Protection ⚠️ 1 branch protection is not maximal on development and all release branches SAST 🟢 10 SAST tool is run on all commits
npm/iconv-lite	0.7.3	Unknown	Unknown
npm/ip-address	10.7.4	🟢 6.9	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 8 issue activity found in the last 90 days -- score normalized to 10 Code-Review ⚠️ 0 Found 0/30 approved changesets -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Packaging 🟢 10 packaging workflow detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/mysql2	3.24.6	🟢 6.7	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Security-Policy 🟢 10 security policy file detected Maintained 🟢 10 30 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies 🟢 4 dependency not pinned by hash detected -- score normalized to 4 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Signed-Releases ⚠️ -1 no releases found Packaging 🟢 10 packaging workflow detected SAST 🟢 10 SAST tool is run on all commits
npm/path-to-regexp	8.4.2	🟢 7.1	Details Check Score Reason Binary-Artifacts 🟢 10 no binaries found in the repo Branch-Protection ⚠️ 1 branch protection is not maximal on development and all release branches CI-Tests 🟢 9 25 out of 26 merged PRs checked by a CI test -- score normalized to 9 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Code-Review 🟢 5 found 12 unreviewed changesets out of 29 -- score normalized to 5 Contributors 🟢 10 25 different organizations found -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Dependency-Update-Tool 🟢 10 update tool detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Maintained 🟢 4 4 commit(s) out of 30 and 1 issue activity out of 30 found in the last 90 days -- score normalized to 4 Packaging ⚠️ -1 no published package detected Pinned-Dependencies ⚠️ 3 dependency not pinned by hash detected -- score normalized to 3 SAST 🟢 9 SAST tool detected but not run on all commits Security-Policy 🟢 9 security policy file detected Signed-Releases ⚠️ -1 no releases found Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Vulnerabilities 🟢 10 no vulnerabilities detected
npm/sql-escaper	1.5.2	Unknown	Unknown
npm/undici	7.30.1	🟢 7.8	Details Check Score Reason Code-Review 🟢 5 Found 13/22 approved changesets -- score normalized to 5 Maintained 🟢 10 30 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10 Security-Policy 🟢 10 security policy file detected Dependency-Update-Tool 🟢 10 update tool detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 8 binaries present in source code License 🟢 10 license file detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 6 dependency not pinned by hash detected -- score normalized to 6 Packaging 🟢 10 packaging workflow detected Vulnerabilities 🟢 7 3 existing vulnerabilities detected Fuzzing 🟢 10 project is fuzzed Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST 🟢 10 SAST tool is run on all commits Signed-Releases ⚠️ -1 no releases found CI-Tests 🟢 10 22 out of 22 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 58 contributing companies or organizations
npm/undici	8.12.2	🟢 7.8	Details Check Score Reason Code-Review 🟢 5 Found 13/22 approved changesets -- score normalized to 5 Maintained 🟢 10 30 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10 Security-Policy 🟢 10 security policy file detected Dependency-Update-Tool 🟢 10 update tool detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 8 binaries present in source code License 🟢 10 license file detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 6 dependency not pinned by hash detected -- score normalized to 6 Packaging 🟢 10 packaging workflow detected Vulnerabilities 🟢 7 3 existing vulnerabilities detected Fuzzing 🟢 10 project is fuzzed Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST 🟢 10 SAST tool is run on all commits Signed-Releases ⚠️ -1 no releases found CI-Tests 🟢 10 22 out of 22 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 58 contributing companies or organizations

Scanned Files

• yarn.lock