fix(deps): update dependency @backstage/plugin-scaffolder-backend

[mend-on-mend]

This PR contains the following updates:

Package	Change	Age	Confidence
@backstage/plugin-scaffolder-backend (source)	2.1.0 -> 2.1.1
@backstage/plugin-scaffolder-backend (source)	2.1.1 -> 2.2.0
@backstage/plugin-scaffolder-backend (source)	^1.33.0 -> ^2.0.0
@backstage/plugin-scaffolder-backend (source)	^1.31.0 -> ^2.0.0

---

Template Secret leakage in logs in Scaffolder when using fetch:template

CVE-2025-55285 / GHSA-3x3q-ghcp-whf7

More information

Details

A logging flaw in Backstage Scaffolder’s fetch:template action up to @backstage/plugin-scaffolder-backend 2.1.0 may write template secrets to logs. The action emitted a duplicate, pre-redaction copy of input parameters, so values provided via the `` bag could appear in local/server logs when the action ran. Exploitation requires use of the secrets argument and access to Scaffolder/build logs; integrity and availability are unaffected.

• Fix: upgrade to 2.1.1, which removes the duplicate log path and ensures secrets are redacted.
• Mitigation: avoid passing `` to fetch:template if upgrade is not possible.

Open an issue in the Backstage repository

Visit our Discord, linked to in Backstage README

Severity

• CVSS Score: 2.6 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N

References

• https://github.com/backstage/backstage/security/advisories/GHSA-3x3q-ghcp-whf7
• https://nvd.nist.gov/vuln/detail/CVE-2025-55285
• https://github.com/backstage/backstage/commit/c371f6fe12371de31dca537510e6653e287cdc2e
• https://github.com/backstage/backstage

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

backstage/backstage (@​backstage/plugin-scaffolder-backend)

v2.1.1

Compare Source

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

Note

Upgrades Backstage packages (including @backstage/plugin-scaffolder-backend to 2.x) across multiple workspaces and refreshes yarn.lock with widespread dependency updates.

• Backstage upgrades:
  • Bump @backstage/plugin-scaffolder-backend to ^2.x (e.g., in workspaces/tech-insights/packages/backend/package.json) and align related packages (backend-defaults ^0.12.x, backend-plugin-api 1.5.0, config 1.3.6, etc.).
  • Broad version updates for Backstage plugins and tooling (catalog, auth, permission, events, integration, scaffolder modules, catalog-node/common, cli-node/config-loader, etc.).
• Lockfile refreshes:
  • Regenerate yarn.lock across workspaces (workspaces/rbac, report-portal, tekton, topology, etc.) reflecting updated Backstage deps and transitive packages.
• Notable transitive changes:
  • express-openapi-validator@5.6.0 (now using multer@2, ajv-formats@3, path-to-regexp@8.3.0).
  • Dependency bumps like undici@5.29.0, protobufjs@7.5.4, better-sqlite3@^12, and additions such as infinispan/urllib via updated Backstage defaults.

^{Written by Cursor Bugbot for commit 1953714. This will update automatically on new commits. Configure here.}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[mend-on-mend]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.