chore(deps): Bump the npm_and_yarn group across 2 directories with 26 updates by dependabot[bot] · Pull Request #82 · echohello-dev/backstage

dependabot · 2026-03-12T15:41:08Z

Bumps the npm_and_yarn group with 25 updates in the / directory:

Package	From	To
react-router	`6.26.2`	`6.30.2`
@backstage/backend-defaults	`0.14.0`	`0.15.2`
@backstage/plugin-auth-backend	`0.25.7`	`0.27.1`
@backstage/plugin-scaffolder-backend	`3.1.0`	`3.1.5`
@babel/runtime	`7.25.6`	`7.28.6`
@backstage/cli-common	`0.1.14`	`0.1.18`
@backstage/integration	`1.14.0`	`1.20.1`
@backstage/plugin-techdocs-node	`1.13.10`	`1.14.3`
@smithy/config-resolver	`3.0.8`	`3.0.13`
ajv	`6.12.6`	`6.14.0`
axios	`1.9.0`	`1.13.6`
basic-ftp	`5.0.5`	`5.2.0`
bn.js	`4.12.0`	`4.12.3`
brace-expansion	`1.1.11`	`1.1.12`
cross-spawn	`7.0.3`	`7.0.6`
diff	`4.0.2`	`4.0.4`
immutable	`3.8.2`	`3.8.3`
jsonpath	`1.1.1`	`1.3.0`
lodash	`4.17.21`	`4.17.23`
multer	`2.0.2`	`2.1.1`
qs	`6.5.3`	`6.5.5`
rollup	`4.41.1`	`4.59.0`
svgo	`2.8.0`	`2.8.2`
vm2	`3.10.0`	`3.10.5`
webpack	`5.99.9`	`5.105.4`

Bumps the npm_and_yarn group with 2 updates in the /packages/backend directory: @backstage/backend-defaults and @backstage/plugin-auth-backend.

Updates react-router from 6.26.2 to 6.30.2

Release notes

Sourced from react-router's releases.

v6.30.2

See the changelog for release notes: https://github.com/remix-run/react-router/blob/v6/CHANGELOG.md#v6302

v6.30.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v6301

v6.30.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v6300

v6.29.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v6290

v6.28.2

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v6282

v6.28.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v6281

v6.28.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v6280

v6.27.0

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v6270

Changelog

Sourced from react-router's changelog.

6.30.2

Patch Changes

Updated dependencies:

@remix-run/router@1.23.1

6.30.1

Patch Changes

Partially revert optimization added in 6.29.0 to reduce calls to matchRoutes because it surfaced other issues (#13623)

Stop logging invalid warning when v7_relativeSplatPath is set to false (#13502)

6.30.0

Minor Changes

Add fetcherKey as a parameter to patchRoutesOnNavigation (#13109)

Patch Changes

Updated dependencies:

@remix-run/router@1.23.0

6.29.0

Minor Changes

Provide the request signal as a parameter to patchRoutesOnNavigation (#12900)

This can be used to abort any manifest fetches if the in-flight navigation/fetcher is aborted

Patch Changes

Do not log v7 deprecation warnings in production builds (#12794)

Limit matchRoutes optimization to client side routers (#12881)

Optimize route matching by skipping redundant matchRoutes calls when possible (#12169)

Updated dependencies:

@remix-run/router@1.22.0

6.28.2

Patch Changes

Updated dependencies:

@remix-run/router@1.21.1

6.28.1

... (truncated)

Commits

26b5d45 chore: Update version for release (#14541)
919f8a8 chore: Update version for release (pre-v6) (#14540)
69bf705 Normalize double slashes in resolvePath (#14537)
3f2400e chore: Update version for release (#13647)
25a264d chore: Update version for release (pre-v6) (#13638)
b5705a0 Remove matchRoutes optimization from render pass (#13623)
785f6f6 Prevent invalid warning for v7_relativeSplatPath (#13502)
e4ba522 chore: Update version for release (#13128)
f0bc784 chore: Update version for release (pre-v6) (#13111)
d9ed824 Fix up changelogs
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for react-router since your current version.

Updates @backstage/backend-defaults from 0.14.0 to 0.15.2

Changelog

Sourced from @backstage/backend-defaults's changelog.

0.15.2

Patch Changes

7455dae: Use node prefix on native imports

44f5d04: Minor internal restructure of the postgres config loading code

4fc7bf0: Bump to tar v7

5dd683f: createRateLimitMiddleware is now exported from @backstage/backend-defaults/httpRouter

8dd518a: Support connection.type: azure in database client to use Microsoft Entra authentication with Azure database for PostgreSQL

69d880e: Bump to latest zod to ensure it has the latest features

Updated dependencies

@backstage/backend-app-api@1.5.0

@backstage/integration@1.20.0

@backstage/integration-aws-node@0.1.20

@backstage/backend-plugin-api@1.7.0

@backstage/backend-dev-utils@0.1.7

@backstage/config-loader@1.10.8

@backstage/cli-node@0.2.18

@backstage/plugin-auth-node@0.6.13

@backstage/plugin-permission-node@0.10.10

@backstage/plugin-events-node@0.4.19

0.15.2-next.1

Patch Changes

8dd518a: Support connection.type: azure in database client to use Microsoft Entra authentication with Azure database for PostgreSQL

Updated dependencies

@backstage/integration@1.20.0-next.1

@backstage/cli-node@0.2.18-next.1

@backstage/backend-plugin-api@1.7.0-next.1

0.15.1-next.0

Patch Changes

7455dae: Use node prefix on native imports

44f5d04: Minor internal restructure of the postgres config loading code

4fc7bf0: Bump to tar v7

69d880e: Bump to latest zod to ensure it has the latest features

Updated dependencies

@backstage/integration-aws-node@0.1.20-next.0

@backstage/backend-plugin-api@1.7.0-next.0

@backstage/backend-dev-utils@0.1.7-next.0

@backstage/config-loader@1.10.8-next.0

@backstage/integration@1.19.3-next.0

@backstage/cli-node@0.2.17-next.0

@backstage/plugin-auth-node@0.6.12-next.0

@backstage/backend-app-api@1.5.0-next.0

@backstage/plugin-permission-node@0.10.9-next.0

... (truncated)

Commits

See full diff in compare view

Updates @backstage/plugin-auth-backend from 0.25.7 to 0.27.1

Changelog

Sourced from @backstage/plugin-auth-backend's changelog.

@backstage/plugin-auth-backend

0.27.1-next.2

Patch Changes

d0f4cd2: Added optional client metadata document endpoint at /.well-known/oauth-client/cli.json relative to the auth backend base URL for CLI authentication. Enabled when auth.experimentalClientIdMetadataDocuments.enabled is set to true.

Updated dependencies

@backstage/backend-plugin-api@1.8.0-next.1

@backstage/plugin-auth-node@0.6.14-next.2

@backstage/plugin-catalog-node@2.1.0-next.2

0.27.1-next.1

Patch Changes

1ccad86: Added who-am-i action to the auth backend actions registry. Returns the catalog entity and user info for the currently authenticated user.

Updated dependencies

@backstage/plugin-auth-node@0.6.14-next.1

@backstage/plugin-catalog-node@2.1.0-next.1

@backstage/backend-plugin-api@1.7.1-next.0

@backstage/catalog-model@1.7.6

@backstage/config@1.3.6

@backstage/errors@1.2.7

@backstage/types@1.2.2

0.27.1-next.0

Patch Changes

6738cf0: build(deps): bump minimatch from 9.0.5 to 10.2.1

619be54: Update migrations to be reversible

Updated dependencies

@backstage/plugin-catalog-node@2.1.0-next.0

@backstage/backend-plugin-api@1.7.1-next.0

@backstage/catalog-model@1.7.6

@backstage/config@1.3.6

@backstage/errors@1.2.7

@backstage/types@1.2.2

@backstage/plugin-auth-node@0.6.14-next.0

0.27.0

Minor Changes

31de2c9: Added experimental support for Client ID Metadata Documents (CIMD).

This allows Backstage to act as an OAuth 2.0 authorization server that supports the IETF Client ID Metadata Document draft. External OAuth clients can use HTTPS URLs as their client_id, and Backstage will fetch metadata from those URLs to validate the client.

Configuration example:

... (truncated)

Commits

See full diff in compare view

Updates @backstage/plugin-scaffolder-backend from 3.1.0 to 3.1.5

Changelog

Sourced from @backstage/plugin-scaffolder-backend's changelog.

@backstage/plugin-scaffolder-backend

3.2.0-next.2

Minor Changes

e8736ea: Added secrets schema validation for task creation, retry, and dry-run endpoints. When a template defines spec.secrets.schema, the API validates provided secrets against the schema and returns a 400 error if validation fails.

Patch Changes

30ff981: Fixed a security vulnerability where secrets could bypass log redaction when transformed through Nunjucks filters in scaffolder templates.

Updated dependencies

@backstage/backend-plugin-api@1.8.0-next.1

@backstage/integration@2.0.0-next.2

@backstage/plugin-scaffolder-common@2.0.0-next.2

@backstage/backend-openapi-utils@0.6.7-next.1

@backstage/plugin-catalog-node@2.1.0-next.2

@backstage/plugin-events-node@0.4.20-next.1

@backstage/plugin-permission-node@0.10.11-next.1

@backstage/plugin-scaffolder-node@0.13.0-next.2

3.2.0-next.1

Minor Changes

c9b11eb: Added a new list-scaffolder-tasks action that allows querying scaffolder tasks with optional ownership filtering and pagination support

0fbcf23: Migrated OpenAPI schemas to 3.1.

7695dd2: Added a new list-scaffolder-actions action that returns all installed scaffolder actions with their schemas and examples

Patch Changes

e27bd4e: Removed @backstage/plugin-scaffolder-backend-module-bitbucket from package.json as the package itself has been deprecated and the code deleted.

ccc20cf: create scaffolder MCP action to dry run a provided scaffolder template

Updated dependencies

@backstage/integration@2.0.0-next.1

@backstage/plugin-scaffolder-common@2.0.0-next.1

@backstage/plugin-scaffolder-node@0.13.0-next.1

@backstage/plugin-catalog-node@2.1.0-next.1

@backstage/backend-openapi-utils@0.6.7-next.0

@backstage/backend-plugin-api@1.7.1-next.0

@backstage/catalog-model@1.7.6

@backstage/config@1.3.6

@backstage/errors@1.2.7

@backstage/types@1.2.2

@backstage/plugin-events-node@0.4.20-next.0

@backstage/plugin-permission-common@0.9.6

@backstage/plugin-permission-node@0.10.11-next.0

3.1.4-next.0

... (truncated)

Commits

See full diff in compare view

Updates @babel/runtime from 7.25.6 to 7.28.6

Release notes

Sourced from @babel/runtime's releases.

v7.28.6 (2026-01-12)

Thanks @kadhirash and @kolvian for your first PRs!

🐛 Bug Fix

babel-cli, babel-code-frame, babel-core, babel-helper-check-duplicate-nodes, babel-helper-fixtures, babel-helper-plugin-utils, babel-node, babel-plugin-transform-flow-comments, babel-plugin-transform-modules-commonjs, babel-plugin-transform-property-mutators, babel-preset-env, babel-traverse, babel-types

#17589 Improve Unicode handling in code-frame tokenizer (@JLHwung)

babel-plugin-transform-regenerator

#17556 fix: transform-regenerator correctly handles scope (@liuxingbaoyu)

babel-plugin-transform-react-jsx

#17538 fix: Keep jsx comments (@liuxingbaoyu)

💅 Polish

babel-core, babel-standalone

#17606 Polish(standalone): improve message on invalid preset/plugin (@JLHwung)

🏠 Internal

babel-plugin-bugfix-v8-static-class-fields-redefine-readonly, babel-plugin-proposal-decorators, babel-plugin-proposal-import-attributes-to-assertions, babel-plugin-proposal-import-wasm-source, babel-plugin-syntax-async-do-expressions, babel-plugin-syntax-decorators, babel-plugin-syntax-destructuring-private, babel-plugin-syntax-do-expressions, babel-plugin-syntax-explicit-resource-management, babel-plugin-syntax-export-default-from, babel-plugin-syntax-flow, babel-plugin-syntax-function-bind, babel-plugin-syntax-function-sent, babel-plugin-syntax-import-assertions, babel-plugin-syntax-import-attributes, babel-plugin-syntax-import-defer, babel-plugin-syntax-import-source, babel-plugin-syntax-jsx, babel-plugin-syntax-module-blocks, babel-plugin-syntax-optional-chaining-assign, babel-plugin-syntax-partial-application, babel-plugin-syntax-pipeline-operator, babel-plugin-syntax-throw-expressions, babel-plugin-syntax-typescript, babel-plugin-transform-async-generator-functions, babel-plugin-transform-async-to-generator, babel-plugin-transform-class-properties, babel-plugin-transform-class-static-block, babel-plugin-transform-dotall-regex, babel-plugin-transform-duplicate-named-capturing-groups-regex, babel-plugin-transform-explicit-resource-management, babel-plugin-transform-exponentiation-operator, babel-plugin-transform-json-strings, babel-plugin-transform-logical-assignment-operators, babel-plugin-transform-nullish-coalescing-operator, babel-plugin-transform-numeric-separator, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-catch-binding, babel-plugin-transform-optional-chaining, babel-plugin-transform-private-methods, babel-plugin-transform-private-property-in-object, babel-plugin-transform-regexp-modifiers, babel-plugin-transform-unicode-property-regex, babel-plugin-transform-unicode-sets-regex

#17580 Allow Babel 8 in compatible Babel 7 plugins (@nicolo-ribaudo)

🏃‍♀️ Performance

babel-plugin-transform-react-jsx

#17555 perf: Use lighter traversal for jsx __source,__self (@liuxingbaoyu)

Committers: 7

Babel Bot (@babel-bot)

Eliot Pontarelli (@kolvian)

Huáng Jùnliàng (@JLHwung)

Kadhirash Sivakumar (@kadhirash)

Nicolò Ribaudo (@nicolo-ribaudo)

@liuxingbaoyu

coderaiser (@coderaiser)

v7.28.5 (2025-10-23)

Thank you @CO0Ki3, @Olexandr88, and @youthfulhps for your first PRs!

👓 Spec Compliance

babel-parser

#17446 Allow Runtime Errors for Function Call Assignment Targets (@liuxingbaoyu)

babel-helper-validator-identifier

#17501 fix: update identifier to unicode 17 (@fisker)

🐛 Bug Fix

babel-plugin-proposal-destructuring-private

#17534 Allow mixing private destructuring and rest (@CO0Ki3)

babel-parser

#17521 Improve @babel/parser error typing (@JLHwung)

#17491 fix: improve ts-only declaration parsing (@JLHwung)

babel-plugin-proposal-discard-binding, babel-plugin-transform-destructuring

... (truncated)

Commits

d7f4008 v7.28.6
35055e3 v7.28.4
ef155f5 v7.28.3
cac0ff4 v7.28.2
f68ac51 chore: Avoid CITGM errors (#17382)
baa4cb8 v7.27.6
7d06930 v7.27.4
5b9468d Reduce regenerator size more (#17287)
cb78b5b [babel 8] Do not replace global regeneratorRuntime references in regenerato...
a0690e3 Split regeneratorRuntime into multiple helpers (#17238)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @babel/runtime since your current version.

Updates @backstage/cli-common from 0.1.14 to 0.1.18

Changelog

Sourced from @backstage/cli-common's changelog.

0.1.18

Patch Changes

7455dae: Use node prefix on native imports

0.1.18-next.0

Patch Changes

7455dae: Use node prefix on native imports

Updated dependencies

@backstage/errors@1.2.7

0.1.17

Patch Changes

ae4dd5d: Move some of the symlink resolution to isChildPath

0.1.16

Patch Changes

5cfb2a4: Added new run, runOutput, and runCheck utilities to help run child processes in a safe and portable way.

c8c2329: Add proxy configuration from env-vars to create-app tasks

2bae83a: Bumped dev dependencies @types/node

0.1.16-next.2

Patch Changes

2bae83a: Bumped dev dependencies @types/node

Updated dependencies

@backstage/errors@1.2.7

0.1.16-next.1

Patch Changes

5cfb2a4: Added new run, runOutput, and runCheck utilities to help run child processes in a safe and portable way.

0.1.16-next.0

Patch Changes

c8c2329: Add proxy configuration from env-vars to create-app tasks

0.1.15

... (truncated)

Commits

See full diff in compare view

Updates @backstage/integration from 1.14.0 to 1.20.1

Changelog

Sourced from @backstage/integration's changelog.

@backstage/integration

2.0.0-next.2

Patch Changes

1513a0b: Fixed a security vulnerability where path traversal sequences in SCM URLs could be used to access unintended API endpoints using server-side integration credentials.

2.0.0-next.1

Major Changes

527cf88: BREAKING Removed deprecated Azure DevOps, Bitbucket, Gerrit and GitHub code:

For Azure DevOps, the long deprecated token string and credential object have been removed from the config.d.ts. Use the credentials array object instead.

For Bitbucket, the long deprecated bitbucket object has been removed from the config.d.ts. Use the bitbucketCloud or bitbucketServer objects instead.

For Gerrit, the parseGerritGitilesUrl function has been removed, use parseGitilesUrlRef instead. The buildGerritGitilesArchiveUrl function has also been removed, use buildGerritGitilesArchiveUrlFromLocation instead.

For GitHub, the getGitHubRequestOptions function has been removed.

Patch Changes

993a598: Fixed Azure integration config schema visibility annotations to use per-field @visibility secret instead of @deepVisibility secret on parent objects, so that non-secret fields like clientId, tenantId, organizations, and managedIdentityClientId are no longer incorrectly marked as secret.

Updated dependencies

@backstage/config@1.3.6

@backstage/errors@1.2.7

1.21.0-next.0

Minor Changes

d933f62: Add configurable throttling and retry mechanism for GitLab integration.

Patch Changes

Updated dependencies

@backstage/config@1.3.6

@backstage/errors@1.2.7

1.20.0

Minor Changes

6999f6d: The AzureUrl class in the @backstage/integration package is now able to process BOTH git branches and git tags. Initially this class only processed git branches and threw an error when non-branch Azure URLs were passed in.

Patch Changes

cc6206e: Added support for {org}.visualstudio.com domains used by Azure DevOps

7455dae: Use node prefix on native imports

1.20.0-next.2

... (truncated)

Commits

c8a8aac Version Packages
4aa43f6 chore(deps): update dependency cross-fetch to v4
f577e11 Version Packages (next)
11153a0 Merge remote-tracking branch 'upstream/master' into entra-rename
ad7d38c fix tests
243c655 Updated Azure Active Directory to Entra ID
8cdb8c2 Version Packages
e43d3eb Version Packages (next)
0b55f77 Removed some unused dependencies
bea3617 Version Packages (next)
Additional commits viewable in compare view

Updates @backstage/plugin-techdocs-node from 1.13.10 to 1.14.3

Changelog

Sourced from @backstage/plugin-techdocs-node's changelog.

@backstage/plugin-techdocs-node

1.14.4-next.2

Patch Changes

e96f6d9: Removed INHERIT from the ALLOWED_MKDOCS_KEYS set to address a security concern with MkDocs configuration inheritance.

Updated dependencies

@backstage/backend-plugin-api@1.8.0-next.1

@backstage/integration@2.0.0-next.2

1.14.3-next.1

Patch Changes

cb7c6b1: Added techdocs.generator.mkdocs.dangerouslyAllowAdditionalKeys configuration option to explicitly bypass MkDocs configuration key restrictions. This enables support for additional MkDocs configuration keys beyond the default safe allow list, such as the hooks key which some MkDocs plugins require.

Updated dependencies

@backstage/integration@2.0.0-next.1

@backstage/backend-plugin-api@1.7.1-next.0

@backstage/catalog-model@1.7.6

@backstage/config@1.3.6

@backstage/errors@1.2.7

@backstage/integration-aws-node@0.1.20

@backstage/plugin-search-common@1.2.22

@backstage/plugin-techdocs-common@0.1.1

1.14.3-next.0

Patch Changes

Updated dependencies

@backstage/integration@1.21.0-next.0

@backstage/backend-plugin-api@1.7.1-next.0

@backstage/catalog-model@1.7.6

@backstage/config@1.3.6

@backstage/errors@1.2.7

@backstage/integration-aws-node@0.1.20

@backstage/plugin-search-common@1.2.22

@backstage/plugin-techdocs-common@0.1.1

1.14.2

Patch Changes

7455dae: Use node prefix on native imports

3c455d4: Some security fixes

Updated dependencies

@backstage/integration@1.20.0

@backstage/integration-aws-node@0.1.20

@backstage/backend-plugin-api@1.7.0

... (truncated)

Commits

See full diff in compare view

Updates @smithy/config-resolver from 3.0.8 to 3.0.13

Changelog

Sourced from @smithy/config-resolver's changelog.

3.0.13

Patch Changes

Updated dependencies [b52b4e8]

@smithy/types@3.7.2

@smithy/node-config-provider@3.1.12

@smithy/util-middleware@3.0.11

3.0.12

Patch Changes

Updated dependencies [fcd5ca8]

@smithy/types@3.7.1

@smithy/node-config-provider@3.1.11

@smithy/util-middleware@3.0.10

3.0.11

Patch Changes

Updated dependencies [cd1929b]

@smithy/types@3.7.0

@smithy/node-config-provider@3.1.10

@smithy/util-middleware@3.0.9

3.0.10

Patch Changes

Updated dependencies [84bec05]

@smithy/types@3.6.0

@smithy/node-config-provider@3.1.9

@smithy/util-middleware@3.0.8

3.0.9

Patch Changes

Updated dependencies [a4c1285]

@smithy/types@3.5.0

@smithy/node-config-provider@3.1.8

@smithy/util-middleware@3.0.7

Commits

50d8c54 Version NPM packages
7877c9e Version NPM packages
012775c Version NPM packages
cd1929b test: convert tests to vitest (#1440)
5de4524 Version NPM packages
8051551 Version NPM packages
See full diff in compare view

Updates ajv from 6.12.6 to 6.14.0

Commits

e3af0a7 6.14.0
b552ed6 add regExp option to address $data exploit via a regular expression (CVE-2025...
72f2286 docs: update v7 info
231e52b Merge pull request #1320 from philsturgeon/patch-1
d3475fc Add spectral, an AJV util from a sponsor
413afe0 docs: v7.0.0-beta.3
11e997b update readme for v7
See full diff in compare view

Updates axios from 1.9.0 to 1.13.6

Release notes

Sourced from axios's releases.

v1.13.6

This release focuses on platform compatibility, error handling improvements, and code quality maintenance.

⚠️ Important Changes

Breaking Changes: None identified in this release.

Action Required: Users targeting React Native should verify their integration, particularly if relying on specific Blob or FormData behaviours, as improvements have been made to support these objects.

🚀 New Features

React Native Blob Support: Axios now includes support for React Native Blob objects. Thanks to @moh3n9595 for the initial implementation. (#5764)

Code Quality: Implemented prettier across the codebase and resolved associated formatting issues. (#7385)

🐛 Bug Fixes

Environment Compatibility:

Fixed module exports for React Native and Browserify environments. (#7386)

Added safe FormData detection for the WeChat Mini Program environment. (#7324)

Error Handling:

AxiosError.message is now correctly enumerable. (#7392)

AxiosError.from now correctly copies the status property from the source error, ensuring better error propagation. (#7403)

🔧 Maintenance & Chores

Dependencies: Updated the development_dependencies group (5 updates). (#7432)

Infrastructure: Migrated @rollup/plugin-babel from v5.3.1 to v6.1.0. (#7424)

Documentation: Added missing JSDoc comments to utilities. (#7427)

🌟 New Contributors

We are thrilled to welcome our new contributors! Thank you for helping improve the project:

@Gudahtt (#7386)

@ybbus (#7392)

@Shiwaangee (#7324)

@skrtheboss (#7403)

@Janaka66 (#7427)

@moh3n9595 (#5764)

@digital-wizard48 (#7424)

Full Changelog: v1.13.5...v1.13.6

v1.13.5

Release 1.13.5

Highlights

Security: Fixed a potential Denial of Service issue involving the __proto__ key in mergeConfig. (PR #7369)

Bug fix: Resolved an issue where AxiosError could be missing the status field on and after v1.13.3. (PR #7368)

Changes

Security

Fix Denial of Service via __proto__ key in mergeConfig. (PR #7369)

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

1.13.3 (2026-01-20)

Bug Fixes

http2: Use port 443 for HTTPS connections by default. (#7256) (d7e6065)

interceptor: handle the error in the same interceptor (#6269) (5945e40)

main field in package.json should correspond to cjs artifacts (#5756) (7373fbf)

package.json: add 'bun' package.json 'exports' condition. Load the Node.js build in Bun instead of the browser build (#5754) (b89217e)

silentJSONParsing=false should throw on invalid JSON (#7253) (#7257) (7d19335)

turn AxiosError into a native error (#5394) (#5558) (1c6a86d)

types: add handlers to AxiosInterceptorManager interface (#5551) (8d1271b)

types: restore AxiosError.cause type from unknown to Error (#7327) (d8233d9)

unclear error message is thrown when specifying an empty proxy authorization (#6314) (6ef867e)

Features

add undefined as a value in AxiosRequestConfig (#5560) (095033c)

add automatic minor and patch upgrades to dependabot (#6053) (65a7584)

add Node.js coverage script using c8 (closes #7289) (#7294) (ec9d94e)

added copilot instructions (3f83143)

compatibility with frozen prototypes (#6265) (860e033)

enhance pipeFileToResponse with error handling (#7169) (88d7884)

types: Intellisense for string literals in a widened union (#6134) (f73474d), closes microsoft/TypeScript#33471

Reverts

Revert "fix: silentJSONParsing=false should throw on invalid JSON (#7253) (#7…" (#7298) (a4230f5), closes #7253 #7 #7298

deps: bump peter-evans/create-pull-request from 7 to 8 in the github-actions group (#7334) (2d6ad5e)

Contributors to this release

Ashvin Tiwari

Nikunj Mochi

Anchal Singh

jasonsaayman

Julian Dax

Akash Dhar Dubey

Madhumita

Tackoil

Justin Dhillon

Rudransh

WuMingDao

codenomnom

Nandan Acharya

Eric Dubé

Tibor Pilz

Gabriel Quaresma

Turadg Aleahmad

... (truncated)

Commits

7108c88 chore(release): prepare release 1.13.6 (#7446)
20a0ba3 refactor(deps): migrate @rollup/plugin-babel from v5.3.1 to v6.1.0 (#7424)
885b4af feat: support react native blob objects (#5764)
00d97b9 docs(utils): add missing JSDoc comments (#7427)
9712548 chore(deps-dev): bump the development_dependencies group across 1 directory w...
d51accb fix(core): copy status from source error in AxiosError.from (#7403)
3e30bbf chore: fix publish to only run on v1 tags
672491d fix: safe FormData detection for WeChat Mini Program (#7306) (#7324)
822e3e4 fix: make AxiosError.message property enumerable (#7392)
ef3711d feat: implement prettier and fix all issues (#7385)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for axios since your current version.

Updates basic-ftp from 5.0.5 to 5.2.0

Release notes

Sourced from basic-ftp's releases.

5.2.0

Changed: Skip files with invalid name in downloadToDir.

5.1.0

Added: Add the option to prevent the use of separate transfer host IPs when using PASV. (#259)

Changelog

Sourced fro...

Description has been truncated

… updates Bumps the npm_and_yarn group with 25 updates in the / directory: | Package | From | To | | --- | --- | --- | | [react-router](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router) | `6.26.2` | `6.30.2` | | [@backstage/backend-defaults](https://github.com/backstage/backstage/tree/HEAD/packages/backend-defaults) | `0.14.0` | `0.15.2` | | [@backstage/plugin-auth-backend](https://github.com/backstage/backstage/tree/HEAD/plugins/auth-backend) | `0.25.7` | `0.27.1` | | [@backstage/plugin-scaffolder-backend](https://github.com/backstage/backstage/tree/HEAD/plugins/scaffolder-backend) | `3.1.0` | `3.1.5` | | [@babel/runtime](https://github.com/babel/babel/tree/HEAD/packages/babel-runtime) | `7.25.6` | `7.28.6` | | [@backstage/cli-common](https://github.com/backstage/backstage/tree/HEAD/packages/cli-common) | `0.1.14` | `0.1.18` | | [@backstage/integration](https://github.com/backstage/backstage/tree/HEAD/packages/integration) | `1.14.0` | `1.20.1` | | [@backstage/plugin-techdocs-node](https://github.com/backstage/backstage/tree/HEAD/plugins/techdocs-node) | `1.13.10` | `1.14.3` | | [@smithy/config-resolver](https://github.com/smithy-lang/smithy-typescript/tree/HEAD/packages/config-resolver) | `3.0.8` | `3.0.13` | | [ajv](https://github.com/ajv-validator/ajv) | `6.12.6` | `6.14.0` | | [axios](https://github.com/axios/axios) | `1.9.0` | `1.13.6` | | [basic-ftp](https://github.com/patrickjuchli/basic-ftp) | `5.0.5` | `5.2.0` | | [bn.js](https://github.com/indutny/bn.js) | `4.12.0` | `4.12.3` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.11` | `1.1.12` | | [cross-spawn](https://github.com/moxystudio/node-cross-spawn) | `7.0.3` | `7.0.6` | | [diff](https://github.com/kpdecker/jsdiff) | `4.0.2` | `4.0.4` | | [immutable](https://github.com/immutable-js/immutable-js) | `3.8.2` | `3.8.3` | | [jsonpath](https://github.com/dchester/jsonpath) | `1.1.1` | `1.3.0` | | [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.17.23` | | [multer](https://github.com/expressjs/multer) | `2.0.2` | `2.1.1` | | [qs](https://github.com/ljharb/qs) | `6.5.3` | `6.5.5` | | [rollup](https://github.com/rollup/rollup) | `4.41.1` | `4.59.0` | | [svgo](https://github.com/svg/svgo) | `2.8.0` | `2.8.2` | | [vm2](https://github.com/patriksimek/vm2) | `3.10.0` | `3.10.5` | | [webpack](https://github.com/webpack/webpack) | `5.99.9` | `5.105.4` | Bumps the npm_and_yarn group with 2 updates in the /packages/backend directory: [@backstage/backend-defaults](https://github.com/backstage/backstage/tree/HEAD/packages/backend-defaults) and [@backstage/plugin-auth-backend](https://github.com/backstage/backstage/tree/HEAD/plugins/auth-backend). Updates `react-router` from 6.26.2 to 6.30.2 - [Release notes](https://github.com/remix-run/react-router/releases) - [Changelog](https://github.com/remix-run/react-router/blob/react-router@6.30.2/packages/react-router/CHANGELOG.md) - [Commits](https://github.com/remix-run/react-router/commits/react-router@6.30.2/packages/react-router) Updates `@backstage/backend-defaults` from 0.14.0 to 0.15.2 - [Release notes](https://github.com/backstage/backstage/releases) - [Changelog](https://github.com/backstage/backstage/blob/master/packages/backend-defaults/CHANGELOG.md) - [Commits](https://github.com/backstage/backstage/commits/HEAD/packages/backend-defaults) Updates `@backstage/plugin-auth-backend` from 0.25.7 to 0.27.1 - [Release notes](https://github.com/backstage/backstage/releases) - [Changelog](https://github.com/backstage/backstage/blob/master/plugins/auth-backend/CHANGELOG.md) - [Commits](https://github.com/backstage/backstage/commits/HEAD/plugins/auth-backend) Updates `@backstage/plugin-scaffolder-backend` from 3.1.0 to 3.1.5 - [Release notes](https://github.com/backstage/backstage/releases) - [Changelog](https://github.com/backstage/backstage/blob/master/plugins/scaffolder-backend/CHANGELOG.md) - [Commits](https://github.com/backstage/backstage/commits/HEAD/plugins/scaffolder-backend) Updates `@babel/runtime` from 7.25.6 to 7.28.6 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.28.6/packages/babel-runtime) Updates `@backstage/cli-common` from 0.1.14 to 0.1.18 - [Release notes](https://github.com/backstage/backstage/releases) - [Changelog](https://github.com/backstage/backstage/blob/master/packages/cli-common/CHANGELOG.md) - [Commits](https://github.com/backstage/backstage/commits/HEAD/packages/cli-common) Updates `@backstage/integration` from 1.14.0 to 1.20.1 - [Release notes](https://github.com/backstage/backstage/releases) - [Changelog](https://github.com/backstage/backstage/blob/master/packages/integration/CHANGELOG.md) - [Commits](https://github.com/backstage/backstage/commits/v1.20.1/packages/integration) Updates `@backstage/plugin-techdocs-node` from 1.13.10 to 1.14.3 - [Release notes](https://github.com/backstage/backstage/releases) - [Changelog](https://github.com/backstage/backstage/blob/master/plugins/techdocs-node/CHANGELOG.md) - [Commits](https://github.com/backstage/backstage/commits/HEAD/plugins/techdocs-node) Updates `@smithy/config-resolver` from 3.0.8 to 3.0.13 - [Release notes](https://github.com/smithy-lang/smithy-typescript/releases) - [Changelog](https://github.com/smithy-lang/smithy-typescript/blob/main/packages/config-resolver/CHANGELOG.md) - [Commits](https://github.com/smithy-lang/smithy-typescript/commits/@smithy/config-resolver@3.0.13/packages/config-resolver) Updates `ajv` from 6.12.6 to 6.14.0 - [Release notes](https://github.com/ajv-validator/ajv/releases) - [Commits](ajv-validator/ajv@v6.12.6...v6.14.0) Updates `axios` from 1.9.0 to 1.13.6 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.9.0...v1.13.6) Updates `basic-ftp` from 5.0.5 to 5.2.0 - [Release notes](https://github.com/patrickjuchli/basic-ftp/releases) - [Changelog](https://github.com/patrickjuchli/basic-ftp/blob/master/CHANGELOG.md) - [Commits](patrickjuchli/basic-ftp@v5.0.5...v5.2.0) Updates `bn.js` from 4.12.0 to 4.12.3 - [Release notes](https://github.com/indutny/bn.js/releases) - [Changelog](https://github.com/indutny/bn.js/blob/master/CHANGELOG.md) - [Commits](indutny/bn.js@v4.12.0...v4.12.3) Updates `brace-expansion` from 1.1.11 to 1.1.12 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@1.1.11...v1.1.12) Updates `cross-spawn` from 7.0.3 to 7.0.6 - [Changelog](https://github.com/moxystudio/node-cross-spawn/blob/master/CHANGELOG.md) - [Commits](moxystudio/node-cross-spawn@v7.0.3...v7.0.6) Updates `diff` from 4.0.2 to 4.0.4 - [Changelog](https://github.com/kpdecker/jsdiff/blob/master/release-notes.md) - [Commits](kpdecker/jsdiff@v4.0.2...v4.0.4) Updates `immutable` from 3.8.2 to 3.8.3 - [Release notes](https://github.com/immutable-js/immutable-js/releases) - [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md) - [Commits](immutable-js/immutable-js@v3.8.2...v3.8.3) Updates `jsonpath` from 1.1.1 to 1.3.0 - [Commits](https://github.com/dchester/jsonpath/commits) Updates `lodash` from 4.17.21 to 4.17.23 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.17.23) Updates `multer` from 2.0.2 to 2.1.1 - [Release notes](https://github.com/expressjs/multer/releases) - [Changelog](https://github.com/expressjs/multer/blob/main/CHANGELOG.md) - [Commits](expressjs/multer@v2.0.2...v2.1.1) Updates `qs` from 6.5.3 to 6.5.5 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.5.3...v6.5.5) Updates `rollup` from 4.41.1 to 4.59.0 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v4.41.1...v4.59.0) Updates `svgo` from 2.8.0 to 2.8.2 - [Release notes](https://github.com/svg/svgo/releases) - [Commits](svg/svgo@v2.8.0...v2.8.2) Updates `underscore` from 1.12.1 to 1.13.6 - [Commits](jashkenas/underscore@1.12.1...1.13.6) Updates `vm2` from 3.10.0 to 3.10.5 - [Release notes](https://github.com/patriksimek/vm2/releases) - [Commits](patriksimek/vm2@v3.10.0...v3.10.5) Updates `webpack` from 5.99.9 to 5.105.4 - [Release notes](https://github.com/webpack/webpack/releases) - [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md) - [Commits](webpack/webpack@v5.99.9...v5.105.4) Updates `@backstage/backend-defaults` from 0.14.1 to 0.15.2 - [Release notes](https://github.com/backstage/backstage/releases) - [Changelog](https://github.com/backstage/backstage/blob/master/packages/backend-defaults/CHANGELOG.md) - [Commits](https://github.com/backstage/backstage/commits/HEAD/packages/backend-defaults) Updates `@backstage/plugin-auth-backend` from 0.25.7 to 0.27.1 - [Release notes](https://github.com/backstage/backstage/releases) - [Changelog](https://github.com/backstage/backstage/blob/master/plugins/auth-backend/CHANGELOG.md) - [Commits](https://github.com/backstage/backstage/commits/HEAD/plugins/auth-backend) --- updated-dependencies: - dependency-name: react-router dependency-version: 6.30.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@backstage/backend-defaults" dependency-version: 0.15.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@backstage/plugin-auth-backend" dependency-version: 0.27.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@backstage/plugin-scaffolder-backend" dependency-version: 3.1.5 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@babel/runtime" dependency-version: 7.28.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@backstage/cli-common" dependency-version: 0.1.18 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@backstage/integration" dependency-version: 1.20.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@backstage/plugin-techdocs-node" dependency-version: 1.14.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@smithy/config-resolver" dependency-version: 3.0.13 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ajv dependency-version: 6.14.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: axios dependency-version: 1.13.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: basic-ftp dependency-version: 5.2.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: bn.js dependency-version: 4.12.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: cross-spawn dependency-version: 7.0.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: diff dependency-version: 4.0.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: immutable dependency-version: 3.8.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: jsonpath dependency-version: 1.3.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.17.23 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: multer dependency-version: 2.1.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.5.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: rollup dependency-version: 4.59.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: svgo dependency-version: 2.8.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: underscore dependency-version: 1.13.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: vm2 dependency-version: 3.10.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: webpack dependency-version: 5.105.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@backstage/backend-defaults" dependency-version: 0.15.2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@backstage/plugin-auth-backend" dependency-version: 0.27.1 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies labels Mar 12, 2026

dependabot Bot mentioned this pull request Mar 12, 2026

chore(deps): Bump @smithy/config-resolver from 3.0.8 to 3.0.13 in the npm_and_yarn group across 1 directory #73

Closed

echohello-safe-settings Bot removed dependencies labels Apr 16, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): Bump the npm_and_yarn group across 2 directories with 26 updates#82

chore(deps): Bump the npm_and_yarn group across 2 directories with 26 updates#82
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-d9b603a0f6

dependabot Bot commented on behalf of github Mar 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Mar 12, 2026

v6.30.2

v6.30.1

v6.30.0

v6.29.0

v6.28.2

v6.28.1

v6.28.0

v6.27.0

6.30.2

Patch Changes

6.30.1

Patch Changes

6.30.0

Minor Changes

Patch Changes

6.29.0

Minor Changes

Patch Changes

6.28.2

Patch Changes

6.28.1

0.15.2

Patch Changes

0.15.2-next.1

Patch Changes

0.15.1-next.0

Patch Changes

@​backstage/plugin-auth-backend

0.27.1-next.2

Patch Changes

0.27.1-next.1

Patch Changes

0.27.1-next.0

Patch Changes

0.27.0

Minor Changes

@​backstage/plugin-scaffolder-backend

3.2.0-next.2

Minor Changes

Patch Changes

3.2.0-next.1

Minor Changes

Patch Changes

3.1.4-next.0

v7.28.6 (2026-01-12)

🐛 Bug Fix

💅 Polish

🏠 Internal

🏃‍♀️ Performance

Committers: 7

v7.28.5 (2025-10-23)

👓 Spec Compliance

🐛 Bug Fix

0.1.18

Patch Changes

0.1.18-next.0

Patch Changes

0.1.17

Patch Changes

0.1.16

Patch Changes

0.1.16-next.2

Patch Changes

0.1.16-next.1

Patch Changes

0.1.16-next.0

Patch Changes

0.1.15

@​backstage/integration

2.0.0-next.2

Patch Changes

2.0.0-next.1

Major Changes

Patch Changes

1.21.0-next.0

Minor Changes

Patch Changes

1.20.0

`@backstage/plugin-auth-backend`

`@backstage/plugin-scaffolder-backend`

`@backstage/integration`

`@backstage/plugin-techdocs-node`