Skip to content

[Snyk] Security upgrade @backstage/theme from 0.0.0-use.local to 0.1.1 #10457

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
snyk-io wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Security upgrade @backstage/theme from 0.0.0-use.local to 0.1.1 #10457

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion plugins/xcmetrics/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@
"@backstage/core-components": "workspace:^",
"@backstage/core-plugin-api": "workspace:^",
"@backstage/errors": "workspace:^",
"@backstage/theme": "workspace:^",
"@backstage/theme": "0.1.1",
"@material-ui/core": "^4.12.2",
"@material-ui/icons": "^4.9.1",
"@material-ui/lab": "4.0.0-alpha.61",
Comment on lines 26 to 32
Copy link

@entelligence-ai-pr-reviews entelligence-ai-pr-reviews bot Jan 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Correctness: ⚠️ Breaks monorepo workspace resolution. Line 6: @backstage/theme changed from workspace:^ to pinned 0.1.1 while all other @backstage/* deps use workspace:^. This forces an outdated version instead of the local workspace package, causing type mismatches and runtime errors. Fix: revert to "@backstage/theme": "workspace:^".

🤖 AI Agent Prompt for Cursor/Windsurf

📋 Copy this prompt to your AI coding assistant (Cursor, Windsurf, etc.) to get help fixing this issue

File: plugins/xcmetrics/package.json, Line 29

Problem: The dependency `@backstage/theme` has been changed from `workspace:^` to a fixed version `0.1.1`, breaking the monorepo workspace protocol. This causes the plugin to use an outdated pinned version instead of the local workspace package, creating version inconsistencies.

Fix: Revert the change to restore the workspace protocol:
- Change `"@backstage/theme": "0.1.1"` back to `"@backstage/theme": "workspace:^"`
- Ensure consistency with other `@backstage/*` dependencies in the same file (lines 26-28) which all use `workspace:^`
- Run `yarn install` or equivalent package manager command after the change to update lockfiles
✨ Committable Code Suggestion

💡 This is a one-click fix! Click "Commit suggestion" to apply this change directly to your branch.

Suggested change
"@backstage/core-components": "workspace:^",
"@backstage/core-plugin-api": "workspace:^",
"@backstage/errors": "workspace:^",
"@backstage/theme": "workspace:^",
"@backstage/theme": "0.1.1",
"@material-ui/core": "^4.12.2",
"@material-ui/icons": "^4.9.1",
"@material-ui/lab": "4.0.0-alpha.61",
"dependencies": {
"@backstage/core-components": "workspace:^",
"@backstage/core-plugin-api": "workspace:^",
"@backstage/errors": "workspace:^",
"@backstage/theme": "workspace:^",
"@material-ui/core": "^4.12.2",
"@material-ui/icons": "^4.9.1",
"@material-ui/lab": "4.0.0-alpha.61",

Expand Down
Loading