Replace dependency passport-saml with @node-saml/passport-saml ^4.0.4 by renovate[bot] · Pull Request #12489 · https-quantumblockchainai-atlassian-net/backstage

renovate · 2026-04-28T10:23:58Z

This PR contains the following updates:

Package	Type	Update	Change
passport-saml → @node-saml/passport-saml	dependencies	replacement	`^3.1.2` → `^4.0.4`

This is a special PR that replaces passport-saml with the community suggested minimal stable replacement version.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

codesandbox · 2026-04-28T10:24:03Z

Review or Edit in CodeSandbox

Open the branch in Web Editor • VS Code • Insiders

Open Preview

augmentcode · 2026-04-28T10:25:44Z

🤖 Augment PR Summary

Summary: This PR replaces the SAML Passport strategy dependency used by the auth-backend plugin.

Changes:

Swaps passport-saml for the community-maintained scoped package @node-saml/passport-saml at ^4.0.4.
Updates the lockfile to reflect the dependency replacement.

Why: Renovate-generated “replacement” update to move off the legacy passport-saml package and onto the suggested successor.

Technical Notes: Any runtime/TS imports that still reference passport-saml (including deep type imports) may need to be updated to the new package name.

_{🤖 Was this summary useful? React with 👍 or 👎}

augmentcode

Review completed. 1 suggestion posted.

Comment augment review to trigger a new review at any time.

augmentcode · 2026-04-28T10:25:45Z

    "passport-oauth2": "^1.6.1",
    "passport-onelogin-oauth": "^0.0.1",
-    "passport-saml": "^3.1.2",
+    "@node-saml/passport-saml": "^4.0.4",


plugins/auth-backend/src/providers/saml/provider.ts still imports from passport-saml (and passport-saml/lib/...), so switching the dependency to @node-saml/passport-saml will likely cause module resolution failures at build/runtime unless those import paths are updated too.

Severity: high

Other Locations

plugins/auth-backend/src/providers/saml/provider.ts:18

plugins/auth-backend/src/providers/saml/provider.ts:23

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

entelligence-ai-pr-reviews · 2026-04-28T10:26:52Z

EntelligenceAI PR Summary

Migrates SAML authentication library from deprecated passport-saml to @node-saml/passport-saml v4.0.4 in the auth-backend plugin, with corresponding lockfile updates.

plugins/auth-backend/package.json: Swaps passport-saml@^3.1.2 for @node-saml/passport-saml@^4.0.4
yarn.lock: Removes passport-saml resolution, adds @node-saml/passport-saml and its transitive dependencies (@node-saml/node-saml, upgraded xml-crypto, xml-encryption, xml2js, @xmldom/xmldom)
yarn.lock: Pins @backstage/plugin-gitops-profiles workspace dependencies to fixed npm versions (config@0.1.1, core-components@0.1.0, core-plugin-api@0.1.0, theme@0.1.1, version-bridge@0.1.0)
yarn.lock: Introduces additional transitive dependencies including cross-fetch, node-fetch, core-js, dompurify, react-syntax-highlighter, updated @types/express and @types/passport, and legacy remark/micromark packages

Confidence Score: 4/5 - Mostly Safe

Likely safe but review recommended — this PR correctly migrates passport-saml@^3.1.2 to @node-saml/passport-saml@^4.0.4, which is the actively maintained fork of the deprecated library and a well-known community-recommended upgrade path. The change is scoped to plugins/auth-backend/package.json and yarn.lock, with no application logic modified. However, this is a major version bump (v3 → v4) of a security-critical authentication library, and the PR summary does not mention any validation of API compatibility or testing of SAML login flows, which warrants at least a functional verification before merging.

Key Findings:

The migration from passport-saml to @node-saml/passport-saml is the correct community-endorsed upgrade path for this deprecated package, and the target version ^4.0.4 includes security fixes for XML parsing vulnerabilities via upgraded xml-crypto, xml-encryption, and @xmldom/xmldom dependencies.
This is a major version bump (v3 → v4) of a SAML authentication library — v4 introduced breaking changes in configuration options and strategy initialization (e.g., issuer moved, cert handling changed) — no evidence in the PR that auth-backend's SAML strategy implementation was audited for compatibility with the new API surface.
The transitive dependency tree changes are substantial (new @node-saml/node-saml package, upgraded xml2js, xmldom), and while these are generally improvements, the yarn.lock changes were not reviewed by the automated analysis, leaving some uncertainty about whether all resolved versions are consistent.
No test evidence or CI results are referenced in the PR to confirm that SAML login/logout flows function correctly end-to-end with the new library version.

Files requiring special attention

plugins/auth-backend/package.json
yarn.lock

socket-security · 2026-04-28T10:28:37Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@node-saml/passport-saml@4.0.4
	@azure/identity@3.2.3
	@esbuild-kit/cjs-loader@2.4.2
	@gitbeaker/browser@35.8.1
	@gitbeaker/node@35.8.1
	@material-ui/core@4.12.4
	@material-ui/lab@4.0.0-alpha.61
	@material-ui/pickers@3.3.10
	@material-ui/styles@4.11.5
	@date-io/core@1.3.13
	@kubernetes-models/base@4.0.3
	@aws-sdk/util-arn-parser@3.310.0
	@aws-sdk/abort-controller@3.370.0
	@graphql-codegen/typescript-resolvers@3.2.0
	@graphql-codegen/graphql-modules-preset@3.1.2
	@graphql-codegen/typescript@3.0.3
	@date-io/luxon@1.3.13
	@frsource/cypress-plugin-visual-regression-diff@3.3.10
	@aws-sdk/middleware-endpoint@3.370.0
	@aws-sdk/util-stream-node@3.370.0
	@aws-sdk/types@3.370.0
	@graphql-tools/schema@9.0.19
	@aws-sdk/node-http-handler@3.370.0
	@aws-sdk/signature-v4@3.370.0
	@graphql-codegen/cli@3.3.0
	@manypkg/get-packages@1.1.3
	@kubernetes-models/apimachinery@1.2.1
	@keyv/memcache@1.3.7
	@codemirror/language@6.8.0
	@microsoft/api-documenter@7.19.27
See 45 more rows in the dashboard

View full report

socket-security · 2026-04-28T10:28:38Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Critical CVE: Node-SAML SAML Signature Verification Vulnerability in npm `@node-saml/node-saml` CVE: GHSA-4mxg-3p6v-xgq3 Node-SAML SAML Signature Verification Vulnerability (CRITICAL) Affected versions: < 5.1.0 Patched version: 5.1.0 From: `?` → `npm/@node-saml/passport-saml@4.0.4` → `npm/@node-saml/node-saml@4.0.5` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@node-saml/node-saml@4.0.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Critical CVE: Node-SAML SAML Authentication Bypass in npm `@node-saml/node-saml` CVE: GHSA-m837-g268-mmv7 Node-SAML SAML Authentication Bypass (CRITICAL) Affected versions: < 5.1.0 Patched version: 5.1.0 From: `?` → `npm/@node-saml/passport-saml@4.0.4` → `npm/@node-saml/node-saml@4.0.5` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@node-saml/node-saml@4.0.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Critical CVE: Node-SAML SAML Signature Verification Vulnerability in npm `@node-saml/passport-saml` CVE: GHSA-4mxg-3p6v-xgq3 Node-SAML SAML Signature Verification Vulnerability (CRITICAL) Affected versions: < 5.1.0 Patched version: 5.1.0 From: plugins/auth-backend/package.json → `npm/@node-saml/passport-saml@4.0.4` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@node-saml/passport-saml@4.0.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm `typescript` under W3C-20150513 License: W3C-20150513 - The applicable license policy does not permit this license (5) (package/ThirdPartyNoticeText.txt) License: LicenseRef-W3C-Community-Final-Specification-Agreement - The applicable license policy does not permit this license (5) (package/ThirdPartyNoticeText.txt) License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/ThirdPartyNoticeText.txt) License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/ThirdPartyNoticeText.txt) From: `?` → `npm/@microsoft/api-extractor@7.33.7` → `npm/typescript@4.8.4` ℹ Read more on: This package \| This alert \| What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/typescript@4.8.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

github-actions · 2026-05-05T11:40:32Z

This PR has been automatically marked as stale because it has not had recent activity from the author. It will be closed if no further activity occurs. If the PR was closed and you want it re-opened, let us know and we'll re-open the PR so that you can continue the contribution!

Replace dependency passport-saml with @node-saml/passport-saml ^4.0.4

546bc49

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

renovate Bot added the dependencies Pull requests that update a dependency file label Apr 28, 2026

github-actions Bot added the auth label Apr 28, 2026

augmentcode Bot reviewed Apr 28, 2026

View reviewed changes

github-actions Bot added the stale label May 5, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Replace dependency passport-saml with @node-saml/passport-saml ^4.0.4#12489

Replace dependency passport-saml with @node-saml/passport-saml ^4.0.4#12489
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/passport-saml-replacement

renovate Bot commented Apr 28, 2026

Uh oh!

codesandbox Bot commented Apr 28, 2026

Uh oh!

augmentcode Bot commented Apr 28, 2026

Uh oh!

augmentcode Bot left a comment

Uh oh!

augmentcode Bot Apr 28, 2026 •

edited

Loading

Uh oh!

entelligence-ai-pr-reviews Bot commented Apr 28, 2026

Uh oh!

socket-security Bot commented Apr 28, 2026

Uh oh!

socket-security Bot commented Apr 28, 2026

Uh oh!

github-actions Bot commented May 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Apr 28, 2026

Configuration

Uh oh!

codesandbox Bot commented Apr 28, 2026

Review or Edit in CodeSandbox

Uh oh!

augmentcode Bot commented Apr 28, 2026

Uh oh!

augmentcode Bot left a comment

Choose a reason for hiding this comment

Uh oh!

augmentcode Bot Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

entelligence-ai-pr-reviews Bot commented Apr 28, 2026

EntelligenceAI PR Summary

Confidence Score: 4/5 - Mostly Safe

Uh oh!

socket-security Bot commented Apr 28, 2026

Uh oh!

socket-security Bot commented Apr 28, 2026

Uh oh!

github-actions Bot commented May 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

augmentcode Bot Apr 28, 2026 •

edited

Loading