Generated on Jul 23, 2024 via pnpm

Npm

Home

@backstage/backend-common 0.20.1

Common functionality library for Backstage backends

backstage

Package summary

issues

licenses

Package created

30 Apr 2020

Version published

16 Jan 2024

Maintainers

Total deps

700

Direct deps

License

Apache-2.0

Issues

4 critical severity issues

critical

mysql2@2.3.3

mysql2 Remote Code Execution (RCE) via the readCodeFor function

Recommendation: Upgrade to version 3.9.4 or later

via: @backstage/backend-app-api@0.5.14 & others

mysql2@2.3.3

MySQL2 for Node Arbitrary Code Injection

Recommendation: Upgrade to version 3.9.7 or later

via: @backstage/backend-app-api@0.5.14 & others

pause@0.0.1

Package has no specified license

Recommendation: Check the package code and files for license information

via: @backstage/backend-app-api@0.5.14 & others

seq-queue@0.0.5

Package has no specified license

Recommendation: Check the package code and files for license information

via: @backstage/backend-app-api@0.5.14 & others

Collapse

Expand

9 high severity issues

high

@backstage/backend-common@0.20.1

`@backstage/backend-common` vulnerable to path traversal through symlinks

Recommendation: Upgrade to version 0.20.2 or later

via: @backstage/backend-common@0.20.1

@backstage/backend-common@0.20.1

`@backstage/backend-common` vulnerable to path traversal through symlinks

Recommendation: Upgrade to version 0.20.2 or later

via: @backstage/backend-common@0.20.1

mysql2@2.3.3

mysql2 vulnerable to Prototype Pollution

Recommendation: Upgrade to version 3.9.8 or later

via: @backstage/backend-app-api@0.5.14 & others

@aws-sdk/abort-controller@3.374.0

Deprecated package

via: @aws-sdk/abort-controller@3.374.0 & others

cpu-features@0.0.10

Package uses install script: "node buildcheck.js > buildcheck.gypi && node-gyp rebuild"

via: @backstage/backend-app-api@0.5.14 & others

har-validator@5.1.5

Deprecated package

via: @backstage/backend-app-api@0.5.14 & others

request@2.88.2

Deprecated package

via: @backstage/backend-app-api@0.5.14 & others

ssh2@1.15.0

Package uses install script: "node install.js"

via: @backstage/backend-app-api@0.5.14 & others

uuid@3.4.0

Deprecated package

via: @backstage/backend-app-api@0.5.14 & others

Collapse

Expand

7 moderate severity issues

moderate

request@2.88.2

Server-Side Request Forgery in Request

Recommendation: None

via: @backstage/backend-app-api@0.5.14 & others

mysql2@2.3.3

mysql2 vulnerable to Prototype Poisoning

Recommendation: Upgrade to version 3.9.4 or later

via: @backstage/backend-app-api@0.5.14 & others

mysql2@2.3.3

mysql2 cache poisoning vulnerability

Recommendation: Upgrade to version 3.9.3 or later

via: @backstage/backend-app-api@0.5.14 & others

tough-cookie@2.5.0

tough-cookie Prototype Pollution vulnerability

Recommendation: Upgrade to version 4.1.3 or later

via: @backstage/backend-app-api@0.5.14 & others

@manypkg/find-root@1.1.0

Package has no specified source code repository

via: @backstage/backend-app-api@0.5.14 & others

@manypkg/get-packages@1.1.3

Package has no specified source code repository

via: @backstage/backend-app-api@0.5.14 & others

pause@0.0.1

Package has no specified source code repository

via: @backstage/backend-app-api@0.5.14 & others

Collapse

Expand

Licenses

MIT License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

sublicense

private-use

Cannot

hold-liable

Must

include-copyright

include-license

477 Packages, Including:

@azure/abort-controller@1.1.0

@azure/abort-controller@2.1.2

@azure/core-auth@1.7.2

@azure/core-client@1.9.2

@azure/core-rest-pipeline@1.16.2

@azure/core-tracing@1.1.2

@azure/core-util@1.9.1

@azure/identity@4.4.0

@azure/logger@1.1.3

@azure/msal-browser@3.20.0

@azure/msal-common@14.14.0

@azure/msal-node@2.12.0

@babel/runtime@7.24.8

@changesets/types@4.1.0

@colors/colors@1.6.0

@cspotcode/source-map-support@0.8.1

@dabh/diagnostics@2.0.3

@ioredis/commands@1.2.0

@jridgewell/resolve-uri@3.1.2

@jridgewell/sourcemap-codec@1.5.0

@jridgewell/trace-mapping@0.3.9

@keyv/memcache@1.4.1

@keyv/redis@2.8.5

@manypkg/find-root@1.1.0

@manypkg/get-packages@1.1.3

@nodelib/fs.scandir@2.1.5

@nodelib/fs.stat@2.0.5

@nodelib/fs.walk@1.2.8

@octokit/auth-app@4.0.13

@octokit/auth-oauth-app@5.0.6

@octokit/auth-oauth-device@4.0.5

@octokit/auth-oauth-user@2.1.2

@octokit/auth-token@3.0.4

@octokit/core@4.2.4

@octokit/endpoint@7.0.6

@octokit/graphql@5.0.6

@octokit/oauth-authorization-url@5.0.0

@octokit/oauth-methods@2.0.6

@octokit/openapi-types@18.1.1

@octokit/plugin-paginate-rest@6.1.2

@octokit/plugin-request-log@1.0.4

@octokit/plugin-rest-endpoint-methods@7.2.3

@octokit/request-error@3.0.3

@octokit/request@6.2.8

@octokit/rest@19.0.13

@octokit/tsconfig@1.0.2

@octokit/types@10.0.0

@octokit/types@9.3.2

@tootallnate/once@2.0.0

@tsconfig/node10@1.0.11

Apache License 2.0

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

sublicense

private-use

use-patent-claims

place-warranty

Cannot

hold-liable

use-trademark

Must

include-copyright

include-license

state-changes

include-notice

157 Packages, Including:

@aws-crypto/crc32@5.2.0

@aws-crypto/crc32c@5.2.0

@aws-crypto/sha1-browser@5.2.0

@aws-crypto/sha256-browser@5.2.0

@aws-crypto/sha256-js@5.2.0

@aws-crypto/supports-web-crypto@5.2.0

@aws-crypto/util@5.2.0

@aws-sdk/abort-controller@3.374.0

@aws-sdk/client-codecommit@3.616.0

@aws-sdk/client-cognito-identity@3.616.0

@aws-sdk/client-s3@3.617.0

@aws-sdk/client-sso-oidc@3.616.0

@aws-sdk/client-sso@3.616.0

@aws-sdk/client-sts@3.616.0

@aws-sdk/core@3.616.0

@aws-sdk/credential-provider-cognito-identity@3.616.0

@aws-sdk/credential-provider-env@3.609.0

@aws-sdk/credential-provider-http@3.616.0

@aws-sdk/credential-provider-ini@3.616.0

@aws-sdk/credential-provider-node@3.616.0

@aws-sdk/credential-provider-process@3.614.0

@aws-sdk/credential-provider-sso@3.616.0

@aws-sdk/credential-provider-web-identity@3.609.0

@aws-sdk/credential-providers@3.617.0

@aws-sdk/middleware-bucket-endpoint@3.616.0

@aws-sdk/middleware-expect-continue@3.616.0

@aws-sdk/middleware-flexible-checksums@3.616.0

@aws-sdk/middleware-host-header@3.616.0

@aws-sdk/middleware-location-constraint@3.609.0

@aws-sdk/middleware-logger@3.609.0

@aws-sdk/middleware-recursion-detection@3.616.0

@aws-sdk/middleware-sdk-s3@3.617.0

@aws-sdk/middleware-signing@3.616.0

@aws-sdk/middleware-ssec@3.609.0

@aws-sdk/middleware-user-agent@3.616.0

@aws-sdk/region-config-resolver@3.614.0

@aws-sdk/signature-v4-multi-region@3.617.0

@aws-sdk/token-providers@3.614.0

@aws-sdk/types@3.609.0

@aws-sdk/util-arn-parser@3.568.0

@aws-sdk/util-endpoints@3.614.0

@aws-sdk/util-locate-window@3.568.0

@aws-sdk/util-user-agent-browser@3.609.0

@aws-sdk/util-user-agent-node@3.614.0

@aws-sdk/xml-builder@3.609.0

@backstage/backend-app-api@0.5.14

@backstage/backend-app-api@0.7.9

@backstage/backend-common@0.20.1

@backstage/backend-common@0.21.7

@backstage/backend-common@0.23.3

ISC License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

Cannot

hold-liable

Must

include-copyright

include-license

41 Packages, Including:

anymatch@3.1.3

chownr@1.1.4

chownr@2.0.0

cliui@8.0.1

deprecation@2.3.1

fastq@1.17.1

fs-minipass@2.1.0

fs.realpath@1.0.0

get-caller-file@2.0.5

glob-parent@5.1.2

glob@7.2.3

glob@8.1.0

graceful-fs@4.2.11

har-schema@2.0.0

inflight@1.0.6

inherits@2.0.4

json-stringify-safe@5.0.1

lru-cache@6.0.0

lru-cache@7.18.3

lru-cache@8.0.5

lru-cache@9.1.2

make-error@1.3.6

minimatch@3.1.2

minimatch@5.1.6

minimatch@9.0.5

minipass@3.3.6

minipass@5.0.0

once@1.4.0

pg-int8@1.0.1

semver@7.6.3

setprototypeof@1.2.0

split-ca@1.0.1

split2@4.2.0

tar@6.2.1

universal-user-agent@6.0.1

wrappy@1.0.2

y18n@5.0.8

yallist@4.0.0

yaml@2.4.5

yargs-parser@21.1.1

zod-to-json-schema@3.23.1

BSD 3-Clause "New" or "Revised" License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

place-warranty

Cannot

use-trademark

hold-liable

Must

include-copyright

include-license

9 Packages, Including:

bcrypt-pbkdf@1.0.2

buffer-equal-constant-time@1.0.1

diff@4.0.2

ieee754@1.2.1

qs@6.11.0

qs@6.5.3

sprintf-js@1.0.3

tough-cookie@2.5.0

typescript-json-schema@0.63.0

BSD 2-Clause "Simplified" License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

place-warranty

Cannot

hold-liable

Must

include-copyright

include-license

5 Packages, Including:

@yarnpkg/parsers@3.0.2

esprima@4.0.1

pct-encode@1.0.3

uri-js@4.4.1

webidl-conversions@3.0.1

N/A

2 Packages, Including:

pause@0.0.1

seq-queue@0.0.5

The Unlicense

Public Domain

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

private-use

modify

Cannot

include-copyright

hold-liable

Must

2 Packages, Including:

stream-buffers@3.0.3

tweetnacl@0.14.5

Python License 2.0

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

Cannot

use-trademark

hold-liable

Must

include-copyright

include-license

state-changes

1 Packages, Including:

argparse@2.0.1

(AFL-2.1 OR BSD-3-Clause)

Permissive

1 Packages, Including:

json-schema@0.4.0

(BSD-3-Clause OR GPL-2.0)

Permissive

1 Packages, Including:

node-forge@1.3.1

(MIT AND Zlib)

Permissive

1 Packages, Including:

pako@1.0.11

(MIT AND BSD-3-Clause)

Permissive

1 Packages, Including:

sha.js@2.4.11

BSD Zero Clause License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

sublicense

private-use

include-copyright

include-license

include-original

Cannot

hold-liable

Must

1 Packages, Including:

tslib@2.6.3

(MIT OR CC0-1.0)

Public Domain

1 Packages, Including:

type-fest@0.20.2

Direct Dependencies

All Dependencies CSV

ⓘ This is a list of @backstage/backend-common 's direct dependencies. Data on all dependencies, including transitive ones, is available via CSV download.

Name	Version	Size	License	Type	Vulnerabilities
@backstage/backend-app-api	0.5.14	346.46 kB	Apache-2.0	prod	4 7 7
dockerode	3.3.5	19.85 kB	Apache-2.0	prod	2
fs-extra	10.1.0	16.52 kB	MIT	prod
git-url-parse	13.1.1	9.33 kB	MIT	prod
jose	4.15.9	535.67 kB	MIT	prod optional
minimatch	5.1.6	12.81 kB	ISC	prod
mysql2	2.3.3	119.67 kB	MIT	prod peer	3 1 2
uuid	8.3.2	27.32 kB	MIT	prod
yauzl	2.10.0	18.26 kB	MIT	prod