chore(deps): update dependency @backstage/integration to v1.20.1 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@backstage/integration (source)	1.16.1 → 1.20.1

---

Backstage vulnerable to potential reading of SCM URLs using built in token

CVE-2026-29185 / GHSA-95v5-prp4-5gv5

More information

Details

Impact

A vulnerability in the SCM URL parsing used by Backstage integrations allowed path traversal sequences in encoded form to be included in file paths. When these URLs were processed by integration functions that construct API URLs, the traversal segments could redirect requests to unintended SCM provider API endpoints using the configured server-side integration credentials.

This affects instances that use any of the SCM integrations (GitHub, Bitbucket Server, Bitbucket Cloud) with the scaffolder or other features that accept user-provided SCM URLs.

Patches

This is patched in @backstage/integration version 1.20.1.

Workarounds

There is no workaround for this vulnerability. Users should upgrade to the patched version.

References

• Backstage SCM integration documentation: https://backstage.io/docs/integrations/

Severity

• CVSS Score: 2.7 / 10 (Low)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

References

• https://github.com/backstage/backstage/security/advisories/GHSA-95v5-prp4-5gv5
• https://nvd.nist.gov/vuln/detail/CVE-2026-29185
• https://github.com/advisories/GHSA-95v5-prp4-5gv5

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

backstage/backstage (@​backstage/integration)

v1.20.1

Compare Source

This release fixes an issue where the @backstage/plugin-search-react package had an unnecessary dependency on @backstage/frontend-app-api.

v1.20.0

Compare Source

Minor Changes

• 6999f6d: The AzureUrl class in the @​backstage/integration package is now able to process BOTH git branches and git tags. Initially this class only processed git branches and threw an error when non-branch Azure URLs were passed in.

Patch Changes

• cc6206e: Added support for {org}.visualstudio.com domains used by Azure DevOps
• 7455dae: Use node prefix on native imports

v1.19.2

Compare Source

Patch Changes

• 3afeab4: Implementing ScmIntegration for GoogleGcs
• 9083273: Rollback the lowercase replacing in GitHub integration config

v1.19.1

Compare Source

This release fixes an issue where Microsoft auth would fail.

Contributed by @​TheGemmell in #​20655

v1.19.0

Compare Source

Minor Changes

• 37fba1d: Added support for Bitbucket Cloud OAuth. This introduces an alternative authentication method using a workspace OAuth consumer, alongside App Passwords (deprecated) and API tokens. OAuth does not require a bot or service account and avoids token expiry issues.

  BREAKING CHANGES

  • @​backstage/integration (src/bitbucketCloud/core.ts)

    • getBitbucketCloudRequestOptions now returns a Promise and must be awaited.

  • @​backstage/plugin-scaffolder-backend-module-bitbucket-cloud (src/actions/helpers.ts)

    • getBitbucketClient now returns a Promise and must be awaited.
    • getAuthorizationHeader now returns a Promise and must be awaited.

  OAuth usage example

  integrations:
    bitbucketCloud:
      - clientId: client-id
        clientSecret: client-secret

Patch Changes

• a26a322: Added support for using a GitHub App installation to generate tokens for public repository access when the publicAccess option is enabled. When all other authentication methods fail (e.g., the app is not installed in that organization), the provider will now use an available installation to generate a token that can be used to access public repositories as read only.
• fb029b6: Updated luxon types
• e15fdae: Made the github urls case insensitive.

v1.18.2

Compare Source

Patch Changes

• fa255f5: Support for Bitbucket Cloud's API token was added as appPassword is deprecated (no new creation from September 9, 2025) and will be removed on June 9, 2026.

  API token usage example:

  integrations:
    bitbucketCloud:
      - username: user@domain.com
        token: my-token

• 05f60e1: Refactored constructor parameter properties to explicit property declarations for compatibility with TypeScript's erasableSyntaxOnly setting. This internal refactoring maintains all existing functionality while ensuring TypeScript compilation compatibility.

• Updated dependencies

  • @​backstage/config@​1.3.6

v1.18.1

Compare Source

Patch Changes

• d772b51: remove host from azure blob storage integration type
• 84443f1: Adds config definitions for Azure Blob Storage.
• Updated dependencies
  • @​backstage/config@​1.3.5

v1.18.0

Compare Source

Minor Changes

• 03bdc68: Added support for limiting GithubAppCredentialsMux to specific apps

Patch Changes

• 56897d7: Fixes issue with Github credentials provider which fails to match organization name if using allowedInstallationOwners

v1.17.1

Compare Source

Patch Changes

• e0189b8: UrlReader: Fix handling of access tokens for GitLab readURL requests
• d1e4a6d: Fixed bug where the GitLab user token and GitLab integration token were being merged together
• Updated dependencies
  • @​backstage/config@​1.3.3

v1.17.0

Compare Source

Minor Changes

• d945206: Added support for federated credentials using managed identities in the Azure DevOps integration. Federated credentials are only available for Azure DevOps organizations that have been configured to use Entra ID for authentication.

  integrations:
    azure:
      - host: dev.azure.com
        credentials:
  +       - clientId: ${APP_REGISTRATION_CLIENT_ID}
  +         managedIdentityClientId: system-assigned
  +         tenantId: ${AZURE_TENANT_ID}

  This also adds support for automatically using the system-assigned managed identity of an Azure resource by specifying system-assigned as the client ID of the managed identity.

  integrations:
    azure:
      - host: dev.azure.com
        credentials:
  -       - clientId: ${AZURE_CLIENT_ID}
  +       - clientId: system-assigned

• f134cea: Implement Edit URL feature for Gerrit 3.9+.

  It's possible to disable the edit url by adding the disableEditUrl: true config in the Gerrit integration.

Patch Changes

• f3381d3: Added missing organizations property to azure section in config.d.ts file
• acea1d4: update documentation
• Updated dependencies
  • @​backstage/config@​1.3.2
  • @​backstage/errors@​1.2.7

v1.16.3

Compare Source

Patch Changes

• 9768992: Mark GitHub webhookSecret config property as optional. A webhookSecret is not required when creating a GitHub App.
• Updated dependencies
  • @​backstage/config@​1.3.2
  • @​backstage/errors@​1.2.7

v1.16.2

Compare Source

Patch Changes

• 89db8b8: Gerrit integration now exports getGitilesAuthenticationUrl. This enables its usage by the GerritUrlReader.
• 4f8b5b6: Allow signing git commits using configured private PGP key in scaffolder
• Updated dependencies
  • @​backstage/config@​1.3.2
  • @​backstage/errors@​1.2.7

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.