[Snyk] Fix for 4 vulnerabilities

[diegoluisi]

Snyk has created this PR to fix 4 vulnerabilities in the yarn dependencies of this project.

Snyk changed the following file(s):

• app/packages/backend/package.json

Note for zero-installs users

If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the .yarn/cache/ directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run yarn to update the contents of the ./yarn/cache directory.
If you are not using zero-install you can ignore this as your flow should likely be unchanged.

⚠️ Warning

Failed to update the yarn.lock, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

	Issue
	Infinite loop SNYK-JS-TAR-17909068
	Incorrect Type Conversion or Cast SNYK-JS-TAR-17909104
	Allocation of Resources Without Limits or Throttling SNYK-JS-TAR-17909152
	Uncaught Exception SNYK-JS-TAR-17909225

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling
🦉 Uncaught Exception

[diegoluisi]

This upgrade includes a high-risk major version update for the Roadie Argo CD backend plugin and a medium-risk update for node-gyp.

@roadiehq/backstage-plugin-argo-cd-backend@2.13.0 → @4.3.1

Risk: HIGH

This is a major upgrade from v2 to v4, which introduces significant breaking changes related to the Backstage backend system and plugin configuration.

Breaking Changes:

• New Backend System Integration: The plugin must be integrated using the new Backstage backend system. This requires changes to how the plugin is initialized in your packages/backend/src/index.ts file. [6]
• Configuration Changes: The structure for configuring the plugin in app-config.yaml has been updated, especially for multi-instance support and authentication methods (session tokens, user/pass, Azure AD). You will need to review and likely migrate your existing configuration. [1, 3]
• RBAC and Permissions: The underlying Argo CD has changed its RBAC enforcement. While not a direct change in the plugin, it may affect the permissions required for the plugin to function correctly. [13]

Recommendation:
Developers must update their backend initialization code to conform to the new Backstage backend system and carefully migrate their app-config.yaml settings to the new format for authentication and multi-instance support. [6]

node-gyp@9.4.1 → @11.0.0

Risk: MEDIUM

This major version upgrade introduces breaking changes related to the required Node.js runtime environment.

Breaking Changes:

• Node.js 16 Support Dropped: Version 11.0.0 of node-gyp removes support for Node.js 16. [14]
• Python Requirement: node-gyp v10.0.0 and later are required for compatibility with Python 3.12+. [10]

Recommendation:
Ensure your build and deployment environments are using a Node.js version later than 16. No application code changes are expected.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.