Skip to content

chore(deps): bump the javascript-deps group with 6 updates - #344

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/javascript-deps-54c39adcaf
Open

chore(deps): bump the javascript-deps group with 6 updates#344
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/javascript-deps-54c39adcaf

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 3, 2026

Copy link
Copy Markdown
Contributor

Bumps the javascript-deps group with 6 updates:

Package From To
@module-federation/enhanced 2.8.2 2.9.0
node-gyp 13.0.1 13.0.2
@backstage/plugin-catalog-react 3.2.1 3.2.2
@testing-library/react 16.3.2 16.3.3
@testing-library/user-event 14.6.5 14.6.6
@backstage/plugin-kubernetes-backend 0.21.8 0.21.9

Updates @module-federation/enhanced from 2.8.2 to 2.9.0

Release notes

Sourced from @​module-federation/enhanced's releases.

Release v2.9.0

What's Changed

New Features 🎉

Bug Fixes 🐞

Other Changes

Full Changelog: module-federation/core@v2.8.2...v2.9.0

Changelog

Sourced from @​module-federation/enhanced's changelog.

2.9.0

Patch Changes

  • Updated dependencies [df8b40f]
    • @​module-federation/webpack-bundler-runtime@​2.9.0
    • @​module-federation/dts-plugin@​2.9.0
    • @​module-federation/runtime-tools@​2.9.0
    • @​module-federation/rspack@​2.9.0
    • @​module-federation/inject-external-runtime-core-plugin@​2.9.0
    • @​module-federation/sdk@​2.9.0
    • @​module-federation/managers@​2.9.0
    • @​module-federation/manifest@​2.9.0
    • @​module-federation/bridge-react-webpack-plugin@​2.9.0
    • @​module-federation/error-codes@​2.9.0
    • @​module-federation/cli@​2.9.0
Commits
  • 51ae6c3 chore: remove dead code and stale commented blocks (#4985)
  • 2120d66 refactor: reuse normalizeSharedOptions and shared createBundlerLogger (#4987)
  • 219315c chore(deps): bump nanoid from 5.1.6 to 5.1.16 in /packages/enhanced/test/conf...
  • b022032 Release v2.8.2 (#4967)
  • See full diff in compare view

Updates node-gyp from 13.0.1 to 13.0.2

Release notes

Sourced from node-gyp's releases.

v13.0.2

13.0.2 (2026-08-25)

Bug Fixes

  • ci: add zizmor security linter for github actions (#3358) (8466166)
  • ci: do not ruff format gyp example code in markdown (#3357) (4a74fbe)
  • fall back gracefully when build symlink creation fails (#3339) (eae161f)

Core

  • deps: bump actions/checkout from 6 to 7 (#3335) (353050b)
  • deps: bump actions/setup-node from 6 to 7 (#3348) (005a7c5)
  • deps: bump actions/setup-python from 6 to 7 (#3349) (42367da)
  • deps: bump astral-sh/ruff-action from 4.0.0 to 4.1.0 (#3342) (ef586e1)

Tests

Changelog

Sourced from node-gyp's changelog.

13.0.2 (2026-08-25)

Bug Fixes

  • ci: add zizmor security linter for github actions (#3358) (8466166)
  • ci: do not ruff format gyp example code in markdown (#3357) (4a74fbe)
  • fall back gracefully when build symlink creation fails (#3339) (eae161f)

Core

  • deps: bump actions/checkout from 6 to 7 (#3335) (353050b)
  • deps: bump actions/setup-node from 6 to 7 (#3348) (005a7c5)
  • deps: bump actions/setup-python from 6 to 7 (#3349) (42367da)
  • deps: bump astral-sh/ruff-action from 4.0.0 to 4.1.0 (#3342) (ef586e1)

Tests

Commits
  • 936498f chore(main): release 13.0.2 (#3343)
  • 8466166 fix(ci): add zizmor security linter for github actions (#3358)
  • 4a74fbe fix(ci): do not ruff format gyp example code in markdown (#3357)
  • eae161f fix: fall back gracefully when build symlink creation fails (#3339)
  • 42367da build(deps): bump actions/setup-python from 6 to 7 (#3349)
  • 3c38cec test: log MSBuild output on Windows build failures (#3328)
  • 005a7c5 build(deps): bump actions/setup-node from 6 to 7 (#3348)
  • a2f8b6a test: fix undici 8.7.0 compatibility (#3345)
  • ef586e1 build(deps): bump astral-sh/ruff-action from 4.0.0 to 4.1.0 (#3342)
  • 353050b build(deps): bump actions/checkout from 6 to 7 (#3335)
  • See full diff in compare view

Updates @backstage/plugin-catalog-react from 3.2.1 to 3.2.2

Changelog

Sourced from @​backstage/plugin-catalog-react's changelog.

@​backstage/plugin-catalog-react

3.2.3-next.1

Patch Changes

  • bf7e890: Added the missing Material UI dependency used by catalog popovers.
  • Updated dependencies
    • @​backstage/core-components@​0.18.14-next.1
    • @​backstage/frontend-plugin-api@​0.18.1-next.0
    • @​backstage/filter-predicates@​0.1.5-next.0
    • @​backstage/ui@​0.18.0-next.1
    • @​backstage/integration-react@​1.2.22-next.0
    • @​backstage/core-compat-api@​0.5.15-next.1
    • @​backstage/core-plugin-api@​1.12.10-next.0
    • @​backstage/catalog-client@​1.16.2-next.0
    • @​backstage/plugin-permission-react@​0.5.5-next.0

3.2.2-next.0

Patch Changes

  • a7b14b5: Fixed EntityOwnerPicker crashing with Entity reference "<name>" had missing or empty kind when the owners query parameter contains humanized entity refs, as produced by the OwnershipCard links in @backstage/plugin-org.

    Query parameters were stored as-is in the initial state and only converted to full entity refs by an effect, which runs after the first render. That first render passed the raw value to the entity presentation API, whose parseEntityRef call rejects a ref without a kind. The same raw value was also sent to catalogApi.getEntitiesByRefs on mount, and made the option checkboxes render unselected until the effect ran.

    The query parameters are now normalized through EntityOwnerFilter when the state is initialized, matching what the existing effect already did and what the filters code path already produced.

  • Updated dependencies

    • @​backstage/ui@​0.17.2-next.0
    • @​backstage/core-components@​0.18.14-next.0
    • @​backstage/core-compat-api@​0.5.15-next.0
    • @​backstage/frontend-test-utils@​0.6.4-next.0
Commits

Updates @testing-library/react from 16.3.2 to 16.3.3

Release notes

Sourced from @​testing-library/react's releases.

v16.3.3

16.3.3 (2026-08-27)

Bug Fixes

  • Avoid act() re-entrant when dispatching events (#1468) (20ce75f)
Commits

Updates @testing-library/user-event from 14.6.5 to 14.6.6

Release notes

Sourced from @​testing-library/user-event's releases.

v14.6.6

14.6.6 (2026-08-22)

Bug Fixes

  • default pointer event pointerType to empty string instead of the string "undefined" (#1325) (71a5475)
Commits
  • 71a5475 fix: default pointer event pointerType to empty string instead of the string ...
  • See full diff in compare view

Updates @backstage/plugin-kubernetes-backend from 0.21.8 to 0.21.9

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the javascript-deps group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [@module-federation/enhanced](https://github.com/module-federation/core/tree/HEAD/packages/enhanced) | `2.8.2` | `2.9.0` |
| [node-gyp](https://github.com/nodejs/node-gyp) | `13.0.1` | `13.0.2` |
| [@backstage/plugin-catalog-react](https://github.com/backstage/backstage/tree/HEAD/plugins/catalog-react) | `3.2.1` | `3.2.2` |
| [@testing-library/react](https://github.com/testing-library/react-testing-library) | `16.3.2` | `16.3.3` |
| [@testing-library/user-event](https://github.com/testing-library/user-event) | `14.6.5` | `14.6.6` |
| [@backstage/plugin-kubernetes-backend](https://github.com/backstage/backstage/tree/HEAD/plugins/kubernetes-backend) | `0.21.8` | `0.21.9` |


Updates `@module-federation/enhanced` from 2.8.2 to 2.9.0
- [Release notes](https://github.com/module-federation/core/releases)
- [Changelog](https://github.com/module-federation/core/blob/main/packages/enhanced/CHANGELOG.md)
- [Commits](https://github.com/module-federation/core/commits/v2.9.0/packages/enhanced)

Updates `node-gyp` from 13.0.1 to 13.0.2
- [Release notes](https://github.com/nodejs/node-gyp/releases)
- [Changelog](https://github.com/nodejs/node-gyp/blob/main/CHANGELOG.md)
- [Commits](nodejs/node-gyp@v13.0.1...v13.0.2)

Updates `@backstage/plugin-catalog-react` from 3.2.1 to 3.2.2
- [Release notes](https://github.com/backstage/backstage/releases)
- [Changelog](https://github.com/backstage/backstage/blob/master/plugins/catalog-react/CHANGELOG.md)
- [Commits](https://github.com/backstage/backstage/commits/HEAD/plugins/catalog-react)

Updates `@testing-library/react` from 16.3.2 to 16.3.3
- [Release notes](https://github.com/testing-library/react-testing-library/releases)
- [Changelog](https://github.com/testing-library/react-testing-library/blob/main/CHANGELOG.md)
- [Commits](testing-library/react-testing-library@v16.3.2...v16.3.3)

Updates `@testing-library/user-event` from 14.6.5 to 14.6.6
- [Release notes](https://github.com/testing-library/user-event/releases)
- [Changelog](https://github.com/testing-library/user-event/blob/main/CHANGELOG.md)
- [Commits](testing-library/user-event@v14.6.5...v14.6.6)

Updates `@backstage/plugin-kubernetes-backend` from 0.21.8 to 0.21.9
- [Release notes](https://github.com/backstage/backstage/releases)
- [Changelog](https://github.com/backstage/backstage/blob/master/plugins/kubernetes-backend/CHANGELOG.md)
- [Commits](https://github.com/backstage/backstage/commits/HEAD/plugins/kubernetes-backend)

---
updated-dependencies:
- dependency-name: "@module-federation/enhanced"
  dependency-version: 2.9.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: javascript-deps
- dependency-name: node-gyp
  dependency-version: 13.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: javascript-deps
- dependency-name: "@backstage/plugin-catalog-react"
  dependency-version: 3.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: javascript-deps
- dependency-name: "@testing-library/react"
  dependency-version: 16.3.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: javascript-deps
- dependency-name: "@testing-library/user-event"
  dependency-version: 14.6.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: javascript-deps
- dependency-name: "@backstage/plugin-kubernetes-backend"
  dependency-version: 0.21.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: javascript-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 3, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 3, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: deps/npm. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot
dependabot Bot requested review from a team as code owners September 3, 2026 22:18
@radius-dependabot-manager
radius-dependabot-manager Bot enabled auto-merge (squash) September 3, 2026 22:21
@github-actions

github-actions Bot commented Sep 3, 2026

Copy link
Copy Markdown

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ✅ 0 package(s) with unknown licenses.
  • ⚠️ 1 packages with OpenSSF Scorecard issues.
See the Details below.

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
npm/@module-federation/enhanced ^2.9.0 UnknownUnknown
npm/node-gyp ^13.0.2 UnknownUnknown
npm/@backstage/plugin-catalog-react ^3.2.2 UnknownUnknown
npm/@testing-library/react ^16.3.3 UnknownUnknown
npm/@testing-library/user-event ^14.6.6 UnknownUnknown
npm/@backstage/plugin-kubernetes-backend ^0.21.9 UnknownUnknown
npm/node-gyp ^13.0.2 UnknownUnknown
npm/@testing-library/react ^16.3.3 UnknownUnknown
npm/@testing-library/react ^16.3.3 UnknownUnknown
npm/@testing-library/user-event ^14.6.6 UnknownUnknown
npm/@backstage/plugin-catalog-react 3.2.2 🟢 6.5
Details
CheckScoreReason
Dependency-Update-Tool🟢 10update tool detected
Maintained🟢 1030 commit(s) and 28 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
Security-Policy🟢 10security policy file detected
Dangerous-Workflow⚠️ 0dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 2badge detected: InProgress
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Packaging🟢 10packaging workflow detected
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
License🟢 10license file detected
SAST🟢 10SAST tool detected
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities⚠️ 0154 existing vulnerabilities detected
CI-Tests🟢 1029 out of 29 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 17 contributing companies or organizations
npm/@backstage/plugin-kubernetes-backend 0.21.9 🟢 6.5
Details
CheckScoreReason
Dependency-Update-Tool🟢 10update tool detected
Maintained🟢 1030 commit(s) and 28 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
Security-Policy🟢 10security policy file detected
Dangerous-Workflow⚠️ 0dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 2badge detected: InProgress
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Packaging🟢 10packaging workflow detected
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
License🟢 10license file detected
SAST🟢 10SAST tool detected
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities⚠️ 0154 existing vulnerabilities detected
CI-Tests🟢 1029 out of 29 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 17 contributing companies or organizations
npm/@module-federation/bridge-react-webpack-plugin 2.9.0 UnknownUnknown
npm/@module-federation/cli 2.9.0 UnknownUnknown
npm/@module-federation/dts-plugin 2.9.0 UnknownUnknown
npm/@module-federation/enhanced 2.9.0 UnknownUnknown
npm/@module-federation/error-codes 2.9.0 UnknownUnknown
npm/@module-federation/inject-external-runtime-core-plugin 2.9.0 UnknownUnknown
npm/@module-federation/managers 2.9.0 UnknownUnknown
npm/@module-federation/manifest 2.9.0 UnknownUnknown
npm/@module-federation/rspack 2.9.0 UnknownUnknown
npm/@module-federation/runtime 2.9.0 UnknownUnknown
npm/@module-federation/runtime-core 2.9.0 UnknownUnknown
npm/@module-federation/runtime-tools 2.9.0 UnknownUnknown
npm/@module-federation/sdk 2.9.0 UnknownUnknown
npm/@module-federation/third-party-dts-extractor 2.9.0 UnknownUnknown
npm/@module-federation/webpack-bundler-runtime 2.9.0 UnknownUnknown
npm/@testing-library/react 16.3.3 ⚠️ 3.7
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 5Found 15/29 approved changesets -- score normalized to 5
Binary-Artifacts🟢 10no binaries found in the repo
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Security-Policy⚠️ 0security policy file not detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@testing-library/user-event 14.6.6 🟢 4.6
Details
CheckScoreReason
Code-Review🟢 4Found 13/29 approved changesets -- score normalized to 4
Maintained🟢 910 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 9
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy⚠️ 0security policy file not detected
Signed-Releases⚠️ -1no releases found
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/node-gyp 13.0.2 🟢 6.9
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 9security policy file detected
Binary-Artifacts🟢 10no binaries found in the repo
Maintained🟢 1023 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies⚠️ 3dependency not pinned by hash detected -- score normalized to 3
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Signed-Releases⚠️ -1no releases found
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Packaging🟢 10packaging workflow detected

Scanned Files

  • package.json
  • packages/app/package.json
  • packages/backend/package.json
  • packages/rad-components/package.json
  • plugins/plugin-radius/package.json
  • yarn.lock

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants