Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the [Dependency Dashboard](https://docs.renovatebot.com/key-concepts/dashboard/) docs to learn more.
[View this repository on the Mend.io Web Portal](https://developer.mend.io/github/Dynatrace/backstage-plugin).

## Config Migration Needed

- [ ] Select this checkbox to let Renovate create an automated Config Migration PR.

## Deprecations / Replacements
> [!WARNING]
The following dependencies are either deprecated or have replacements available.

| Datasource | Package | Replacement PR? |
|------------|------|--------------|
| npm | [@material-ui/core](https://redirect.github.com/mui-org/material-ui) |  |
| npm | [@material-ui/icons](https://redirect.github.com/mui-org/material-ui) |  |
| npm | [@material-ui/lab](https://redirect.github.com/mui-org/material-ui) |  |

## Rate-Limited

The following updates are currently rate-limited. To force their creation now, click on a checkbox below.

- [ ] chore: Update all patch dependency updates (`@backstage/app-defaults`, `@backstage/backend-defaults`, `@backstage/cli`, `@backstage/core-app-api`, `@backstage/core-components`, `@backstage/core-plugin-api`, `@backstage/dev-utils`, `@backstage/integration-react`, `@backstage/plugin-api-docs`, `@backstage/plugin-app-backend`, `@backstage/plugin-auth-backend-module-guest-provider`, `@backstage/plugin-auth-node`, `@backstage/plugin-catalog`, `@backstage/plugin-catalog-backend-module-scaffolder-entity-model`, `@backstage/plugin-catalog-graph`, `@backstage/plugin-catalog-import`, `@backstage/plugin-org`, `@backstage/plugin-permission-backend`, `@backstage/plugin-permission-backend-module-allow-all-policy`, `@backstage/plugin-permission-common`, `@backstage/plugin-permission-react`, `@backstage/plugin-proxy-backend`, `@backstage/plugin-search`, `@backstage/plugin-search-backend`, `@backstage/plugin-search-backend-module-pg`, `@backstage/plugin-search-backend-node`, `@backstage/plugin-search-react`, `@backstage/plugin-techdocs-module-addons-contrib`, `@backstage/plugin-techdocs-react`, `@backstage/plugin-user-settings`, `@backstage/test-utils`, `@internationalized/date`, `@testing-library/user-event`, `@types/lodash`, `@types/luxon`, `esbuild`, `fast-uri`, `flatted`, `minimatch`, `postcss`, `react-router-dom`, `tar`, `vm2`, `ws`)
- [ ] chore: Update actions/setup-node action to v7
- [ ] chore: Update backstage monorepo (major) (`@backstage/plugin-catalog-react`, `@backstage/plugin-scaffolder-backend`)
- [ ] chore: Update dependency @testing-library/jest-dom to v7
- [ ] chore: Update dependency basic-ftp to v6
- [ ] chore: Update dependency better-sqlite3 to v13
- [ ] chore: Update dependency concurrently to v10
- [ ] chore: Update dependency express to v5 (`express`, `@types/express`)
- [ ] chore: Update dependency fast-uri to v4
- [ ] chore: Update dependency immutable to v5
- [ ] chore: Update dependency js-yaml to v5
- [ ] chore: Update dependency koa to v3
- [ ] chore: Update dependency lerna to v10
- [ ] chore: Update dependency linkify-it to v6
- [ ] chore: Update dependency minimatch to v10
- [ ] chore: Update dependency node-gyp to v13
- [ ] chore: Update dependency protobufjs to v8
- [ ] chore: Update dependency react-router-dom to v7
- [ ] chore: Update dependency sigstore to v5
- [ ] chore: Update dependency svgo to v4
- [ ] chore: Update dependency typescript to v7
- [ ] chore: Update dependency undici to v8
- [ ] chore: Update jest monorepo to v30 (`@types/jest`, `jest`, `jest-environment-jsdom`)
- [ ] chore: Update react monorepo to v19 (`@types/react`, `@types/react-dom`, `react`, `react-dom`)
- [ ] 🔐 **Create all rate-limited PRs at once** 🔐

## PR Edited (Blocked)

The following updates have been manually edited so Renovate will no longer make changes. To discard all commits and start over, click on a checkbox below.

- [ ] chore: Update dependency form-data to v2.5.6 [SECURITY]
- [ ] chore: Update dependency react-router to v7.18.2 [SECURITY]
- [ ] chore: Update dependency @backstage/plugin-auth-backend to ^0.29.0 [SECURITY]
- [ ] chore: Update dependency markdown-it to v14 [SECURITY]
- [ ] chore: Update dependency uuid to v11 [SECURITY]
- [ ] [chore: Update all minor dependency updates](../pull/367) (`@backstage-community/plugin-github-actions`, `@backstage-community/plugin-tech-radar`, `@backstage/catalog-client`, `@backstage/catalog-model`, `@backstage/plugin-catalog-backend`, `@backstage/plugin-permission-node`, `@backstage/plugin-scaffolder`, `@backstage/plugin-techdocs-backend`, `@backstage/plugin-techdocs-node`, `@commitlint/cli`, `@commitlint/config-conventional`, `@commitlint/config-lerna-scopes`, `@playwright/test`, `@types/node`, `@typescript-eslint/parser`, `axios`, `better-sqlite3`, `fast-xml-builder`, `fast-xml-parser`, `ip-address`, `jsonpath-plus`, `lint-staged`, `msw`, `node-gyp`, `pg`, `prettier`, `rollup`, `shell-quote`, `wait-on`, `yarn`)

## Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

- [ ] [chore: Update dependency nanoid to v3.3.18 [SECURITY]](../pull/433)
- [ ] [chore: Update actions/checkout action to v7](../pull/410)
- [ ] [chore: Update dependency @types/express-serve-static-core to v5](../pull/370)
- [ ] **Click on this checkbox to rebase all open PRs at once**

## PR Closed (Blocked)

The following updates are blocked by an existing closed PR. To recreate the PR, click on a checkbox below.

- [ ] [chore: Replace dependency @material-ui/core with @mui/material ^5.0.0](../pull/23)
- [ ] [chore: Replace dependency @material-ui/icons with @mui/icons-material ^5.0.0](../pull/24)

## Detected Dependencies

dockerfile (1)

packages/backend/Dockerfile (1)

- `node 24-bookworm-slim`

github-actions (2)

.github/workflows/ci.yaml (7)

- `actions/checkout v6` → [Updates: `v7`]
- `actions/setup-node v6` → [Updates: `v7`]
- `actions/upload-artifact v7`
- `actions/upload-artifact v7`
- `actions/upload-artifact v7`
- `actions/upload-artifact v7`
- `node 24.x`

.github/workflows/snyk.yml (3)

- `actions/checkout v6` → [Updates: `v7`]
- `snyk/actions v1.0.0`
- `snyk/actions v1.0.0`

npm (6)

package.json (95)

- `@types/webpack-env 1.18.8`
- `better-sqlite3 12.10.0` → [Updates: `12.11.1`, `13.0.3`]
- `@backstage/cli ^0.36.1` → [Updates: `^0.36.1`]
- `@commitlint/cli 21.0.1` → [Updates: `21.2.2`]
- `@commitlint/config-conventional 21.0.1` → [Updates: `21.2.2`]
- `@commitlint/config-lerna-scopes 21.0.1` → [Updates: `21.2.0`]
- `@playwright/test 1.60.0` → [Updates: `1.62.1`]
- `@spotify/prettier-config ^15.0.0`
- `@trivago/prettier-plugin-sort-imports 6.0.2`
- `@types/jest 29.5.14` → [Updates: `30.0.0`]
- `@types/node 24.12.4` → [Updates: `24.13.3`]
- `@typescript-eslint/parser 8.60.0` → [Updates: `8.67.0`]
- `concurrently 9.2.4` → [Updates: `10.0.5`]
- `eslint-plugin-header ^3.1.1`
- `husky ^9.0.0`
- `jest ^29.0.0` → [Updates: `^30.0.0`]
- `jest-environment-jsdom ^29.0.0` → [Updates: `^30.0.0`]
- `lerna 9.0.7` → [Updates: `10.0.0`]
- `lint-staged 17.0.8` → [Updates: `17.3.0`]
- `node-gyp 12.3.0` → [Updates: `12.4.0`, `13.0.1`]
- `prettier 3.8.3` → [Updates: `3.9.6`]
- `typescript ~5.9.0` → [Updates: `~7.0.0`]
- `wait-on ^9.0.10` → [Updates: `^9.0.10`]
- `node 20 || 22 || 24`
- `@internationalized/date 3.12.2` → [Updates: `3.12.3`]
- `@types/react ^18` → [Updates: `^19.0.0`]
- `@types/react-dom ^18` → [Updates: `^19.0.0`]
- `@opentelemetry/api 1.9.1`
- `lodash >=4.18.1`
- `lodash-es >=4.18.1`
- `basic-ftp 5.3.1` → [Updates: `6.2.0`]
- `multer 2.2.0`
- `underscore 1.13.8`
- `axios 1.18.1` → [Updates: `1.19.0`]
- `koa 2.16.4` → [Updates: `3.2.1`]
- `brace-expansion 5.0.9`
- `brace-expansion 5.0.9`
- `brace-expansion 5.0.9`
- `minimatch 3.1.5` → [Updates: `10.2.6`]
- `minimatch 5.1.8` → [Updates: `5.1.9`, `10.2.6`]
- `minimatch 5.1.8` → [Updates: `5.1.9`, `10.2.6`]
- `minimatch 7.4.8` → [Updates: `7.4.9`, `10.2.6`]
- `minimatch 9.0.7` → [Updates: `9.0.9`, `10.2.6`]
- `minimatch 9.0.7` → [Updates: `9.0.9`, `10.2.6`]
- `minimatch 10.2.3` → [Updates: `10.2.6`]
- `markdown-it 13.0.2` → [Updates: `14.2.0`]
- `form-data 2.5.4` → [Updates: `2.5.6`]
- `jsonpath-plus 10.3.0` → [Updates: `10.4.0`]
- `@backstage/plugin-techdocs-node 1.14.3` → [Updates: `1.15.2`]
- `rollup 4.59.0` → [Updates: `4.62.4`]
- `elliptic 6.6.1`
- `fast-uri 3.1.5` → [Updates: `3.1.6`, `4.1.2`]
- `fast-xml-builder 1.2.0` → [Updates: `1.3.1`]
- `fast-xml-parser 5.7.0` → [Updates: `5.11.0`]
- `qs 6.15.3`
- `bfj 9.1.3`
- `svgo 2.8.3` → [Updates: `4.0.2`]
- `tar 7.5.21` → [Updates: `7.5.22`]
- `immutable 4.3.9` → [Updates: `5.1.9`]
- `flatted ^3.4.2` → [Updates: `^3.4.2`]
- `undici 7.29.0` → [Updates: `8.10.0`]
- `protobufjs 7.6.5` → [Updates: `8.7.2`]
- `js-yaml 3.15.1` → [Updates: `5.3.0`]
- `js-yaml 3.15.1` → [Updates: `5.3.0`]
- `js-yaml 3.15.1` → [Updates: `5.3.0`]
- `js-yaml 3.15.1` → [Updates: `5.3.0`]
- `js-yaml 4.3.1` → [Updates: `5.3.0`]
- `js-yaml 4.3.1` → [Updates: `5.3.0`]
- `js-yaml 4.3.1` → [Updates: `5.3.0`]
- `js-yaml 4.3.1` → [Updates: `5.3.0`]
- `js-yaml 4.3.1` → [Updates: `5.3.0`]
- `adm-zip 0.6.0`
- `vm2 3.11.5` → [Updates: `3.11.6`]
- `uuid 9.0.1` → [Updates: `11.1.1`]
- `uuid 9.0.1` → [Updates: `11.1.1`]
- `uuid 9.0.1` → [Updates: `11.1.1`]
- `brace-expansion 5.0.9`
- `brace-expansion 5.0.9`
- `brace-expansion 5.0.9`
- `postcss 8.5.23` → [Updates: `8.5.26`]
- `adm-zip 0.6.0`
- `shell-quote 1.9.0` → [Updates: `1.10.0`]
- `sigstore 4.1.1` → [Updates: `5.0.0`]
- `tmp 0.2.7`
- `esbuild ^0.28.1` → [Updates: `^0.28.1`]
- `@grpc/grpc-js 1.14.4`
- `form-data 4.0.6`
- `form-data 4.0.6`
- `ws 8.21.1` → [Updates: `8.21.3`]
- `js-cookie 3.0.8`
- `linkify-it 5.0.2` → [Updates: `6.1.0`]
- `websocket-driver 0.7.5`
- `ip-address 10.4.0` → [Updates: `10.5.0`]
- `nanoid 3.3.17` → [Updates: `3.3.18`]
- `yarn 4.12.0` → [Updates: `4.18.0`]

packages/app/package.json (39)

- `@backstage-community/plugin-github-actions 1.0.0` → [Updates: `1.3.0`]
- `@backstage-community/plugin-tech-radar ^1.0.0` → [Updates: `^1.0.0`]
- `@backstage/app-defaults ^1.7.7` → [Updates: `^1.7.7`]
- `@backstage/catalog-model ^1.8.0` → [Updates: `^1.8.0`]
- `@backstage/cli ^0.36.1` → [Updates: `^0.36.1`]
- `@backstage/core-app-api ^1.20.0` → [Updates: `^1.20.0`]
- `@backstage/core-components ^0.18.9` → [Updates: `^0.18.9`]
- `@backstage/core-plugin-api ^1.12.5` → [Updates: `^1.12.5`]
- `@backstage/integration-react ^1.2.17` → [Updates: `^1.2.17`]
- `@backstage/plugin-api-docs ^0.14.0` → [Updates: `^0.14.0`]
- `@backstage/plugin-catalog ^2.0.4` → [Updates: `^2.0.4`]
- `@backstage/plugin-catalog-common ^1.1.9`
- `@backstage/plugin-catalog-graph ^0.6.3` → [Updates: `^0.6.3`]
- `@backstage/plugin-catalog-import ^0.13.12` → [Updates: `^0.13.12`]
- `@backstage/plugin-catalog-react ^2.1.4` → [Updates: `^3.0.0`]
- `@backstage/plugin-org ^0.7.3` → [Updates: `^0.7.3`]
- `@backstage/plugin-permission-react ^0.5.0` → [Updates: `^0.5.0`]
- `@backstage/plugin-scaffolder ^1.36.2` → [Updates: `^1.36.2`]
- `@backstage/plugin-search ^1.7.3` → [Updates: `^1.7.3`]
- `@backstage/plugin-search-react ^1.11.3` → [Updates: `^1.11.3`]
- `@backstage/plugin-techdocs ^1.17.5` → [Updates: `^1.17.5`]
- `@backstage/plugin-techdocs-module-addons-contrib ^1.1.35` → [Updates: `^1.1.35`]
- `@backstage/plugin-techdocs-react ^1.3.10` → [Updates: `^1.3.10`]
- `@backstage/plugin-user-settings ^0.9.2` → [Updates: `^0.9.2`]
- `@backstage/theme ^0.7.3`
- `@material-ui/core ^4.12.2` → [Updates: `^5.0.0`]
- `@material-ui/icons ^4.9.1` → [Updates: `^5.0.0`]
- `history ^5.0.0`
- `react ^18.0.2` → [Updates: `^19.0.0`]
- `react-dom ^18.0.2` → [Updates: `^19.0.0`]
- `react-router 7.18.0` → [Updates: `7.18.2`]
- `react-router-dom 6.30.4` → [Updates: `6.30.6`, `7.18.2`]
- `react-use ^17.2.4`
- `@backstage/test-utils ^1.7.17` → [Updates: `^1.7.17`]
- `@testing-library/dom 10.4.1`
- `@testing-library/jest-dom 6.9.1` → [Updates: `7.0.1`]
- `@testing-library/react 16.3.2`
- `@testing-library/user-event ^14.0.0` → [Updates: `^14.0.0`]
- `@types/react-dom *`

packages/backend/package.json (31)

- `@backstage/backend-defaults ^0.17.0` → [Updates: `^0.17.0`]
- `@backstage/backend-plugin-api ^1.9.0` → [Updates: `^1.9.0`]
- `@backstage/catalog-client ^1.15.0` → [Updates: `^1.15.0`]
- `@backstage/catalog-model ^1.8.0` → [Updates: `^1.8.0`]
- `@backstage/config ^1.3.7`
- `@backstage/plugin-app-backend ^0.5.13` → [Updates: `^0.5.13`]
- `@backstage/plugin-auth-backend ^0.28.0` → [Updates: `^0.29.0`]
- `@backstage/plugin-auth-backend-module-guest-provider ^0.2.18` → [Updates: `^0.2.18`]
- `@backstage/plugin-auth-node ^0.7.0` → [Updates: `^0.7.0`]
- `@backstage/plugin-catalog-backend ^3.6.1` → [Updates: `^3.6.1`]
- `@backstage/plugin-catalog-backend-module-scaffolder-entity-model ^0.2.19` → [Updates: `^0.2.19`]
- `@backstage/plugin-permission-backend ^0.7.11` → [Updates: `^0.7.11`]
- `@backstage/plugin-permission-backend-module-allow-all-policy ^0.2.18` → [Updates: `^0.2.18`]
- `@backstage/plugin-permission-common ^0.9.8` → [Updates: `^0.9.8`]
- `@backstage/plugin-permission-node ^0.10.12` → [Updates: `^0.11.0`]
- `@backstage/plugin-proxy-backend ^0.6.12` → [Updates: `^0.6.12`]
- `@backstage/plugin-scaffolder-backend ^3.4.0` → [Updates: `^4.0.0`]
- `@backstage/plugin-search-backend ^2.1.1` → [Updates: `^2.1.1`]
- `@backstage/plugin-search-backend-module-pg ^0.5.54` → [Updates: `^0.5.54`]
- `@backstage/plugin-search-backend-node ^1.4.3` → [Updates: `^1.4.3`]
- `@backstage/plugin-techdocs-backend ^2.1.7` → [Updates: `^2.1.7`]
- `dockerode 5.0.1`
- `express 4.22.2` → [Updates: `5.2.1`]
- `express-promise-router ^4.1.0`
- `pg 8.21.0` → [Updates: `8.23.0`]
- `winston ^3.2.1`
- `@backstage/cli ^0.36.1` → [Updates: `^0.36.1`]
- `@types/dockerode ^4.0.0`
- `@types/express 4.17.25` → [Updates: `5.0.6`]
- `@types/express-serve-static-core 4.19.9` → [Updates: `5.1.3`]
- `@types/luxon ^3.0.0` → [Updates: `^3.0.0`]

plugins/dql-backend/package.json (12)

- `@backstage/config ^1.3.7`
- `@types/express 4.17.25` → [Updates: `5.0.6`]
- `express 4.22.2` → [Updates: `5.2.1`]
- `express-promise-router ^4.1.0`
- `undici 7.29.0` → [Updates: `8.10.0`]
- `winston ^3.2.1`
- `yn 5.1.0`
- `zod 4.4.3`
- `@backstage/cli ^0.36.1` → [Updates: `^0.36.1`]
- `@backstage/test-utils ^1.7.17` → [Updates: `^1.7.17`]
- `@types/supertest 7.2.1`
- `msw 2.14.6` → [Updates: `2.15.0`]

plugins/dql-common/package.json (4)

- `lodash >=4.18.1`
- `zod 4.4.3`
- `@backstage/cli ^0.36.1` → [Updates: `^0.36.1`]
- `@types/lodash ^4.17.0` → [Updates: `^4.17.0`]

plugins/dql/package.json (21)

- `@backstage/catalog-model ^1.8.0` → [Updates: `^1.8.0`]
- `@backstage/core-components ^0.18.9` → [Updates: `^0.18.9`]
- `@backstage/core-plugin-api ^1.12.5` → [Updates: `^1.12.5`]
- `@backstage/errors ^1.3.0`
- `@backstage/plugin-catalog-react ^2.1.4` → [Updates: `^3.0.0`]
- `@backstage/theme ^0.7.3`
- `@material-ui/core ^4.12.2` → [Updates: `^5.0.0`]
- `@material-ui/icons ^4.9.1` → [Updates: `^5.0.0`]
- `@material-ui/lab 4.0.0-alpha.61`
- `lodash >=4.18.1`
- `react-use ^17.2.4`
- `zod 4.4.3`
- `@backstage/cli ^0.36.1` → [Updates: `^0.36.1`]
- `@backstage/core-app-api ^1.20.0` → [Updates: `^1.20.0`]
- `@backstage/dev-utils ^1.1.22` → [Updates: `^1.1.22`]
- `@backstage/test-utils ^1.7.17` → [Updates: `^1.7.17`]
- `@testing-library/jest-dom 6.9.1` → [Updates: `7.0.1`]
- `@testing-library/react 16.3.2`
- `@testing-library/user-event ^14.0.0` → [Updates: `^14.0.0`]
- `@types/lodash ^4.17.0` → [Updates: `^4.17.0`]
- `react ^17.0.0 || ^18.0.0` → [Updates: `^17.0.0 || ^18.0.0 || ^19.0.0`]

nvm (1)

.nvmrc (1)

- `node 24`

---

- [ ] Check this box to trigger a request for Renovate to run again on this repository

Start with the Renovate Dependency Dashboard, then review the dependency entries in package.json, .github/workflows/ci.yaml, .github/workflows/snyk.yml, and packages/backend/Dockerfile. Separate individual updates, check their linked or blocked pull requests, and run the repository checks for each selected change; done means an explicitly chosen update is applied without breaking the project.

Written by the indexing model from the issue text.