Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the [Dependency Dashboard](https://docs.renovatebot.com/key-concepts/dashboard/) docs to learn more.

## Config Migration Needed

- [ ] Select this checkbox to let Renovate create an automated Config Migration PR.

## Deprecations / Replacements
> [!WARNING]
The following dependencies are either deprecated or have replacements available.

| Datasource | Package | Replacement PR? |
|------------|------|--------------|
| npm | [@material-ui/core](https://redirect.github.com/mui-org/material-ui) |  |
| npm | [@material-ui/icons](https://redirect.github.com/mui-org/material-ui) |  |
| npm | [@material-ui/lab](https://redirect.github.com/mui-org/material-ui) |  |

## Rate-Limited

The following updates are currently rate-limited. To force their creation now, click on a checkbox below.

- [ ] chore: Replace dependency @material-ui/core with @mui/material ^5.0.0
- [ ] chore: Replace dependency @material-ui/icons with @mui/icons-material ^5.0.0
- [ ] chore: Update actions/setup-node action from v6.5.0 to v7
- [ ] chore: Update backstage monorepo (major) (`@backstage/plugin-catalog-react`, `@backstage/plugin-scaffolder-backend`)
- [ ] chore: Update dependency @testing-library/jest-dom from 6.9.1 to 7.0.0
- [ ] chore: Update dependency basic-ftp from 5.3.1 to 6.0.2
- [ ] chore: Update dependency better-sqlite3 from 12.10.0 to 13.0.1
- [ ] chore: Update dependency concurrently from 9.2.4 to 10.0.4
- [ ] chore: Update dependency express from 4.22.2 to 5.2.1 (`express`, `@types/express`)
- [ ] chore: Update dependency fast-uri from 3.1.4 to 4.1.1
- [ ] chore: Update dependency immutable from 4.3.9 to 5.1.9
- [ ] chore: Update dependency js-yaml to v5.2.2
- [ ] chore: Update dependency koa from 2.16.4 to 3.2.1
- [ ] chore: Update dependency linkify-it from 5.0.2 to 6.1.0
- [ ] chore: Update dependency minimatch to v10.2.5
- [ ] chore: Update dependency node-gyp from 12.3.0 to 13.0.1
- [ ] chore: Update dependency protobufjs from 7.6.5 to 8.7.1
- [ ] chore: Update dependency sigstore from 4.1.1 to 5.0.0
- [ ] chore: Update dependency svgo from 2.8.3 to 4.0.2
- [ ] chore: Update dependency typescript from 5.9.3 to ~7.0.0
- [ ] chore: Update dependency undici from 7.28.0 to 8.9.0
- [ ] chore: Update jest monorepo (major) (`@types/jest`, `jest`, `jest-environment-jsdom`)
- [ ] chore: Update react monorepo (major) (`@types/react`, `@types/react-dom`, `react`, `react-dom`)
- [ ] 🔐 **Create all rate-limited PRs at once** 🔐

## PR Edited (Blocked)

The following updates have been manually edited so Renovate will no longer make changes. To discard all commits and start over, click on a checkbox below.

- [ ] chore: Update all patch dependency updates (`@backstage/backend-defaults`, `@internationalized/date`, `@types/lodash`, `@types/luxon`, `brace-expansion`, `fast-uri`, `flatted`, `js-yaml`, `minimatch`, `postcss`, `tar`)
- [ ] chore: Update all minor dependency updates (`@backstage-community/plugin-github-actions`, `@backstage-community/plugin-tech-radar`, `@backstage/catalog-client`, `@backstage/catalog-model`, `@backstage/plugin-catalog-backend`, `@backstage/plugin-permission-node`, `@backstage/plugin-scaffolder`, `@backstage/plugin-techdocs-backend`, `@backstage/plugin-techdocs-node`, `@commitlint/cli`, `@commitlint/config-conventional`, `@commitlint/config-lerna-scopes`, `@playwright/test`, `@types/node`, `@typescript-eslint/parser`, `better-sqlite3`, `fast-xml-builder`, `fast-xml-parser`, `jsonpath-plus`, `lint-staged`, `msw`, `node-gyp`, `pg`, `prettier`, `rollup`, `shell-quote`, `undici`, `wait-on`, `yarn`)
- [ ] chore: Update actions/checkout action from v6.1.0 to v7
- [ ] chore: Update dependency @types/express-serve-static-core from 4.19.9 to 5.1.2

## Pending Status Checks

The following updates await pending status checks. To force their creation now, click on a checkbox below.

- [ ] chore: Update dependency lerna from 9.0.7 to 10.0.0

## Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

- [ ] [chore: Update dependency form-data from 2.5.4 to 2.5.6 [SECURITY]](../pull/411)
- [ ] [chore: Update dependency @backstage/plugin-auth-backend from 0.28.0 to ^0.29.0 [SECURITY]](../pull/419)
- [ ] [chore: Update dependency markdown-it from 13.0.2 to 14.2.0 [SECURITY]](../pull/412)
- [ ] [chore: Update dependency react-router from 7.18.0 to 8.3.0 [SECURITY]](../pull/425)
- [ ] [chore: Update dependency react-router-dom from 6.30.4 to 7.0.0 [SECURITY]](../pull/414)
- [ ] [chore: Update dependency uuid from 9.0.1 to 11.1.1 [SECURITY]](../pull/415)
- [ ] **Click on this checkbox to rebase all open PRs at once**

## Detected Dependencies

dockerfile (1)

packages/backend/Dockerfile (1)

- `node 24-bookworm-slim`

github-actions (2)

.github/workflows/ci.yaml (7)

- `actions/checkout v6` → [Updates: `v7`]
- `actions/setup-node v6` → [Updates: `v7`]
- `actions/upload-artifact v7`
- `actions/upload-artifact v7`
- `actions/upload-artifact v7`
- `actions/upload-artifact v7`
- `node 24.x`

.github/workflows/snyk.yml (3)

- `actions/checkout v6` → [Updates: `v7`]
- `snyk/actions v1.0.0`
- `snyk/actions v1.0.0`

npm (6)

package.json (92)

- `@types/webpack-env 1.18.8`
- `better-sqlite3 12.10.0` → [Updates: `12.11.1`, `13.0.1`]
- `@backstage/cli ^0.36.1`
- `@commitlint/cli 21.0.1` → [Updates: `21.2.1`]
- `@commitlint/config-conventional 21.0.1` → [Updates: `21.2.0`]
- `@commitlint/config-lerna-scopes 21.0.1` → [Updates: `21.2.0`]
- `@playwright/test 1.60.0` → [Updates: `1.62.0`]
- `@spotify/prettier-config ^15.0.0`
- `@trivago/prettier-plugin-sort-imports 6.0.2`
- `@types/jest 29.5.14` → [Updates: `30.0.0`]
- `@types/node 24.12.4` → [Updates: `24.13.3`]
- `@typescript-eslint/parser 8.60.0` → [Updates: `8.65.0`]
- `concurrently 9.2.4` → [Updates: `10.0.4`]
- `eslint-plugin-header ^3.1.1`
- `husky ^9.0.0`
- `jest ^29.0.0` → [Updates: `^30.0.0`]
- `jest-environment-jsdom ^29.0.0` → [Updates: `^30.0.0`]
- `lerna 9.0.7` → [Updates: `10.0.0`]
- `lint-staged 17.0.8` → [Updates: `17.2.0`]
- `node-gyp 12.3.0` → [Updates: `12.4.0`, `13.0.1`]
- `prettier 3.8.3` → [Updates: `3.9.6`]
- `typescript ~5.9.0` → [Updates: `~7.0.0`]
- `wait-on ^9.0.10` → [Updates: `^9.0.10`]
- `node 20 || 22 || 24`
- `@internationalized/date 3.12.2` → [Updates: `3.12.3`]
- `@types/react ^18` → [Updates: `^19.0.0`]
- `@types/react-dom ^18` → [Updates: `^19.0.0`]
- `@opentelemetry/api 1.9.1`
- `lodash >=4.18.1`
- `lodash-es >=4.18.1`
- `basic-ftp 5.3.1` → [Updates: `6.0.2`]
- `multer 2.2.0`
- `underscore 1.13.8`
- `axios 1.18.1` → [Updates: `1.19.0`]
- `koa 2.16.4` → [Updates: `3.2.1`]
- `brace-expansion 5.0.8` → [Updates: `5.0.9`]
- `brace-expansion 5.0.8` → [Updates: `5.0.9`]
- `brace-expansion 5.0.8` → [Updates: `5.0.9`]
- `minimatch 3.1.5` → [Updates: `10.2.5`]
- `minimatch 5.1.8` → [Updates: `5.1.9`, `10.2.5`]
- `minimatch 5.1.8` → [Updates: `5.1.9`, `10.2.5`]
- `minimatch 7.4.8` → [Updates: `7.4.9`, `10.2.5`]
- `minimatch 9.0.7` → [Updates: `9.0.9`, `10.2.5`]
- `minimatch 9.0.7` → [Updates: `9.0.9`, `10.2.5`]
- `minimatch 10.2.3` → [Updates: `10.2.6`]
- `markdown-it 13.0.2` → [Updates: `14.2.0`]
- `form-data 2.5.4` → [Updates: `2.5.6`]
- `jsonpath-plus 10.3.0` → [Updates: `10.4.0`]
- `@backstage/plugin-techdocs-node 1.14.3` → [Updates: `1.15.2`]
- `rollup 4.59.0` → [Updates: `4.62.3`]
- `elliptic 6.6.1`
- `fast-uri 3.1.4` → [Updates: `3.1.5`, `4.1.1`]
- `fast-xml-builder 1.2.0` → [Updates: `1.3.0`]
- `fast-xml-parser 5.7.0` → [Updates: `5.10.1`]
- `qs 6.15.3`
- `bfj 9.1.3`
- `svgo 2.8.3` → [Updates: `4.0.2`]
- `tar 7.5.21` → [Updates: `7.5.22`]
- `immutable 4.3.9` → [Updates: `5.1.9`]
- `flatted ^3.4.2` → [Updates: `^3.4.2`]
- `undici 7.28.0` → [Updates: `7.29.0`, `8.9.0`]
- `protobufjs 7.6.5` → [Updates: `8.7.1`]
- `js-yaml 3.15.0` → [Updates: `3.15.1`, `5.2.2`]
- `js-yaml 3.15.0` → [Updates: `3.15.1`, `5.2.2`]
- `js-yaml 3.15.0` → [Updates: `3.15.1`, `5.2.2`]
- `js-yaml 3.15.0` → [Updates: `3.15.1`, `5.2.2`]
- `js-yaml 4.3.0` → [Updates: `4.3.1`, `5.2.2`]
- `js-yaml 4.3.0` → [Updates: `4.3.1`, `5.2.2`]
- `js-yaml 4.3.0` → [Updates: `4.3.1`, `5.2.2`]
- `js-yaml 4.3.0` → [Updates: `4.3.1`, `5.2.2`]
- `adm-zip 0.6.0`
- `vm2 3.11.5`
- `uuid 9.0.1` → [Updates: `11.1.1`]
- `uuid 9.0.1` → [Updates: `11.1.1`]
- `uuid 9.0.1` → [Updates: `11.1.1`]
- `brace-expansion 5.0.8` → [Updates: `5.0.9`]
- `brace-expansion 5.0.8` → [Updates: `5.0.9`]
- `brace-expansion 5.0.8` → [Updates: `5.0.9`]
- `postcss 8.5.23` → [Updates: `8.5.25`]
- `adm-zip 0.6.0`
- `shell-quote 1.9.0` → [Updates: `1.10.0`]
- `sigstore 4.1.1` → [Updates: `5.0.0`]
- `tmp 0.2.7`
- `esbuild ^0.28.1`
- `@grpc/grpc-js 1.14.4`
- `form-data 4.0.6`
- `form-data 4.0.6`
- `ws 8.21.1`
- `js-cookie 3.0.8`
- `linkify-it 5.0.2` → [Updates: `6.1.0`]
- `websocket-driver 0.7.5`
- `yarn 4.12.0` → [Updates: `4.17.1`]

packages/app/package.json (39)

- `@backstage-community/plugin-github-actions 1.0.0` → [Updates: `1.3.0`]
- `@backstage-community/plugin-tech-radar ^1.0.0` → [Updates: `^1.0.0`]
- `@backstage/app-defaults ^1.7.7`
- `@backstage/catalog-model ^1.8.0` → [Updates: `^1.8.0`]
- `@backstage/cli ^0.36.1`
- `@backstage/core-app-api ^1.20.0`
- `@backstage/core-components ^0.18.9`
- `@backstage/core-plugin-api ^1.12.5`
- `@backstage/integration-react ^1.2.17`
- `@backstage/plugin-api-docs ^0.14.0`
- `@backstage/plugin-catalog ^2.0.4`
- `@backstage/plugin-catalog-common ^1.1.9`
- `@backstage/plugin-catalog-graph ^0.6.3`
- `@backstage/plugin-catalog-import ^0.13.12`
- `@backstage/plugin-catalog-react ^2.1.4` → [Updates: `^3.0.0`]
- `@backstage/plugin-org ^0.7.3`
- `@backstage/plugin-permission-react ^0.5.0`
- `@backstage/plugin-scaffolder ^1.36.2` → [Updates: `^1.36.2`]
- `@backstage/plugin-search ^1.7.3`
- `@backstage/plugin-search-react ^1.11.3`
- `@backstage/plugin-techdocs ^1.17.5`
- `@backstage/plugin-techdocs-module-addons-contrib ^1.1.35`
- `@backstage/plugin-techdocs-react ^1.3.10`
- `@backstage/plugin-user-settings ^0.9.2`
- `@backstage/theme ^0.7.3`
- `@material-ui/core ^4.12.2` → [Updates: `^5.0.0`]
- `@material-ui/icons ^4.9.1` → [Updates: `^5.0.0`]
- `history ^5.0.0`
- `react ^18.0.2` → [Updates: `^19.0.0`]
- `react-dom ^18.0.2` → [Updates: `^19.0.0`]
- `react-router 7.18.0` → [Updates: `8.3.0`]
- `react-router-dom 6.30.4` → [Updates: `7.0.0`]
- `react-use ^17.2.4`
- `@backstage/test-utils ^1.7.17`
- `@testing-library/dom 10.4.1`
- `@testing-library/jest-dom 6.9.1` → [Updates: `7.0.0`]
- `@testing-library/react 16.3.2`
- `@testing-library/user-event ^14.0.0`
- `@types/react-dom *`

packages/backend/package.json (31)

- `@backstage/backend-defaults ^0.17.0` → [Updates: `^0.17.0`]
- `@backstage/backend-plugin-api ^1.9.0`
- `@backstage/catalog-client ^1.15.0` → [Updates: `^1.15.0`]
- `@backstage/catalog-model ^1.8.0` → [Updates: `^1.8.0`]
- `@backstage/config ^1.3.7`
- `@backstage/plugin-app-backend ^0.5.13`
- `@backstage/plugin-auth-backend ^0.28.0` → [Updates: `^0.29.0`]
- `@backstage/plugin-auth-backend-module-guest-provider ^0.2.18`
- `@backstage/plugin-auth-node ^0.7.0`
- `@backstage/plugin-catalog-backend ^3.6.1` → [Updates: `^3.6.1`]
- `@backstage/plugin-catalog-backend-module-scaffolder-entity-model ^0.2.19`
- `@backstage/plugin-permission-backend ^0.7.11`
- `@backstage/plugin-permission-backend-module-allow-all-policy ^0.2.18`
- `@backstage/plugin-permission-common ^0.9.8`
- `@backstage/plugin-permission-node ^0.10.12` → [Updates: `^0.11.0`]
- `@backstage/plugin-proxy-backend ^0.6.12`
- `@backstage/plugin-scaffolder-backend ^3.4.0` → [Updates: `^4.0.0`]
- `@backstage/plugin-search-backend ^2.1.1`
- `@backstage/plugin-search-backend-module-pg ^0.5.54`
- `@backstage/plugin-search-backend-node ^1.4.3`
- `@backstage/plugin-techdocs-backend ^2.1.7` → [Updates: `^2.1.7`]
- `dockerode 5.0.1`
- `express 4.22.2` → [Updates: `5.2.1`]
- `express-promise-router ^4.1.0`
- `pg 8.21.0` → [Updates: `8.22.0`]
- `winston ^3.2.1`
- `@backstage/cli ^0.36.1`
- `@types/dockerode ^4.0.0`
- `@types/express 4.17.25` → [Updates: `5.0.6`]
- `@types/express-serve-static-core 4.19.9` → [Updates: `5.1.2`]
- `@types/luxon ^3.0.0` → [Updates: `^3.0.0`]

plugins/dql-backend/package.json (12)

- `@backstage/config ^1.3.7`
- `@types/express 4.17.25` → [Updates: `5.0.6`]
- `express 4.22.2` → [Updates: `5.2.1`]
- `express-promise-router ^4.1.0`
- `undici 7.28.0` → [Updates: `7.29.0`, `8.9.0`]
- `winston ^3.2.1`
- `yn 5.1.0`
- `zod 4.4.3`
- `@backstage/cli ^0.36.1`
- `@backstage/test-utils ^1.7.17`
- `@types/supertest 7.2.1`
- `msw 2.14.6` → [Updates: `2.15.0`]

plugins/dql-common/package.json (4)

- `lodash >=4.18.1`
- `zod 4.4.3`
- `@backstage/cli ^0.36.1`
- `@types/lodash ^4.17.0` → [Updates: `^4.17.0`]

plugins/dql/package.json (21)

- `@backstage/catalog-model ^1.8.0` → [Updates: `^1.8.0`]
- `@backstage/core-components ^0.18.9`
- `@backstage/core-plugin-api ^1.12.5`
- `@backstage/errors ^1.3.0`
- `@backstage/plugin-catalog-react ^2.1.4` → [Updates: `^3.0.0`]
- `@backstage/theme ^0.7.3`
- `@material-ui/core ^4.12.2` → [Updates: `^5.0.0`]
- `@material-ui/icons ^4.9.1` → [Updates: `^5.0.0`]
- `@material-ui/lab 4.0.0-alpha.61`
- `lodash >=4.18.1`
- `react-use ^17.2.4`
- `zod 4.4.3`
- `@backstage/cli ^0.36.1`
- `@backstage/core-app-api ^1.20.0`
- `@backstage/dev-utils ^1.1.22`
- `@backstage/test-utils ^1.7.17`
- `@testing-library/jest-dom 6.9.1` → [Updates: `7.0.0`]
- `@testing-library/react 16.3.2`
- `@testing-library/user-event ^14.0.0`
- `@types/lodash ^4.17.0` → [Updates: `^4.17.0`]
- `react ^17.0.0 || ^18.0.0` → [Updates: `^17.0.0 || ^18.0.0 || ^19.0.0`]

nvm (1)

.nvmrc (1)

- `node 24`

This is a Renovate-generated dashboard rather than a scoped change; start with the linked Dependency Dashboard documentation and review package.json, packages/app/package.json, packages/backend/Dockerfile, and the listed GitHub Actions workflows. There is no single completion criterion, and several updates already have pull requests.

Written by the indexing model from the issue text.