Snyk vulnerability [SNYK-JS-UNDICI-19635222]

## Affecting Packages/Plugins

* [example-app](packages/app/package.json)
* [example-app-legacy](packages/app-legacy/package.json)
* [example-backend](packages/backend/package.json)
* [@backstage/backend-defaults](packages/backend-defaults/package.json)
* [@backstage/backend-dynamic-feature-service](packages/backend-dynamic-feature-service/package.json)
* [@backstage/backend-test-utils](packages/backend-test-utils/package.json)
* [@backstage/cli](packages/cli/package.json)
* [@backstage/cli-defaults](packages/cli-defaults/package.json)
* [@backstage/cli-module-build](packages/cli-module-build/package.json)
* [@backstage/frontend-dynamic-feature-loader](packages/frontend-dynamic-feature-loader/package.json)
* [@techdocs/cli](packages/techdocs-cli/package.json)
* [techdocs-cli-embedded-app](packages/techdocs-cli-embedded-app/package.json)
* [@backstage/plugin-auth-backend](plugins/auth-backend/package.json)
* [@backstage/plugin-auth-backend-module-aws-alb-provider](plugins/auth-backend-module-aws-alb-provider/package.json)
* [@backstage/plugin-auth-backend-module-github-provider](plugins/auth-backend-module-github-provider/package.json)
* [@backstage/plugin-auth-backend-module-oidc-provider](plugins/auth-backend-module-oidc-provider/package.json)
* [@backstage/plugin-catalog-backend](plugins/catalog-backend/package.json)
* [@backstage/plugin-catalog-backend-module-ai-model](plugins/catalog-backend-module-ai-model/package.json)
* [@backstage/plugin-catalog-backend-module-aws](plugins/catalog-backend-module-aws/package.json)
* [@backstage/plugin-catalog-backend-module-azure](plugins/catalog-backend-module-azure/package.json)
* [@backstage/plugin-catalog-backend-module-backstage-openapi](plugins/catalog-backend-module-backstage-openapi/package.json)
* [@backstage/plugin-catalog-backend-module-bitbucket-cloud](plugins/catalog-backend-module-bitbucket-cloud/package.json)
* [@backstage/plugin-catalog-backend-module-bitbucket-server](plugins/catalog-backend-module-bitbucket-server/package.json)
* [@backstage/plugin-catalog-backend-module-gcp](plugins/catalog-backend-module-gcp/package.json)
* [@backstage/plugin-catalog-backend-module-gerrit](plugins/catalog-backend-module-gerrit/package.json)
* [@backstage/plugin-catalog-backend-module-gitea](plugins/catalog-backend-module-gitea/package.json)
* [@backstage/plugin-catalog-backend-module-github](plugins/catalog-backend-module-github/package.json)
* [@backstage/plugin-catalog-backend-module-github-org](plugins/catalog-backend-module-github-org/package.json)
* [@backstage/plugin-catalog-backend-module-gitlab](plugins/catalog-backend-module-gitlab/package.json)
* [@backstage/plugin-catalog-backend-module-gitlab-org](plugins/catalog-backend-module-gitlab-org/package.json)
* [@backstage/plugin-catalog-backend-module-incremental-ingestion](plugins/catalog-backend-module-incremental-ingestion/package.json)
* [@backstage/plugin-catalog-backend-module-ldap](plugins/catalog-backend-module-ldap/package.json)
* [@backstage/plugin-catalog-backend-module-logs](plugins/catalog-backend-module-logs/package.json)
* [@backstage/plugin-catalog-backend-module-msgraph](plugins/catalog-backend-module-msgraph/package.json)
* [@backstage/plugin-catalog-backend-module-msgraph-incremental](plugins/catalog-backend-module-msgraph-incremental/package.json)
* [@backstage/plugin-catalog-backend-module-openapi](plugins/catalog-backend-module-openapi/package.json)
* [@backstage/plugin-catalog-backend-module-puppetdb](plugins/catalog-backend-module-puppetdb/package.json)
* [@backstage/plugin-catalog-backend-module-scaffolder-entity-model](plugins/catalog-backend-module-scaffolder-entity-model/package.json)
* [@backstage/plugin-catalog-backend-module-unprocessed](plugins/catalog-backend-module-unprocessed/package.json)
* [@backstage/plugin-connections-example-backend](plugins/connections-example-backend/package.json)
* [@backstage/plugin-kubernetes-backend](plugins/kubernetes-backend/package.json)
* [@backstage/plugin-mcp-actions-backend](plugins/mcp-actions-backend/package.json)
* [@backstage/plugin-notifications-backend](plugins/notifications-backend/package.json)
* [@backstage/plugin-notifications-backend-module-email](plugins/notifications-backend-module-email/package.json)
* [@backstage/plugin-notifications-backend-module-slack](plugins/notifications-backend-module-slack/package.json)
* [@backstage/plugin-scaffolder-backend](plugins/scaffolder-backend/package.json)
* [@backstage/plugin-scaffolder-backend-module-azure](plugins/scaffolder-backend-module-azure/package.json)
* [@backstage/plugin-scaffolder-backend-module-bitbucket-cloud](plugins/scaffolder-backend-module-bitbucket-cloud/package.json)
* [@backstage/plugin-scaffolder-backend-module-bitbucket-server](plugins/scaffolder-backend-module-bitbucket-server/package.json)
* [@backstage/plugin-scaffolder-backend-module-confluence-to-markdown](plugins/scaffolder-backend-module-confluence-to-markdown/package.json)
* [@backstage/plugin-scaffolder-backend-module-cookiecutter](plugins/scaffolder-backend-module-cookiecutter/package.json)
* [@backstage/plugin-scaffolder-backend-module-gcp](plugins/scaffolder-backend-module-gcp/package.json)
* [@backstage/plugin-scaffolder-backend-module-gerrit](plugins/scaffolder-backend-module-gerrit/package.json)
* [@backstage/plugin-scaffolder-backend-module-gitea](plugins/scaffolder-backend-module-gitea/package.json)
* [@backstage/plugin-scaffolder-backend-module-github](plugins/scaffolder-backend-module-github/package.json)
* [@backstage/plugin-scaffolder-backend-module-gitlab](plugins/scaffolder-backend-module-gitlab/package.json)
* [@backstage/plugin-scaffolder-backend-module-notifications](plugins/scaffolder-backend-module-notifications/package.json)
* [@backstage/plugin-scaffolder-backend-module-rails](plugins/scaffolder-backend-module-rails/package.json)
* [@backstage/plugin-scaffolder-backend-module-sentry](plugins/scaffolder-backend-module-sentry/package.json)
* [@backstage/plugin-scaffolder-backend-module-workspace-database](plugins/scaffolder-backend-module-workspace-database/package.json)
* [@backstage/plugin-scaffolder-backend-module-yeoman](plugins/scaffolder-backend-module-yeoman/package.json)
* [@backstage/plugin-scaffolder-node-test-utils](plugins/scaffolder-node-test-utils/package.json)
* [@backstage/plugin-search-backend-module-catalog](plugins/search-backend-module-catalog/package.json)
* [@backstage/plugin-search-backend-module-techdocs](plugins/search-backend-module-techdocs/package.json)
* [@backstage/plugin-techdocs-backend](plugins/techdocs-backend/package.json)

## Overview
[undici](https://www.npmjs.org/package/undici) is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Uncaught Exception in the `WebSocketStream` API, whose socket-close handler calls `abort()` on the writable stream while the application holds a writer lock and then discards the rejected promise that aborting a locked stream returns. An attacker can crash the process through Node's default `unhandledRejection` handling by tearing down a WebSocket connection without completing the close handshake, for example with a TCP reset, a proxy teardown, or a protocol-violating frame. This requires the application to use the `WebSocketStream` API while actively writing through a writer, and the server to be attacker-controlled or compromised.
## Remediation
Upgrade `undici` to version 7.29.1, 8.10.2 or higher.
## References
- [GitHub Advisory](https://github.com/nodejs/undici/security/advisories/GHSA-rx4f-c7p8-82vq)
- [GitHub Commit](https://github.com/nodejs/undici/commit/1858656ebb1e919311c1f31613dfd581b7214349)

Start by reviewing the listed packages/*/package.json and plugins/*/package.json files to determine how undici is declared across the affected packages. Update the dependency to a remediated version, then verify that every affected package resolves to undici 7.29.1, 8.10.2, or higher and that the repository's dependency checks pass.

Written by the indexing model from the issue text.