Repository navigation
Close the 21 Dependabot alerts in the retirement proof's Go module #5047
Description
🤖 Generated by the Agentic Engineer
Evidence
All 21 open Dependabot alerts on this repository's default branch (7 critical, 5 high, 8 moderate, 1 low) come from one file: scripts/retire-backstage-stateless/poller-native/go.mod. It pins indirect dependencies that have published fixes: golang.org/x/crypto (13 alerts, fixed from 0.52.0/0.55.0), oras.land/oras-go/v2 (7 alerts, fixed from 2.6.1/2.6.2) and golang.org/x/net (1 alert). The alerts have been open since 2026-10-13 and no update pull request has been proposed for this module.
Audience and problem
The maintainer and both agent lanes read the repository's security tab. The module is a test-only harness for the Backstage retirement proof, so the vulnerable code is unlikely to be reachable. But 21 open alerts, 7 of them critical, hide any real new alert behind noise, and nothing proposes the updates on its own.
Hypothesis
Moving the module's indirect dependencies to their fixed versions closes all 21 alerts. Making sure the dependency updater covers this nested module stops the count from building up again.
Acceptance criteria
- Superseded by chore(backstage): retire the completed retirement fence and tooling #5161: the one-shot module and its tests were removed; no affected module remains to upgrade.
- The open Dependabot alert count for this file is 0.
- No updater coverage is needed for the deleted module; its reviewed retirement is recorded in chore(backstage): retire the completed retirement fence and tooling #5161.
Effort: low. Coordinate with the open retirement work in this directory (platform#5044, #5041, #5045) to avoid conflicting edits.
Resolved 2026-10-26: the documented dependency-graph refresh reprocessed the current manifests. GitHub marked all 21 original alerts fixed; none was manually dismissed. A complete API census and the browser both show zero open alerts.
Activity
devantler commentedon Oct 24, 2026
Refinement, 2026-10-24: the module is gone, but the alerts are not.
scripts/retire-backstage-stateless/. That path returns 404 onmaintoday, so there is nothing left to upgrade, and the first and third acceptance criteria no longer have a subject.So the remaining work is only the second criterion: get those 21 alerts closed because their manifest no longer exists (Dependabot normally does that itself once the dependency graph drops the file), without dismissing anything still present elsewhere. I have not dismissed or changed any alert. This stays open until the alert count for that path reads 0.
devantler commentedon Oct 26, 2026
Resolved the remaining acceptance criterion through GitHub's documented dependency-graph refresh. I used “Refresh Dependabot alerts” in this repository's Security UI, then independently read the complete alerts API. All 21 original alerts were marked
fixedby GitHub between 08:13:34Z and 08:13:40Z on 2026-10-26, with no dismissal reason, and the complete open-alert count is now zero. The UI independently shows “No open alerts” and the new dependency-file check time.The default-branch tree independently confirms the one-shot module is absent after #5161, so updating or adding updater coverage for that retired module would recreate work with no remaining consumer. No dependency versions, scanner rules, risk tolerances or manual dismissals were changed. This completes the issue rather than leaving a stale upstream blocker in the queue.