[yumike]

Summary — partial remediation only

Update @azure/identity 4.13.0 → 4.14.1 within the existing Backstage ^4.0.0 requirement. Its updated MSAL Node dependency no longer uses vulnerable UUID.

• Azure Identity → MSAL Node 3.8.8 → uuid ^8.3.0 is removed.
• Azure Identity now selects MSAL Node 7.2.0, which has no uuid dependency.
• Other upstream changes required by Identity 4.14.1 include MSAL Browser 5, MSAL Common 16, open 11, and core-process 1.
• Lockfile-only, with no manifest changes, range narrowing, source patches, or overrides. The transitive major changes are declared by the updated Identity parent, not forced outside its ranges.

This does not close UUID alert #57. UUID 8.3.2 and other affected majors remain through independent consumers. This removes one vulnerable dependency path, not every affected copy.

Compatibility

• Identity 4.14.1 and core-process require Node >=22; Node 20 deployments cannot use this update. This matches the Backstage 1.56.3 Node 22/24 baseline; CI uses 24.22.2.
• Independent review of the installed Backstage integration/backend-defaults consumers found no removed Identity runtime exports or incompatible constructor/getToken changes in the APIs they use.
• Upstream 4.14.1 requires form_post callbacks for InteractiveBrowserCredential; inspected Backstage consumers do not instantiate that class. Custom interactive flows need separate verification.

Validation

• Hardened immutable install on Node 24.22.2.
• All 666 repository tests; typecheck, lint, formatting.
• All plugin builds and separate frontend/backend builds.
• Old/new mocked client-secret token acquisition, public credential constructor and chained-credential checks pass on both Node 22.22.2 and 24.22.2. HTTP transport is fully synthetic: no real credentials or cloud requests.
• Confirmed MSAL Node 3.8.8 is removed and 7.2.0 has no UUID dependency.
• Audited the exact added/removed resolution set; changes are confined to the Identity dependency subtree. Vulnerable UUID copies outside it remain explicit.
• Only yarn.lock changes.

Live Entra authentication, Azure DevOps/Blob/PostgreSQL access, managed/workload identities, developer CLI execution, interactive-browser flows and token renewal were not exercised. Existing backend, local config/data and main checkout remain unchanged.