@backstage/backend-test-utils
Test helpers library for Backstage backends
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| publish-pattern | new-deps-added | AI (publish-pattern): text-extensions replaces textextensions — same upstream author, benign rename, no risk. | ai | |
| dependencies | unvetted-dep:@types/keyv | AI (dependencies): Standard TypeScript type definitions for keyv; appropriate dependency for a backend test utilities package. | ai | |
| dependencies | unvetted-dep:@keyv/valkey | AI (dependencies): Legitimate keyv adapter for Valkey caching; appropriate for a backend test utilities package. | ai | |
| dependencies | unvetted-dep:@types/qs | AI (dependencies): Standard TypeScript type definitions package; stable false positive for this well-established Backstage library. | ai | |
| dependencies | unvetted-dep:testcontainers | AI (dependencies): Well-known integration testing library for spinning up Docker containers in tests; expected dependency for a backend test utilities package. | ai | |
| dependencies | unvetted-dep:@backstage/backend-plugin-api | AI (dependencies): First-party Backstage package from the same monorepo; stable false positive for all @backstage/* packages. | ai | |
| dependencies | unvetted-dep:@keyv/memcache | AI (dependencies): Legitimate keyv adapter for Memcache; appropriate for a backend test utilities package. | ai | |
| phantom-deps | phantom-dep:@types/express-serve-static-core | AI (phantom-deps): Framework-scoped type package; stable false positive for this Backstage package. | ai | |
| phantom-deps | phantom-dep:pg | AI (phantom-deps): pg is a declared runtime dep used for PostgreSQL test container support; not directly imported but loaded by convention in this DB testing utility. | ai | |
| provenance | no-provenance | AI (provenance): Backstage monorepo packages historically published without Sigstore provenance; absence is consistent across all versions and not a security signal for this package. | ai | |
| phantom-deps | phantom-dep:mysql2 | AI (phantom-deps): mysql2 is a declared runtime dep for MySQL test container support; pattern is stable for this backend testing utility package. | ai | |
| phantom-deps | phantom-dep:better-sqlite3 | AI (phantom-deps): better-sqlite3 is a declared runtime dep for SQLite testing support; loaded by convention in this DB testing utility. | ai | |
| phantom-deps | phantom-dep:@types/qs | AI (phantom-deps): Framework-scoped type package; stable false positive for this Backstage package. | ai | |
| phantom-deps | phantom-dep:@types/keyv | AI (phantom-deps): Framework-scoped type package; stable false positive for this Backstage package. | ai | |
| phantom-deps | phantom-dep:@types/express | AI (phantom-deps): Framework-scoped type package; stable false positive for this Backstage package. | ai | |
| phantom-deps | phantom-dep:@backstage/plugin-auth-node | AI (phantom-deps): Same-org Backstage package declared as runtime dep; phantom detection is a false positive here. | ai |
Versions (showing 15 of 15)
| Version | Deps | Published |
|---|---|---|
| 1.11.3 | 31 / 5 | |
| 1.11.2 | 32 / 5 | |
| 1.11.1 | 32 / 5 | |
| 1.11.0 | 32 / 5 | |
| 1.10.4 | 32 / 5 | |
| 1.10.3 | 32 / 5 | |
| 1.10.2 | 32 / 5 | |
| 1.10.1 | 32 / 5 | |
| 1.10.0 | 32 / 5 | |
| 1.9.1 | 32 / 5 | |
| 1.9.0 | 32 / 5 | |
| 1.8.0 | 31 / 4 | |
| 1.7.0 | 31 / 4 | |
| 1.6.0 | 31 / 4 | |
| 1.5.0 | 28 / 4 |
v1.11.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.11.2
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v1.9.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.9.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.8.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.7.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.6.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v1.5.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.