Is @backstage/config-loader safe to use?

@backstage/config-loader has no known vulnerabilities on the latest version (1.10.10). DepScope rates its health at 69/100 (moderate risk).

What is the latest version of @backstage/config-loader?

The latest version of @backstage/config-loader is 1.10.10, released 2026-04-14.

Does @backstage/config-loader have known vulnerabilities?

No known vulnerabilities on the latest version of @backstage/config-loader.

Is @backstage/config-loader deprecated?

No, @backstage/config-loader is actively maintained. Latest release: 1.10.10 (2026-04-14).

What are alternatives to @backstage/config-loader?

Popular alternatives to @backstage/config-loader in npm include: semver, debug, minimatch, ansi-styles, brace-expansion.

What license does @backstage/config-loader use?

@backstage/config-loader is licensed under Apache-2.0.

@backstage/config-loader

npmv1.10.10

Config loading functionality used by Backstage backend, and CLI

License Apache-2.0permissive1132 versions3 maintainers15 deps

backstage/backstage

/ 100

Health

safe to use

@backstage/[email protected] is safe to use (health: 69/100)

Health breakdown0 – 100

25/25

maintenance

0/20

popularity

25/25

security

15/15

maturity

4/15

community

Vulnerabilities

none known

Bundle & TypeScript

📦

Bundle Size

4656.7 KBminified

1338.6 KB gzipped

15 direct dependencies

ESMside effectsscoped

🌟

TypeScript

10/10typed

bundled

Health History

Dependency Tree

License Audit

Dependencies (15)

ajv yaml lodash chokidar fs-extra minimist json-schema @backstage/types @backstage/config @backstage/errors @types/json-schema json-schema-traverse @backstage/cli-common typescript-json-schema json-schema-merge-allof

API access

Get this data programmatically — free, no authentication.

curl https://depscope.dev/api/check/npm/@backstage/config-loader