From b15f74b62f9a588bff1e9e4b2937c53a7471617b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fredrik=20Adel=C3=B6w?= Date: Tue, 26 May 2026 10:29:17 +0200 Subject: [PATCH 1/4] try to remove protojs pins MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Fredrik Adelöw --- packages/create-app/seed-yarn.lock | 43 ------------------------------ 1 file changed, 43 deletions(-) diff --git a/packages/create-app/seed-yarn.lock b/packages/create-app/seed-yarn.lock index e92bbfe51d..b6ba82ab17 100644 --- a/packages/create-app/seed-yarn.lock +++ b/packages/create-app/seed-yarn.lock @@ -37,46 +37,3 @@ fast-xml-builder@*: version "3.1.0" resolved "https://registry.yarnpkg.com/knex/-/knex-3.1.0.tgz#b6ddd5b5ad26a6315234a5b09ec38dc4a370bd8c" integrity sha512-GLoII6hR0c4ti243gMs5/1Rb3B+AjwMOfjYm97pu0FOQa7JH56hgBxYf5WK2525ceSbBY1cjeZ9yk99GPMB6Kw== - -// @protobufjs/inquire@1.1.1 dropped the eval-based workaround that hid its -// dynamic require() from bundlers, which causes webpack/rspack to emit a -// "Critical dependency: the request of a dependency is an expression" warning -// that fails the build under CI=true. Pin to 1.1.0 until upstream is fixed. -// See https://github.com/protobufjs/protobuf.js/issues/2057 -"@protobufjs/inquire@^1.1.0": - version "1.1.0" - resolved "https://registry.yarnpkg.com/@protobufjs/inquire/-/inquire-1.1.0.tgz#ff200e3e7cf2429e2dcafc1140828e8cc638f089" - integrity sha512-kdSefcPdruJiFMVSbn801t4vFK7KB/5gd2fYvrxhuJYg8ILrmn9SKSX2tZdV6V+ksulWqS7aXjBcRXl3wHoD9Q== - -// protobufjs@7.5.6 bumped its @protobufjs/inquire dependency to ^1.1.1, which -// would bypass the pin above. Pin protobufjs to 7.5.5 (the last version that -// requests inquire ^1.1.0) for all known workspace queries. -"protobufjs@^7.0.0": - version "7.5.5" - resolved "https://registry.yarnpkg.com/protobufjs/-/protobufjs-7.5.5.tgz#b7089ca4410374c75150baf277353ef76db69f96" - integrity sha512-3wY1AxV+VBNW8Yypfd1yQY9pXnqTAN+KwQxL8iYm3/BjKYMNg4i0owhEe26PWDOMaIrzeeF98Lqd5NGz4omiIg== - -"protobufjs@^7.2.5": - version "7.5.5" - resolved "https://registry.yarnpkg.com/protobufjs/-/protobufjs-7.5.5.tgz#b7089ca4410374c75150baf277353ef76db69f96" - integrity sha512-3wY1AxV+VBNW8Yypfd1yQY9pXnqTAN+KwQxL8iYm3/BjKYMNg4i0owhEe26PWDOMaIrzeeF98Lqd5NGz4omiIg== - -"protobufjs@^7.2.6": - version "7.5.5" - resolved "https://registry.yarnpkg.com/protobufjs/-/protobufjs-7.5.5.tgz#b7089ca4410374c75150baf277353ef76db69f96" - integrity sha512-3wY1AxV+VBNW8Yypfd1yQY9pXnqTAN+KwQxL8iYm3/BjKYMNg4i0owhEe26PWDOMaIrzeeF98Lqd5NGz4omiIg== - -"protobufjs@^7.3.2": - version "7.5.5" - resolved "https://registry.yarnpkg.com/protobufjs/-/protobufjs-7.5.5.tgz#b7089ca4410374c75150baf277353ef76db69f96" - integrity sha512-3wY1AxV+VBNW8Yypfd1yQY9pXnqTAN+KwQxL8iYm3/BjKYMNg4i0owhEe26PWDOMaIrzeeF98Lqd5NGz4omiIg== - -"protobufjs@^7.4.0": - version "7.5.5" - resolved "https://registry.yarnpkg.com/protobufjs/-/protobufjs-7.5.5.tgz#b7089ca4410374c75150baf277353ef76db69f96" - integrity sha512-3wY1AxV+VBNW8Yypfd1yQY9pXnqTAN+KwQxL8iYm3/BjKYMNg4i0owhEe26PWDOMaIrzeeF98Lqd5NGz4omiIg== - -"protobufjs@^7.5.3": - version "7.5.5" - resolved "https://registry.yarnpkg.com/protobufjs/-/protobufjs-7.5.5.tgz#b7089ca4410374c75150baf277353ef76db69f96" - integrity sha512-3wY1AxV+VBNW8Yypfd1yQY9pXnqTAN+KwQxL8iYm3/BjKYMNg4i0owhEe26PWDOMaIrzeeF98Lqd5NGz4omiIg== From c069132a86d0830292f9cbe8ab750be054c53d46 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fredrik=20Adel=C3=B6w?= Date: Tue, 26 May 2026 11:23:14 +0200 Subject: [PATCH 2/4] fix(cli): suppress protobufjs/inquire dynamic require warning in bundler MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Since protobufjs 7.5.9, the @protobufjs/inquire utility is no longer called with dynamic module names (replaced by bundler-safe lookups in protobufjs/protobuf.js#2254). However, webpack/rspack still statically analyzes the inquire source and emits a "Critical dependency" warning for its require(moduleName) pattern. This is a false positive — the code path is dead in practice. Co-Authored-By: Claude Opus 4.6 (1M context) Signed-off-by: Fredrik Adelöw --- .../src/lib/bundler/config.ts | 25 +++++++++++++------ 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/packages/cli-module-build/src/lib/bundler/config.ts b/packages/cli-module-build/src/lib/bundler/config.ts index d3e5f01eac..e2de9ef2c8 100644 --- a/packages/cli-module-build/src/lib/bundler/config.ts +++ b/packages/cli-module-build/src/lib/bundler/config.ts @@ -394,16 +394,25 @@ export async function createConfig( }), }, plugins, - ...(options.moduleFederationRemote && { + ignoreWarnings: [ + // @protobufjs/inquire uses require(moduleName) with a dynamic argument. + // Since protobufjs >=7.5.9 this code path is never exercised (the + // bundler-safe optional module lookups backport replaced all call sites), + // but webpack/rspack still statically analyzes the source and emits a + // "Critical dependency" warning. Safe to suppress. + // See https://github.com/protobufjs/protobuf.js/issues/2057 + { module: /@protobufjs[\\/]inquire/ }, // TODO: remove this warning skipping as soon as the corresponding bundler limitation // described in issue https://github.com/web-infra-dev/rspack/issues/13635 is fixed // when PR: https://github.com/web-infra-dev/rspack/pull/13636 is merged. - ignoreWarnings: [ - { - message: - /No version specified and unable to automatically determine one\. No version in description file/, - }, - ], - }), + ...(options.moduleFederationRemote + ? [ + { + message: + /No version specified and unable to automatically determine one\. No version in description file/, + }, + ] + : []), + ], }; } From a1971eace88c89f719b6377f30d47174a2bcb258 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fredrik=20Adel=C3=B6w?= Date: Tue, 26 May 2026 11:42:53 +0200 Subject: [PATCH 3/4] chore: add changeset for protobufjs warning suppression MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 4.6 (1M context) Signed-off-by: Fredrik Adelöw --- .changeset/remove-protobufjs-pins.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changeset/remove-protobufjs-pins.md diff --git a/.changeset/remove-protobufjs-pins.md b/.changeset/remove-protobufjs-pins.md new file mode 100644 index 0000000000..2b436e3e7f --- /dev/null +++ b/.changeset/remove-protobufjs-pins.md @@ -0,0 +1,5 @@ +--- +'@backstage/cli-module-build': patch +--- + +Suppress false-positive `@protobufjs/inquire` "Critical dependency" warning in the bundler. Since `protobufjs` 7.5.9, the dynamic require path in inquire is no longer exercised, but webpack/rspack still flags it during static analysis. From eca61bc02e5bbd7fdc1ab2f6d282ffe3ef9f5569 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fredrik=20Adel=C3=B6w?= Date: Tue, 26 May 2026 12:04:56 +0200 Subject: [PATCH 4/4] fix(cli): narrow protobufjs warning suppression to specific message MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 4.6 (1M context) Signed-off-by: Fredrik Adelöw --- packages/cli-module-build/src/lib/bundler/config.ts | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/packages/cli-module-build/src/lib/bundler/config.ts b/packages/cli-module-build/src/lib/bundler/config.ts index e2de9ef2c8..8d6d92050e 100644 --- a/packages/cli-module-build/src/lib/bundler/config.ts +++ b/packages/cli-module-build/src/lib/bundler/config.ts @@ -401,7 +401,11 @@ export async function createConfig( // but webpack/rspack still statically analyzes the source and emits a // "Critical dependency" warning. Safe to suppress. // See https://github.com/protobufjs/protobuf.js/issues/2057 - { module: /@protobufjs[\\/]inquire/ }, + { + module: /@protobufjs[\\/]inquire/, + message: + /Critical dependency: the request of a dependency is an expression/, + }, // TODO: remove this warning skipping as soon as the corresponding bundler limitation // described in issue https://github.com/web-infra-dev/rspack/issues/13635 is fixed // when PR: https://github.com/web-infra-dev/rspack/pull/13636 is merged.