From 2e5c5f85b2b36f9062adc624e2a90a9445f1be73 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fredrik=20Adel=C3=B6w?= Date: Mon, 30 Mar 2026 23:02:37 +0200 Subject: [PATCH 1/2] Bump glob to v13 and rollup to v4.59+ to fix security vulnerabilities MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Addresses the high severity rollup path traversal vulnerability (GHSA-mw96-cpmx-2vgc) and the glob security advisory by upgrading all instances across the monorepo. Updates code that used the legacy callback-based glob API to use the modern promise/sync API. Co-Authored-By: Claude Opus 4.6 (1M context) Signed-off-by: Fredrik Adelöw --- .changeset/bump-glob-rollup-security.md | 11 + packages/cli-module-auth/package.json | 2 +- .../cli-module-auth/src/commands/login.ts | 4 +- packages/cli-module-build/package.json | 4 +- packages/cli-module-test-jest/config/jest.js | 2 +- packages/cli-module-test-jest/package.json | 2 +- packages/cli/package.json | 2 +- packages/repo-tools/package.json | 2 +- packages/ui/package.json | 2 +- plugins/catalog-backend/package.json | 3 +- .../src/processors/FileReaderProcessor.ts | 5 +- yarn.lock | 274 +++++++++--------- 12 files changed, 158 insertions(+), 155 deletions(-) create mode 100644 .changeset/bump-glob-rollup-security.md diff --git a/.changeset/bump-glob-rollup-security.md b/.changeset/bump-glob-rollup-security.md new file mode 100644 index 0000000000..1738169fd1 --- /dev/null +++ b/.changeset/bump-glob-rollup-security.md @@ -0,0 +1,11 @@ +--- +'@backstage/plugin-catalog-backend': patch +'@backstage/cli-module-auth': patch +'@backstage/cli-module-build': patch +'@backstage/cli-module-test-jest': patch +'@backstage/cli': patch +'@backstage/ui': patch +'@backstage/repo-tools': patch +--- + +Bumped `glob` dependency from v7/v8/v11 to v13 to address security vulnerabilities in older versions. Bumped `rollup` from v4.27 to v4.59+ to fix a high severity path traversal vulnerability (GHSA-mw96-cpmx-2vgc). diff --git a/packages/cli-module-auth/package.json b/packages/cli-module-auth/package.json index 17f502d03b..4976fe722a 100644 --- a/packages/cli-module-auth/package.json +++ b/packages/cli-module-auth/package.json @@ -37,7 +37,7 @@ "@backstage/errors": "workspace:^", "cleye": "^2.3.0", "fs-extra": "^11.2.0", - "glob": "^7.1.7", + "glob": "^13.0.0", "inquirer": "^8.2.0", "proper-lockfile": "^4.1.2", "yaml": "^2.0.0", diff --git a/packages/cli-module-auth/src/commands/login.ts b/packages/cli-module-auth/src/commands/login.ts index 6bb8751147..5320bae726 100644 --- a/packages/cli-module-auth/src/commands/login.ts +++ b/packages/cli-module-auth/src/commands/login.ts @@ -31,7 +31,7 @@ import { getSecretStore, getAuthInstanceService } from '@internal/cli'; import crypto from 'node:crypto'; import fs from 'fs-extra'; import path from 'node:path'; -import glob from 'glob'; +import { globSync } from 'glob'; import YAML from 'yaml'; import inquirer from 'inquirer'; @@ -178,7 +178,7 @@ async function pickBaseUrl() { 'packages/*/app-config.yaml', 'packages/*/app-config.*.yaml', ]; - const files = patterns.flatMap(p => glob.sync(p, { cwd, nodir: true })); + const files = patterns.flatMap(p => globSync(p, { cwd, nodir: true })); for (const file of files) { try { const content = await fs.readFile(path.resolve(cwd, file), 'utf8'); diff --git a/packages/cli-module-build/package.json b/packages/cli-module-build/package.json index f7c97d35f2..ce8a9f8a7e 100644 --- a/packages/cli-module-build/package.json +++ b/packages/cli-module-build/package.json @@ -70,7 +70,7 @@ "eslint-webpack-plugin": "^4.2.0", "fork-ts-checker-webpack-plugin": "^9.0.0", "fs-extra": "^11.2.0", - "glob": "^7.1.7", + "glob": "^13.0.0", "html-webpack-plugin": "^5.6.3", "lodash": "^4.17.21", "mini-css-extract-plugin": "^2.4.2", @@ -83,7 +83,7 @@ "raw-loader": "^4.0.2", "react-dev-utils": "^12.0.0-next.60", "react-refresh": "^0.18.0", - "rollup": "^4.27.3", + "rollup": "^4.59.0", "rollup-plugin-dts": "^6.1.0", "rollup-plugin-esbuild": "^6.1.1", "rollup-plugin-postcss": "^4.0.0", diff --git a/packages/cli-module-test-jest/config/jest.js b/packages/cli-module-test-jest/config/jest.js index 8a88483d42..52ccf989c4 100644 --- a/packages/cli-module-test-jest/config/jest.js +++ b/packages/cli-module-test-jest/config/jest.js @@ -17,7 +17,7 @@ const fs = require('fs-extra'); const path = require('node:path'); const crypto = require('node:crypto'); -const glob = require('node:util').promisify(require('glob')); +const { glob } = require('glob'); const { version } = require('../package.json'); const paths = require('@backstage/cli-common').findPaths(process.cwd()); const { diff --git a/packages/cli-module-test-jest/package.json b/packages/cli-module-test-jest/package.json index a1dccac101..0218bca911 100644 --- a/packages/cli-module-test-jest/package.json +++ b/packages/cli-module-test-jest/package.json @@ -40,7 +40,7 @@ "cleye": "^2.3.0", "cross-fetch": "^4.0.0", "fs-extra": "^11.2.0", - "glob": "^7.1.7", + "glob": "^13.0.0", "jest-css-modules": "^2.1.0", "sucrase": "^3.20.2", "yargs": "^16.2.0" diff --git a/packages/cli/package.json b/packages/cli/package.json index ab6a1f0ca2..9cabc2ee4d 100644 --- a/packages/cli/package.json +++ b/packages/cli/package.json @@ -71,7 +71,7 @@ "eslint-plugin-react-hooks": "^5.0.0", "eslint-plugin-unused-imports": "^4.1.4", "fs-extra": "^11.2.0", - "glob": "^7.1.7", + "glob": "^13.0.0", "jest-css-modules": "^2.1.0", "pirates": "^4.0.6", "postcss": "^8.1.0", diff --git a/packages/repo-tools/package.json b/packages/repo-tools/package.json index 27e6cdf6b7..cd1ba32c6b 100644 --- a/packages/repo-tools/package.json +++ b/packages/repo-tools/package.json @@ -69,7 +69,7 @@ "command-exists": "^1.2.9", "commander": "^14.0.3", "fs-extra": "^11.2.0", - "glob": "^8.0.3", + "glob": "^13.0.0", "globby": "^11.0.0", "is-glob": "^4.0.3", "js-yaml": "^4.1.0", diff --git a/packages/ui/package.json b/packages/ui/package.json index 6d99d851b7..0be76edf5d 100644 --- a/packages/ui/package.json +++ b/packages/ui/package.json @@ -64,7 +64,7 @@ "@types/react-dom": "^18.0.0", "@types/use-sync-external-store": "^0.0.6", "eslint-plugin-storybook": "^10.3.3", - "glob": "^11.0.1", + "glob": "^13.0.0", "globals": "^17.0.0", "react": "^18.0.2", "react-dom": "^18.0.2", diff --git a/plugins/catalog-backend/package.json b/plugins/catalog-backend/package.json index d4a1298027..0bcf0fa9a2 100644 --- a/plugins/catalog-backend/package.json +++ b/plugins/catalog-backend/package.json @@ -85,7 +85,7 @@ "fast-json-stable-stringify": "^2.1.0", "fs-extra": "^11.2.0", "git-url-parse": "^15.0.0", - "glob": "^7.1.6", + "glob": "^13.0.0", "knex": "^3.0.0", "lodash": "^4.17.21", "luxon": "^3.0.0", @@ -107,7 +107,6 @@ "@types/core-js": "^2.5.4", "@types/express": "^4.17.6", "@types/git-url-parse": "^9.0.0", - "@types/glob": "^8.0.0", "@types/lodash": "^4.14.151", "@types/supertest": "^2.0.8", "better-sqlite3": "^12.0.0", diff --git a/plugins/catalog-backend/src/processors/FileReaderProcessor.ts b/plugins/catalog-backend/src/processors/FileReaderProcessor.ts index 4c692ead93..12648aa96d 100644 --- a/plugins/catalog-backend/src/processors/FileReaderProcessor.ts +++ b/plugins/catalog-backend/src/processors/FileReaderProcessor.ts @@ -15,9 +15,8 @@ */ import fs from 'fs-extra'; -import g from 'glob'; +import { glob } from 'glob'; import path from 'node:path'; -import { promisify } from 'node:util'; import { LocationSpec } from '@backstage/plugin-catalog-common'; import { CatalogProcessor, @@ -26,8 +25,6 @@ import { processingResult, } from '@backstage/plugin-catalog-node'; -const glob = promisify(g); - const LOCATION_TYPE = 'file'; /** @public */ diff --git a/yarn.lock b/yarn.lock index 6469dc403b..a882c51e18 100644 --- a/yarn.lock +++ b/yarn.lock @@ -2851,7 +2851,7 @@ __metadata: "@types/proper-lockfile": "npm:^4" cleye: "npm:^2.3.0" fs-extra: "npm:^11.2.0" - glob: "npm:^7.1.7" + glob: "npm:^13.0.0" inquirer: "npm:^8.2.0" keytar: "npm:^7.9.0" proper-lockfile: "npm:^4.1.2" @@ -2905,7 +2905,7 @@ __metadata: eslint-webpack-plugin: "npm:^4.2.0" fork-ts-checker-webpack-plugin: "npm:^9.0.0" fs-extra: "npm:^11.2.0" - glob: "npm:^7.1.7" + glob: "npm:^13.0.0" html-webpack-plugin: "npm:^5.6.3" lodash: "npm:^4.17.21" mini-css-extract-plugin: "npm:^2.4.2" @@ -2918,7 +2918,7 @@ __metadata: raw-loader: "npm:^4.0.2" react-dev-utils: "npm:^12.0.0-next.60" react-refresh: "npm:^0.18.0" - rollup: "npm:^4.27.3" + rollup: "npm:^4.59.0" rollup-plugin-dts: "npm:^6.1.0" rollup-plugin-esbuild: "npm:^6.1.1" rollup-plugin-postcss: "npm:^4.0.0" @@ -3108,7 +3108,7 @@ __metadata: cleye: "npm:^2.3.0" cross-fetch: "npm:^4.0.0" fs-extra: "npm:^11.2.0" - glob: "npm:^7.1.7" + glob: "npm:^13.0.0" jest-css-modules: "npm:^2.1.0" sucrase: "npm:^3.20.2" yargs: "npm:^16.2.0" @@ -3232,7 +3232,7 @@ __metadata: eslint-plugin-react-hooks: "npm:^5.0.0" eslint-plugin-unused-imports: "npm:^4.1.4" fs-extra: "npm:^11.2.0" - glob: "npm:^7.1.7" + glob: "npm:^13.0.0" jest: "npm:^30.2.0" jest-css-modules: "npm:^2.1.0" jsdom: "npm:^27.1.0" @@ -5139,7 +5139,6 @@ __metadata: "@types/core-js": "npm:^2.5.4" "@types/express": "npm:^4.17.6" "@types/git-url-parse": "npm:^9.0.0" - "@types/glob": "npm:^8.0.0" "@types/lodash": "npm:^4.14.151" "@types/supertest": "npm:^2.0.8" better-sqlite3: "npm:^12.0.0" @@ -5149,7 +5148,7 @@ __metadata: fast-json-stable-stringify: "npm:^2.1.0" fs-extra: "npm:^11.2.0" git-url-parse: "npm:^15.0.0" - glob: "npm:^7.1.6" + glob: "npm:^13.0.0" knex: "npm:^3.0.0" lodash: "npm:^4.17.21" luxon: "npm:^3.0.0" @@ -7823,7 +7822,7 @@ __metadata: command-exists: "npm:^1.2.9" commander: "npm:^14.0.3" fs-extra: "npm:^11.2.0" - glob: "npm:^8.0.3" + glob: "npm:^13.0.0" globby: "npm:^11.0.0" is-glob: "npm:^4.0.3" js-yaml: "npm:^4.1.0" @@ -7951,7 +7950,7 @@ __metadata: "@types/use-sync-external-store": "npm:^0.0.6" clsx: "npm:^2.1.1" eslint-plugin-storybook: "npm:^10.3.3" - glob: "npm:^11.0.1" + glob: "npm:^13.0.0" globals: "npm:^17.0.0" react: "npm:^18.0.2" react-aria: "npm:^3.47.0" @@ -17206,156 +17205,177 @@ __metadata: languageName: node linkType: hard -"@rollup/rollup-android-arm-eabi@npm:4.53.3": - version: 4.53.3 - resolution: "@rollup/rollup-android-arm-eabi@npm:4.53.3" +"@rollup/rollup-android-arm-eabi@npm:4.60.1": + version: 4.60.1 + resolution: "@rollup/rollup-android-arm-eabi@npm:4.60.1" conditions: os=android & cpu=arm languageName: node linkType: hard -"@rollup/rollup-android-arm64@npm:4.53.3": - version: 4.53.3 - resolution: "@rollup/rollup-android-arm64@npm:4.53.3" +"@rollup/rollup-android-arm64@npm:4.60.1": + version: 4.60.1 + resolution: "@rollup/rollup-android-arm64@npm:4.60.1" conditions: os=android & cpu=arm64 languageName: node linkType: hard -"@rollup/rollup-darwin-arm64@npm:4.53.3": - version: 4.53.3 - resolution: "@rollup/rollup-darwin-arm64@npm:4.53.3" +"@rollup/rollup-darwin-arm64@npm:4.60.1": + version: 4.60.1 + resolution: "@rollup/rollup-darwin-arm64@npm:4.60.1" conditions: os=darwin & cpu=arm64 languageName: node linkType: hard -"@rollup/rollup-darwin-x64@npm:4.53.3": - version: 4.53.3 - resolution: "@rollup/rollup-darwin-x64@npm:4.53.3" +"@rollup/rollup-darwin-x64@npm:4.60.1": + version: 4.60.1 + resolution: "@rollup/rollup-darwin-x64@npm:4.60.1" conditions: os=darwin & cpu=x64 languageName: node linkType: hard -"@rollup/rollup-freebsd-arm64@npm:4.53.3": - version: 4.53.3 - resolution: "@rollup/rollup-freebsd-arm64@npm:4.53.3" +"@rollup/rollup-freebsd-arm64@npm:4.60.1": + version: 4.60.1 + resolution: "@rollup/rollup-freebsd-arm64@npm:4.60.1" conditions: os=freebsd & cpu=arm64 languageName: node linkType: hard -"@rollup/rollup-freebsd-x64@npm:4.53.3": - version: 4.53.3 - resolution: "@rollup/rollup-freebsd-x64@npm:4.53.3" +"@rollup/rollup-freebsd-x64@npm:4.60.1": + version: 4.60.1 + resolution: "@rollup/rollup-freebsd-x64@npm:4.60.1" conditions: os=freebsd & cpu=x64 languageName: node linkType: hard -"@rollup/rollup-linux-arm-gnueabihf@npm:4.53.3": - version: 4.53.3 - resolution: "@rollup/rollup-linux-arm-gnueabihf@npm:4.53.3" +"@rollup/rollup-linux-arm-gnueabihf@npm:4.60.1": + version: 4.60.1 + resolution: "@rollup/rollup-linux-arm-gnueabihf@npm:4.60.1" conditions: os=linux & cpu=arm & libc=glibc languageName: node linkType: hard -"@rollup/rollup-linux-arm-musleabihf@npm:4.53.3": - version: 4.53.3 - resolution: "@rollup/rollup-linux-arm-musleabihf@npm:4.53.3" +"@rollup/rollup-linux-arm-musleabihf@npm:4.60.1": + version: 4.60.1 + resolution: "@rollup/rollup-linux-arm-musleabihf@npm:4.60.1" conditions: os=linux & cpu=arm & libc=musl languageName: node linkType: hard -"@rollup/rollup-linux-arm64-gnu@npm:4.53.3": - version: 4.53.3 - resolution: "@rollup/rollup-linux-arm64-gnu@npm:4.53.3" +"@rollup/rollup-linux-arm64-gnu@npm:4.60.1": + version: 4.60.1 + resolution: "@rollup/rollup-linux-arm64-gnu@npm:4.60.1" conditions: os=linux & cpu=arm64 & libc=glibc languageName: node linkType: hard -"@rollup/rollup-linux-arm64-musl@npm:4.53.3": - version: 4.53.3 - resolution: "@rollup/rollup-linux-arm64-musl@npm:4.53.3" +"@rollup/rollup-linux-arm64-musl@npm:4.60.1": + version: 4.60.1 + resolution: "@rollup/rollup-linux-arm64-musl@npm:4.60.1" conditions: os=linux & cpu=arm64 & libc=musl languageName: node linkType: hard -"@rollup/rollup-linux-loong64-gnu@npm:4.53.3": - version: 4.53.3 - resolution: "@rollup/rollup-linux-loong64-gnu@npm:4.53.3" +"@rollup/rollup-linux-loong64-gnu@npm:4.60.1": + version: 4.60.1 + resolution: "@rollup/rollup-linux-loong64-gnu@npm:4.60.1" conditions: os=linux & cpu=loong64 & libc=glibc languageName: node linkType: hard -"@rollup/rollup-linux-ppc64-gnu@npm:4.53.3": - version: 4.53.3 - resolution: "@rollup/rollup-linux-ppc64-gnu@npm:4.53.3" +"@rollup/rollup-linux-loong64-musl@npm:4.60.1": + version: 4.60.1 + resolution: "@rollup/rollup-linux-loong64-musl@npm:4.60.1" + conditions: os=linux & cpu=loong64 & libc=musl + languageName: node + linkType: hard + +"@rollup/rollup-linux-ppc64-gnu@npm:4.60.1": + version: 4.60.1 + resolution: "@rollup/rollup-linux-ppc64-gnu@npm:4.60.1" conditions: os=linux & cpu=ppc64 & libc=glibc languageName: node linkType: hard -"@rollup/rollup-linux-riscv64-gnu@npm:4.53.3": - version: 4.53.3 - resolution: "@rollup/rollup-linux-riscv64-gnu@npm:4.53.3" +"@rollup/rollup-linux-ppc64-musl@npm:4.60.1": + version: 4.60.1 + resolution: "@rollup/rollup-linux-ppc64-musl@npm:4.60.1" + conditions: os=linux & cpu=ppc64 & libc=musl + languageName: node + linkType: hard + +"@rollup/rollup-linux-riscv64-gnu@npm:4.60.1": + version: 4.60.1 + resolution: "@rollup/rollup-linux-riscv64-gnu@npm:4.60.1" conditions: os=linux & cpu=riscv64 & libc=glibc languageName: node linkType: hard -"@rollup/rollup-linux-riscv64-musl@npm:4.53.3": - version: 4.53.3 - resolution: "@rollup/rollup-linux-riscv64-musl@npm:4.53.3" +"@rollup/rollup-linux-riscv64-musl@npm:4.60.1": + version: 4.60.1 + resolution: "@rollup/rollup-linux-riscv64-musl@npm:4.60.1" conditions: os=linux & cpu=riscv64 & libc=musl languageName: node linkType: hard -"@rollup/rollup-linux-s390x-gnu@npm:4.53.3": - version: 4.53.3 - resolution: "@rollup/rollup-linux-s390x-gnu@npm:4.53.3" +"@rollup/rollup-linux-s390x-gnu@npm:4.60.1": + version: 4.60.1 + resolution: "@rollup/rollup-linux-s390x-gnu@npm:4.60.1" conditions: os=linux & cpu=s390x & libc=glibc languageName: node linkType: hard -"@rollup/rollup-linux-x64-gnu@npm:4.53.3": - version: 4.53.3 - resolution: "@rollup/rollup-linux-x64-gnu@npm:4.53.3" +"@rollup/rollup-linux-x64-gnu@npm:4.60.1": + version: 4.60.1 + resolution: "@rollup/rollup-linux-x64-gnu@npm:4.60.1" conditions: os=linux & cpu=x64 & libc=glibc languageName: node linkType: hard -"@rollup/rollup-linux-x64-musl@npm:4.53.3": - version: 4.53.3 - resolution: "@rollup/rollup-linux-x64-musl@npm:4.53.3" +"@rollup/rollup-linux-x64-musl@npm:4.60.1": + version: 4.60.1 + resolution: "@rollup/rollup-linux-x64-musl@npm:4.60.1" conditions: os=linux & cpu=x64 & libc=musl languageName: node linkType: hard -"@rollup/rollup-openharmony-arm64@npm:4.53.3": - version: 4.53.3 - resolution: "@rollup/rollup-openharmony-arm64@npm:4.53.3" +"@rollup/rollup-openbsd-x64@npm:4.60.1": + version: 4.60.1 + resolution: "@rollup/rollup-openbsd-x64@npm:4.60.1" + conditions: os=openbsd & cpu=x64 + languageName: node + linkType: hard + +"@rollup/rollup-openharmony-arm64@npm:4.60.1": + version: 4.60.1 + resolution: "@rollup/rollup-openharmony-arm64@npm:4.60.1" conditions: os=openharmony & cpu=arm64 languageName: node linkType: hard -"@rollup/rollup-win32-arm64-msvc@npm:4.53.3": - version: 4.53.3 - resolution: "@rollup/rollup-win32-arm64-msvc@npm:4.53.3" +"@rollup/rollup-win32-arm64-msvc@npm:4.60.1": + version: 4.60.1 + resolution: "@rollup/rollup-win32-arm64-msvc@npm:4.60.1" conditions: os=win32 & cpu=arm64 languageName: node linkType: hard -"@rollup/rollup-win32-ia32-msvc@npm:4.53.3": - version: 4.53.3 - resolution: "@rollup/rollup-win32-ia32-msvc@npm:4.53.3" +"@rollup/rollup-win32-ia32-msvc@npm:4.60.1": + version: 4.60.1 + resolution: "@rollup/rollup-win32-ia32-msvc@npm:4.60.1" conditions: os=win32 & cpu=ia32 languageName: node linkType: hard -"@rollup/rollup-win32-x64-gnu@npm:4.53.3": - version: 4.53.3 - resolution: "@rollup/rollup-win32-x64-gnu@npm:4.53.3" +"@rollup/rollup-win32-x64-gnu@npm:4.60.1": + version: 4.60.1 + resolution: "@rollup/rollup-win32-x64-gnu@npm:4.60.1" conditions: os=win32 & cpu=x64 languageName: node linkType: hard -"@rollup/rollup-win32-x64-msvc@npm:4.53.3": - version: 4.53.3 - resolution: "@rollup/rollup-win32-x64-msvc@npm:4.53.3" +"@rollup/rollup-win32-x64-msvc@npm:4.60.1": + version: 4.60.1 + resolution: "@rollup/rollup-win32-x64-msvc@npm:4.60.1" conditions: os=win32 & cpu=x64 languageName: node linkType: hard @@ -21191,16 +21211,6 @@ __metadata: languageName: node linkType: hard -"@types/glob@npm:^8.0.0": - version: 8.1.0 - resolution: "@types/glob@npm:8.1.0" - dependencies: - "@types/minimatch": "npm:^5.1.2" - "@types/node": "npm:*" - checksum: 10/9101f3a9061e40137190f70626aa0e202369b5ec4012c3fabe6f5d229cce04772db9a94fa5a0eb39655e2e4ad105c38afbb4af56a56c0996a8c7d4fc72350e3d - languageName: node - linkType: hard - "@types/global-agent@npm:^2.1.3": version: 2.1.3 resolution: "@types/global-agent@npm:2.1.3" @@ -21600,13 +21610,6 @@ __metadata: languageName: node linkType: hard -"@types/minimatch@npm:^5.1.2": - version: 5.1.2 - resolution: "@types/minimatch@npm:5.1.2" - checksum: 10/94db5060d20df2b80d77b74dd384df3115f01889b5b6c40fa2dfa27cfc03a68fb0ff7c1f2a0366070263eb2e9d6bfd8c87111d4bc3ae93c3f291297c1bf56c85 - languageName: node - linkType: hard - "@types/minimist@npm:^1.2.5": version: 1.2.5 resolution: "@types/minimist@npm:1.2.5" @@ -31583,7 +31586,7 @@ __metadata: languageName: node linkType: hard -"foreground-child@npm:^3.1.0, foreground-child@npm:^3.3.1": +"foreground-child@npm:^3.1.0": version: 3.3.1 resolution: "foreground-child@npm:3.3.1" dependencies: @@ -32416,22 +32419,6 @@ __metadata: languageName: node linkType: hard -"glob@npm:^11.0.1": - version: 11.1.0 - resolution: "glob@npm:11.1.0" - dependencies: - foreground-child: "npm:^3.3.1" - jackspeak: "npm:^4.1.1" - minimatch: "npm:^10.1.1" - minipass: "npm:^7.1.2" - package-json-from-dist: "npm:^1.0.0" - path-scurry: "npm:^2.0.0" - bin: - glob: dist/esm/bin.mjs - checksum: 10/da4501819633daff8822c007bb3f93d5c4d2cbc7b15a8e886660f4497dd251a1fb4f53a85fba1e760b31704eff7164aeb2c7a82db10f9f2c362d12c02fe52cf3 - languageName: node - linkType: hard - "glob@npm:^7.1.3, glob@npm:^7.1.4, glob@npm:^7.1.6, glob@npm:^7.1.7, glob@npm:^7.2.3": version: 7.2.3 resolution: "glob@npm:7.2.3" @@ -32446,7 +32433,7 @@ __metadata: languageName: node linkType: hard -"glob@npm:^8.0.1, glob@npm:^8.0.3, glob@npm:^8.1.0": +"glob@npm:^8.0.1, glob@npm:^8.1.0": version: 8.1.0 resolution: "glob@npm:8.1.0" dependencies: @@ -35186,7 +35173,7 @@ __metadata: languageName: node linkType: hard -"jackspeak@npm:^4.1.1, jackspeak@npm:^4.2.3": +"jackspeak@npm:^4.2.3": version: 4.2.3 resolution: "jackspeak@npm:4.2.3" dependencies: @@ -38701,7 +38688,7 @@ __metadata: languageName: node linkType: hard -"minimatch@npm:^10.0.0, minimatch@npm:^10.1.1, minimatch@npm:^10.2.1, minimatch@npm:^10.2.2, minimatch@npm:^10.2.4": +"minimatch@npm:^10.0.0, minimatch@npm:^10.2.1, minimatch@npm:^10.2.2, minimatch@npm:^10.2.4": version: 10.2.4 resolution: "minimatch@npm:10.2.4" dependencies: @@ -41385,7 +41372,7 @@ __metadata: languageName: node linkType: hard -"path-scurry@npm:^2.0.0, path-scurry@npm:^2.0.2": +"path-scurry@npm:^2.0.2": version: 2.0.2 resolution: "path-scurry@npm:2.0.2" dependencies: @@ -45017,32 +45004,35 @@ __metadata: languageName: node linkType: hard -"rollup@npm:^4.27.3, rollup@npm:^4.43.0": - version: 4.53.3 - resolution: "rollup@npm:4.53.3" +"rollup@npm:^4.43.0, rollup@npm:^4.59.0": + version: 4.60.1 + resolution: "rollup@npm:4.60.1" dependencies: - "@rollup/rollup-android-arm-eabi": "npm:4.53.3" - "@rollup/rollup-android-arm64": "npm:4.53.3" - "@rollup/rollup-darwin-arm64": "npm:4.53.3" - "@rollup/rollup-darwin-x64": "npm:4.53.3" - "@rollup/rollup-freebsd-arm64": "npm:4.53.3" - "@rollup/rollup-freebsd-x64": "npm:4.53.3" - "@rollup/rollup-linux-arm-gnueabihf": "npm:4.53.3" - "@rollup/rollup-linux-arm-musleabihf": "npm:4.53.3" - "@rollup/rollup-linux-arm64-gnu": "npm:4.53.3" - "@rollup/rollup-linux-arm64-musl": "npm:4.53.3" - "@rollup/rollup-linux-loong64-gnu": "npm:4.53.3" - "@rollup/rollup-linux-ppc64-gnu": "npm:4.53.3" - "@rollup/rollup-linux-riscv64-gnu": "npm:4.53.3" - "@rollup/rollup-linux-riscv64-musl": "npm:4.53.3" - "@rollup/rollup-linux-s390x-gnu": "npm:4.53.3" - "@rollup/rollup-linux-x64-gnu": "npm:4.53.3" - "@rollup/rollup-linux-x64-musl": "npm:4.53.3" - "@rollup/rollup-openharmony-arm64": "npm:4.53.3" - "@rollup/rollup-win32-arm64-msvc": "npm:4.53.3" - "@rollup/rollup-win32-ia32-msvc": "npm:4.53.3" - "@rollup/rollup-win32-x64-gnu": "npm:4.53.3" - "@rollup/rollup-win32-x64-msvc": "npm:4.53.3" + "@rollup/rollup-android-arm-eabi": "npm:4.60.1" + "@rollup/rollup-android-arm64": "npm:4.60.1" + "@rollup/rollup-darwin-arm64": "npm:4.60.1" + "@rollup/rollup-darwin-x64": "npm:4.60.1" + "@rollup/rollup-freebsd-arm64": "npm:4.60.1" + "@rollup/rollup-freebsd-x64": "npm:4.60.1" + "@rollup/rollup-linux-arm-gnueabihf": "npm:4.60.1" + "@rollup/rollup-linux-arm-musleabihf": "npm:4.60.1" + "@rollup/rollup-linux-arm64-gnu": "npm:4.60.1" + "@rollup/rollup-linux-arm64-musl": "npm:4.60.1" + "@rollup/rollup-linux-loong64-gnu": "npm:4.60.1" + "@rollup/rollup-linux-loong64-musl": "npm:4.60.1" + "@rollup/rollup-linux-ppc64-gnu": "npm:4.60.1" + "@rollup/rollup-linux-ppc64-musl": "npm:4.60.1" + "@rollup/rollup-linux-riscv64-gnu": "npm:4.60.1" + "@rollup/rollup-linux-riscv64-musl": "npm:4.60.1" + "@rollup/rollup-linux-s390x-gnu": "npm:4.60.1" + "@rollup/rollup-linux-x64-gnu": "npm:4.60.1" + "@rollup/rollup-linux-x64-musl": "npm:4.60.1" + "@rollup/rollup-openbsd-x64": "npm:4.60.1" + "@rollup/rollup-openharmony-arm64": "npm:4.60.1" + "@rollup/rollup-win32-arm64-msvc": "npm:4.60.1" + "@rollup/rollup-win32-ia32-msvc": "npm:4.60.1" + "@rollup/rollup-win32-x64-gnu": "npm:4.60.1" + "@rollup/rollup-win32-x64-msvc": "npm:4.60.1" "@types/estree": "npm:1.0.8" fsevents: "npm:~2.3.2" dependenciesMeta: @@ -45068,8 +45058,12 @@ __metadata: optional: true "@rollup/rollup-linux-loong64-gnu": optional: true + "@rollup/rollup-linux-loong64-musl": + optional: true "@rollup/rollup-linux-ppc64-gnu": optional: true + "@rollup/rollup-linux-ppc64-musl": + optional: true "@rollup/rollup-linux-riscv64-gnu": optional: true "@rollup/rollup-linux-riscv64-musl": @@ -45080,6 +45074,8 @@ __metadata: optional: true "@rollup/rollup-linux-x64-musl": optional: true + "@rollup/rollup-openbsd-x64": + optional: true "@rollup/rollup-openharmony-arm64": optional: true "@rollup/rollup-win32-arm64-msvc": @@ -45094,7 +45090,7 @@ __metadata: optional: true bin: rollup: dist/bin/rollup - checksum: 10/e2eff82405061fa907f15dfbf742b1f5fb4b214495c00989bcdbe21da5fcb3f6dec3deabacec491300a53c99da409586cfc77bdf29b411fccb9089b72cd3728d + checksum: 10/6866a35efc999990e191fc954a859ba802d13be63ca13b04746459455982f6b8784d92e5eea8db3ef8acf8baba8c43e8e6cb741f3233ba4c46adf148d3708a9c languageName: node linkType: hard From b6c0ef5d5da814359f91d487d41978e0537256fa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fredrik=20Adel=C3=B6w?= Date: Tue, 31 Mar 2026 15:20:56 +0200 Subject: [PATCH 2/2] Add windowsPathsNoEscape to glob calls that may receive backslash paths MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Glob v13 treats backslashes as escape characters by default, unlike v7 which treated them as path separators on Windows. This broke Windows CI where path.join/resolve produce backslash paths. Co-Authored-By: Claude Opus 4.6 (1M context) Signed-off-by: Fredrik Adelöw --- .../src/commands/package/start/startPackage.ts | 5 ++++- packages/cli-module-test-jest/config/jest.js | 4 +++- packages/repo-tools/src/commands/package-docs/command.ts | 1 + .../catalog-backend/src/processors/FileReaderProcessor.ts | 4 +++- 4 files changed, 11 insertions(+), 3 deletions(-) diff --git a/packages/cli-module-build/src/commands/package/start/startPackage.ts b/packages/cli-module-build/src/commands/package/start/startPackage.ts index e0ab13facc..628034a6d8 100644 --- a/packages/cli-module-build/src/commands/package/start/startPackage.ts +++ b/packages/cli-module-build/src/commands/package/start/startPackage.ts @@ -25,7 +25,10 @@ export function resolveEntryPath( targetDir: string, ): string { const { dir: entryDir, name: entryName } = parse(entrypoint); - const [entryFile] = glob.sync(`${resolve(targetDir, entryDir, entryName)}.*`); + const [entryFile] = glob.sync( + `${resolve(targetDir, entryDir, entryName)}.*`, + { windowsPathsNoEscape: true }, + ); if (entryFile) { return join(entryDir, entryName); } diff --git a/packages/cli-module-test-jest/config/jest.js b/packages/cli-module-test-jest/config/jest.js index 52ccf989c4..7697fbb6d7 100644 --- a/packages/cli-module-test-jest/config/jest.js +++ b/packages/cli-module-test-jest/config/jest.js @@ -367,7 +367,9 @@ async function getRootConfig() { // workspace and load those in as separate jest projects instead. const projectPaths = await Promise.all( workspacePatterns.map(pattern => - glob(path.join(paths.targetRoot, pattern)), + glob(path.join(paths.targetRoot, pattern), { + windowsPathsNoEscape: true, + }), ), ).then(_ => _.flat()); diff --git a/packages/repo-tools/src/commands/package-docs/command.ts b/packages/repo-tools/src/commands/package-docs/command.ts index 3e635b34f4..777f0f5883 100644 --- a/packages/repo-tools/src/commands/package-docs/command.ts +++ b/packages/repo-tools/src/commands/package-docs/command.ts @@ -119,6 +119,7 @@ export default async function packageDocs(paths: string[] = [], opts: any) { const existingDocsJsonPaths = glob.sync( targetPaths.resolveRoot('dist-types/**/docs.json'), + { windowsPathsNoEscape: true }, ); if (existingDocsJsonPaths.length > 0) { console.warn( diff --git a/plugins/catalog-backend/src/processors/FileReaderProcessor.ts b/plugins/catalog-backend/src/processors/FileReaderProcessor.ts index 12648aa96d..5658b8e0d0 100644 --- a/plugins/catalog-backend/src/processors/FileReaderProcessor.ts +++ b/plugins/catalog-backend/src/processors/FileReaderProcessor.ts @@ -44,7 +44,9 @@ export class FileReaderProcessor implements CatalogProcessor { } try { - const fileMatches = await glob(location.target); + const fileMatches = await glob(location.target, { + windowsPathsNoEscape: true, + }); if (fileMatches.length > 0) { for (const fileMatch of fileMatches) {