Merge pull request #33687 from backstage/freben/bump-glob-rollup

Bump glob to v13 and rollup to v4.59+ to fix security vulnerabilities

packages/cli-module-auth/package.json

@@ -37,7 +37,7 @@
     "@backstage/errors": "workspace:^",
     "cleye": "^2.3.0",
     "fs-extra": "^11.2.0",
-    "glob": "^7.1.7",
+    "glob": "^13.0.0",
     "inquirer": "^8.2.0",
     "proper-lockfile": "^4.1.2",
     "yaml": "^2.0.0",

packages/cli-module-auth/src/commands/login.ts

@@ -31,7 +31,7 @@ import { getSecretStore, getAuthInstanceService } from '@internal/cli';
 import crypto from 'node:crypto';
 import fs from 'fs-extra';
 import path from 'node:path';
-import glob from 'glob';
+import { globSync } from 'glob';
 import YAML from 'yaml';
 import inquirer from 'inquirer';
 
@@ -178,7 +178,7 @@ async function pickBaseUrl() {
     'packages/*/app-config.yaml',
     'packages/*/app-config.*.yaml',
   ];
-  const files = patterns.flatMap(p => glob.sync(p, { cwd, nodir: true }));
+  const files = patterns.flatMap(p => globSync(p, { cwd, nodir: true }));
   for (const file of files) {
     try {
       const content = await fs.readFile(path.resolve(cwd, file), 'utf8');

packages/cli-module-build/package.json

@@ -70,7 +70,7 @@
     "eslint-webpack-plugin": "^4.2.0",
     "fork-ts-checker-webpack-plugin": "^9.0.0",
     "fs-extra": "^11.2.0",
-    "glob": "^7.1.7",
+    "glob": "^13.0.0",
     "html-webpack-plugin": "^5.6.3",
     "lodash": "^4.17.21",
     "mini-css-extract-plugin": "^2.4.2",
@@ -83,7 +83,7 @@
     "raw-loader": "^4.0.2",
     "react-dev-utils": "^12.0.0-next.60",
     "react-refresh": "^0.18.0",
-    "rollup": "^4.27.3",
+    "rollup": "^4.59.0",
     "rollup-plugin-dts": "^6.1.0",
     "rollup-plugin-esbuild": "^6.1.1",
     "rollup-plugin-postcss": "^4.0.0",

packages/cli-module-build/src/commands/package/start/startPackage.ts

@@ -25,7 +25,10 @@ export function resolveEntryPath(
   targetDir: string,
 ): string {
   const { dir: entryDir, name: entryName } = parse(entrypoint);
-  const [entryFile] = glob.sync(`${resolve(targetDir, entryDir, entryName)}.*`);
+  const [entryFile] = glob.sync(
+    `${resolve(targetDir, entryDir, entryName)}.*`,
+    { windowsPathsNoEscape: true },
+  );
   if (entryFile) {
     return join(entryDir, entryName);
   }

packages/cli-module-test-jest/config/jest.js

@@ -17,7 +17,7 @@
 const fs = require('fs-extra');
 const path = require('node:path');
 const crypto = require('node:crypto');
-const glob = require('node:util').promisify(require('glob'));
+const { glob } = require('glob');
 const { version } = require('../package.json');
 const paths = require('@backstage/cli-common').findPaths(process.cwd());
 const {
@@ -367,7 +367,9 @@ async function getRootConfig() {
   // workspace and load those in as separate jest projects instead.
   const projectPaths = await Promise.all(
     workspacePatterns.map(pattern =>
-      glob(path.join(paths.targetRoot, pattern)),
+      glob(path.join(paths.targetRoot, pattern), {
+        windowsPathsNoEscape: true,
+      }),
     ),
   ).then(_ => _.flat());
 

packages/cli-module-test-jest/package.json

@@ -40,7 +40,7 @@
     "cleye": "^2.3.0",
     "cross-fetch": "^4.0.0",
     "fs-extra": "^11.2.0",
-    "glob": "^7.1.7",
+    "glob": "^13.0.0",
     "jest-css-modules": "^2.1.0",
     "sucrase": "^3.20.2",
     "yargs": "^16.2.0"

packages/cli/package.json

@@ -71,7 +71,7 @@
     "eslint-plugin-react-hooks": "^5.0.0",
     "eslint-plugin-unused-imports": "^4.1.4",
     "fs-extra": "^11.2.0",
-    "glob": "^7.1.7",
+    "glob": "^13.0.0",
     "jest-css-modules": "^2.1.0",
     "pirates": "^4.0.6",
     "postcss": "^8.1.0",

packages/repo-tools/package.json

@@ -69,7 +69,7 @@
     "command-exists": "^1.2.9",
     "commander": "^14.0.3",
     "fs-extra": "^11.2.0",
-    "glob": "^8.0.3",
+    "glob": "^13.0.0",
     "globby": "^11.0.0",
     "is-glob": "^4.0.3",
     "js-yaml": "^4.1.0",

packages/repo-tools/src/commands/package-docs/command.ts

@@ -119,6 +119,7 @@ export default async function packageDocs(paths: string[] = [], opts: any) {
 
   const existingDocsJsonPaths = glob.sync(
     targetPaths.resolveRoot('dist-types/**/docs.json'),
+    { windowsPathsNoEscape: true },
   );
   if (existingDocsJsonPaths.length > 0) {
     console.warn(

packages/ui/package.json

@@ -64,7 +64,7 @@
     "@types/react-dom": "^18.0.0",
     "@types/use-sync-external-store": "^1.0.0",
     "eslint-plugin-storybook": "^10.3.3",
-    "glob": "^11.0.1",
+    "glob": "^13.0.0",
     "globals": "^17.0.0",
     "react": "^18.0.2",
     "react-dom": "^18.0.2",