Merge pull request #33687 from backstage/freben/bump-glob-rollup

Bump glob to v13 and rollup to v4.59+ to fix security vulnerabilities

plugins/catalog-backend/package.json

@@ -85,7 +85,7 @@
     "fast-json-stable-stringify": "^2.1.0",
     "fs-extra": "^11.2.0",
     "git-url-parse": "^15.0.0",
-    "glob": "^7.1.6",
+    "glob": "^13.0.0",
     "knex": "^3.0.0",
     "lodash": "^4.17.21",
     "luxon": "^3.0.0",
@@ -107,7 +107,6 @@
     "@types/core-js": "^2.5.4",
     "@types/express": "^4.17.6",
     "@types/git-url-parse": "^9.0.0",
-    "@types/glob": "^8.0.0",
     "@types/lodash": "^4.14.151",
     "@types/supertest": "^2.0.8",
     "better-sqlite3": "^12.0.0",

plugins/catalog-backend/src/processors/FileReaderProcessor.ts

@@ -15,9 +15,8 @@
  */
 
 import fs from 'fs-extra';
-import g from 'glob';
+import { glob } from 'glob';
 import path from 'node:path';
-import { promisify } from 'node:util';
 import { LocationSpec } from '@backstage/plugin-catalog-common';
 import {
   CatalogProcessor,
@@ -26,8 +25,6 @@ import {
   processingResult,
 } from '@backstage/plugin-catalog-node';
 
-const glob = promisify(g);
-
 const LOCATION_TYPE = 'file';
 
 /** @public */
@@ -47,7 +44,9 @@ export class FileReaderProcessor implements CatalogProcessor {
     }
 
     try {
-      const fileMatches = await glob(location.target);
+      const fileMatches = await glob(location.target, {
+        windowsPathsNoEscape: true,
+      });
 
       if (fileMatches.length > 0) {
         for (const fileMatch of fileMatches) {