From 5e1016583982df6d8fb1064ea458870c513a1b75 Mon Sep 17 00:00:00 2001
From: Raghunandan Balachandran <raghunandan@spotify.com>
Date: Fri, 20 Feb 2026 10:48:29 +0100
Subject: [PATCH 1/2] cli: bump bfj dependency from ^8.0.0 to ^9.0.2

The only usage of bfj in @backstage/cli is `bfj.write(path, data)` in
bundle.ts for writing bundle-stats.json. The write API is unchanged in
v9 and v9.0.0/v9.0.1 are deprecated, so the range starts at ^9.0.2.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Raghunandan Balachandran <raghunandan@spotify.com>
---
 packages/cli/package.json |  2 +-
 yarn.lock                 | 49 ++++-----------------------------------
 2 files changed, 6 insertions(+), 45 deletions(-)

diff --git a/packages/cli/package.json b/packages/cli/package.json
index a089dadedd..4372ded7db 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -79,7 +79,7 @@
     "@typescript-eslint/parser": "^8.16.0",
     "@yarnpkg/lockfile": "^1.1.0",
     "@yarnpkg/parsers": "^3.0.0",
-    "bfj": "^8.0.0",
+    "bfj": "^9.0.2",
     "buffer": "^6.0.3",
     "chalk": "^4.0.0",
     "chokidar": "^3.3.1",
diff --git a/yarn.lock b/yarn.lock
index cc9278c94f..31857afc56 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -3348,7 +3348,7 @@ __metadata:
     "@typescript-eslint/parser": "npm:^8.16.0"
     "@yarnpkg/lockfile": "npm:^1.1.0"
     "@yarnpkg/parsers": "npm:^3.0.0"
-    bfj: "npm:^8.0.0"
+    bfj: "npm:^9.0.2"
     buffer: "npm:^6.0.3"
     chalk: "npm:^4.0.0"
     chokidar: "npm:^3.3.1"
@@ -26043,16 +26043,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"bfj@npm:^8.0.0":
-  version: 8.0.0
-  resolution: "bfj@npm:8.0.0"
+"bfj@npm:^9.0.2":
+  version: 9.1.3
+  resolution: "bfj@npm:9.1.3"
   dependencies:
-    bluebird: "npm:^3.7.2"
     check-types: "npm:^11.2.3"
     hoopy: "npm:^0.1.4"
-    jsonpath: "npm:^1.1.1"
     tryer: "npm:^1.0.1"
-  checksum: 10/3e79233e2ba30681a494470d664c654351d2f4fcba7c2972f7e8b6248e374a77a164141164ea32d23f805f0a235aa87dbf480ad0a5939c36f5efbf922de8beb4
+  checksum: 10/33119ebc5237345f0032d6d5b1543306298022711891eb28bd7e592663c3a027dec2f561beebd491e6c2f3779883bcaae91df4d958920776e1db9659399e1b8e
   languageName: node
   linkType: hard
 
@@ -30898,16 +30896,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"esprima@npm:1.2.5":
-  version: 1.2.5
-  resolution: "esprima@npm:1.2.5"
-  bin:
-    esparse: ./bin/esparse.js
-    esvalidate: ./bin/esvalidate.js
-  checksum: 10/839aad5916d05d3a82ccf3adaf67c2b5df69278fd7168347346e7af298dc7fbfbfd7bc5e27e38031a584d50d28e37da35d711b2f5d5376794f84b1bd8e559665
-  languageName: node
-  linkType: hard
-
 "esprima@npm:^4.0.0, esprima@npm:^4.0.1, esprima@npm:~4.0.0":
   version: 4.0.1
   resolution: "esprima@npm:4.0.1"
@@ -36888,17 +36876,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"jsonpath@npm:^1.1.1":
-  version: 1.2.1
-  resolution: "jsonpath@npm:1.2.1"
-  dependencies:
-    esprima: "npm:1.2.5"
-    static-eval: "npm:2.1.1"
-    underscore: "npm:1.13.6"
-  checksum: 10/6ef7ffd94a74448ad6f87c3208b9ced092dee7cd66a3b144c97642117354922d7233e885afe4b5d56f9b5a6dff742faec8c9a7c5a7a1b47f61ebfb198ca9a01b
-  languageName: node
-  linkType: hard
-
 "jsonpointer@npm:^5.0.0, jsonpointer@npm:^5.0.1":
   version: 5.0.1
   resolution: "jsonpointer@npm:5.0.1"
@@ -47307,15 +47284,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"static-eval@npm:2.1.1":
-  version: 2.1.1
-  resolution: "static-eval@npm:2.1.1"
-  dependencies:
-    escodegen: "npm:^2.1.0"
-  checksum: 10/b47e8238014745ea457f2dc9e14130298ce5dbec142a5c93a943f338fe1b47d03086d1897114e15d8603a9a7a39fed95bb49ccd3fa95dfc1550952eca0688417
-  languageName: node
-  linkType: hard
-
 "statuses@npm:2.0.1":
   version: 2.0.1
   resolution: "statuses@npm:2.0.1"
@@ -49575,13 +49543,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"underscore@npm:1.13.6":
-  version: 1.13.6
-  resolution: "underscore@npm:1.13.6"
-  checksum: 10/58cf5dc42cb0ac99c146ae4064792c0a2cc84f3a3c4ad88f5082e79057dfdff3371d896d1ec20379e9ece2450d94fa78f2ef5bfefc199ba320653e32c009bd66
-  languageName: node
-  linkType: hard
-
 "underscore@npm:^1.12.1, underscore@npm:^1.13.3":
   version: 1.13.7
   resolution: "underscore@npm:1.13.7"

From 246877ae6c17cafe4117075a19285fe45c27640f Mon Sep 17 00:00:00 2001
From: Raghunandan Balachandran <raghunandan@spotify.com>
Date: Fri, 20 Feb 2026 11:18:57 +0100
Subject: [PATCH 2/2] Add changeset for bfj bump

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Raghunandan Balachandran <raghunandan@spotify.com>
---
 .changeset/bump-bfj-v9.md | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 .changeset/bump-bfj-v9.md

diff --git a/.changeset/bump-bfj-v9.md b/.changeset/bump-bfj-v9.md
new file mode 100644
index 0000000000..63309e4657
--- /dev/null
+++ b/.changeset/bump-bfj-v9.md
@@ -0,0 +1,5 @@
+---
+'@backstage/cli': patch
+---
+
+Updated dependency `bfj` to `^9.0.2`.