30.4.0 introduced synchronous require(ESM) that requires Node v24.9+,
breaking tests on Node 22. 30.3.0 pulls in @sinonjs/fake-timers@^15
which conflicts with @types/sinon@^17 (used by aws-sdk-client-mock).
30.2.0 avoids both issues cleanly.
Resets lockfile to a clean base-install from master constraints.
Signed-off-by: Fredrik Adelöw <freben@gmail.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Keep the monorepo's own jest resolution consistent with the template
range, and update the lockfile to 30.3.0 accordingly.
Co-authored-by: Cursor <cursoragent@cursor.com>
Signed-off-by: Fredrik Adelöw <freben@gmail.com>
Several packages had the same dependency listed in both `dependencies`
and `devDependencies`. This removes the duplicate from whichever section
is incorrect based on actual usage in the source code.
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Made-with: Cursor
The `isDev` export in `packages/cli/src/wiring/version.ts` was never
imported anywhere. Remove it to reduce dead code.
Made-with: Cursor
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Add a `toError` utility function to `@backstage/errors` that converts
unknown values to `ErrorLike` objects. If the value is already error-like
it is returned as-is. Strings are used directly as the error message, and
other values are stringified with a fallback to JSON.stringify to avoid
unhelpful `[object Object]` messages.
Non-error causes passed to `CustomErrorBase` are now converted and stored
using `toError` rather than discarded. Existing `assertError` call sites
across the codebase are migrated to `toError`.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Addresses the high severity rollup path traversal vulnerability
(GHSA-mw96-cpmx-2vgc) and the glob security advisory by upgrading
all instances across the monorepo. Updates code that used the legacy
callback-based glob API to use the modern promise/sync API.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Addresses the high severity rollup path traversal vulnerability
(GHSA-mw96-cpmx-2vgc) and the glob security advisory by upgrading
all instances across the monorepo. Updates code that used the legacy
callback-based glob API to use the modern promise/sync API.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Addresses the high severity rollup path traversal vulnerability
(GHSA-mw96-cpmx-2vgc) and the glob security advisory by upgrading
all instances across the monorepo. Updates code that used the legacy
callback-based glob API to use the modern promise/sync API.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Add `DOM.AsyncIterable` to the shared TypeScript configuration in
`@backstage/cli`, making standard async iteration methods available on
DOM APIs like `FileSystemDirectoryHandle`. This aligns behavior with
TypeScript 6.0, where this lib is included in `DOM` by default.
With the async iterable types now available, replace the custom
`IterableDirectoryHandle` and `WritableFileHandle` types in the scaffolder
plugin with the standard `FileSystemDirectoryHandle` and
`FileSystemFileHandle` DOM types. Add type guard functions for
`FileSystemHandle` since it is not a discriminated union.
Signed-off-by: Jon Koops <jonkoops@gmail.com>
The __fixtures__ directory that required this exclusion was moved to
@backstage/cli-module-build.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
The built-in templates used by `yarn new` are moved from `packages/cli/templates/`
to `packages/cli-module-new/templates/`, colocating them with the code that
consumes them.
A backwards compatibility rewrite in the template resolution ensures that
existing `@backstage/cli/templates/*` references in root `package.json`
configurations continue to work by transparently resolving them to
`@backstage/cli-module-new/templates/*`.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Add a new `cli-module` template to the Backstage CLI that scaffolds
CLI module packages. This includes adding the `cli-module` role to the
template system, with proper naming conventions and prompts.
The generated package includes:
- A bin entry point for standalone execution
- An index.ts with createCliModule setup
- An example command using cleye
- Standard package.json with cli-module role
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Fix argument parsing bugs in the execute command where actionId at index 0
was incorrectly skipped when --instance was absent, and flag values matching
the actionId string were erroneously removed. Add --help support to the
execute command for CLI report generation. Add missing bin script and
cli-report.md for cli-module-actions. Add resolveAuth tests. Bump
backend-defaults changeset to minor for the security-relevant auth change.
Replace cross-fetch with native fetch in cli-module-auth to avoid punycode
deprecation warnings during CLI report generation.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Update the new frontend plugin template to use createDevApp in its dev entry point and teach cli-module-new to resolve frontend-dev-utils versions for generated packages.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
- Use cli-defaults instead of listing individual CLI modules in
create-app template and root package.json
- Move nodeTransform config files from cli-module-build to cli-node
to avoid cross-module direct imports
- Rename cli-module-create-github-app to cli-module-github
- Start createCliModule init chain with Promise.resolve()
- Deduplicate exitWithError in runCliModule.ts
- Extract shared isCommandNodeHidden to @internal/cli
- Add explanatory comment for fromArray deduplication field
- Restore error for cli role packages missing bin in runCliExtraction
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Move jest config files to cli-module-test-jest/config and node
transform + webpack-public-path to cli-module-build/config. Replace
originals in @backstage/cli/config with lazy proxies that forward
to the appropriate module or throw if it is not installed.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Individual CLI modules now silently take precedence over array-sourced
modules (e.g. from cli-defaults) when their commands overlap. Conflict
errors between non-array modules include both package names for easier
debugging.
Commands reference their parent module instead of storing a raw package
name string. createCliModule now validates that packageJson has a name.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Introduces a new `@backstage/cli-defaults` package that re-exports all
standard CLI modules as a single array, simplifying dependency management
for consumers. The CLI's `CliInitializer` is updated to support array
exports alongside single module exports. The create-app template,
changesets, and CLI fallback are updated to use `@backstage/cli-defaults`
instead of listing 11 individual modules.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
On Windows, require.resolve() returns paths like D:\...\index.cjs.js
which when passed to import() causes ERR_UNSUPPORTED_ESM_URL_SCHEME
because the D: prefix is interpreted as a URL protocol. Use
pathToFileURL() to produce proper file:// URLs.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
The CLI provides tsconfig presets that include webpack-env in the
types array, so @types/webpack-env must remain a dependency of the
CLI package for consuming apps to compile correctly.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Align dependency versions in CLI modules to match the original CLI
package versions. Move dependencies that are only used by modules out
of the main CLI package, and add missing dependencies to the modules
that actually use them. Revert import-to-require conversions in
cli-module-build that were incorrectly introduced during the split.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Resolve CLI module entry points relative to the target project root
rather than relying on bare module name resolution. This ensures modules
are found even when the CLI package is symlinked from a separate location,
such as in the E2E test workspace setup.
Also add the missing cli-module-* entries to the create-app tasks test
mock that were omitted in a previous commit.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
The CLI now scans the project root's dependencies and devDependencies
for packages with the cli-module role, loading them automatically.
Falls back to the built-in set with a deprecation warning when no
modules are found. Updated create-app templates and the monorepo root
to include all CLI modules as explicit devDependencies.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Rename createCliPlugin to createCliModule, CliPlugin to CliModule, and
the cli-plugin package role to cli-module to better distinguish CLI
modules from other plugin types.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Move createCliPlugin and related types from the standalone
@backstage/cli-plugin-api package into @backstage/cli-node and
remove the now-empty package.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Switch CommandGraph and CliInitializer to use OpaqueCommandTreeNode and
OpaqueCommandLeafNode from @internal/cli instead of raw $$type markers.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Add thorough TSDoc comments to createCliPlugin, BackstageCommand,
CommandContext, and CliPlugin. Remove the CliFeature type alias in
favor of using CliPlugin directly.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Replace pluginId with packageJson input for createCliPlugin, remove
CommandExecuteFn type alias by inlining it, and rename
CommandContext.info.description to info.name.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
github-actions[bot]