Addresses the high severity rollup path traversal vulnerability
(GHSA-mw96-cpmx-2vgc) and the glob security advisory by upgrading
all instances across the monorepo. Updates code that used the legacy
callback-based glob API to use the modern promise/sync API.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Addresses the high severity rollup path traversal vulnerability
(GHSA-mw96-cpmx-2vgc) and the glob security advisory by upgrading
all instances across the monorepo. Updates code that used the legacy
callback-based glob API to use the modern promise/sync API.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Addresses the high severity rollup path traversal vulnerability
(GHSA-mw96-cpmx-2vgc) and the glob security advisory by upgrading
all instances across the monorepo. Updates code that used the legacy
callback-based glob API to use the modern promise/sync API.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
When the transform tests were moved from @backstage/cli to
@backstage/cli-module-build, the coveragePathIgnorePatterns config
was not carried over. This caused test failures in CI when running
with --coverage, as Jest tried to instrument the fixture files
containing fake node_modules packages.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
- Use cli-defaults instead of listing individual CLI modules in
create-app template and root package.json
- Move nodeTransform config files from cli-module-build to cli-node
to avoid cross-module direct imports
- Rename cli-module-create-github-app to cli-module-github
- Start createCliModule init chain with Promise.resolve()
- Deduplicate exitWithError in runCliModule.ts
- Extract shared isCommandNodeHidden to @internal/cli
- Add explanatory comment for fromArray deduplication field
- Restore error for cli role packages missing bin in runCliExtraction
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Rename all bin entries from `cli-module-*` to `backstage-cli-module-*`
to establish a clear namespace for Backstage CLI tooling.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Move jest config files to cli-module-test-jest/config and node
transform + webpack-public-path to cli-module-build/config. Replace
originals in @backstage/cli/config with lazy proxies that forward
to the appropriate module or throw if it is not installed.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Move serve_index.html to cli-module-build/templates and use
findOwnPaths instead of require.resolve for safer path resolution.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Align dependency versions in CLI modules to match the original CLI
package versions. Move dependencies that are only used by modules out
of the main CLI package, and add missing dependencies to the modules
that actually use them. Revert import-to-require conversions in
cli-module-build that were incorrectly introduced during the split.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
- Move runtime dependencies from devDependencies to dependencies in
cli-module-build, cli-module-auth, cli-module-migrate, cli-module-new,
cli-module-test-jest, and cli-module-translations
- Fix relative package.json paths in cli-module-build
- Downgrade rollup in cli-module-build to ^4.27.3 to match the CLI
- Downgrade eslint-webpack-plugin to ^4.2.0 to prevent @types/eslint v9
- Add CLI module packages to create-app version helper
- Add allow-warnings for CLI module packages in API reports
- Generate API report files for all CLI module packages
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Downgrade rollup from ^4.59.0 to ^4.27.3 to match the main CLI package
and avoid the dedupe upgrading all rollup instances to 4.59.0, which
breaks API report generation.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Downgrade eslint-webpack-plugin in cli-module-build from ^5.0.3 to
^4.2.0 to match the main CLI package, preventing @types/eslint from
being resolved to v9 which breaks the eslint-plugin TypeScript checks.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Each CLI module package now includes a bin script and cli.ts entry
point, allowing modules to be executed directly via npx without
being wired into the main @backstage/cli package.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
github-actions[bot]