13075 Commits

Author SHA1 Message Date
Fredrik Adelöw 9ed2f68261 Merge pull request #34163 from backstage/dependabot/npm_and_yarn/fast-uri-3.1.2
chore(deps): Bump fast-uri from 3.0.1 to 3.1.2
2026-05-13 13:15:07 +02:00
renovate[bot] 4d190cd91b chore(deps): update dependency copy-to-clipboard to v3.3.3
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-05-13 07:23:58 +00:00
renovate[bot] 50879e3e8e chore(deps): update dependency @types/estree to v1.0.9
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-05-13 06:03:44 +00:00
renovate[bot] 9b12ba8b41 chore(deps): update dependency @stoplight/spectral-runtime to v1.1.5
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-05-13 04:44:39 +00:00
dependabot[bot] 75e0a10c3b chore(deps): Bump fast-uri from 3.0.1 to 3.1.2
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.0.1 to 3.1.2.
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](https://github.com/fastify/fast-uri/compare/v3.0.1...v3.1.2)

---
updated-dependencies:
- dependency-name: fast-uri
  dependency-version: 3.1.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-05-13 03:26:11 +00:00
renovate[bot] 2fb5ae4c69 chore(deps): update dependency @stoplight/spectral-rulesets to v1.22.1
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-05-13 03:25:41 +00:00
renovate[bot] 876cabf31d chore(deps): update dependency @stoplight/spectral-functions to v1.10.2
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-05-13 02:09:29 +00:00
renovate[bot] 6cb7d2b12e chore(deps): update dependency @stoplight/spectral-formatters to v1.5.1
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-05-13 01:19:50 +00:00
backstage-goalie[bot] ea223011c8 Merge pull request #34192 from backstage/renovate/slack-web-api-7.x-lockfile
chore(deps): update dependency @slack/web-api to v7.15.2
2026-05-13 01:15:20 +00:00
dependabot[bot] 6a4200789d chore(deps): Bump @protobufjs/utf8 from 1.1.0 to 1.1.1
Bumps [@protobufjs/utf8](https://github.com/dcodeIO/protobuf.js) from 1.1.0 to 1.1.1.
- [Release notes](https://github.com/dcodeIO/protobuf.js/releases)
- [Changelog](https://github.com/protobufjs/protobuf.js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/dcodeIO/protobuf.js/compare/protobufjs-cli-v1.1.0...protobufjs-cli-v1.1.1)

---
updated-dependencies:
- dependency-name: "@protobufjs/utf8"
  dependency-version: 1.1.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-05-12 20:04:44 +00:00
Ben Lambert d09c21cb84 feat(scaffolder): config-driven template groups and swappable TemplateCard (#34147)
* feat(scaffolder): config-driven template groups and swappable TemplateCard

Signed-off-by: benjdlambert <ben@blam.sh>

* refactor(scaffolder): keep createGroupsWithOther internal

Signed-off-by: benjdlambert <ben@blam.sh>

* docs(scaffolder): fix sub-page extension ID in changeset

Signed-off-by: benjdlambert <ben@blam.sh>

* address PR review feedback

Signed-off-by: benjdlambert <ben@blam.sh>

* split TemplateCard swappable contract from legacy props

Signed-off-by: benjdlambert <ben@blam.sh>

* address review feedback: dedupe tags, defensive groups copy, doc clarifications

Signed-off-by: benjdlambert <ben@blam.sh>

* regenerate api reports

Signed-off-by: benjdlambert <ben@blam.sh>

* align docs and changeset with actual default group titles

Signed-off-by: benjdlambert <ben@blam.sh>

* regen api reports after rebase

Signed-off-by: benjdlambert <ben@blam.sh>

---------

Signed-off-by: benjdlambert <ben@blam.sh>
2026-05-12 12:29:44 +02:00
renovate[bot] 9ff4098ea2 chore(deps): update dependency @slack/web-api to v7.15.2
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-05-12 10:27:36 +00:00
renovate[bot] 154f186ae2 chore(deps): update dependency @rspack/plugin-react-refresh to v1.6.2
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-05-12 10:27:08 +00:00
Ben Lambert dbeb7aab3e feat(scaffolder): add BUI theme for scaffolder forms (#33053)
* feat(scaffolder): add BUI theme for scaffolder forms

Add a Backstage UI (BUI) form theme as an alternative to the Material
UI theme. Toggled via formProps.theme or enableBackstageUi page config.

Includes BUI widgets, templates, field extension variants, and a ported
React Aria Autocomplete component.

Signed-off-by: benjdlambert <ben@blam.sh>

* refactor(scaffolder): use BUI Combobox and CheckboxGroup for form widgets

Signed-off-by: benjdlambert <ben@blam.sh>

* chore(scaffolder): enable BUI form flag and add kitchen sink demo template

Signed-off-by: benjdlambert <ben@blam.sh>

* fix(scaffolder): use outlined input style for BUI form widgets

Signed-off-by: benjdlambert <ben@blam.sh>

* fix(scaffolder): address BUI form PR feedback

Signed-off-by: benjdlambert <ben@blam.sh>

* fix(scaffolder): format CSS and regen API reports

Signed-off-by: benjdlambert <ben@blam.sh>

---------

Signed-off-by: benjdlambert <ben@blam.sh>
2026-05-12 10:35:21 +02:00
Fredrik Adelöw d61a91846e fix(create-app): pin jest and @jest/environment-jsdom-abstract to ~30.2.0
30.4.0 introduced synchronous require(ESM) that requires Node v24.9+,
breaking tests on Node 22. 30.3.0 pulls in @sinonjs/fake-timers@^15
which conflicts with @types/sinon@^17 (used by aws-sdk-client-mock).
30.2.0 avoids both issues cleanly.

Resets lockfile to a clean base-install from master constraints.

Signed-off-by: Fredrik Adelöw <freben@gmail.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-05-11 15:04:51 +02:00
Fredrik Adelöw e7020fa352 fix(create-app): pin @jest/environment-jsdom-abstract to ~30.3.0 alongside jest
Signed-off-by: Fredrik Adelöw <freben@gmail.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-05-11 14:46:37 +02:00
Fredrik Adelöw da0a5444be fix(create-app): also pin jest in root and cli package.json to ~30.3.0
Keep the monorepo's own jest resolution consistent with the template
range, and update the lockfile to 30.3.0 accordingly.

Co-authored-by: Cursor <cursoragent@cursor.com>

Signed-off-by: Fredrik Adelöw <freben@gmail.com>
2026-05-11 14:46:37 +02:00
Andre Wanlin cd02b9e99b Merge pull request #33635 from backstage/dependabot/npm_and_yarn/brace-expansion-1.1.13
build(deps): bump brace-expansion from 1.1.12 to 1.1.13
2026-05-08 14:06:15 -05:00
Andre Wanlin df2a5f8de1 Merge pull request #34120 from backstage/dependabot/npm_and_yarn/vm2-3.11.2
build(deps): bump vm2 from 3.10.3 to 3.11.2
2026-05-08 14:03:24 -05:00
Andre Wanlin 254d2b9b5c Merge pull request #33793 from backstage/dependabot/npm_and_yarn/hono/node-server-1.19.13
chore(deps): bump @hono/node-server from 1.19.10 to 1.19.13
2026-05-08 14:01:34 -05:00
backstage-goalie[bot] 548a5558f5 Merge pull request #34126 from backstage/renovate/npm-axios-vulnerability
Update dependency axios to v1.15.2 [SECURITY]
2026-05-06 12:55:51 +00:00
renovate[bot] 9158f153d3 Update dependency postcss to v8.5.10 [SECURITY]
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-05-05 13:45:53 +00:00
renovate[bot] a0361e34c7 Update dependency axios to v1.15.2 [SECURITY]
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-05-05 13:27:28 +00:00
Fredrik Adelöw f3aebf577d Merge pull request #34053 from sriharsha9618/msgraph-incremental
feat(catalog): add plugin-catalog-backend-module-msgraph-incremental
2026-05-05 16:21:37 +03:00
dependabot[bot] e522c6039b build(deps): bump vm2 from 3.10.3 to 3.11.2
Bumps [vm2](https://github.com/patriksimek/vm2) from 3.10.3 to 3.11.2.
- [Release notes](https://github.com/patriksimek/vm2/releases)
- [Changelog](https://github.com/patriksimek/vm2/blob/main/CHANGELOG.md)
- [Commits](https://github.com/patriksimek/vm2/compare/v3.10.3...v3.11.2)

---
updated-dependencies:
- dependency-name: vm2
  dependency-version: 3.11.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-05-04 16:58:03 +00:00
Charles de Dreuille 021b36800f fix(ui): collapse plugin header spacing before headers
Signed-off-by: Charles de Dreuille <charles.dedreuille@gmail.com>
2026-04-30 09:33:18 +01:00
Ben Lambert a0f58971a7 chore: fix issue with types (#34104)
Signed-off-by: benjdlambert <ben@blam.sh>
2026-04-29 15:50:39 +00:00
Ben Lambert fa06df607e Merge commit from fork
Signed-off-by: Benjamin Lambert <benjdlambert@gmail.com>
Signed-off-by: benjdlambert <ben@blam.sh>
2026-04-29 15:51:19 +02:00
renovate[bot] 6de96f171d Update CodeMirror
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-04-28 11:58:57 +02:00
renovate[bot] 015362b551 chore(deps): update dependency @uiw/react-codemirror to v4.25.9
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-04-28 11:30:17 +02:00
pillaris 0f36fcd879 chore: remove incremental ingestion modules from example backend
These modules are not needed by all Backstage users, so registering them
unconditionally in the example backend adds unnecessary routes, services,
and runtime dependencies. The backend.add(...) lines are documented in
the plugin README instead.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: pillaris <pillaris@adobe.com>
2026-04-27 14:37:30 +05:30
pillaris 6fa66e7907 fix: remove unnecessary direct msgraph dep from example backend
@backstage/plugin-catalog-backend-module-msgraph is only used
transitively via msgraph-incremental; no direct import exists in
packages/backend/src/index.ts.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: pillaris <pillaris@adobe.com>
2026-04-27 14:26:52 +05:30
Andre Wanlin d04ab67227 Merge pull request #33967 from backstage/dependabot/npm_and_yarn/protobufjs-7.5.5
chore(deps): bump protobufjs from 7.5.4 to 7.5.5
2026-04-25 06:36:15 -05:00
Andre Wanlin 3a8f077ec5 Merge pull request #33931 from backstage/dependabot/npm_and_yarn/hono-4.12.14
build(deps): bump hono from 4.12.7 to 4.12.14
2026-04-25 06:36:04 -05:00
Andre Wanlin f60c531990 Merge pull request #33889 from backstage/dependabot/npm_and_yarn/follow-redirects-1.16.0
chore(deps): bump follow-redirects from 1.15.11 to 1.16.0
2026-04-25 06:35:55 -05:00
pillaris 02859a1db9 fix(catalog): fix lint and type errors in msgraph-incremental plugin
- Use node:crypto import protocol
- Add @backstage/backend-test-utils to devDependencies
- Use template literal instead of string concatenation
- Add non-null assertions on result.entities in tests
- Remove unused rootGroup variable
Signed-off-by: pillaris <pillaris@adobe.com>
2026-04-25 10:13:23 +05:30
pillaris 5126adb17a chore: update yarn.lock for msgraph-incremental workspace entry
Add workspace:^ alias for the new plugin so the lockfile is consistent
with the packages/backend dependency reference. Remove stale pg@^8.11.0
range no longer referenced by any workspace package.
Signed-off-by: pillaris <pillaris@adobe.com>
2026-04-25 09:56:42 +05:30
Charles de Dreuille 030fb311aa Merge pull request #33997 from backstage/charlesdedreuille/act-355-header-improvements
feat(ui): add description, tags, and metadata props to Header
2026-04-24 13:59:56 +01:00
Patrik Oldsberg f635139ebc Limit @remixicon/react to versions below 4.9.0
The license changed in 4.9.0, so we need to cap the allowed version
range across all packages that depend on it.

Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
2026-04-23 16:42:38 +02:00
Johan Persson 1a8de99d1d Add test suite for useDefinition hook in @backstage/ui (#34042)
* Add test infrastructure to @backstage/ui

Signed-off-by: Johan Persson <johanopersson@gmail.com>

* Add resolveResponsiveValue tests

Signed-off-by: Johan Persson <johanopersson@gmail.com>

* Add useDefinition prop resolution and classes tests

Fixed a bug in useDefinition where passing null for classNameTarget or
utilityTarget was incorrectly defaulted to 'root' due to the nullish
coalescing operator treating null as falsy.

Signed-off-by: Johan Persson <johanopersson@gmail.com>

* Add useDefinition data attributes tests

Signed-off-by: Johan Persson <johanopersson@gmail.com>

* Add resolveDefinitionProps tests

Signed-off-by: Johan Persson <johanopersson@gmail.com>

* Add processUtilityProps tests

Signed-off-by: Johan Persson <johanopersson@gmail.com>

* Add useDefinition bg system tests

Signed-off-by: Johan Persson <johanopersson@gmail.com>

* Add useDefinition utility style and analytics tests

Signed-off-by: Johan Persson <johanopersson@gmail.com>

* Add useDefinition href resolution tests

Signed-off-by: Johan Persson <johanopersson@gmail.com>

* Add useDefinition options tests

Signed-off-by: Johan Persson <johanopersson@gmail.com>

* Wrap all useDefinition tests with BUIProvider

Signed-off-by: Johan Persson <johanopersson@gmail.com>

* Fix type errors in useDefinition tests

Use `as const satisfies ComponentConfig<any, any>` instead of
`as ComponentConfig<any, any>` to preserve literal types needed
by the conditional type machinery (DataAttributes, ResolveBgProps,
analytics intersection).

Signed-off-by: Johan Persson <johanopersson@gmail.com>

* Address review feedback in useDefinition tests

- Rename shadowed Wrapper to RouterWrapper in createRouterWrapper
- Fix inaccurate comment about splat vs non-splat routes
- Clarify misleading test name for provider data-bg behavior

Signed-off-by: Johan Persson <johanopersson@gmail.com>

---------

Signed-off-by: Johan Persson <johanopersson@gmail.com>
2026-04-23 16:00:09 +02:00
pillaris f1279ea2d6 feat(catalog): add catalog-backend-module-msgraph-incremental plugin
Introduces a new Backstage backend module that incrementally ingests
users and groups from Microsoft Graph one page at a time, using the
incremental ingestion framework.
Unlike MicrosoftGraphOrgEntityProvider, this module never holds the
full dataset in memory. Each burst processes a single page (up to 999
items), making it suitable for large Azure AD tenants where the
full-scan provider causes memory pressure or OOM failures.
The @odata.nextLink cursor is persisted in the incremental ingestion
marks table, so a pod restart during ingestion resumes from the last
completed page rather than starting over.
Signed-off-by: pillaris <pillaris@adobe.com>
2026-04-23 15:56:43 +05:30
Fredrik Adelöw e9b78e9698 Remove uuid dependency in favor of crypto.randomUUID()
The uuid package dropped its CommonJS entry point in v14, making it
incompatible with Backstage's CJS build output and Jest test runner.
Rather than working around the ESM-only issue, replace all usage with
the built-in crypto.randomUUID() which has been available in Node.js
since v16.7 and in all major browsers since March 2022.

Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Made-with: Cursor
2026-04-23 10:51:43 +02:00
Charles de Dreuille 5a7495d072 chore: merge master and resolve package.json conflict
Both @braintree/sanitize-url (this branch) and @internationalized/date
(master) were added to packages/ui dependencies; keeping both.

Signed-off-by: Charles de Dreuille <charles.dedreuille@gmail.com>
2026-04-23 08:53:44 +01:00
Charles de Dreuille 251acf38d6 fix(ui): address further PR review comments
- Replace custom UNSAFE_HREF_RE with @braintree/sanitize-url for robust XSS prevention
- Shorten renderInlineMarkdown JSDoc
- Single-user with href: collapse two adjacent links into one wrapping avatar + name
- Multi-user list: use href ?? index:name as key to avoid collisions on duplicate names
- Status dot: replace role="img"/aria-label with aria-hidden (text label is sufficient)

Signed-off-by: Charles de Dreuille <charles.dedreuille@gmail.com>
2026-04-23 08:52:08 +01:00
Jan Michael Ong 19a4d08bd2 chore: add octokit/plugin-retry
Signed-off-by: Jan Michael Ong <adobejmong@gmail.com>
2026-04-22 09:03:49 -07:00
Charles de Dreuille ec109ce7fb fix(ui): replace custom regex with marked Lexer for inline description parsing
Uses marked's Lexer.lexInline() instead of a hand-rolled regex to parse
inline links in the Header description. marked ships CommonJS, has zero
dependencies, and is already used in the monorepo. This gives us a proper
token model that handles edge cases the regex could not.

Signed-off-by: Charles de Dreuille <charles.dedreuille@gmail.com>
2026-04-22 12:41:26 +01:00
1337 e907ba6fe1 Merge branch 'backstage:master' into feature/catalog-export 2026-04-22 09:17:13 +02:00
renovate[bot] 4c66f3e96c Update dependency dompurify to v3.4.0 [SECURITY]
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-04-21 15:14:31 +00:00
Charles de Dreuille 2deaa49120 fix(ui): replace react-markdown with inline parser to fix ESM Jest failures
react-markdown v8+ is ESM-only and breaks Jest in Node-role packages that
transitively import @backstage/ui via core-app-api. Since the Header
description only needs inline link support, a small regex-based parser
is sufficient and avoids the ESM dependency entirely.

Signed-off-by: Charles de Dreuille <charles.dedreuille@gmail.com>
2026-04-20 17:59:45 +01:00
Charles de Dreuille 9a5a3274cc chore: update lockfile after adding react-markdown dependency
Signed-off-by: Charles de Dreuille <charles.dedreuille@gmail.com>
Made-with: Cursor
2026-04-19 11:44:11 +02:00