Resolve config paths relative to the target package directory instead
of the workspace root in readDatabaseClient, matching the behavior of
the rest of the config loading system.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
The PID file was written to the database directory before
`pg.initialise()`, which prevented initialization from succeeding.
Moved the PID file write to just after initialization but before
starting the database.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Uses a PID file to track which process owns each temp directory, so
concurrent instances from different projects are not affected.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
- Close embedded DB on shutdown to avoid leaking the Postgres process
and temp directory
- Use fs.remove instead of deprecated fs.rmdir with recursive option
- Guard against absolute config paths in readDatabaseClient
- Forward embedded-postgres error logs to console.error
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
The 18.x version ships its own .d.ts files that TypeScript resolves
correctly, so the custom module declaration is no longer needed.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Fix implicit any types in startEmbeddedDb callbacks, replace the
re-export type declaration with an inline type definition for the
embedded-postgres module, and update runBackend tests to mock the
config loading and use async timer advancement.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Rather than requiring the `EXPERIMENTAL_DEV_DB` environment variable,
the embedded postgres server is now started automatically when
`backend.database.client` is set to `embedded-postgres` in the app
config. The CLI reads the config before spawning the backend and
injects the actual pg connection details via env override.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Glob v13 treats backslashes as escape characters by default, unlike v7
which treated them as path separators on Windows. This broke Windows CI
where path.join/resolve produce backslash paths.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Addresses the high severity rollup path traversal vulnerability
(GHSA-mw96-cpmx-2vgc) and the glob security advisory by upgrading
all instances across the monorepo. Updates code that used the legacy
callback-based glob API to use the modern promise/sync API.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Addresses the high severity rollup path traversal vulnerability
(GHSA-mw96-cpmx-2vgc) and the glob security advisory by upgrading
all instances across the monorepo. Updates code that used the legacy
callback-based glob API to use the modern promise/sync API.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Addresses the high severity rollup path traversal vulnerability
(GHSA-mw96-cpmx-2vgc) and the glob security advisory by upgrading
all instances across the monorepo. Updates code that used the legacy
callback-based glob API to use the modern promise/sync API.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
When passing --always-yarn-pack, we previously
packed all packages in parallel. Since
package.json files are rewritten during packing,
this could cause intermittent "No local workspace
found for this range" failures.
To fix this, we now pack packages in batches,
starting with the ones that have no workspace
dependencies and expanding out to include packages
whose dependencies have already been packed.
Signed-off-by: MT Lewis <mtlewis@users.noreply.github.com>
When the transform tests were moved from @backstage/cli to
@backstage/cli-module-build, the coveragePathIgnorePatterns config
was not carried over. This caused test failures in CI when running
with --coverage, as Jest tried to instrument the fixture files
containing fake node_modules packages.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Updated `resolvePackagePath` to correctly resolve `package.json` for dynamic plugins that bundle their own copy of `@backstage/backend-plugin-api`. This change ensures that the resolution works for both the host application and bundled dependencies, enhancing compatibility with plugins created using the `backstage-cli package bundle` command.
Signed-off-by: David Festal <dfestal@redhat.com>
Assisted-by: Cursor
The bin scripts already had the full runCliModule logic for the production
path. Inline the same pattern for local dev and drop the intermediate
src/cli.ts files that just duplicated it.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
- Use cli-defaults instead of listing individual CLI modules in
create-app template and root package.json
- Move nodeTransform config files from cli-module-build to cli-node
to avoid cross-module direct imports
- Rename cli-module-create-github-app to cli-module-github
- Start createCliModule init chain with Promise.resolve()
- Deduplicate exitWithError in runCliModule.ts
- Extract shared isCommandNodeHidden to @internal/cli
- Add explanatory comment for fromArray deduplication field
- Restore error for cli role packages missing bin in runCliExtraction
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Rename all bin entries from `cli-module-*` to `backstage-cli-module-*`
to establish a clear namespace for Backstage CLI tooling.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Include cli-module role in CLI report generation alongside the
existing cli role. Packages without a bin field are silently skipped.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Move jest config files to cli-module-test-jest/config and node
transform + webpack-public-path to cli-module-build/config. Replace
originals in @backstage/cli/config with lazy proxies that forward
to the appropriate module or throw if it is not installed.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Move serve_index.html to cli-module-build/templates and use
findOwnPaths instead of require.resolve for safer path resolution.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
CLI modules should only export the module itself as a default export.
Remove the named `buildPlugin` export from cli-module-build and the
unused `configOption` export from cli-module-config. Also remove the
API report warning skip for CLI module packages.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Align dependency versions in CLI modules to match the original CLI
package versions. Move dependencies that are only used by modules out
of the main CLI package, and add missing dependencies to the modules
that actually use them. Revert import-to-require conversions in
cli-module-build that were incorrectly introduced during the split.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
- Move runtime dependencies from devDependencies to dependencies in
cli-module-build, cli-module-auth, cli-module-migrate, cli-module-new,
cli-module-test-jest, and cli-module-translations
- Fix relative package.json paths in cli-module-build
- Downgrade rollup in cli-module-build to ^4.27.3 to match the CLI
- Downgrade eslint-webpack-plugin to ^4.2.0 to prevent @types/eslint v9
- Add CLI module packages to create-app version helper
- Add allow-warnings for CLI module packages in API reports
- Generate API report files for all CLI module packages
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Downgrade rollup from ^4.59.0 to ^4.27.3 to match the main CLI package
and avoid the dedupe upgrading all rollup instances to 4.59.0, which
breaks API report generation.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Patrik Oldsberg