Glob v13 treats backslashes as escape characters by default, unlike v7
which treated them as path separators on Windows. This broke Windows CI
where path.join/resolve produce backslash paths.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Addresses the high severity rollup path traversal vulnerability
(GHSA-mw96-cpmx-2vgc) and the glob security advisory by upgrading
all instances across the monorepo. Updates code that used the legacy
callback-based glob API to use the modern promise/sync API.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Addresses the high severity rollup path traversal vulnerability
(GHSA-mw96-cpmx-2vgc) and the glob security advisory by upgrading
all instances across the monorepo. Updates code that used the legacy
callback-based glob API to use the modern promise/sync API.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Addresses the high severity rollup path traversal vulnerability
(GHSA-mw96-cpmx-2vgc) and the glob security advisory by upgrading
all instances across the monorepo. Updates code that used the legacy
callback-based glob API to use the modern promise/sync API.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
The test assertions for lazy-loaded extension components used the
default 1000ms RTL timeout, which is insufficient under CI load.
Increased to 10000ms to match the pattern in createDevApp.test.tsx.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Replace the bulk DELETE + INSERT of all search rows with a minimal sync
that only touches rows that actually changed:
- Postgres: single writable CTE with unnest — DELETE stale rows and
INSERT new ones in one atomic statement using snapshot isolation
- MySQL: temporary table merge with deadlock retry (errno 1213)
- SQLite: unchanged bulk replace (sufficient for dev/test)
For a typical user entity with ~200 search rows where one annotation
changed, this reduces the operation from ~400 row writes to ~2.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Special-case `from: '/'` in redirect config to use an exact path match
instead of the `/*` wildcard, which would match the entire app.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
The RealAlertApiStory component used require('@backstage/core-plugin-api')
inside the function body. Vite bundles Storybook as ESM, where require is
not available at runtime, causing a ReferenceError. Replace with a
standard top-level import.
Signed-off-by: Charles de Dreuille <charles.dedreuille@gmail.com>
Made-with: Cursor
Allow users to configure URL redirects on the app/routes extension
through app-config. Redirects are specified as an array of {from, to}
path pairs in the extension config schema.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Roll back the NFS page component changes (BuiHeader, headerVariant,
NfsCatalogGraphPage, NfsDefaultImportPage) from catalog-graph and
catalog-import plugins. Only the title and icon metadata additions to the
new frontend system plugin definitions are retained.
For the kubernetes plugin, replace the generic RiShipLine icon with a
proper Kubernetes helm wheel SVG icon from Simple Icons.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
- Extract shared `searchExists` helper into `searchSubquery.ts` to avoid
duplicate EXISTS subquery logic between the two filter modules
- Rename `applyInStrategy` to `applyExistsStrategy` to reflect the actual
query shape
- Update block comment with correct EXISTS SQL examples
- Remove unused `strategy` parameter from `applyEntityFilterToQuery`
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Switch filter query builders from IN (subquery) to EXISTS (correlated
subquery) patterns. This enables PostgreSQL semi-join optimizations
(stops at first match) and replaces NOT IN with NOT EXISTS (faster,
no NULL-semantics pitfalls).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Page components without props don't need to be exported from the
package API surface. Import directly from the component file in
the alpha entry points instead.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Move NfsDefaultImportPage out of the public API and export it as
DefaultImportPage from the alpha entry point instead.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Use `paginationOptions: { type: 'none' }` in EntityDataTable instead
of deriving page size from data length, which was 0 during the initial
loading render causing only one row to be displayed.
Signed-off-by: Johan Persson <johanopersson@gmail.com>
Refactor `SignInResolverFactoryOptions` and `createSchemaFromZod` to use
`TSchema extends ZodType` instead of `ZodSchema<Output, Def, Input>`,
avoiding "excessively deep" TypeScript inference errors when multiple
Zod copies are resolved in a project.
Signed-off-by: Jon Koops <jonkoops@gmail.com>
Add `DOM.AsyncIterable` to the shared TypeScript configuration in
`@backstage/cli`, making standard async iteration methods available on
DOM APIs like `FileSystemDirectoryHandle`. This aligns behavior with
TypeScript 6.0, where this lib is included in `DOM` by default.
With the async iterable types now available, replace the custom
`IterableDirectoryHandle` and `WritableFileHandle` types in the scaffolder
plugin with the standard `FileSystemDirectoryHandle` and
`FileSystemFileHandle` DOM types. Add type guard functions for
`FileSystemHandle` since it is not a discriminated union.
Signed-off-by: Jon Koops <jonkoops@gmail.com>
- Register title and icon on the new-frontend createFrontendPlugin export.
- Add NfsDefaultImportPage using @backstage/ui Header with shared grid body.
- Point the alpha PageBlueprint loader at the NFS variant.
- Depend on @backstage/ui and @remixicon/react.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
- Add title, icon, and NfsCatalogGraphPage to the new frontend plugin alpha entry
- Refactor catalog graph page with headerVariant for legacy vs Backstage UI header
- Export NfsCatalogGraphPage from the CatalogGraphPage module
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
For CIMD clients using loopback redirect URIs (localhost/127.0.0.1),
match by scheme, hostname, and path only, ignoring the port. Native
CLI apps like Claude Code use ephemeral ports for OAuth callbacks.
Signed-off-by: benjdlambert <ben@blam.sh>
Fredrik Adelöw