Addresses the high severity rollup path traversal vulnerability
(GHSA-mw96-cpmx-2vgc) and the glob security advisory by upgrading
all instances across the monorepo. Updates code that used the legacy
callback-based glob API to use the modern promise/sync API.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Addresses the high severity rollup path traversal vulnerability
(GHSA-mw96-cpmx-2vgc) and the glob security advisory by upgrading
all instances across the monorepo. Updates code that used the legacy
callback-based glob API to use the modern promise/sync API.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Addresses the high severity rollup path traversal vulnerability
(GHSA-mw96-cpmx-2vgc) and the glob security advisory by upgrading
all instances across the monorepo. Updates code that used the legacy
callback-based glob API to use the modern promise/sync API.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
- Convert CliAuth getters to methods (getInstanceName, getBaseUrl) so
options can be added in the future
- Remove StoredInstance from cli-node public API, hiding instance details
- Move secretStore to cli-internal for re-use, refactoring from fs-extra
to node:fs
- Add shared getAuthInstanceService helper in cli-internal for
constructing secret-store service keys
- Define StoredInstance locally in cli-module-auth instead of importing
from cli-node
- Update all consumers and tests for the new method-based API
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Fix argument parsing bugs in the execute command where actionId at index 0
was incorrectly skipped when --instance was absent, and flag values matching
the actionId string were erroneously removed. Add --help support to the
execute command for CLI report generation. Add missing bin script and
cli-report.md for cli-module-actions. Add resolveAuth tests. Bump
backend-defaults changeset to minor for the security-relevant auth change.
Replace cross-fetch with native fetch in cli-module-auth to avoid punycode
deprecation warnings during CLI report generation.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Rename all bin entries from `cli-module-*` to `backstage-cli-module-*`
to establish a clear namespace for Backstage CLI tooling.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Align dependency versions in CLI modules to match the original CLI
package versions. Move dependencies that are only used by modules out
of the main CLI package, and add missing dependencies to the modules
that actually use them. Revert import-to-require conversions in
cli-module-build that were incorrectly introduced during the split.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
- Move runtime dependencies from devDependencies to dependencies in
cli-module-build, cli-module-auth, cli-module-migrate, cli-module-new,
cli-module-test-jest, and cli-module-translations
- Fix relative package.json paths in cli-module-build
- Downgrade rollup in cli-module-build to ^4.27.3 to match the CLI
- Downgrade eslint-webpack-plugin to ^4.2.0 to prevent @types/eslint v9
- Add CLI module packages to create-app version helper
- Add allow-warnings for CLI module packages in API reports
- Generate API report files for all CLI module packages
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Each CLI module package now includes a bin script and cli.ts entry
point, allowing modules to be executed directly via npx without
being wired into the main @backstage/cli package.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
github-actions[bot]