Addresses the high severity rollup path traversal vulnerability
(GHSA-mw96-cpmx-2vgc) and the glob security advisory by upgrading
all instances across the monorepo. Updates code that used the legacy
callback-based glob API to use the modern promise/sync API.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Addresses the high severity rollup path traversal vulnerability
(GHSA-mw96-cpmx-2vgc) and the glob security advisory by upgrading
all instances across the monorepo. Updates code that used the legacy
callback-based glob API to use the modern promise/sync API.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Addresses the high severity rollup path traversal vulnerability
(GHSA-mw96-cpmx-2vgc) and the glob security advisory by upgrading
all instances across the monorepo. Updates code that used the legacy
callback-based glob API to use the modern promise/sync API.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Rename all bin entries from `cli-module-*` to `backstage-cli-module-*`
to establish a clear namespace for Backstage CLI tooling.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Change peer dependency from jest-cli to jest to match the actual
runtime usage of require('jest') and the original @backstage/cli
peer dependency declaration.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Move jest config files to cli-module-test-jest/config and node
transform + webpack-public-path to cli-module-build/config. Replace
originals in @backstage/cli/config with lazy proxies that forward
to the appropriate module or throw if it is not installed.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Align dependency versions in CLI modules to match the original CLI
package versions. Move dependencies that are only used by modules out
of the main CLI package, and add missing dependencies to the modules
that actually use them. Revert import-to-require conversions in
cli-module-build that were incorrectly introduced during the split.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
- Move runtime dependencies from devDependencies to dependencies in
cli-module-build, cli-module-auth, cli-module-migrate, cli-module-new,
cli-module-test-jest, and cli-module-translations
- Fix relative package.json paths in cli-module-build
- Downgrade rollup in cli-module-build to ^4.27.3 to match the CLI
- Downgrade eslint-webpack-plugin to ^4.2.0 to prevent @types/eslint v9
- Add CLI module packages to create-app version helper
- Add allow-warnings for CLI module packages in API reports
- Generate API report files for all CLI module packages
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Each CLI module package now includes a bin script and cli.ts entry
point, allowing modules to be executed directly via npx without
being wired into the main @backstage/cli package.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
1337