The license changed in 4.9.0, so we need to cap the allowed version
range across all packages that depend on it.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
* Add test infrastructure to @backstage/ui
Signed-off-by: Johan Persson <johanopersson@gmail.com>
* Add resolveResponsiveValue tests
Signed-off-by: Johan Persson <johanopersson@gmail.com>
* Add useDefinition prop resolution and classes tests
Fixed a bug in useDefinition where passing null for classNameTarget or
utilityTarget was incorrectly defaulted to 'root' due to the nullish
coalescing operator treating null as falsy.
Signed-off-by: Johan Persson <johanopersson@gmail.com>
* Add useDefinition data attributes tests
Signed-off-by: Johan Persson <johanopersson@gmail.com>
* Add resolveDefinitionProps tests
Signed-off-by: Johan Persson <johanopersson@gmail.com>
* Add processUtilityProps tests
Signed-off-by: Johan Persson <johanopersson@gmail.com>
* Add useDefinition bg system tests
Signed-off-by: Johan Persson <johanopersson@gmail.com>
* Add useDefinition utility style and analytics tests
Signed-off-by: Johan Persson <johanopersson@gmail.com>
* Add useDefinition href resolution tests
Signed-off-by: Johan Persson <johanopersson@gmail.com>
* Add useDefinition options tests
Signed-off-by: Johan Persson <johanopersson@gmail.com>
* Wrap all useDefinition tests with BUIProvider
Signed-off-by: Johan Persson <johanopersson@gmail.com>
* Fix type errors in useDefinition tests
Use `as const satisfies ComponentConfig<any, any>` instead of
`as ComponentConfig<any, any>` to preserve literal types needed
by the conditional type machinery (DataAttributes, ResolveBgProps,
analytics intersection).
Signed-off-by: Johan Persson <johanopersson@gmail.com>
* Address review feedback in useDefinition tests
- Rename shadowed Wrapper to RouterWrapper in createRouterWrapper
- Fix inaccurate comment about splat vs non-splat routes
- Clarify misleading test name for provider data-bg behavior
Signed-off-by: Johan Persson <johanopersson@gmail.com>
---------
Signed-off-by: Johan Persson <johanopersson@gmail.com>
Both @braintree/sanitize-url (this branch) and @internationalized/date
(master) were added to packages/ui dependencies; keeping both.
Signed-off-by: Charles de Dreuille <charles.dedreuille@gmail.com>
- Replace custom UNSAFE_HREF_RE with @braintree/sanitize-url for robust XSS prevention
- Shorten renderInlineMarkdown JSDoc
- Single-user with href: collapse two adjacent links into one wrapping avatar + name
- Multi-user list: use href ?? index:name as key to avoid collisions on duplicate names
- Status dot: replace role="img"/aria-label with aria-hidden (text label is sufficient)
Signed-off-by: Charles de Dreuille <charles.dedreuille@gmail.com>
Uses marked's Lexer.lexInline() instead of a hand-rolled regex to parse
inline links in the Header description. marked ships CommonJS, has zero
dependencies, and is already used in the monorepo. This gives us a proper
token model that handles edge cases the regex could not.
Signed-off-by: Charles de Dreuille <charles.dedreuille@gmail.com>
react-markdown v8+ is ESM-only and breaks Jest in Node-role packages that
transitively import @backstage/ui via core-app-api. Since the Header
description only needs inline link support, a small regex-based parser
is sufficient and avoids the ESM dependency entirely.
Signed-off-by: Charles de Dreuille <charles.dedreuille@gmail.com>
Add three new props to the Header component:
- `tags`: renders a row of text/link items above the title, separated by
3×3px circle dividers
- `description`: renders a markdown string below the title with inline
link support via react-markdown
- `metadata`: renders key-value pairs below the description with 20px gaps
Also deprecates the `breadcrumbs` prop for future removal.
Signed-off-by: Charles de Dreuille <charles.dedreuille@gmail.com>
Made-with: Cursor
Adds a new DateRangePicker component to @backstage/ui built on React Aria,
featuring a custom field group with two DateInput fields and a calendar
trigger, a RangeCalendar popover with proper range selection visuals
(solid circles for start/end, transparent solid fill for in-range cells
with row-boundary rounding), and full BUI token usage including bg
consumer auto-increment. Includes Storybook stories and a docs-ui page.
Signed-off-by: Charles de Dreuille <charles.dedreuille@gmail.com>
Made-with: Cursor
Changed version ranges for react-aria, react-aria-components, and
react-stately from `^` (minor) to `~` (patch) across all consuming
packages to prevent unintended minor version upgrades.
Also aligned app-visualizer's react-aria-components from 1.14 to 1.17.
Signed-off-by: Johan Persson <johanopersson@gmail.com>
Add dependencies that were only available transitively through other
packages but were being imported directly:
- csstype and copy-to-clipboard in @backstage/core-components
- @storybook/react-vite in @backstage/ui
- react-aria-components in @backstage/plugin-notifications
- @octokit/core in @backstage/plugin-scaffolder-backend-module-github
- @rjsf/utils in example-app-legacy
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Made-with: Cursor
React Aria Components v1.17.0 consolidated individual packages
into monopackages, dropping `@react-types/table` as a transitive
dependency. This caused `TS2307` errors in new app installations
where `react-aria-components@1.17.0` was resolved.
Migrate all imports from individual `@react-aria/*` and
`@react-stately/*` packages to the `react-aria` and
`react-stately` monopackages in both `@backstage/ui` and
`@backstage/plugin-app`, and update minimum dependency versions
accordingly.
Signed-off-by: Johan Persson <johanopersson@gmail.com>
Addresses the high severity rollup path traversal vulnerability
(GHSA-mw96-cpmx-2vgc) and the glob security advisory by upgrading
all instances across the monorepo. Updates code that used the legacy
callback-based glob API to use the modern promise/sync API.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Addresses the high severity rollup path traversal vulnerability
(GHSA-mw96-cpmx-2vgc) and the glob security advisory by upgrading
all instances across the monorepo. Updates code that used the legacy
callback-based glob API to use the modern promise/sync API.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Addresses the high severity rollup path traversal vulnerability
(GHSA-mw96-cpmx-2vgc) and the glob security advisory by upgrading
all instances across the monorepo. Updates code that used the legacy
callback-based glob API to use the modern promise/sync API.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Add `react-aria`, `@react-aria/interactions`, `@react-stately/layout`,
and `@react-stately/overlays` as dependencies, and `react-stately` as a
dev dependency to `@backstage/ui`.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Updated the peer dependency ranges for `react`, `react-dom`, and
`@types/react` in `packages/ui` to require React 18+, removing the
`^17.0.0` range.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Only CSS and other non-script, non-JSON exports should be excluded from
typesVersions. The package.json export still needs to be included.
Also preserves field order when updating existing typesVersions.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
This adds support for CSS entry points in package exports. When a package
declares a CSS file in its exports field, the CLI will now automatically
bundle it during `backstage-cli package build` and rewrite the export
path from src/ to dist/ at publish time.
The CSS bundling uses lightningcss to resolve @import statements and
preserves @layer declarations that would otherwise be stripped during
bundling.
This allows packages like @backstage/ui to use the standard build command
instead of custom build scripts for CSS bundling.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
github-actions[bot]