74233 Commits

Author SHA1 Message Date
Ben Lambert 4f5ed06dd1 Merge commit from fork 2026-03-11 13:33:31 +01:00
Ben Lambert 0f9d673e82 Merge commit from fork
* Fix redirect URI allowlist bypass via URL userinfo syntax

* Validate redirect URIs against normalized origin+pathname
2026-03-11 13:33:00 +01:00
renovate[bot] b9a41c0a22 chore(deps): update dependency @uiw/react-codemirror to v4.25.8
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-03-11 12:14:09 +01:00
renovate[bot] 6ea57c4fed chore(deps): update dependency @uiw/codemirror-themes to v4.25.8
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-03-11 12:13:27 +01:00
Fredrik Adelöw 65364716da fix: add NULL safety and idempotent DROP CONSTRAINT to search FK migration
Prevent orphan cleanup queries from incorrectly matching rows with NULL
entity_id via LEFT JOIN, and use DROP CONSTRAINT IF EXISTS for safer
partial re-runs given transaction: false.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
2026-03-11 11:53:28 +01:00
Fredrik Adelöw 03b72362a9 Merge pull request #33283 from backstage/freben/dependabot-approve-lockonly
chore(ci): auto-approve yarn.lock-only dependabot PRs
2026-03-11 11:41:17 +01:00
renovate[bot] 3a6b4d2132 chore(deps): update opensearchproject/opensearch docker tag to v2.19.5
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-03-11 10:33:20 +00:00
Fredrik Adelöw da08dd1a8b Merge pull request #33244 from backstage/renovate/eslint-monorepo
chore(deps): update dependency eslint to v9.39.4
2026-03-11 11:24:03 +01:00
Fredrik Adelöw 22475eaba9 Merge pull request #33237 from backstage/renovate/shiki-monorepo
chore(deps): update shiki monorepo to v3.23.0
2026-03-11 11:23:45 +01:00
Fredrik Adelöw c08e4daf24 Merge pull request #33178 from backstage/renovate/postcss-8.x-lockfile
chore(deps): update dependency postcss to v8.5.8
2026-03-11 11:23:27 +01:00
Fredrik Adelöw 96cbf33e12 Merge pull request #33276 from backstage/dependabot/npm_and_yarn/hono-4.12.7
chore(deps): bump hono from 4.12.5 to 4.12.7
2026-03-11 11:22:06 +01:00
backstage-goalie[bot] f969ed66e1 Merge pull request #33274 from backstage/renovate/npm-tar-vulnerability
chore(deps): update dependency tar to v7.5.11 [security]
2026-03-11 10:21:27 +00:00
backstage-goalie[bot] a55682b2c4 Merge pull request #33266 from backstage/renovate/knip-5.x-lockfile
chore(deps): update dependency knip to v5.86.0
2026-03-11 10:21:23 +00:00
Fredrik Adelöw 040551d99b chore(ci): auto-approve yarn.lock-only dependabot PRs
Add the same auto-approval step that the renovate workflow already has,
so that dependabot PRs that only touch yarn.lock files get approved
automatically.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
2026-03-11 11:20:17 +01:00
renovate[bot] 9148bbaf88 chore(deps): update dependency motion to v12.35.1
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-03-11 11:12:10 +01:00
Fredrik Adelöw 42a42d5625 fix: add JSDoc type annotation for MySQL orphan ID mapping
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
2026-03-11 11:06:57 +01:00
Fredrik Adelöw ffe5febfd6 fix: use LEFT JOIN for MySQL batch deletes in search FK migration
Address review feedback: replace NOT IN subquery with LEFT JOIN for
MySQL batch deletes. Since MySQL doesn't support LIMIT in multi-table
DELETE, orphan entity_ids are found via SELECT first, then deleted in
a separate statement.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
2026-03-11 11:04:52 +01:00
Fredrik Adelöw b4e28e1c27 fix(catalog): make search FK migration safe for large databases
The search FK migration previously ran all DDL and a bulk DELETE in a
single transaction, holding AccessExclusiveLock for the entire duration.
On large tables this blocks all reads for potentially minutes or hours.

This restructures the migration per database engine:
- PostgreSQL: batch-deletes orphans before DDL, uses NOT VALID to skip
  full table scan under AccessExclusiveLock, then VALIDATE CONSTRAINT
  under the weaker ShareUpdateExclusiveLock
- MySQL: batch-deletes orphans with LIMIT before DDL
- SQLite: unchanged simple approach (no locking concerns)

Also sets transaction: false so the batched deletes run outside the
DDL transaction.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
2026-03-11 10:58:42 +01:00
Patrik Oldsberg 70183e9c55 AGENTS.md: fix duplicate /packages/app entry in Key Directories
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
2026-03-11 08:37:44 +01:00
Vivek Hipparkar 29ca39bd52 Merge branch 'fix/scaffolder-markdown-links-new-tab' of https://github.com/Vivek1819/backstage into fix/scaffolder-markdown-links-new-tab
Signed-off-by: Vivek Hipparkar <vivekhipparkar@gmail.com>
2026-03-11 12:06:10 +05:30
letthem 4987665d31 chore: trigger
Signed-off-by: letthem <suyeon3662@naver.com>
2026-03-11 13:29:41 +09:00
Kim Jikwan 261dacb2fc Fix prettier formatting for spring-batch-dashboard.yaml
Signed-off-by: Kim Jikwan <zc149@naver.com>
2026-03-11 13:24:46 +09:00
dependabot[bot] 3772043284 chore(deps): bump hono from 4.12.5 to 4.12.7
Bumps [hono](https://github.com/honojs/hono) from 4.12.5 to 4.12.7.
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](https://github.com/honojs/hono/compare/v4.12.5...v4.12.7)

---
updated-dependencies:
- dependency-name: hono
  dependency-version: 4.12.7
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-03-11 02:16:09 +00:00
Kim Jikwan e4eac3ec84 chore : Add Spring Batch Dashboard plugin to marketplace
Signed-off-by: Kim Jikwan <zc149@naver.com>
2026-03-11 11:12:54 +09:00
renovate[bot] b106887f5b chore(deps): update dependency tar to v7.5.11 [security]
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-03-10 23:54:34 +00:00
Fredrik Adelöw 85ec4d7314 fix: remove tautological assertion in burst length test
Replace the self-referencing callCount assertion with a concrete
expected value of 3, derived from the mocked time progression.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
2026-03-10 20:12:49 +01:00
Fredrik Adelöw 90ea210559 Merge pull request #33100 from backstage/changeset-release/master
Version Packages (next)
2026-03-10 19:45:31 +01:00
Fredrik Adelöw cbcc344945 one more flake
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
2026-03-10 19:43:23 +01:00
Oscar Reyes 7e841e6c39 chore(plugins): Adding testkube plugin data
Signed-off-by: Oscar Reyes <oscar-rreyes1@hotmail.com>
2026-03-10 11:40:07 -06:00
github-actions[bot] ed7c4e3bef Version Packages (next) 2026-03-10 17:34:12 +00:00
Patrik Oldsberg 1097f68579 Merge pull request #33181 from backstage/rugvip/cli-boolean-flag-negation
cli: enable --no- prefix negation for boolean flags
2026-03-10 18:27:53 +01:00
renovate[bot] 5cdba6200d chore(deps): update dependency lint-staged to v16
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-03-10 17:22:41 +00:00
Jonathan Roebuck 106d1b2a0e feat(catalog-backend-module-github): add config flag for verified email behavior (#33262)
Add a `defaultUserTransformer.useVerifiedEmails` config option to the
githubOrg provider, making the verified domain email behavior from #32997
opt-in rather than the default.

Signed-off-by: Jonathan Roebuck <jroebuck@spotify.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-10 16:55:53 +00:00
renovate[bot] b959d534b3 chore(deps): update dependency knip to v5.86.0
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-03-10 16:42:36 +00:00
Fredrik Adelöw bed58405ab Merge pull request #33263 from backstage/freben/notar
remove @types/tar
2026-03-10 17:27:11 +01:00
Fredrik Adelöw df604dd3ae Merge pull request #33261 from backstage/freben/icon
fixup icons
2026-03-10 17:26:01 +01:00
benjdlambert 74aa55f0e9 chore: reset yarn.lock
Signed-off-by: benjdlambert <ben@blam.sh>
2026-03-10 17:20:38 +01:00
Patrik Oldsberg 5a5a113070 chore: deduplicate yarn.lock entries
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
2026-03-10 17:20:38 +01:00
Patrik Oldsberg feaf449008 cli: enable --no- prefix negation for boolean flags
Bump cleye to ^2.3.0 (which pulls in type-flag 4.1.0) and enable
booleanFlagNegation: true in all cli() invocations so that boolean
flags automatically support --no-<flag> prefix negation.

Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
2026-03-10 17:20:38 +01:00
Ben Lambert fa6dd7a611 chore: fix build (#33264)
Signed-off-by: benjdlambert <ben@blam.sh>
2026-03-10 17:19:29 +01:00
Fredrik Adelöw dbb7f0017a Merge pull request #33176 from backstage/freben/xml
bump aws-sdk to get rid of critical fast-xml-parser warning
2026-03-10 17:04:33 +01:00
Johan Persson d4d52fb13c fix(ui): ensure disabled rows override pointer cursor
Move the disabled rule after the pointer cursor rules so that
disabled rows always show cursor: not-allowed, even when they
have data-href or data-selection-mode.

Signed-off-by: Johan Persson <johanopersson@gmail.com>
2026-03-10 17:00:38 +01:00
Johan Persson f42f4cc055 fix(ui): truncate Table column headers with ellipsis on overflow
Wrap column header text in a label span with text-overflow: ellipsis
so that long headers truncate instead of wrapping to multiple lines.

Signed-off-by: Johan Persson <johanopersson@gmail.com>
2026-03-10 17:00:38 +01:00
Johan Persson fbd5c5a93d fix(ui): only show pointer cursor on interactive Table rows
Row always passed onAction to React Aria even when no handler or
href was set, causing all rows to appear interactive. Now onAction
is only passed when there is an actual interaction. CSS explicitly
sets cursor: default on rows and scopes cursor: pointer to rows
with href, selection mode, or pressable state.

Signed-off-by: Johan Persson <johanopersson@gmail.com>
2026-03-10 17:00:38 +01:00
Fredrik Adelöw 1fd15249ad remove @types/tar
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
2026-03-10 16:44:41 +01:00
Fredrik Adelöw 645749d827 Merge pull request #33180 from cftad/gh-waittime
Update GitHub Scaffolder Environment Action Input Description
2026-03-10 16:41:20 +01:00
Fredrik Adelöw da2a0f974c Merge pull request #33242 from backstage/renovate/react-monorepo
fix(deps): update dependency react-refresh to ^0.18.0
2026-03-10 16:39:28 +01:00
Fredrik Adelöw 37459ebed3 Merge pull request #33027 from Flagsmith/asaphk/flagsmith-plugin
docs: add the Flagsmith plugin to the microsite directory
2026-03-10 16:36:54 +01:00
Fredrik Adelöw f234b29025 Merge pull request #33234 from backstage/renovate/postgres-17.x
chore(deps): update postgres docker tag to v17.9
2026-03-10 16:34:19 +01:00
Fredrik Adelöw 1340c82948 fixup icons
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
2026-03-10 16:33:24 +01:00