Adds a new `Badge` component to the Backstage UI library. Badge shares the same visual appearance as `Tag` (size tokens, colors, border radius, icon slot) but renders as a plain non-interactive `<span>` with no React Aria plumbing.
Key characteristics:
- Plain DOM element — accessible text content exposed to screen readers without any role override
- Background consumer — participates in the bg context system and steps up neutral background levels (`neutral-2` → `neutral-3` → `neutral-4`) when placed inside colored containers
- Supports `icon`, `size` (`small` | `medium`, defaults to `small`), `children`, and `className` props
- Fully themeable via `BadgeDefinition`
Also includes Storybook stories and full docs-ui documentation (props table, examples, theming section, changelog).
Signed-off-by: Charles de Dreuille <charles.dedreuille@gmail.com>
Made-with: Cursor
* verify-links: catch broken anchors, directory links, and invisible characters
Enhances the link verification script to catch several categories of
broken links that were previously missed:
- Broken anchors (cross-file and same-file) by extracting heading slugs
from target documents and verifying anchors resolve
- Directory links missing index.md suffix within docs/
- Invisible/zero-width characters in URLs
- Case-sensitive anchor mismatches
Also strips fenced code blocks before scanning for links to avoid false
positives, and handles duplicate heading slug deduplication (GitHub and
Docusaurus append -1, -2, etc.).
Fixes a few newly-caught broken links in existing docs.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
* Fix CodeQL incomplete multi-character sanitization alert
Apply HTML tag stripping in a loop so that nested fragments
like <scr<script>ipt> are fully removed.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
---------
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Make `permissionsRegistry` required and `permissions` always a
`PermissionsService` in `CatalogEnvironment`. Remove the deprecated
`PermissionAuthorizer` fallback path and the `createPermissionIntegrationRouter`
fallback — catalog now exclusively uses `permissionsRegistry.addResourceType`
to register its permission resource type.
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Made-with: Cursor
Adds startup warnings to HostDiscovery.fromConfig when backend.baseUrl
is set to a localhost address in a production environment, or when the
value is not a valid URL at all.
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Made-with: Cursor
The `toError` utility now converts thrown strings to proper `Error`
objects, changing the cause message format from `unknown error 'boom'`
to `Error: boom`.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
- Remove JSON.stringify fallback from toError, use the same unknown
error messaging as stringifyError for all non-string/non-error values
- Add try/catch to protect against values that throw on string
conversion (e.g. null-prototype objects, symbols)
- Fix no-op `void toError(err)` in DeleteEntityConfirmationDialog
- Fix `${err}` producing [object Object] in UrlReaderProcessor
- Fix double toError call in openStackSwift
- Update JSDoc to accurately describe the behavior
- Add tests for throwing toString and circular objects
- Add changeset for all refactored packages
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Add a `toError` utility function to `@backstage/errors` that converts
unknown values to `ErrorLike` objects. If the value is already error-like
it is returned as-is. Strings are used directly as the error message, and
other values are stringified with a fallback to JSON.stringify to avoid
unhelpful `[object Object]` messages.
Non-error causes passed to `CustomErrorBase` are now converted and stored
using `toError` rather than discarded. Existing `assertError` call sites
across the codebase are migrated to `toError`.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Export NfsDefaultCatalogPage as CatalogIndexPage from the ./alpha entry
point along with CatalogIndexPageProps, CatalogTableRow, and
CatalogTableColumnsFunc. This allows adopters to use and customize the
catalog index page within a PageBlueprint in the new frontend system.
No changes to the stable main entry point API.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Uses a PID file to track which process owns each temp directory, so
concurrent instances from different projects are not affected.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
- Close embedded DB on shutdown to avoid leaking the Postgres process
and temp directory
- Use fs.remove instead of deprecated fs.rmdir with recursive option
- Guard against absolute config paths in readDatabaseClient
- Forward embedded-postgres error logs to console.error
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
The 18.x version ships its own .d.ts files that TypeScript resolves
correctly, so the custom module declaration is no longer needed.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Fix implicit any types in startEmbeddedDb callbacks, replace the
re-export type declaration with an inline type definition for the
embedded-postgres module, and update runBackend tests to mock the
config loading and use async timer advancement.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Replace manual string concatenation with URL and URLSearchParams for
safer encoding and better readability.
Signed-off-by: Jonathan Roebuck <jroebuck@spotify.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Patrik Oldsberg