Glob v13 treats backslashes as escape characters by default, unlike v7
which treated them as path separators on Windows. This broke Windows CI
where path.join/resolve produce backslash paths.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
The legacy frontend plugin template had the same name (`frontend-plugin`) as
the new frontend plugin template, causing a conflict error when both were shown
(e.g. when the frontend system could not be auto-detected). Rename the legacy
template to `frontend-plugin-legacy` so both can coexist.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Vincenzo Scamporlino <vincenzos@spotify.com>
Add `position: relative` and `z-index: 2` to nav items so they
paint above the hover/active indicator, matching the Tabs pattern.
This fixes themes with opaque `--bui-bg-neutral-2` values obscuring
tab labels on hover.
Also fix `--bui-font-family` (non-existent) to `--bui-font-regular`.
Signed-off-by: Johan Persson <johanopersson@gmail.com>
Addresses the high severity rollup path traversal vulnerability
(GHSA-mw96-cpmx-2vgc) and the glob security advisory by upgrading
all instances across the monorepo. Updates code that used the legacy
callback-based glob API to use the modern promise/sync API.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Addresses the high severity rollup path traversal vulnerability
(GHSA-mw96-cpmx-2vgc) and the glob security advisory by upgrading
all instances across the monorepo. Updates code that used the legacy
callback-based glob API to use the modern promise/sync API.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Addresses the high severity rollup path traversal vulnerability
(GHSA-mw96-cpmx-2vgc) and the glob security advisory by upgrading
all instances across the monorepo. Updates code that used the legacy
callback-based glob API to use the modern promise/sync API.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
The test assertions for lazy-loaded extension components used the
default 1000ms RTL timeout, which is insufficient under CI load.
Increased to 10000ms to match the pattern in createDevApp.test.tsx.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Replace the bulk DELETE + INSERT of all search rows with a minimal sync
that only touches rows that actually changed:
- Postgres: single writable CTE with unnest — DELETE stale rows and
INSERT new ones in one atomic statement using snapshot isolation
- MySQL: temporary table merge with deadlock retry (errno 1213)
- SQLite: unchanged bulk replace (sufficient for dev/test)
For a typical user entity with ~200 search rows where one annotation
changed, this reduces the operation from ~400 row writes to ~2.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Special-case `from: '/'` in redirect config to use an exact path match
instead of the `/*` wildcard, which would match the entire app.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Add installation example for extraIcons in the customize-theme guide
and fix "productional code" typo in quickstart-app-plugin--old.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Karthik