Glob v13 treats backslashes as escape characters by default, unlike v7
which treated them as path separators on Windows. This broke Windows CI
where path.join/resolve produce backslash paths.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Addresses the high severity rollup path traversal vulnerability
(GHSA-mw96-cpmx-2vgc) and the glob security advisory by upgrading
all instances across the monorepo. Updates code that used the legacy
callback-based glob API to use the modern promise/sync API.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Addresses the high severity rollup path traversal vulnerability
(GHSA-mw96-cpmx-2vgc) and the glob security advisory by upgrading
all instances across the monorepo. Updates code that used the legacy
callback-based glob API to use the modern promise/sync API.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Addresses the high severity rollup path traversal vulnerability
(GHSA-mw96-cpmx-2vgc) and the glob security advisory by upgrading
all instances across the monorepo. Updates code that used the legacy
callback-based glob API to use the modern promise/sync API.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Replace the bulk DELETE + INSERT of all search rows with a minimal sync
that only touches rows that actually changed:
- Postgres: single writable CTE with unnest — DELETE stale rows and
INSERT new ones in one atomic statement using snapshot isolation
- MySQL: temporary table merge with deadlock retry (errno 1213)
- SQLite: unchanged bulk replace (sufficient for dev/test)
For a typical user entity with ~200 search rows where one annotation
changed, this reduces the operation from ~400 row writes to ~2.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Special-case `from: '/'` in redirect config to use an exact path match
instead of the `/*` wildcard, which would match the entire app.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Add installation example for extraIcons in the customize-theme guide
and fix "productional code" typo in quickstart-app-plugin--old.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
The RealAlertApiStory component used require('@backstage/core-plugin-api')
inside the function body. Vite bundles Storybook as ESM, where require is
not available at runtime, causing a ReferenceError. Replace with a
standard top-level import.
Signed-off-by: Charles de Dreuille <charles.dedreuille@gmail.com>
Made-with: Cursor
Add AppThemeSelector as an implementation for appThemeApiRef in the
shared Storybook API registry. Without this, any story that renders
a ToastContainer fails with NotImplementedError for core.apptheme.
Signed-off-by: Charles de Dreuille <charles.dedreuille@gmail.com>
Made-with: Cursor
Use dynamic import pattern for SubPageBlueprint loader instead of
Promise.resolve, and fix missing comma in TypeScript example.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Allow users to configure URL redirects on the app/routes extension
through app-config. Redirects are specified as an array of {from, to}
path pairs in the extension config schema.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Roll back the NFS page component changes (BuiHeader, headerVariant,
NfsCatalogGraphPage, NfsDefaultImportPage) from catalog-graph and
catalog-import plugins. Only the title and icon metadata additions to the
new frontend system plugin definitions are retained.
For the kubernetes plugin, replace the generic RiShipLine icon with a
proper Kubernetes helm wheel SVG icon from Simple Icons.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Fredrik Adelöw