Deduplicate the plugin/module feature flag registration loops and
distinguish the error source (Plugin vs Module). Treat
FEATURE_FLAG_INVALID as a warning in frontend-defaults.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
- Fixes the `Cannot access '_AppRootElementBlueprintesm' before
initialization` crash in `@backstage/frontend-plugin-api` caused by a
self-referential import in the packaged ESM.
- Cleans up similar self-imports in `@backstage/catalog-model`,
`@backstage/core-plugin-api`, `@backstage/plugin-catalog-node`,
`@backstage/plugin-kubernetes-common`, and
`@backstage/plugin-kubernetes-node`. Value imports switch to relative
paths; type-only imports use `import type` so they're erased at
runtime.
- Adds a new `@backstage/no-self-package-imports` ESLint rule. It reads
each package's `exports` map, traverses the relative import graph from
every entry's source file, and only reports imports where the current
file is in the same bundle as the target entry (same-entry). Files
that aren't reachable from any entry (tests, scripts, orphans) are
skipped. `import type`, `package.json` imports, and cross-entry
self-imports are allowed by default; cross-entry can be opted into
with `allowCrossEntry: false`.
Signed-off-by: Marat Dyatko <maratd@spotify.com>
Made-with: Cursor
The uuid package dropped its CommonJS entry point in v14, making it
incompatible with Backstage's CJS build output and Jest test runner.
Rather than working around the ESM-only issue, replace all usage with
the built-in crypto.randomUUID() which has been available in Node.js
since v16.7 and in all major browsers since March 2022.
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Made-with: Cursor
Both @braintree/sanitize-url (this branch) and @internationalized/date
(master) were added to packages/ui dependencies; keeping both.
Signed-off-by: Charles de Dreuille <charles.dedreuille@gmail.com>
- Replace custom UNSAFE_HREF_RE with @braintree/sanitize-url for robust XSS prevention
- Shorten renderInlineMarkdown JSDoc
- Single-user with href: collapse two adjacent links into one wrapping avatar + name
- Multi-user list: use href ?? index:name as key to avoid collisions on duplicate names
- Status dot: replace role="img"/aria-label with aria-hidden (text label is sufficient)
Signed-off-by: Charles de Dreuille <charles.dedreuille@gmail.com>
Wrap each feature flag registration in a try/catch so that a single
invalid flag name (e.g. containing a slash) is reported through the
error collector instead of crashing the entire app at bootstrap.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
- Tags: replace div+Fragment with ul/li; move circle divider to CSS ::before pseudo-element, removing it from the DOM
- Metadata: replace div wrapper with dl/dt/dd for proper key-value semantics; reset dl and dd browser margins
- HeaderMetadataUsers: render multi-user stack as ul/li; simplify single-user branch into one ternary with a fragment
- HeaderMetadataStatus: add role="img" and aria-label to the status dot so screen readers announce its meaning
- Restore Fragment import from react
Signed-off-by: Charles de Dreuille <charles.dedreuille@gmail.com>
Uses marked's Lexer.lexInline() instead of a hand-rolled regex to parse
inline links in the Header description. marked ships CommonJS, has zero
dependencies, and is already used in the monorepo. This gives us a proper
token model that handles edge cases the regex could not.
Signed-off-by: Charles de Dreuille <charles.dedreuille@gmail.com>
The following patches were included in the v1.50.2 patch release and
no longer need to be tracked:
- pr-33908 (TechDocs sidebar positioning)
- pr-33952 (zod v4 bump)
- pr-33975 (React Aria dependency clamping)
- pr-33984 (tab indicator opacity fix)
Signed-off-by: Fredrik Adelöw <freben@spotify.com>
Made-with: Cursor
- Replace hardcoded gap: 20px with var(--bui-space-5) in metadata row
- Trim leading whitespace from href before unsafe-scheme check to prevent bypass
Signed-off-by: Charles de Dreuille <charles.dedreuille@gmail.com>
Reverting the full-width change as it is too disruptive at this time
and will be handled in a separate PR.
Signed-off-by: Charles de Dreuille <charles.dedreuille@gmail.com>
- Guard against unsafe URL schemes (javascript:/vbscript:/data:) in description links
- Use index-based keys for tags and metadata to avoid duplicate-key warnings
- Render ReactNode metadata values directly instead of wrapping in Text to avoid invalid span>div nesting; only wrap plain strings in Text
- Replace empty-string Avatar src fallback with data:, to prevent spurious page requests
- Fix JSDoc in HeaderMetadataUsers to accurately describe the row layout
Signed-off-by: Charles de Dreuille <charles.dedreuille@gmail.com>
react-markdown v8+ is ESM-only and breaks Jest in Node-role packages that
transitively import @backstage/ui via core-app-api. Since the Header
description only needs inline link support, a small regex-based parser
is sufficient and avoids the ESM dependency entirely.
Signed-off-by: Charles de Dreuille <charles.dedreuille@gmail.com>
Patrik Oldsberg