e9b6e978f1
Merge commit from fork
...
* fix: prevent SSRF via redirect in CIMD metadata fetch
* fix: prevent SSRF via redirect in CIMD metadata fetch
* fix: add redirect target listener to SSRF redirect test
2026-03-11 13:34:25 +01:00
4f5ed06dd1
Merge commit from fork
2026-03-11 13:33:31 +01:00
0f9d673e82
Merge commit from fork
...
* Fix redirect URI allowlist bypass via URL userinfo syntax
* Validate redirect URIs against normalized origin+pathname
2026-03-11 13:33:00 +01:00
b9a41c0a22
chore(deps): update dependency @uiw/react-codemirror to v4.25.8
...
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-03-11 12:14:09 +01:00
6ea57c4fed
chore(deps): update dependency @uiw/codemirror-themes to v4.25.8
...
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-03-11 12:13:27 +01:00
03b72362a9
Merge pull request #33283 from backstage/freben/dependabot-approve-lockonly
...
chore(ci): auto-approve yarn.lock-only dependabot PRs
2026-03-11 11:41:17 +01:00
da08dd1a8b
Merge pull request #33244 from backstage/renovate/eslint-monorepo
...
chore(deps): update dependency eslint to v9.39.4
2026-03-11 11:24:03 +01:00
22475eaba9
Merge pull request #33237 from backstage/renovate/shiki-monorepo
...
chore(deps): update shiki monorepo to v3.23.0
2026-03-11 11:23:45 +01:00
c08e4daf24
Merge pull request #33178 from backstage/renovate/postcss-8.x-lockfile
...
chore(deps): update dependency postcss to v8.5.8
2026-03-11 11:23:27 +01:00
96cbf33e12
Merge pull request #33276 from backstage/dependabot/npm_and_yarn/hono-4.12.7
...
chore(deps): bump hono from 4.12.5 to 4.12.7
2026-03-11 11:22:06 +01:00
f969ed66e1
Merge pull request #33274 from backstage/renovate/npm-tar-vulnerability
...
chore(deps): update dependency tar to v7.5.11 [security]
2026-03-11 10:21:27 +00:00
a55682b2c4
Merge pull request #33266 from backstage/renovate/knip-5.x-lockfile
...
chore(deps): update dependency knip to v5.86.0
2026-03-11 10:21:23 +00:00
040551d99b
chore(ci): auto-approve yarn.lock-only dependabot PRs
...
Add the same auto-approval step that the renovate workflow already has,
so that dependabot PRs that only touch yarn.lock files get approved
automatically.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
Signed-off-by: Fredrik Adelöw <freben@spotify.com >
2026-03-11 11:20:17 +01:00
9148bbaf88
chore(deps): update dependency motion to v12.35.1
...
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-03-11 11:12:10 +01:00
3772043284
chore(deps): bump hono from 4.12.5 to 4.12.7
...
Bumps [hono](https://github.com/honojs/hono ) from 4.12.5 to 4.12.7.
- [Release notes](https://github.com/honojs/hono/releases )
- [Commits](https://github.com/honojs/hono/compare/v4.12.5...v4.12.7 )
---
updated-dependencies:
- dependency-name: hono
dependency-version: 4.12.7
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-03-11 02:16:09 +00:00
b106887f5b
chore(deps): update dependency tar to v7.5.11 [security]
...
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-03-10 23:54:34 +00:00
90ea210559
Merge pull request #33100 from backstage/changeset-release/master
...
Version Packages (next)
2026-03-10 19:45:31 +01:00
ed7c4e3bef
Version Packages (next)
2026-03-10 17:34:12 +00:00
1097f68579
Merge pull request #33181 from backstage/rugvip/cli-boolean-flag-negation
...
cli: enable --no- prefix negation for boolean flags
2026-03-10 18:27:53 +01:00
106d1b2a0e
feat(catalog-backend-module-github): add config flag for verified email behavior ( #33262 )
...
Add a `defaultUserTransformer.useVerifiedEmails` config option to the
githubOrg provider, making the verified domain email behavior from #32997
opt-in rather than the default.
Signed-off-by: Jonathan Roebuck <jroebuck@spotify.com >
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com >
2026-03-10 16:55:53 +00:00
b959d534b3
chore(deps): update dependency knip to v5.86.0
...
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-03-10 16:42:36 +00:00
bed58405ab
Merge pull request #33263 from backstage/freben/notar
...
remove @types/tar
2026-03-10 17:27:11 +01:00
df604dd3ae
Merge pull request #33261 from backstage/freben/icon
...
fixup icons
2026-03-10 17:26:01 +01:00
74aa55f0e9
chore: reset yarn.lock
...
Signed-off-by: benjdlambert <ben@blam.sh >
2026-03-10 17:20:38 +01:00
5a5a113070
chore: deduplicate yarn.lock entries
...
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com >
Made-with: Cursor
2026-03-10 17:20:38 +01:00
feaf449008
cli: enable --no- prefix negation for boolean flags
...
Bump cleye to ^2.3.0 (which pulls in type-flag 4.1.0) and enable
booleanFlagNegation: true in all cli() invocations so that boolean
flags automatically support --no-<flag> prefix negation.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com >
Made-with: Cursor
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com >
Made-with: Cursor
2026-03-10 17:20:38 +01:00
fa6dd7a611
chore: fix build ( #33264 )
...
Signed-off-by: benjdlambert <ben@blam.sh >
2026-03-10 17:19:29 +01:00
dbb7f0017a
Merge pull request #33176 from backstage/freben/xml
...
bump aws-sdk to get rid of critical fast-xml-parser warning
2026-03-10 17:04:33 +01:00
d4d52fb13c
fix(ui): ensure disabled rows override pointer cursor
...
Move the disabled rule after the pointer cursor rules so that
disabled rows always show cursor: not-allowed, even when they
have data-href or data-selection-mode.
Signed-off-by: Johan Persson <johanopersson@gmail.com >
2026-03-10 17:00:38 +01:00
f42f4cc055
fix(ui): truncate Table column headers with ellipsis on overflow
...
Wrap column header text in a label span with text-overflow: ellipsis
so that long headers truncate instead of wrapping to multiple lines.
Signed-off-by: Johan Persson <johanopersson@gmail.com >
2026-03-10 17:00:38 +01:00
fbd5c5a93d
fix(ui): only show pointer cursor on interactive Table rows
...
Row always passed onAction to React Aria even when no handler or
href was set, causing all rows to appear interactive. Now onAction
is only passed when there is an actual interaction. CSS explicitly
sets cursor: default on rows and scopes cursor: pointer to rows
with href, selection mode, or pressable state.
Signed-off-by: Johan Persson <johanopersson@gmail.com >
2026-03-10 17:00:38 +01:00
1fd15249ad
remove @types/tar
...
Signed-off-by: Fredrik Adelöw <freben@spotify.com >
2026-03-10 16:44:41 +01:00
645749d827
Merge pull request #33180 from cftad/gh-waittime
...
Update GitHub Scaffolder Environment Action Input Description
2026-03-10 16:41:20 +01:00
da2a0f974c
Merge pull request #33242 from backstage/renovate/react-monorepo
...
fix(deps): update dependency react-refresh to ^0.18.0
2026-03-10 16:39:28 +01:00
37459ebed3
Merge pull request #33027 from Flagsmith/asaphk/flagsmith-plugin
...
docs: add the Flagsmith plugin to the microsite directory
2026-03-10 16:36:54 +01:00
f234b29025
Merge pull request #33234 from backstage/renovate/postgres-17.x
...
chore(deps): update postgres docker tag to v17.9
2026-03-10 16:34:19 +01:00
1340c82948
fixup icons
...
Signed-off-by: Fredrik Adelöw <freben@spotify.com >
2026-03-10 16:33:24 +01:00
cbc012c664
Merge pull request #32340 from Believe-SA/docs/hooks
...
feat(docs-ui): document BUI's hooks
2026-03-10 16:29:22 +01:00
c07c27d2b1
Merge pull request #33258 from backstage/freben/fix-e2e
...
fix end to end tests
2026-03-10 16:27:40 +01:00
26fa44767a
Merge pull request #31989 from 0xts/feat/scaffolder-logs-btn
...
feat: add log download btn for LogViewer
2026-03-10 16:24:26 +01:00
1b116e4160
Merge pull request #33210 from backstage/renovate/changesets-cli-2.x-lockfile
...
chore(deps): update dependency @changesets/cli to v2.30.0
2026-03-10 16:23:34 +01:00
2fe57aa333
Merge pull request #33158 from backstage/freben/move-stitch-queue-2
...
catalog: move stitch queue into dedicated table
2026-03-10 16:21:13 +01:00
294f9fe17f
Merge pull request #32377 from samarthsinh2660/fix/table-filters-title-layout
...
fix(core-components): fix Table layout when filters and title are used together
2026-03-10 16:19:10 +01:00
a302ac285c
fix end to end tests
...
Signed-off-by: Fredrik Adelöw <freben@spotify.com >
2026-03-10 16:16:12 +01:00
422a79039b
Merge pull request #32619 from kaidubauskas-dd/kaidd/fix-user-slack-dms
...
fix(notifications-slack): Only DM explicit user recipients
2026-03-10 15:33:57 +01:00
3b38dd0249
fix: mock fromTemporaryCredentials at module boundary instead of nested STS client
...
Replace the @aws-sdk/nested-clients/sts mock with a mock of
fromTemporaryCredentials itself. This avoids depending on AWS SDK
internal implementation details while still verifying that the correct
role ARN, session name, and external ID are passed.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
Signed-off-by: Fredrik Adelöw <freben@spotify.com >
2026-03-10 15:29:30 +01:00
241aa36b00
Merge pull request #33221 from backstage/freben/add-location-on-conflict-refresh
...
Add onConflict option to location registration endpoint
2026-03-10 15:19:31 +01:00
63746129b2
reports
...
Signed-off-by: Fredrik Adelöw <freben@spotify.com >
2026-03-10 15:18:11 +01:00
a49c59f2da
Update .changeset/curvy-socks-punch.md
...
Signed-off-by: Fredrik Adelöw <freben@gmail.com >
2026-03-10 14:56:07 +01:00
5dc320ed5e
remove unnecessary cast
...
Signed-off-by: Fredrik Adelöw <freben@spotify.com >
2026-03-10 14:39:01 +01:00
Ben Lambert