@backstage/repo-tools 0.17.1-next.0 → 0.17.1-next.1

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @backstage/repo-tools
 
+## 0.17.1-next.1
+
+### Patch Changes
+
+- 2e5c5f8: Bumped `glob` dependency from v7/v8/v11 to v13 to address security vulnerabilities in older versions. Bumped `rollup` from v4.27 to v4.59+ to fix a high severity path traversal vulnerability (GHSA-mw96-cpmx-2vgc).
+- 8e9679b: Parallelized CLI report generation, reducing wall-clock time by ~4x.
+- Updated dependencies
+  - @backstage/backend-plugin-api@1.9.0-next.1
+
 ## 0.17.1-next.0
 
 ### Patch Changes

package/dist/commands/api-reports/cli-reports/runCliExtraction.cjs.js

@@ -1,7 +1,9 @@
 'use strict';
 
 var path = require('node:path');
+var os = require('node:os');
 var fs = require('fs-extra');
+var pLimit = require('p-limit');
 var util = require('../../util.cjs.js');
 var cliCommon = require('@backstage/cli-common');
 var generateCliReport = require('./generateCliReport.cjs.js');
@@ -9,7 +11,9 @@ var logApiReportInstructions = require('../common/logApiReportInstructions.cjs.j
 
 function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
 
+var os__default = /*#__PURE__*/_interopDefaultCompat(os);
 var fs__default = /*#__PURE__*/_interopDefaultCompat(fs);
+var pLimit__default = /*#__PURE__*/_interopDefaultCompat(pLimit);
 
 function parseHelpPage(helpPageContent) {
   let usage;
@@ -59,10 +63,10 @@ function parseHelpPage(helpPageContent) {
     commandArguments
   };
 }
-async function exploreCliHelpPages(run) {
+async function exploreCliHelpPages(run, limit) {
   const helpPages = new Array();
   async function exploreHelpPage(...path) {
-    const content = await run(...path, "--help");
+    const content = await limit(() => run(...path, "--help"));
     const parsed = parseHelpPage(content);
     helpPages.push({ path, ...parsed });
     await Promise.all(
@@ -82,65 +86,68 @@ async function runCliExtraction({
   packageDirs,
   isLocalBuild
 }) {
-  for (const packageDir of packageDirs) {
-    console.log(`## Processing ${packageDir}`);
-    const fullDir = cliCommon.targetPaths.resolveRoot(packageDir);
-    const pkgJson = await fs__default.default.readJson(path.resolve(fullDir, "package.json"));
-    if (!pkgJson.bin) {
-      if (pkgJson.backstage?.role === "cli") {
-        throw new Error(
-          `CLI package ${pkgJson.name} is missing a "bin" field in its package.json`
-        );
-      }
-      continue;
-    }
-    const models = new Array();
-    if (typeof pkgJson.bin === "string") {
-      const run = util.createBinRunner(fullDir, pkgJson.bin);
-      const helpPages = await exploreCliHelpPages(run);
-      models.push({ name: path.basename(pkgJson.bin), helpPages });
-    } else {
-      for (const [name, path] of Object.entries(pkgJson.bin)) {
-        const run = util.createBinRunner(fullDir, path);
-        const helpPages = await exploreCliHelpPages(run);
-        models.push({ name, helpPages });
+  const limit = pLimit__default.default(os__default.default.cpus().length);
+  await Promise.all(
+    packageDirs.map(async (packageDir) => {
+      console.log(`## Processing ${packageDir}`);
+      const fullDir = cliCommon.targetPaths.resolveRoot(packageDir);
+      const pkgJson = await fs__default.default.readJson(path.resolve(fullDir, "package.json"));
+      if (!pkgJson.bin) {
+        if (pkgJson.backstage?.role === "cli") {
+          throw new Error(
+            `CLI package ${pkgJson.name} is missing a "bin" field in its package.json`
+          );
+        }
+        return;
       }
-    }
-    for (const model of models) {
-      const report = generateCliReport.generateCliReport({ packageName: pkgJson.name, model });
-      const reportPath = path.resolve(
-        fullDir,
-        `cli-report.${models.length === 1 ? "" : `${model.name}.`}md`
-      );
-      const existingReport = await fs__default.default.readFile(reportPath, "utf8").catch((error) => {
-        if (error.code === "ENOENT") {
-          return void 0;
+      const models = new Array();
+      if (typeof pkgJson.bin === "string") {
+        const run = util.createBinRunner(fullDir, pkgJson.bin);
+        const helpPages = await exploreCliHelpPages(run, limit);
+        models.push({ name: path.basename(pkgJson.bin), helpPages });
+      } else {
+        for (const [name, path] of Object.entries(pkgJson.bin)) {
+          const run = util.createBinRunner(fullDir, path);
+          const helpPages = await exploreCliHelpPages(run, limit);
+          models.push({ name, helpPages });
         }
-        throw error;
-      });
-      if (existingReport !== report) {
-        if (isLocalBuild) {
-          console.warn(`CLI report changed for ${packageDir}`);
-          await fs__default.default.writeFile(reportPath, report);
-        } else {
-          logApiReportInstructions.logApiReportInstructions();
-          if (existingReport) {
-            console.log("");
-            console.log(
-              `The conflicting file is ${path.relative(
-                cliCommon.targetPaths.rootDir,
-                reportPath
-              )}, expecting the following content:`
-            );
-            console.log("");
-            console.log(report);
+      }
+      for (const model of models) {
+        const report = generateCliReport.generateCliReport({ packageName: pkgJson.name, model });
+        const reportPath = path.resolve(
+          fullDir,
+          `cli-report.${models.length === 1 ? "" : `${model.name}.`}md`
+        );
+        const existingReport = await fs__default.default.readFile(reportPath, "utf8").catch((error) => {
+          if (error.code === "ENOENT") {
+            return void 0;
+          }
+          throw error;
+        });
+        if (existingReport !== report) {
+          if (isLocalBuild) {
+            console.warn(`CLI report changed for ${packageDir}`);
+            await fs__default.default.writeFile(reportPath, report);
+          } else {
             logApiReportInstructions.logApiReportInstructions();
+            if (existingReport) {
+              console.log("");
+              console.log(
+                `The conflicting file is ${path.relative(
+                  cliCommon.targetPaths.rootDir,
+                  reportPath
+                )}, expecting the following content:`
+              );
+              console.log("");
+              console.log(report);
+              logApiReportInstructions.logApiReportInstructions();
+            }
+            throw new Error(`CLI report changed for ${packageDir}`);
           }
-          throw new Error(`CLI report changed for ${packageDir}, `);
         }
       }
-    }
-  }
+    })
+  );
 }
 
 exports.runCliExtraction = runCliExtraction;

package/dist/commands/package-docs/command.cjs.js

@@ -97,7 +97,8 @@ async function generateDocJson(pkg) {
 async function packageDocs(paths$1 = [], opts) {
   console.warn("!!! This is an experimental command !!!");
   const existingDocsJsonPaths = glob.glob.sync(
-    cliCommon.targetPaths.resolveRoot("dist-types/**/docs.json")
+    cliCommon.targetPaths.resolveRoot("dist-types/**/docs.json"),
+    { windowsPathsNoEscape: true }
   );
   if (existingDocsJsonPaths.length > 0) {
     console.warn(

package/dist/commands/util.cjs.js

@@ -8,40 +8,51 @@ var path = require('node:path');
 
 const ansiPattern = new RegExp(`${String.fromCharCode(27)}\\[[0-9;]*m`, "g");
 function createBinRunner(cwd, path$1) {
-  return async (...command) => {
-    const args = path$1 ? [path$1, ...command] : command;
-    const outPath = path.join(os.tmpdir(), `backstage-cli-out-${crypto.randomUUID()}.txt`);
-    const outFd = fs.openSync(outPath, "w");
-    try {
-      const result = node_child_process.spawnSync("node", args, {
+  return (...command) => {
+    return new Promise((resolve, reject) => {
+      const args = path$1 ? [path$1, ...command] : command;
+      const outPath = path.join(os.tmpdir(), `backstage-cli-out-${crypto.randomUUID()}.txt`);
+      const outFd = fs.openSync(outPath, "w");
+      const child = node_child_process.spawn("node", args, {
         cwd,
         env: { ...process.env, NO_COLOR: "1" },
         stdio: ["ignore", outFd, "pipe"]
       });
       fs.closeSync(outFd);
-      const stdout = fs.readFileSync(outPath, "utf8").replace(ansiPattern, "");
-      if (result.error) {
-        throw new Error(`Process error: ${result.error.message}`);
-      }
-      const stderr = result.stderr?.toString() ?? "";
-      if (result.signal) {
-        throw new Error(
-          `Process was killed with signal ${result.signal}
-${stderr}`
-        );
-      } else if (result.status !== 0) {
-        throw new Error(`Process exited with code ${result.status}
-${stderr}`);
-      } else if (stderr.trim()) {
-        throw new Error(`Command printed error output: ${stderr}`);
-      }
-      return stdout;
-    } finally {
-      try {
-        fs.unlinkSync(outPath);
-      } catch {
-      }
-    }
+      const stderrChunks = [];
+      child.stderr?.on("data", (chunk) => stderrChunks.push(chunk));
+      child.on("error", (err) => {
+        try {
+          fs.unlinkSync(outPath);
+        } catch {
+        }
+        reject(new Error(`Process error: ${err.message}`));
+      });
+      child.on("close", (code, signal) => {
+        try {
+          const stdout = fs.readFileSync(outPath, "utf8").replace(ansiPattern, "");
+          const stderr = Buffer.concat(stderrChunks).toString();
+          if (signal) {
+            reject(
+              new Error(`Process was killed with signal ${signal}
+${stderr}`)
+            );
+          } else if (code !== 0) {
+            reject(new Error(`Process exited with code ${code}
+${stderr}`));
+          } else if (stderr.trim()) {
+            reject(new Error(`Command printed error output: ${stderr}`));
+          } else {
+            resolve(stdout);
+          }
+        } finally {
+          try {
+            fs.unlinkSync(outPath);
+          } catch {
+          }
+        }
+      });
+    });
   };
 }
 

package/dist/package.json.cjs.js

@@ -1,6 +1,6 @@
 'use strict';
 
-var version = "0.17.1-next.0";
+var version = "0.17.1-next.1";
 
 exports.version = version;
 //# sourceMappingURL=package.json.cjs.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@backstage/repo-tools",
-  "version": "0.17.1-next.0",
+  "version": "0.17.1-next.1",
   "description": "CLI for Backstage repo tooling ",
   "backstage": {
     "role": "cli"
@@ -43,7 +43,7 @@
   "dependencies": {
     "@apidevtools/swagger-parser": "^10.1.0",
     "@apisyouwonthate/style-guide": "^1.4.0",
-    "@backstage/backend-plugin-api": "1.8.1-next.0",
+    "@backstage/backend-plugin-api": "1.9.0-next.1",
     "@backstage/catalog-model": "1.7.7",
     "@backstage/cli-common": "0.2.1-next.0",
     "@backstage/cli-node": "0.3.1-next.0",
@@ -69,7 +69,7 @@
     "command-exists": "^1.2.9",
     "commander": "^14.0.3",
     "fs-extra": "^11.2.0",
-    "glob": "^8.0.3",
+    "glob": "^13.0.0",
     "globby": "^11.0.0",
     "is-glob": "^4.0.3",
     "js-yaml": "^4.1.0",
@@ -87,8 +87,8 @@
     "zod": "^3.25.76 || ^4.0.0"
   },
   "devDependencies": {
-    "@backstage/backend-test-utils": "1.11.2-next.0",
-    "@backstage/cli": "0.36.1-next.0",
+    "@backstage/backend-test-utils": "1.11.2-next.1",
+    "@backstage/cli": "0.36.1-next.1",
     "@backstage/types": "1.2.2",
     "@types/is-glob": "^4.0.2",
     "@types/node": "^22.13.14",