fix(deps): update rhdh x2a dependencies (minor)#2791
Conversation
renovate
Bot
added
dependencies
renovate
Bot
added
dependencies
renovate
Bot
force-pushed
the
renovate/rhdh-x2a-dependencies-(minor)
branch
4 times, most recently
from
87e1106 to
e793dfb
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/rhdh-x2a-dependencies-(minor)
branch
15 times, most recently
from
d259287 to
46b6c08
Compare
renovate
Bot
force-pushed
the
renovate/rhdh-x2a-dependencies-(minor)
branch
17 times, most recently
from
175aa37 to
8ff6ec7
Compare
renovate
Bot
force-pushed
the
renovate/rhdh-x2a-dependencies-(minor)
branch
4 times, most recently
from
baf9418 to
a5bad3f
Compare
Changed Packages
|
There was a problem hiding this comment.
So far we must preserve RHDH 1.9 (Backstage 1.45.3) compatibility
The @playwright/test bump to 1.59.1 is fine.
The @backstage-community/plugin-rbac-backend should stay at 7.6.2 (or whichever version is compatible with Backstage 1.45.3).
The rbac-backend 7.12.3 code runs against @backstage/backend-defaults@0.13.2 and @backstage/backend-plugin-api@1.5.0. This is almost certain to cause runtime errors.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #2791 +/- ##
==========================================
- Coverage 53.29% 53.29% -0.01%
==========================================
Files 2407 2407
Lines 86420 86422 +2
Branches 23954 23953 -1
==========================================
Hits 46057 46057
- Misses 40036 40111 +75
+ Partials 327 254 -73
*This pull request uses carry forward flags. Click here to find out more. Continue to review full report in Codecov by Sentry.
🚀 New features to boost your workflow:
|
|
Partial fix: #3108 The @backstage-community/plugin-rbac-backend update must wait. |
|
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
|
2 participants
This PR contains the following updates:
7.6.2→7.13.01.59.1→1.60.0Release Notes
backstage/community-plugins (@backstage-community/plugin-rbac-backend)
v7.13.0Compare Source
Minor Changes
6a916a1: Backstage version bump to v1.50.4Patch Changes
6a916a1]v7.12.5Compare Source
Patch Changes
39a3942: Hardens RBAC policy handling to prevent Casbin CSV poisoning and improve error visibility.Key fixes:
permissionvalues containing"before persistence (prevents known CSV parse failures).loadPolicyfailures after audit logging so mutation/read paths surface the root cause instead of secondary errors.400/404where appropriate).Compatibility notes:
permissionvalues with embedded"are now rejected.permissionMappingmust list distinct Backstage permission actions (no duplicates); at most one entry per supported action (create,read,update,delete,use).permission.rbac.validation.conditionalPolicies.maxConditionDepthpermission.rbac.validation.conditionalPolicies.maxConditionNodeCountpermission.rbac.validation.conditionalPolicies.maxCriteriaItemspermission.rbac.validation.conditionalPoliciesFile.maxBytespermission.rbac.validation.conditionalPoliciesFile.maxDocumentsOperational note:
v7.12.4Compare Source
Patch Changes
170f85d: Migrate to Jest 30 and fix backend test assertion compatibility170f85d]v7.12.3Compare Source
Patch Changes
fb2a770: Made postgres username and password optional in casbin adapter factory to support passwordless authenticationv7.12.2Compare Source
Patch Changes
39272f8: Updated dependencycsv-parseto^6.0.0.70e6333: Updated dependency@dagrejs/graphlibto^4.0.0.a559dfb: Updated dependency@types/nodeto22.19.17.8846adf: Updated dependencyqsto6.15.1.v7.12.1Compare Source
Patch Changes
40e44bb: Updated dependencyqsto6.14.2.v7.12.0Compare Source
Minor Changes
8993474: Backstage version bump to v1.49.2Patch Changes
8993474]v7.11.0Compare Source
Minor Changes
50e194d: Add support for a default role and permissions for authenticated users in RBAC backendIntroduced a new
defaultRoleandbasicPermissionsconfiguration options to assign a default role to all authenticated users.Updated the RBAC permission policy to include the default role in user roles if not already present.
Patch Changes
50e194d]v7.10.0Compare Source
Minor Changes
133eae6: Add support for loading conditional permissions from a remote provider (fix #6412)Patch Changes
133eae6]v7.9.1Compare Source
Patch Changes
d737494: Backstage version bump to v1.48.5d737494]v7.9.0Compare Source
Minor Changes
da170a1: Add support for group reference in superUsers list, using direct membership onlyPatch Changes
8a6b81c: Updated dependency@types/supertestto^7.0.0.v7.8.0Compare Source
Minor Changes
843bbe2: Backstage version bump to v1.48.4Patch Changes
843bbe2]v7.7.2Compare Source
Patch Changes
8c7bddb: Added NFS supportaf998b7: Updated dependencysupertestto7.2.2.v7.7.1Compare Source
Patch Changes
b133c9d: Updated dependency@types/supertestto^6.0.0.497d5c6: Updated dependency@types/nodeto22.19.11.9c7ae87: Fix - stop error on upgrade v1.47.x - allow all plugins in the arry to showv7.7.0Compare Source
Minor Changes
e6dbf70: Backstage version bump to v1.47.2Patch Changes
e6dbf70: updated the permissionFactory to use theFetchUrlReader.fromConfiga184943: Updated dependency@types/nodeto22.19.7.e6dbf70]microsoft/playwright (@playwright/test)
v1.60.0Compare Source
🌐 HAR recording on Tracing
tracing.startHar() / tracing.stopHar() expose HAR recording as a first-class tracing API, with the same
content,modeandurlFilteroptions asrecordHar. The returned Disposable makes it easy to scope a recording withawait using:🪝 Drop API
New locator.drop() simulates an external drag-and-drop of files or clipboard-like data onto an element. Playwright dispatches
dragenter,dragover, anddropwith a synthetic [DataTransfer] in the page context — works cross-browser and is great for testing upload zones:🎯 Aria snapshots
page.locator('body').boxesoption on locator.ariaSnapshot() / page.ariaSnapshot() appends each element's bounding box as[box=x,y,width,height], useful for AI consumption.🛑 test.abort()
New test.abort() aborts the currently running test from a fixture, hook, or route handler with an optional message. Use it when you have detected an unrecoverable misuse and want to fail the test right away:
New APIs
Browser, Context and Page
Locators and Assertions
descriptionin page.getByRole() / locator.getByRole() / frame.getByRole() / frameLocator.getByRole() for matching the accessible description.pseudoin expect(locator).toHaveCSS() reads computed styles from::beforeor::after.stylein locator.highlight() applies extra inline CSS to the highlight overlay, plus new page.hideHighlight() to clear all highlights.Network
noDefaultsin browserType.connectOverCDP() disables Playwright's default overrides on the default context (download behavior, focus emulation, media emulation), so attaching to a user's daily-driver browser doesn't disturb its state.Errors and Reporting
line/columnproperties (lineNumber/columnNumberare deprecated).expect(...)matcher failure.workerInfoargument with details about the worker for fixture teardown errors.Test runner
{testFileBaseName}token in testProject.snapshotPathTemplate — file name without extension.workers: 0or negative values.🛠️ Other improvements
npx playwright show-reportaccepts.zipfiles directly — no need to unzip first.repeatEachIndexis shown in the test header when non-zero.Breaking Changes⚠️
Locator.ariaRef()— use the standard locator.ariaSnapshot() pipeline.handleoption onBrowserContext.exposeBindingandPage.exposeBinding.loggeroption onBrowserType.connectandBrowserType.connectOverCDP— use tracing instead.videosPath/videoSize— userecordVideoinstead.Browser Versions
This version was also tested against the following stable channels:
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.