cherry-pick node-tar patch

.changeset/green-flowers-brush.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-scaffolder-backend': patch
+---
+
+Removed unused dependency

.changeset/odd-eagles-guess.md

@@ -0,0 +1,8 @@
+---
+'@backstage/backend-defaults': patch
+'@backstage/plugin-scaffolder-node': patch
+'@backstage/repo-tools': patch
+'@backstage/cli': patch
+---
+
+Bump to tar v7

packages/backend-defaults/package.json

@@ -188,7 +188,7 @@
     "rate-limit-redis": "^4.2.0",
     "raw-body": "^2.4.1",
     "selfsigned": "^2.0.0",
-    "tar": "^6.1.12",
+    "tar": "^7.5.6",
     "triple-beam": "^1.4.1",
     "uuid": "^11.0.0",
     "winston": "^3.2.1",

packages/backend-defaults/src/entrypoints/urlReader/lib/tree/ReadableArrayResponse.ts

@@ -25,7 +25,7 @@ import platformPath, { dirname } from 'path';
 import getRawBody from 'raw-body';
 import fs from 'fs-extra';
 import { promisify } from 'util';
-import tar from 'tar';
+import * as tar from 'tar';
 import { pipeline as pipelineCb, Readable } from 'stream';
 import { FromReadableArrayOptions } from '../types';
 

packages/backend-defaults/src/entrypoints/urlReader/lib/tree/TarArchiveResponse.test.ts

@@ -18,7 +18,7 @@ import fs from 'fs-extra';
 import { resolve as resolvePath, join as joinPath } from 'path';
 import { TarArchiveResponse } from './TarArchiveResponse';
 import { createMockDirectory } from '@backstage/backend-test-utils';
-import tar from 'tar';
+import * as tar from 'tar';
 
 const archiveData = fs.readFileSync(
   resolvePath(__filename, '../../__fixtures__/mock-main.tar.gz'),

packages/backend-defaults/src/entrypoints/urlReader/lib/tree/TarArchiveResponse.ts

@@ -24,13 +24,11 @@ import concatStream from 'concat-stream';
 import fs from 'fs-extra';
 import platformPath from 'path';
 import { pipeline as pipelineCb, Readable } from 'stream';
-import tar, { FileStat, Parse, ParseStream, ReadEntry } from 'tar';
+import * as tar from 'tar';
+import type { ReadEntry } from 'tar';
 import { promisify } from 'util';
 import { stripFirstDirectoryFromPath } from './util';
 
-// Tar types for `Parse` is not a proper constructor, but it should be
-const TarParseStream = Parse as unknown as { new (): ParseStream };
-
 const pipeline = promisify(pipelineCb);
 
 /**
@@ -73,7 +71,7 @@ export class TarArchiveResponse implements UrlReaderServiceReadTreeResponse {
     this.onlyOnce();
 
     const files = Array<UrlReaderServiceReadTreeResponseFile>();
-    const parser = new TarParseStream();
+    const parser = new tar.Parser();
 
     parser.on('entry', (entry: ReadEntry & Readable) => {
       if (entry.type === 'Directory') {
@@ -172,7 +170,7 @@ export class TarArchiveResponse implements UrlReaderServiceReadTreeResponse {
           }
 
           // Block symlinks/hardlinks that escape the extraction directory
-          const entry = stat as FileStat & { type?: string; linkpath?: string };
+          const entry = stat as ReadEntry;
           if (
             (entry.type === 'SymbolicLink' || entry.type === 'Link') &&
             entry.linkpath

packages/cli/package.json

@@ -141,7 +141,7 @@
     "style-loader": "^3.3.1",
     "sucrase": "^3.20.2",
     "swc-loader": "^0.2.3",
-    "tar": "^6.1.12",
+    "tar": "^7.5.6",
     "ts-checker-rspack-plugin": "^1.1.5",
     "ts-morph": "^24.0.0",
     "undici": "^7.2.3",

packages/cli/src/modules/build/lib/buildBackend.ts

@@ -17,7 +17,7 @@
 import os from 'os';
 import fs from 'fs-extra';
 import { resolve as resolvePath } from 'path';
-import tar, { CreateOptions } from 'tar';
+import * as tar from 'tar';
 import { createDistWorkspace } from './packager';
 import { getEnvironmentParallelism } from '../../../lib/parallel';
 import { buildPackage, Output } from './builder';
@@ -78,7 +78,7 @@ export async function buildBackend(options: BuildBackendOptions) {
         portable: true,
         noMtime: true,
         gzip: true,
-      } as CreateOptions & { noMtime: boolean },
+      },
       [''],
     );
   } finally {

packages/cli/src/modules/build/lib/packager/createDistWorkspace.ts

@@ -22,7 +22,7 @@ import {
   relative as relativePath,
 } from 'path';
 import { tmpdir } from 'os';
-import tar, { CreateOptions, FileOptions } from 'tar';
+import * as tar from 'tar';
 import partition from 'lodash/partition';
 import { paths } from '../../../../lib/paths';
 import { run } from '../../../../lib/run';
@@ -268,7 +268,7 @@ export async function createDistWorkspace(
         portable: true,
         noMtime: true,
         gzip: options.skeleton.endsWith('.gz'),
-      } as CreateOptions & FileOptions & { noMtime: boolean },
+      },
       skeletonFiles,
     );
   }

packages/repo-tools/package.json

@@ -80,7 +80,7 @@
     "minimatch": "^9.0.0",
     "p-limit": "^3.0.2",
     "portfinder": "^1.0.32",
-    "tar": "^6.1.12",
+    "tar": "^7.5.6",
     "ts-morph": "^24.0.0",
     "yaml-diff-patch": "^2.0.0",
     "zod": "^3.22.4"

packages/repo-tools/src/commands/generate-patch/generate-patch.ts

@@ -28,7 +28,7 @@ import { ForwardedError } from '@backstage/errors';
 import { Readable } from 'stream';
 import { finished } from 'stream/promises';
 import { ReadableStream } from 'stream/web';
-import tar from 'tar';
+import * as tar from 'tar';
 
 // TODO: add option for this
 const DEFAULT_REGISTRY_URL = 'https://registry.npmjs.org';

plugins/scaffolder-backend/package.json

@@ -104,7 +104,6 @@
     "p-limit": "^3.1.0",
     "p-queue": "^6.6.2",
     "prom-client": "^15.0.0",
-    "tar": "^6.1.12",
     "triple-beam": "^1.4.1",
     "uuid": "^11.0.0",
     "winston": "^3.2.1",

plugins/scaffolder-node/package.json

@@ -69,7 +69,7 @@
     "jsonschema": "^1.5.0",
     "lodash": "^4.17.21",
     "p-limit": "^3.1.0",
-    "tar": "^6.1.12",
+    "tar": "^7.5.6",
     "winston": "^3.2.1",
     "winston-transport": "^4.7.0",
     "zod": "^3.22.4",

plugins/scaffolder-node/src/tasks/serializer.ts

@@ -14,7 +14,7 @@
  * limitations under the License.
  */
 
-import tar from 'tar';
+import * as tar from 'tar';
 import concatStream from 'concat-stream';
 import { promisify } from 'util';
 import { pipeline as pipelineCb, Readable } from 'stream';

yarn.lock

@@ -2616,7 +2616,7 @@ __metadata:
     raw-body: "npm:^2.4.1"
     selfsigned: "npm:^2.0.0"
     supertest: "npm:^7.0.0"
-    tar: "npm:^6.1.12"
+    tar: "npm:^7.5.6"
     triple-beam: "npm:^1.4.1"
     uuid: "npm:^11.0.0"
     wait-for-expect: "npm:^3.0.2"
@@ -2968,7 +2968,7 @@ __metadata:
     style-loader: "npm:^3.3.1"
     sucrase: "npm:^3.20.2"
     swc-loader: "npm:^0.2.3"
-    tar: "npm:^6.1.12"
+    tar: "npm:^7.5.6"
     terser-webpack-plugin: "npm:^5.1.3"
     ts-checker-rspack-plugin: "npm:^1.1.5"
     ts-morph: "npm:^24.0.0"
@@ -6389,7 +6389,6 @@ __metadata:
     prom-client: "npm:^15.0.0"
     strip-ansi: "npm:^7.1.0"
     supertest: "npm:^7.0.0"
-    tar: "npm:^6.1.12"
     triple-beam: "npm:^1.4.1"
     uuid: "npm:^11.0.0"
     wait-for-expect: "npm:^3.0.2"
@@ -6472,7 +6471,7 @@ __metadata:
     jsonschema: "npm:^1.5.0"
     lodash: "npm:^4.17.21"
     p-limit: "npm:^3.1.0"
-    tar: "npm:^6.1.12"
+    tar: "npm:^7.5.6"
     winston: "npm:^3.2.1"
     winston-transport: "npm:^4.7.0"
     zod: "npm:^3.22.4"
@@ -7377,7 +7376,7 @@ __metadata:
     minimatch: "npm:^9.0.0"
     p-limit: "npm:^3.0.2"
     portfinder: "npm:^1.0.32"
-    tar: "npm:^6.1.12"
+    tar: "npm:^7.5.6"
     ts-morph: "npm:^24.0.0"
     typedoc: "npm:^0.28.0"
     yaml-diff-patch: "npm:^2.0.0"
@@ -31735,7 +31734,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"glob@npm:^10.0.0, glob@npm:^10.2.2, glob@npm:^10.3.10, glob@npm:^10.3.7, glob@npm:^10.4.1":
+"glob@npm:^10.0.0, glob@npm:^10.2.2, glob@npm:^10.3.10, glob@npm:^10.4.1":
   version: 10.4.5
   resolution: "glob@npm:10.4.5"
   dependencies:
@@ -38321,13 +38320,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"minizlib@npm:^3.0.1":
-  version: 3.0.1
-  resolution: "minizlib@npm:3.0.1"
+"minizlib@npm:^3.0.1, minizlib@npm:^3.1.0":
+  version: 3.1.0
+  resolution: "minizlib@npm:3.1.0"
   dependencies:
-    minipass: "npm:^7.0.4"
-    rimraf: "npm:^5.0.5"
-  checksum: 10/622cb85f51e5c206a080a62d20db0d7b4066f308cb6ce82a9644da112367c3416ae7062017e631eb7ac8588191cfa4a9a279b8651c399265202b298e98c4acef
+    minipass: "npm:^7.1.2"
+  checksum: 10/f47365cc2cb7f078cbe7e046eb52655e2e7e97f8c0a9a674f4da60d94fb0624edfcec9b5db32e8ba5a99a5f036f595680ae6fe02a262beaa73026e505cc52f99
   languageName: node
   linkType: hard
 
@@ -38369,15 +38367,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"mkdirp@npm:^3.0.1":
-  version: 3.0.1
-  resolution: "mkdirp@npm:3.0.1"
-  bin:
-    mkdirp: dist/cjs/src/bin.js
-  checksum: 10/16fd79c28645759505914561e249b9a1f5fe3362279ad95487a4501e4467abeb714fd35b95307326b8fd03f3c7719065ef11a6f97b7285d7888306d1bd2232ba
-  languageName: node
-  linkType: hard
-
 "mock-socket@npm:^9.3.0":
   version: 9.3.1
   resolution: "mock-socket@npm:9.3.1"
@@ -44149,17 +44138,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"rimraf@npm:^5.0.5":
-  version: 5.0.10
-  resolution: "rimraf@npm:5.0.10"
-  dependencies:
-    glob: "npm:^10.3.7"
-  bin:
-    rimraf: dist/esm/bin.mjs
-  checksum: 10/f3b8ce81eecbde4628b07bdf9e2fa8b684e0caea4999acb1e3b0402c695cd41f28cd075609a808e61ce2672f528ca079f675ab1d8e8d5f86d56643a03e0b8d2e
-  languageName: node
-  linkType: hard
-
 "rimraf@npm:~2.6.2":
   version: 2.6.3
   resolution: "rimraf@npm:2.6.3"
@@ -46752,7 +46730,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"tar@npm:^6.0.2, tar@npm:^6.0.5, tar@npm:^6.1.0, tar@npm:^6.1.11, tar@npm:^6.1.12, tar@npm:^6.1.2, tar@npm:^6.2.1":
+"tar@npm:^6.0.2, tar@npm:^6.0.5, tar@npm:^6.1.0, tar@npm:^6.1.11, tar@npm:^6.1.2, tar@npm:^6.2.1":
   version: 6.2.1
   resolution: "tar@npm:6.2.1"
   dependencies:
@@ -46766,17 +46744,16 @@ __metadata:
   languageName: node
   linkType: hard
 
-"tar@npm:^7.0.0, tar@npm:^7.4.3":
-  version: 7.4.3
-  resolution: "tar@npm:7.4.3"
+"tar@npm:^7.0.0, tar@npm:^7.4.3, tar@npm:^7.5.6":
+  version: 7.5.11
+  resolution: "tar@npm:7.5.11"
   dependencies:
     "@isaacs/fs-minipass": "npm:^4.0.0"
     chownr: "npm:^3.0.0"
     minipass: "npm:^7.1.2"
-    minizlib: "npm:^3.0.1"
-    mkdirp: "npm:^3.0.1"
+    minizlib: "npm:^3.1.0"
     yallist: "npm:^5.0.0"
-  checksum: 10/12a2a4fc6dee23e07cc47f1aeb3a14a1afd3f16397e1350036a8f4cdfee8dcac7ef5978337a4e7b2ac2c27a9a6d46388fc2088ea7c80cb6878c814b1425f8ecf
+  checksum: 10/fb2e77ee858a73936c68e066f4a602d428d6f812e6da0cc1e14a41f99498e4f7fd3535e355fa15157240a5538aa416026cfa6306bb0d1d1c1abf314b1f878e9a
   languageName: node
   linkType: hard