chore(adoption-insights): refresh yarn.lock

[christoph-jerolimov]

Summary

• Regenerate yarn.lock for the adoption-insights workspace to align resolved @backstage/* dependency versions

Test plan

• CI passes (lockfile consistency, build, lint)

🤖 Generated with Claude Code

[rhdh-qodo-merge]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

Context used

✅ Compliance rules (platform): 11 rules

✅ Cross-repo context

  Explored: repo: redhat-developer/rhdh (sha: 70bd1b08)

  Not relevant to this PR: redhat-developer/rhdh-chart

  Not relevant to this PR: redhat-developer/rhdh-operator

  Not relevant to this PR: redhat-developer/rhdh-local

1. vm2 added to backend 🐞 Bug ⛨ Security

Description

The refreshed lockfile makes @backstage/config-loader depend on typescript-json-schema, which adds
vm2 and ts-node to the backend’s production transitive dependency graph via
@backstage/backend-defaults. This increases backend deployment/install footprint and
dependency-audit surface compared to the prior schema-generator dependency set.

Code

workspaces/adoption-insights/yarn.lock[2546]

+    typescript-json-schema: "npm:^0.67.0"

Relevance

⭐⭐ Medium

No prior vm2/ts-node precedent; team sometimes avoids dev-tool runtime deps (PR3246). Lockfile
refresh may limit changes.

PR-#3246
PR-#3818

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The backend depends on @backstage/backend-defaults at runtime, and that package depends on
@backstage/config-loader, which in this lockfile depends on typescript-json-schema;
typescript-json-schema explicitly depends on vm2 and ts-node, so these become part of the
backend’s production transitive dependency graph.

workspaces/adoption-insights/packages/backend/package.json[23-55]
workspaces/adoption-insights/yarn.lock[1897-1915]
workspaces/adoption-insights/yarn.lock[2530-2547]
workspaces/adoption-insights/yarn.lock[32551-32563]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`@backstage/config-loader` now pulls in `typescript-json-schema`, which brings `vm2` and `ts-node` into the backend’s production transitive dependency graph.

## Issue Context
This comes from the resolved Backstage package set in `workspaces/adoption-insights/yarn.lock` (not from a direct dependency change in `packages/backend/package.json`).

## Fix
Regenerate the lockfile so that `@backstage/backend-defaults` / `@backstage/config-loader` resolve to patch versions that don’t require `typescript-json-schema` (or otherwise don’t pull `vm2`), e.g. by updating within the existing semver ranges (`^0.17.3`, etc.) and re-running `yarn install` in the adoption-insights workspace.

## Fix Focus Areas
- workspaces/adoption-insights/yarn.lock[2530-2547]
- workspaces/adoption-insights/yarn.lock[1897-1915]
- workspaces/adoption-insights/yarn.lock[32551-32563]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

[rhdh-qodo-merge]

PR Summary by Qodo

chore(adoption-insights): regenerate yarn.lock to realign Backstage resolutions

⚙️ Configuration changes 🕐 20-40 Minutes

AI Description

• Regenerates the adoption-insights workspace lockfile to normalize resolved @backstage/* versions.
• Aligns transitive dependency graph by consolidating Backstage package ranges to single patch
 versions.
• Updates lockfile entries for newly required transitive tooling packages introduced by resolution
 changes.

Diagram

graph TD
  A["CI / reviewers"] --> B["Yarn"] --> C["adoption-insights"] --> D["workspaces/adoption-insights/yarn.lock"] --> E["@backstage/*"] --> F["Transitive deps"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Pin Backstage versions in package.json (avoid lock-only drift)

• ➕ Makes intended version alignment explicit and reviewable in manifests
• ➕ Reduces future lockfile-only downgrades/upgrades caused by solver changes
• ➖ Requires touching multiple workspace manifests
• ➖ May conflict with shared repo-wide versioning strategy

2. Use Yarn constraints/dedupe to enforce single Backstage patch versions

• ➕ Prevents multiple patch versions from coexisting in the graph
• ➕ Can reduce future lockfile churn across regenerations
• ➖ Adds maintenance overhead (constraints rules)
• ➖ May require iterative tuning to satisfy all workspaces

3. Adopt a Backstage release-manifest driven update process

• ➕ Aligns all Backstage packages to a known-good set
• ➕ Typically reduces incompatibility risk across plugin ecosystem
• ➖ Heavier process for a single-workspace adjustment
• ➖ May force broader upgrades beyond adoption-insights needs

Recommendation: Regenerating yarn.lock is appropriate for resolving version skew, but reviewers should sanity-check that the resulting Backstage patch-level shifts (many moving to the lower patch in the shown ranges) are expected and consistent with the repo’s intended Backstage baseline. If this kind of drift recurs, prefer adding explicit version pins or Yarn constraints to make the alignment deterministic.

Files changed (1) +925 / -700

Other (1) +925 / -700

yarn.lockRegenerate lockfile to align resolved @backstage/* patch versions +925/-700

Regenerate lockfile to align resolved @backstage/* patch versions

• Rewrites the adoption-insights yarn.lock to consolidate many @backstage/* resolutions to single patch versions (largely shifting to the lower patch in overlapping ranges). Adjusts numerous related Backstage plugin dependency references accordingly and introduces/updates several transitive tooling entries (e.g., typescript-json-schema/ts-node and associated dependencies) as a consequence of the new resolution set.

workspaces/adoption-insights/yarn.lock

[rhdh-gh-app]

Unexpected Changesets

The following changeset(s) reference packages that have not been changed in this PR:

• /home/runner/work/rhdh-plugins/rhdh-plugins/workspaces/adoption-insights/.changeset/refresh-yarn-lock.md: @red-hat-developer-hub/backstage-plugin-adoption-insights, @red-hat-developer-hub/backstage-plugin-adoption-insights-backend, @red-hat-developer-hub/backstage-plugin-adoption-insights-common, @red-hat-developer-hub/backstage-plugin-analytics-module-adoption-insights

Note that only changes that affect the published package require changesets, for example changes to tests and storybook stories do not require changesets.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 57.33%. Comparing base (5e0934d) to head (bdfae08).
⚠️ Report is 7 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3925   +/-   ##
=======================================
  Coverage   57.33%   57.33%           
=======================================
  Files        2380     2380           
  Lines       95589    95589           
  Branches    26678    26678           
=======================================
  Hits        54802    54802           
  Misses      39279    39279           
  Partials     1508     1508           

Flag	Coverage Δ		*Carryforward flag
adoption-insights	84.54% <ø> (ø)		Carriedforward from 5e0934d
ai-integrations	69.26% <ø> (ø)		Carriedforward from 5e0934d
app-defaults	69.79% <ø> (ø)		Carriedforward from 5e0934d
augment	46.67% <ø> (ø)		Carriedforward from 5e0934d
boost	75.27% <ø> (ø)		Carriedforward from 5e0934d
bulk-import	72.59% <ø> (ø)		Carriedforward from 5e0934d
cost-management	13.55% <ø> (ø)		Carriedforward from 5e0934d
dcm	60.72% <ø> (ø)		Carriedforward from 5e0934d
extensions	56.28% <ø> (ø)		Carriedforward from 5e0934d
global-floating-action-button	71.18% <ø> (ø)		Carriedforward from 5e0934d
global-header	62.19% <ø> (ø)		Carriedforward from 5e0934d
homepage	47.58% <ø> (ø)		Carriedforward from 5e0934d
install-dynamic-plugins	56.77% <ø> (ø)		Carriedforward from 5e0934d
intelligent-assistant	74.05% <ø> (ø)		Carriedforward from 5e0934d
konflux	91.98% <ø> (ø)		Carriedforward from 5e0934d
lightspeed	69.02% <ø> (ø)		Carriedforward from 5e0934d
mcp-integrations	83.40% <ø> (ø)		Carriedforward from 5e0934d
orchestrator	62.70% <ø> (ø)		Carriedforward from 5e0934d
quickstart	65.18% <ø> (ø)		Carriedforward from 5e0934d
sandbox	79.56% <ø> (ø)		Carriedforward from 5e0934d
scorecard	82.66% <ø> (ø)		Carriedforward from 5e0934d
theme	83.85% <ø> (ø)		Carriedforward from 5e0934d
translations	5.12% <ø> (ø)		Carriedforward from 5e0934d
x2a	79.31% <ø> (ø)		Carriedforward from 5e0934d

*This pull request uses carry forward flags. Click here to find out more.

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 5e0934d...bdfae08. Read the comment docs.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.