Frogbot to work with Backstage Yarn Plugin
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 372
- Forks
- 107
- Avg merge
- 2d 20h
- Merged PRs (30d)
- 5
Description
Is your feature request related to a problem? Please describe.
We use the backstage yarn plugin to resolve all our backstage dependencies to keep it updated easier however, and I don't think this is an issue per-se but lack of functionality, as the backstage yarn plugin replaces all the dependencies automagically with backstage:^ frogbot fails to resolve them properly:
npm ERR! code EUNSUPPORTEDPROTOCOL
npm ERR! Unsupported URL Type "backstage:": backstage:^
npm ERR! A complete log of this run can be found in: /root/.npm/_logs/2025-05-08T07_26_36_629Z-debug-0.log
target '/tmp/jfrog.cli.temp.-1746689167-3720575895/plugins/homepage-useful-links [npm]' errors:
failed to build dependency tree: failed while building 'npm' dependency tree: error while running '/usr/local/bin/npm install --ignore-scripts --package-lock-only': exit status 1
Describe the solution you'd like to see
Would be nice if this could work with the backstage yarn plugin added!
Describe alternatives you've considered
N/A
Additional context
Snyk had a similar issue and this one but it was resolved, but still doesn't seem to work for us 😢
LMK if this should be a bug instead of a feature, but I think its just something to do with some functionality with yarn and how it builds the dependencies. (its a bit magical to me)
Happy to contribute this as well if some guidance is given on what needs to happen!
Thanks!
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the failure in the npm dependency-tree build with a project using Backstage's Yarn plugin and the backstage:^ protocol. Review the Backstage Yarn plugin and linked Snyk references, then trace how Frogbot invokes npm install --ignore-scripts --package-lock-only. Done means Frogbot can resolve the dependencies and complete the scan without the unsupported-protocol error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, nodejs
- Domain
- devtools
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100