jfrog / jfrog/frogbot

Frogbot to work with Backstage Yarn Plugin

Open
#861 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

feature request
Dominant language
Go
Stars
372
Forks
107
Avg merge
2d 20h
Merged PRs (30d)
5

Description

Is your feature request related to a problem? Please describe.
We use the backstage yarn plugin to resolve all our backstage dependencies to keep it updated easier however, and I don't think this is an issue per-se but lack of functionality, as the backstage yarn plugin replaces all the dependencies automagically with backstage:^ frogbot fails to resolve them properly:

npm ERR! code EUNSUPPORTEDPROTOCOL
npm ERR! Unsupported URL Type "backstage:": backstage:^
npm ERR! A complete log of this run can be found in: /root/.npm/_logs/2025-05-08T07_26_36_629Z-debug-0.log
target '/tmp/jfrog.cli.temp.-1746689167-3720575895/plugins/homepage-useful-links [npm]' errors:
failed to build dependency tree: failed while building 'npm' dependency tree: error while running '/usr/local/bin/npm install --ignore-scripts --package-lock-only': exit status 1

Describe the solution you'd like to see
Would be nice if this could work with the backstage yarn plugin added!

Describe alternatives you've considered
N/A

Additional context
Snyk had a similar issue and this one but it was resolved, but still doesn't seem to work for us 😢

LMK if this should be a bug instead of a feature, but I think its just something to do with some functionality with yarn and how it builds the dependencies. (its a bit magical to me)

Happy to contribute this as well if some guidance is given on what needs to happen!

Thanks!

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the failure in the npm dependency-tree build with a project using Backstage's Yarn plugin and the backstage:^ protocol. Review the Backstage Yarn plugin and linked Snyk references, then trace how Frogbot invokes npm install --ignore-scripts --package-lock-only. Done means Frogbot can resolve the dependencies and complete the scan without the unsupported-protocol error.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, nodejs
Domain
devtools
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.