Pack up removal and replacement

[jhoward1994]

What does it do?

This PR implements the gradual removal of @strapi/pack-up from the SDK Plugin
as outlined in the RFC.

Notion search "RFC-Remove-strapi-pack-up..."

Current Progress:

• Phase 0: Test Infrastructure (feature flags)
• Phase 1: Verify Command
• Phase 2: Init Command
• Phase 3: Build Command (Vite migration)
• Phase 4: Watch Command (Vite watch mode)

Key Changes:

• Major version bump to v6
• Native package.json validation replacing pack-up's check
• Native plugin scaffolding generation replacing pack-up's init
• Comparison tool to validate migration parity - ⚠️ to be removed before merging

Why is it needed?

Pack-up has a security vulnerability in its Vite dependency (CVE).
SDK Plugin and Design System are the only remaining Strapi projects using pack-up.

This migration will:

• Eliminate the security risk
• Remove the last use of pack-up
• Remove unnecessary build abstraction
• Gives us direct control over the build process

How to test it?

End-to-End Testing: SDK Plugin in Strapi App
(replace paths with real ones on your system)

Step 1: Build the SDK Plugin

cd /sdk-plugin
yarn install
yarn build

Step 2: Create a New Plugin

Create plugin in the Strapi examples/empty project

cd /strapi/examples/empty
/sdk-plugin/bin/strapi-plugin.js init src/plugins/my-plugin --no-install

Step 3: Install and Build the Plugin

cd /strapi/examples/empty/src/plugins/my-plugin
yarn install
yarn build
yarn verify

Step 4: Register the Plugin in Strapi

Edit /strapi/examples/empty/config/plugins.ts:

export default {
'my-plugin': {
enabled: true,
resolve: './src/plugins/my-plugin',
},
};

Step 5: Start Strapi and Verify Plugin Loads

From monorepo examples/empty directory

cd /strapi/examples/empty
yarn develop

Open http://localhost:1337/admin - you should see the plugin in the left sidebar.

Step 6: Test Watch Mode (in separate terminal)

cd /strapi/examples/empty/src/plugins/my-plugin
yarn watch

Make a change to admin/src/index.ts - the plugin should rebuild and you'll see the change after refreshing the admin
panel.

Related issue(s)/PR(s)

Notion search "RFC-Remove-strapi-pack-up..."
DX-2163

[changeset-bot]

🦋 Changeset detected

Latest commit: e1dee66

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@strapi/sdk-plugin	Major

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[jhoward1994]

This is work in progress but can be reviewed in comparison to the RFC and for the first three phases listed

[innerdvations]

How will this handle building a plugin in which there exists a packup config file? Will it still read it and convert the values to the corresponding rollup config?

[jhoward1994]

As it would be a new major version the build system no longer reads packup.config

wdyt? we could add a detection warning? When a packup.config.ts is found, we could display:

Warning: packup.config.ts detected but will be ignored.
SDK Plugin v6 no longer uses packup... etc etc

[innerdvations]

Ok, I think that's fine. Let's just make sure the release notes mention that, and maybe have a migration guide? Afaik that would just be renaming the file to rollup.config.ts and moving a few parameters, right?

[jhoward1994]

It's actually read from package.json#exports which programmatically generates Vite config

We have configFile: false in src/cli/commands/utils/build/vite-config.ts

So all thats needed is something like this in the plugin package json

  {                                                                                                                                   
    "exports": {                                                                                                                      
      "./strapi-admin": {                                                                                                             
        "types": "./dist/admin/src/index.d.ts",                                                                                       
        "source": "./admin/src/index.ts",                                                                                             
        "import": "./dist/admin/index.mjs",                                                                                           
        "require": "./dist/admin/index.js",                                                                                           
        "default": "./dist/admin/index.js"                                                                                            
      },                                                                                                                              
      "./strapi-server": {                                                                                                            
        "types": "./dist/server/src/index.d.ts",                                                                                      
        "source": "./server/src/index.ts",                                                                                            
        "import": "./dist/server/index.mjs",                                                                                          
        "require": "./dist/server/index.js",                                                                                          
        "default": "./dist/server/index.js"                                                                                           
      }                                                                                                                               
    }                                                                                                                                 
  } 

[jhoward1994]

strapi/documentation#2919

@innerdvations could you check out the docs changes and let me know what you think ?

[sonarqubecloud]

Quality Gate failed

Failed conditions
2 Security Hotspots
3.3% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud