try to remove protojs pins

[freben]

Summary

Removes the protobufjs/inquire version pins from the seed lockfile and suppresses the resulting bundler warning.

Background

@protobufjs/inquire@1.1.0 used eval("require")(moduleName) to hide a dynamic require from bundlers. When we pinned it, that was the workaround. The maintainer has since published 1.1.1 and 1.1.2 which remove the eval, but replace it with a bare require(moduleName) — still a dynamic require that webpack/rspack flags as "Critical dependency: the request of a dependency is an expression".

However, protobufjs 7.5.9 (2026-05-17, PR #2254) backported bundler-safe optional module lookups: all call sites that previously used util.inquire("fs"), util.inquire("buffer"), etc. were replaced with direct requires using webpack magic comments. The inquire utility is still in the dependency tree but is never exercised with dynamic module names.

What this PR does

1. Removes the version pins for protobufjs and @protobufjs/inquire from packages/create-app/seed-yarn.lock, letting them resolve naturally (protobufjs 7.6.0, @protobufjs/inquire 1.1.2).

2. Adds an ignoreWarnings entry in the bundler config (packages/cli-module-build) to suppress the false-positive "Critical dependency" warning from @protobufjs/inquire. The comment in the source explains the reasoning and links to the upstream issue.

Why ignoreWarnings is safe for all end users

The suppression ships to end users via @backstage/cli-module-build. This is safe regardless of which protobufjs version they have resolved in their lockfile:

• @protobufjs/inquire is designed for optional module lookups — it returns null when a require fails, never crashes. The "Critical dependency" is a bundler static analysis warning, not a runtime error.
• protobufjs is a server-side dependency (gRPC, Firestore, OpenTelemetry). If it ends up in a frontend bundle, the dynamic require was always non-functional regardless of version.
• For protobufjs >= 7.5.9, the dynamic require path in inquire is dead code (never called).
• For protobufjs < 7.5.9, the inquire calls degrade gracefully at runtime. We're not masking a real failure.

We considered adding "protobufjs": ">=7.5.9" as a dependency floor in a published package like @backstage/backend-defaults to force end users onto the fixed version. We decided against it — the ignoreWarnings is sufficient, and promoting a transitive dependency to a direct one just to set a floor could cause resolution conflicts for adopters with other constraints.

See also: protobufjs/protobuf.js#2057

Test plan

• E2E create-app test passes (yarn install + tsc + build)
• No protobufjs/inquire warnings in build output

🤖 Generated with Claude Code

[Copilot]

Copilot wasn't able to review any files in this pull request.

[backstage-goalie]

Missing Changesets

The following package(s) are changed by this PR but do not have a changeset:

• @backstage/create-app

See CONTRIBUTING.md for more information about how to add changesets.

Changed Packages

Package Name	Package Path	Changeset Bump	Current Version
@backstage/cli-module-build	packages/cli-module-build	patch	v0.1.3
@backstage/create-app	packages/create-app	none	v0.8.3

[Copilot]

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

[Rugvip]

Alright, seems like an exceptional enough breakage of an existing dependency to make this worthwhile