Pack up removal and replacement

[jhoward1994]

What does it do?

This PR implements the gradual removal of @strapi/pack-up from the SDK Plugin
as outlined in the RFC.

Notion search "RFC-Remove-strapi-pack-up..."

Current Progress:

• Phase 0: Test Infrastructure (feature flags)
• Phase 1: Verify Command
• Phase 2: Init Command
• Phase 3: Build Command (Vite migration)
• Phase 4: Watch Command (Vite watch mode)

Key Changes:

• Major version bump to v6
• Native package.json validation replacing pack-up's check
• Native plugin scaffolding generation replacing pack-up's init
• Comparison tool to validate migration parity - ⚠️ to be removed before merging

Why is it needed?

Pack-up has a security vulnerability in its Vite dependency (CVE).
SDK Plugin and Design System are the only remaining Strapi projects using pack-up.

This migration will:

• Eliminate the security risk
• Remove the last use of pack-up
• Remove unnecessary build abstraction
• Gives us direct control over the build process

How to test it?

End-to-End Testing: SDK Plugin in Strapi App
(replace paths with real ones on your system)

Step 1: Build the SDK Plugin

cd /sdk-plugin
yarn install
yarn build

Step 2: Create a New Plugin

Create plugin in the Strapi examples/empty project

cd /strapi/examples/empty
/sdk-plugin/bin/strapi-plugin.js init src/plugins/my-plugin --no-install

Step 3: Install and Build the Plugin

cd /strapi/examples/empty/src/plugins/my-plugin
yarn install
yarn build
yarn verify

Step 4: Register the Plugin in Strapi

Edit /strapi/examples/empty/config/plugins.ts:

export default {
'my-plugin': {
enabled: true,
resolve: './src/plugins/my-plugin',
},
};

Step 5: Start Strapi and Verify Plugin Loads

From monorepo examples/empty directory

cd /strapi/examples/empty
yarn develop

Open http://localhost:1337/admin - you should see the plugin in the left sidebar.

Step 6: Test Watch Mode (in separate terminal)

cd /strapi/examples/empty/src/plugins/my-plugin
yarn watch

Make a change to admin/src/index.ts - the plugin should rebuild and you'll see the change after refreshing the admin
panel.

Related issue(s)/PR(s)

Notion search "RFC-Remove-strapi-pack-up..."
DX-2163

[changeset-bot]

⚠️ No Changeset found

Latest commit: 83bd683

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[jhoward1994]

This is work in progress but can be reviewed in comparison to the RFC and for the first three phases listed

[sonarqubecloud]

Quality Gate failed

Failed conditions
2 Security Hotspots
4.0% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud