TL;DR Backstage’s security posture remains strong! Today, we’re releasing the report from the second independent security audit of the Backstage project.

As an Incubating project within the Cloud Native Computing Foundation (CNCF), Backstage is fortunate enough to take advantage of sponsored continuous security audits. The Open Source Technology Improvement Fund (OSTIF) sponsors the audits as part of its ongoing efforts to secure the open source software ecosystem, and the audit itself was performed by X41 D-Sec, who also performed the first audit. Our goal with the audit was to re-evaluate and further improve Backstage’s security posture, focusing on the core Backstage framework and plugins.

tl;dr: Salt Lake City did not disappoint! Backstage continues to be at the forefront of many conversations being had at BackstageCon and across KubeCon + CloudNativeCon. If you weren't able to join us, all the BackstageCon talks are available for replay on YouTube. Read on for the highlights — plus, photos of super cute pups — as a treat! 🐕

TL;DR To enhance the developer experience, Dynatrace adopted Backstage as its central developer portal and enhances Backstage entities with real-time data. This decision, along with the symbiosis between the Dynatrace platform and Backstage, has unlocked two significant opportunities.

• First, centralizing all development-related artifacts and democratizing ownership have reduced onboarding time for our teams.
• Second, we enhanced the developer experience by integrating observability and security data into Backstage, offering seamless entry points to Dynatrace for in-depth analysis.

TL;DR There is no shortage of content that discusses the benefits that Backstage brings to organizations (and if you want to read more on that, you can just click here, here, or here). But I want to share what it did for me, a developer here at Spotify. And not just what it did, but how I’ve used Backstage to help me achieve goals at each stage of my journey at Spotify — from my first day as a brand new employee to today, my 1,186th day as a contributor.

tl;dr: We've set up the new community plugins repository, and have migrated most of the packages in the plugins directory of the main Backstage repository to their new home!

For those who depended on these plugins, migrating is as simple as yarn backstage-cli versions:bump then yarn backstage-cli versions:migrate. If you're already on 1.26.1, then be sure to run yarn backstage-cli versions:bump --skip-migrate then yarn backstage-cli versions:migrate to take advantage of the code reference replacement helpers.

tl;dr: And with that the first BackstageCon Europe comes to an end! The City of Light was good to Backstage with many great conversations at both BackstageCon and KubeCon + CloudNativeCon Europe 2024. If you weren't able to join, the CNCF has a great playlist of all the BackstageCon talks ready to go on YouTube. Check out some of the highlights below — then grab your popcorn and settle in!

TL;DR: For the Backstage maintainers, ensuring that the project is secure for every adopter and end user is one of our top priorities. With the recent discovery of CVE-2024-26150, we've shipped fixes for versions > v1.15.0. Please update your Backstage instance.

tl;dr BackstageCon North America is officially in the books! We had a blast in Chicago talking about Backstage non-stop throughout the week at both BackstageCon and KubeCon. If you weren't able to join us, the BackstageCon talks are available for replay on the CNCF YouTube channel.

TL;DR Chicago Trading Company (CTC) adopted Backstage ten months ago to help reduce onboarding frictions with their new cloud-based DevOps Kubernetes platform. Through templatization and open feedback loops, the team has conservatively saved 18 months of developer time to date with Backstage. We spoke with CTC DevOps engineer Scott Kausler who shared the details of their onboarding journey, lessons learned, and insights for other Backstage adopters.

Editor's Note: In this post, Expedia Group provides a follow-up to their initial Q4 2021 post on how they measure Backstage proof of value. We're grateful to the Expedia Group team for sharing their processes, revised proof of value metrics, and adaptations to their approach over time in hopes of providing a successful framework for the rest of the Backstage community.

Expedia Group's mission is to power global travel for everyone, everywhere. This vision is made possible through Expedia Group's massive platform, which connects 168 million loyalty members, 50 thousand B2B partners, 3 million properties and 500 airlines, car rentals and cruise lines across the globe. In short, the scale of our platform is enormous, which means that we need to scale our engineering capabilities as well so we can continue to provide seamless experiences to our travelers and partners.