Skip to main content
Version: Next

v1.54.0

These are the release notes for the v1.54.0 release of Backstage.

A huge thanks to the whole team of maintainers and contributors as well as the amazing Backstage Community for the hard work in getting this release developed and done.

Highlights​

BREAKING: Stricter OAuth redirect URI allowlist matching​

The OAuth redirect URI and client ID metadata document allowlists in @backstage/plugin-auth-backend now match patterns against each URL component separately instead of against the full URL string. Wildcards no longer match across the host and path boundary, patterns must include an explicit protocol and are otherwise rejected as invalid configuration instead of being silently ignored, and redirect URIs that contain embedded credentials are always rejected.

A wildcard port also no longer implicitly matches every path: a pattern such as http://localhost:* now only matches the root path. Use http://localhost:*/* to allow any port and any path. The built-in loopback defaults have been updated accordingly, so this only affects explicitly configured patterns.

BREAKING: Deprecated extension config.schema removed​

The deprecated config.schema option for extensions and extension blueprints has been removed from @backstage/frontend-plugin-api. Use the top-level configSchema option with Standard Schema-compatible schema values, such as Zod v4.

BREAKING: Connections moved to a shared contract​

The Connections API is still early, so this only applies to you if you are experimenting with it already. Update backend-only imports from @backstage/connections, update connection lookups to pass a typed query object instead of a top-level url, and rename RootConnectionAuth to ConfiguredConnectionAuth. New GitHub and AWS connection types have also been added.

Contributed by @neoreddog in #34718, #35029, #35059, and #35209

BREAKING: OpenAPI validation command renamed​

The backstage-repo-tools repo schema openapi verify command has been renamed to backstage-repo-tools repo schema openapi validate. A new backstage-repo-tools package schema openapi validate command has also been added to validate OpenAPI 3.x documents for individual packages.

Create-app and Home page updates​

Create-app: New apps created with @backstage/create-app now include a GitHub Actions CI workflow that runs linting, type checking, tests, configuration validation, and a Docker image build on pull requests. The app template also includes a pre-configured Home page with a customizable widget grid, and create-app now checks the Node.js LTS version and Yarn availability before scaffolding.

Home plugin: The Home plugin now includes new frontend system widget blueprints for Most Visited, Recently Visited, World Clocks, a configurable Toolkit, and a search bar from the Search plugin. The home page layout now supports a defaultConfig for defining the initial widget grid through app configuration.

Catalog backend reliability and performance​

Relation sync: The Catalog backend now syncs entity relations by applying only the diff of changed rows instead of deleting and reinserting all relations. In steady state, this avoids unnecessary writes, dead tuples, WAL traffic, and stitching work for unchanged relation neighbors.

Write resilience: Entity provider mutations on PostgreSQL now retry automatically on deadlocks, and concurrent entity processing on MySQL now retries the updateProcessedEntity transaction on deadlock errors. SCM location.moved events are also ignored for files that are not actively tracked, preventing spurious locations from being created.

AiResource kind: The alpha AiResource catalog kind now supports plugin and marketplace spec types, plus allowedTools, license, and compatibility fields for skill resources. Catalog relation generation also now honors declared kind combinations and completes reverse relations for existing AiResource fields.

Contributed by @nickwtan in #34890, #34891, and #34892

Agent-friendly catalog refresh​

@backstage/plugin-catalog-backend now includes a refresh-catalog-entity action that agents and MCP clients can use to re-queue a single entity for processing after creating or updating it. This makes it possible to read back fresh catalog data immediately after a scaffolder run without waiting for the next scheduled processing loop.

Contributed by @Naga15 in #34447

Audit logging for Kubernetes and MCP actions​

Kubernetes: @backstage/plugin-kubernetes-backend now emits auditor events for cluster list, cluster proxy, entity workload, custom resource, and deprecated services endpoint requests. Administrators can filter audit logs by eventId values such as cluster-fetch and resource-fetch, and by queryType metadata.

API proxy: The Kubernetes API proxy now refreshes cached middleware when cluster details change, after a configurable TTL, or when the cache reaches its size limit. It also logs startup warnings for clusters configured with skipTLSVerify: true.

MCP actions: @backstage/plugin-mcp-actions-backend now emits audit events for MCP server connection, tool discovery, and tool execution operations. MCP servers can also be configured with instructions for both default and named servers.

Contributed by @04kash in #34863 and #35017, and @thepetk in #33339

Stable system metadata service​

coreServices.rootSystemMetadata is now available as a stable backend service for reading metadata about the running Backstage system, including installed plugins. The service is registered automatically by @backstage/backend-defaults, test utilities now include mockServices.rootSystemMetadata, and the internal OpenAPI documentation provider can use system metadata to discover installed plugins automatically.

TechDocs initial filter configuration​

The TechDocs page extension now accepts an initialFilter configuration value for page:techdocs. Valid values are all, owned, and starred; the default is owned.

Configuration schema validation improvements​

Stricter validation: Package preparation now validates TypeScript configuration schemas strictly before publishing. Other build and bundle paths report schema errors as warnings, and the --strict flag for backstage-cli config:check and backstage-cli config:schema now treats TypeScript configuration schema errors as fatal.

Recoverable errors: @backstage/config-loader also adds an onSchemaError callback that callers can use to report schema errors and continue loading. A bug where strict config checks incorrectly rejected valid open-ended object schemas has been fixed.

Backstage UI updates​

Fixed Table not filling the container width in Firefox when TableRoot is used directly inside ResizableTableContainer. Contributed by @robingileborg in #34755.

Check the BUI Changelog for more details.

Additional fixes and improvements​

  • Fixed config-driven route redirects in the new frontend system so they preserve the query string and fragment from the original URL. Contributed by @niklasR in #35002.
  • Added support for using a SubRouteRef as the parent of another SubRouteRef in the new frontend system.
  • Fixed unnecessary entity page and analytics rerenders when surrounding context values had not changed.
  • Fixed a brief "Entity not found" flash when navigating between catalog entity pages. Contributed by @Nikshaan in #35131.
  • Fixed the catalog graph page so configured filter and graph defaults are applied when the page opens. Contributed by @JasonColapietro in #35102.
  • Fixed the About card field labels so theme typography overrides no longer change the intended label size. Contributed by @meganide in #35076.
  • Fixed the DependencyGraph component so nodes no longer briefly overlap before the initial layout settles.
  • Fixed EntityOwnerPicker in owners-only mode to display human-readable entity titles and keep large owner lists responsive through virtualization. Contributed by @Parsifal-M in #34873.
  • Fixed UserListPicker showing all catalog entities as "Owned" when the logged-in user has no ownership entity refs. Contributed by @jozsefurak-seon in #34629.
  • Migrated the Unprocessed Entities UI to Backstage UI components and added search to the pending entities tab. Contributed by @Believe-SA in #34502.
  • Fixed OpenAPI definition widget deep linking. Contributed by @AntonioEreiz in #34493.
  • Fixed renderInTestApp so mocked identity APIs reliably take effect instead of being overwritten by the default guest fallback. Contributed by @KrishnaParihar1 in #34635.
  • Fixed the Azure DevOps URL reader so abort signals are forwarded to the commits API request. Contributed by @mohamedaminehamdi in #34734.
  • Fixed OAuth start requests with malformed origins returning a 500 instead of a 400.
  • Fixed the built-in CLI client being rejected when allowedClientIdPatterns is configured for Client ID Metadata Documents. Contributed by @arogozin in #34990.
  • Fixed Microsoft provider sign-in and token refresh for non-Graph scopes, such as Azure Management API scopes.
  • Fixed MCP OAuth metadata so RFC-compliant clients know which scopes to request and can receive refresh tokens when refresh tokens are enabled. Contributed by @vetom in #35172.
  • Allowed ChatGPT Codex clients to use Client ID Metadata Documents by default.
  • Fixed limited user token creation so it throws when required user IP metadata is missing instead of constructing an invalid token.
  • Permission rule parameter schemas now accept JSON Schema-compatible Standard Schema implementations, such as Zod v4. Zod v3 schemas remain supported but are deprecated.
  • Fixed notification recipient resolution for cyclic group relationships. Contributed by @marttimourujarvi in #34618.
  • Added support for routing Slack notifications to a specific channel via payload.metadata.slackChannel. Contributed by @sspadotto in #34968.
  • Added a kubernetes.clusterLocatorContinueOnError configuration option so a failing cluster locator can be skipped while clusters from other locators are still returned. Contributed by @alde in #34861.
  • Fixed Kubernetes AWS IAM strategy credential resolution for account-specific assume-role configurations.
  • Scaffolder tasks now wait for recovery checkpoint state to be persisted before continuing, and restored checkpoints preserve falsy values without re-running their callbacks.
  • Removed the native addon requirement from scaffolder template rendering.
  • Made the description parameter optional in the publish:gerrit scaffolder action. Contributed by @tcardonne in #34453.
  • Added new backstage-cli new templates for permission policy modules, search collator modules, and catalog processor modules.
  • Fixed backstage-cli new failing with "No version available" for several templates.
  • Updated generated plugin templates to use toastApiRef, add UserInfoService to permission policy modules, and include better table accessibility and backend module dependencies.
  • Improved TypeScript 7 forward-compatibility in Catalog exports and the Backstage ESLint plugin.
  • Updated nodemailer from v8 to v9 in the email notifications module. The new major version validates TLS certificates by default when fetching remote content such as attachments or OAuth2 tokens.

Security Fixes​

This release does not contain any security fixes.

Contributors​

Big shoutout to all 36 of you amazing folks who chipped in on this release: @04kash, @AntonioEreiz, @Believe-SA, @JasonColapietro, @Kartikupadhyay44, @KrishnaParihar1, @Naga15, @Nikshaan, @NithinU2802, @Parsifal-M, @alde, @arogozin, @baraka-akeyless, @deejay1, @djamaile, @dotboris, @drodil, @gaelgoth, @hudsonb, @jozsefurak-seon, @karthikjeeyar, @kz-masa, @marttimourujarvi, @meganide, @mohamedaminehamdi, @mylonasg88, @neoreddog, @nickwtan, @niklasR, @piyushtripathi9424, @robingileborg, @sebastian-danielsson, @sspadotto, @tcardonne, @thepetk, @vetom

Upgrade path​

We recommend that you keep your Backstage project up to date with this latest release. For more guidance on how to upgrade, check out the documentation for keeping Backstage updated.

Below you can find a list of links and references to help you learn about and start using this new release.

Sign up for our newsletter if you want to be informed about what is happening in the world of Backstage.