RATATOSKRATATOSK
Sign in

Backstage

v1.55.0CI/CD & App Delivery
Sep 15, 2026

ACTION 6CHECK 6PLAN 1OTHER 213

A broad feature and maintenance release adds scaffolder recovery and credential controls, TechDocs, notification and streaming capabilities, and Kubernetes and authentication improvements. It also includes dependency and tooling security updates, a security fix, and compatibility changes that affect users of the listed resolvers, catalog integrations, MCP configuration, and task recovery.

Action needed (6)

  • securityModule Federation dependency updates for security

    This release updates the Module Federation dependencies to versions that avoid known security vulnerabilities.

  • securityYarn tooling dependency updates for security

    This release updates the Yarn tooling dependencies to versions that avoid known security vulnerabilities.

  • securityModule Federation security dependency update

    This release updates the Module Federation dependencies to versions that avoid known security vulnerabilities.

  • securityOpenAPI generator tooling security update

    This release updates the OpenAPI generator tooling to avoid known security vulnerabilities.

  • securityOpenAPI generator tooling security update

    This release updates the OpenAPI generator tooling to avoid known security vulnerabilities.

  • breakingLocale-insensitive Unicode casing

    String handling now uses locale-insensitive Unicode casing for consistent results across environments.

Check if affected (6)

  • securityKubernetes catalog cluster locator URL validation

    Applies if you use the catalog cluster locator.

    The catalog cluster locator now validates Kubernetes API server URLs to block non-public addresses, cloud metadata endpoints, and non-HTTPS URLs by default. Trusted hostnames can be listed in dangerouslyAllowClusterUrls to permit HTTP or non-public addresses for those hosts, while TLS verification skipping requires dangerouslyAllowSkipTLSVerify; catalog entities cannot use the serviceAccount auth provider, only permitted annotations are passed as auth metadata, and Kubernetes API fetches no longer follow HTTP redirects automatically.

  • securityPull request workspace handling security fix

    Applies if you use pull request workspace handling.

    This release fixes a security issue in pull request workspace handling.

  • breakingGitHub user ID catalog lookup matching

    Applies if you use GitHub user ID catalog lookups.

    GitHub user ID catalog lookups now require an exact match and handle candidates that differ only by letter casing.

  • breakingKubernetes entity content loading and tab visibility

    Applies if you use Kubernetes entity content.

    Kubernetes entity content no longer loads its UI until the tab is opened, keeping it out of the initial bundle. Tab visibility is now an entity filter predicate that can be overridden through app config, and entities with an empty Kubernetes annotation now show the tab.

  • breakingDefault MCP server exposure

    Applies if you configure mcpActions.servers.

    The default MCP server at /api/mcp-actions/v1 is now always exposed. Configuring mcpActions.servers no longer replaces it; named servers are subsets of the default server, which continues to expose every registered action.

  • breakingWorkspace provider requirement for task recovery

    Applies if you use Workspace serialization for task recovery.

    Workspace serialization for task recovery now requires a separate workspace provider module, including when the legacy configuration is used.

Plan ahead (1)

  • deprecatedGitHub username sign-in resolver deprecation

    Applies if you use the GitHub username sign-in resolver.

    The GitHub username sign-in resolver is deprecated in favor of the stable user ID resolver.

All 213 other recorded changesvalue changes 154 · fixes 35 · additions 20 · constraints 2 · deprecations 1 · renames 1

value changes (154)

fixes (35)

  • ffaca06: Fixed a connection leak in the scaffolder event stream where unsubscribing did not abort the underlying SSE connection. Also changed unexpected server disconnects to signal an error instead of silently completing, enabling consumers to retry.
  • ffaca06: Fixed several issues with scaffolder task event stream reconnection: retry timers are now properly cancelled on cleanup, concurrent reconnect attempts are guarded against, and tab visibility changes reconnect the stream using the last seen event cursor without re-fetching the task.
  • 7c1019c: Fixed the scaffolder wizard not scrolling to the top on step change when the app uses the new frontend system (no <main> element).
  • 78656f8: Fixed several issues in the alpha catalog model layer system. Schema updates now preserve sibling field validation when changing a property named type, support deleting inherited fields and constraints, and retain literal JSON values in const and default. Kind schemas without an explicit root type retain their fields, and invalid combined schemas are rejected during model compilation. Empty kind descriptions and reverse relation titles are now applied correctly.
  • 96badbc: Fixed a bug where plugin packages installed through feature discovery were loaded before the app's own code ran. This could cause bootstrap-order-sensitive setup code in the app, such as configuring MUI 5's class name prefix, to be skipped if a discovered plugin's dependencies loaded MUI 5 components first. Discovered plugin packages are now loaded after the app's own code instead.
  • 277a125: Fixed declaration bundling of imports that use the node: built-in module prefix.
  • 1134d4b: Fixed reading a duration from configuration so that an all-zero ISO 8601 duration (such as PT0S) now yields a consistent zero value instead of an empty result.
  • bfb6497: Fixed CopyTextButton showing its tooltip on hover/focus instead of only after the user clicks to copy the text.
  • 603e704: The JSON Schema exported for filter predicates can now be compiled by validators built on RE2 (for example Go's regexp, used by Amazon Bedrock AgentCore Gateway), which previously rejected the predicate key pattern and failed every call to tools such as query-catalog-entities. Accepted keys are unchanged, except that a key whose first character is U+2028 or U+2029 is no longer rejected.
  • 52022b9: Fixed app.extensions shorthand and disabled field to accept boolean-ish strings ('true'/'false'), so environment variable substitution can be used to toggle extensions, e.g. ${CATALOG_OVERVIEW_ENABLED}.
  • bd6cf43: Fixed a bug where overriding a plugin extension with withOverrides moved the overridden extension to the end of the plugin's extension list. This caused overridden extensions to lose their original position, for example making an overridden sub page tab move to the end of the tabs on its page. Overridden extensions now keep their original order, while extensions that don't override an existing one are appended at the end.
  • 23705f3: Fixed an issue where reading or downloading files from Bitbucket Server could fail when the branch name contained special characters such as an ampersand or a plus sign. The branch name is now correctly encoded in the request URL.
  • e592bc5: Fixed an issue where reading files from GitLab could fail when the branch name contained special characters such as an ampersand or a plus sign. The branch name is now correctly encoded in the request URL.
  • e895def: Fixed handling of GitLab URLs for instances configured with a relative base path.
  • f914343: Fixed toast text layout when the application does not define a global line height.
  • 4cba335: Fixes published entry point configurations so it can be imported reliably in Jest/Node resolution.
  • 08c5d9b: Fixed inconsistent URL pattern matching in token revocation.
  • Prevented an unavailable Pinniped supervisor during provider startup from causing an unhandled promise rejection before the first authentication request.
  • Fixed a regression where the About card's field labels (OWNER, SYSTEM, TAGS, etc.) lost their vertical gap above the value.
  • Fixed circular dependency warnings when building the catalog plugin.
  • Fixed the About card to safely show and hide filtered icon links when navigating between entities, without initializing hidden links.
  • Fixed entity context menus to report errors from contributed items without disrupting the menu.
  • Use locale-insensitive Unicode casing for consistent string handling across environments.
  • - 348bea1: Fixed GitlabDiscoveryEntityProvider to only process push events targeting the configured branch.
  • - b7db066: Fixed a scope validation issue in GitLab organization discovery.
  • - 7ac10da: Fixed accumulating abort listeners on MicrosoftGraphClient.
  • - 5d6a62b: Fixed the owner selected in the import stepper being written to the generated catalog-info.yaml as a display name instead of an entity reference. Groups are still suggested by their display name, but selecting one now sets a valid spec.owner, for example picking My Team results in my-team.
  • - a7b14b5: Fixed EntityOwnerPicker crashing with Entity reference "<name>" had missing or empty kind when the owners query parameter contains humanized entity refs, as produced by the OwnershipCard links in @backstage/plugin-org. Query parameters were stored as-is in the initial state and only converted to full entity refs by an effect, which runs after the first render. That first render passed the raw value to the entity presentation API, whose parseEntityRef call rejects a ref without a kind. The same raw value was also sent to catalogApi.getEntitiesByRefs on mount, and made the option checkboxes render unselected until the effect ran. The query parameters are now normalized through EntityOwnerFilter when the state is initialized, matching what the existing effect already did and what the filters code path already produced.
  • - bca8281: Fix clock configuration handling and use lazy initialization for the clocks state.
  • - cd4a9c7: Fixed CardExtension to avoid requiring app context when a custom Renderer is provided.
  • - fe0ec65: Fixed ownership card catalog links to filter by stable entity references instead of display titles.
  • - 3026628: Validate repository file paths before transforming Confluence content.
  • Workspace upload failures are now propagated so that a task does not record a completed step without its corresponding workspace.
  • - b11c9b4: Fixed a bug where the search engine could receive an unfiltered query when no document types were permitted.
  • - 0ae9229: Fixed WebSocket upgrade error responses to prevent load balancers from returning 502 when authentication fails. Error responses now use valid HTTP headers, ensuring the actual error status (401 or 500) is delivered to the client instead of being masked.

additions (20)

  • 1a705ca: Added templateDryRunPermission, which allows permission policies to control who can submit inline Software Template dry runs.
  • 5ff93bf: Added functionality to register a Template Outputs Component in the new frontend system.
  • ee97130: Added support for techdocs.generator.pullOptions when pulling the TechDocs generator Docker image from private registries that require authentication.
  • 62d1a6f: Added techdocs.generator.mkdocs.dangerouslyAllowAdditionalPlugins configuration option, allowing operators to extend the set of permitted MkDocs plugins during TechDocs generation.
  • bf1f82d: Added the required OpenAPI types dependency for Swagger Parser.
  • de957f6: Added @backstage/cli-module-package-manager-yarn with backstage-cli pm verify-patches to validate Yarn patch references, local patch files, lockfile consistency, and patched Backstage package versions against the selected Backstage release. The command is included in @backstage/cli-defaults.
  • b80a9f3: Added an onCopyLog prop to the LogViewer component that renders a copy button in the toolbar, allowing users to copy all log content to the clipboard.
  • a15bac8: Added an optional variant prop to CopyTextButton to allow configuring its visual style (primary, secondary, or tertiary).
  • 279fdf6: Declared the DOM Testing Library dependency required by React Testing Library.
  • 40838dc: Added an extension boundary around custom navigation content.
  • - bf7e890: Added the missing Material UI dependency used by catalog popovers.
  • - ad8f2a8: Added actions to get kubernetes clusters and entity resources
  • - d9a57de: Add KubernetesWatcher interface for streaming Kubernetes resource changes via an async iterator. The watcher is separated from KubernetesFetcher because watching is a long-lived streaming connection that only works with server-side auth providers. Watch supports all event types (ADDED, MODIFIED, DELETED, BOOKMARK, ERROR) with errors yielded as data rather than thrown.
  • - 2a19159: Hardened notification email delivery with format validation and optional allowedEmailDomains. Invalid or disallowed addresses are skipped; allowlistEmailAddresses and denylistEmailAddresses match case-insensitively, allowlist still overrides the domain list, and denied addresses win last.
  • - 80a548a: Added resolveNotificationLink utility function that resolves relative notification links to absolute URLs using a provided base URL. This can be used by notification processor modules to ensure links are absolute before forwarding them to external systems.
  • - bbba6b5: Added support for requiring user-provided credentials for Azure DevOps mutation actions when scaffolder.requireScmUserCredentials is enabled.
  • - bbba6b5: Added support for requiring user-provided credentials for Bitbucket Cloud mutation actions when scaffolder.requireScmUserCredentials is enabled.
  • Added new config path scaffolder.taskRecovery.gcsBucket.name for GCS workspace provider.
  • - 3bb3710: Added optional cancellation support when waiting to claim a scaffolder task.
  • Added task recovery feature with new scaffolder.taskRecovery config section.

constraints (2)

  • 61809fe: Allow independently registered catalog model sources to share identical layers, while reporting a clear error for conflicting layers with the same ID.
  • d9a949e: Added support for rendering custom link elements inside HeaderIconLinkRow.

deprecations (1)

  • - 38441ff: Migrate to toastApi from deprecated alertApi

renames (1)

  • 89743dc: Replaced the deprecated dependency used by repo list-deprecations with the equivalent TypeScript ESLint rule.
Add Backstage to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →
Official release note ↗All Backstage releases →