Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Project: BackstageClear ×

Backstagev1.52.0CI/CD & App DeliveryJun 16, 2026

ACTION 2CHECK 7PLAN 9OTHER 288View full analysis

A broad feature and maintenance release with breaking configuration and API evolution across catalog, scaffolder, TechDocs, frontend, actions, and Kubernetes capabilities. It also includes correctness, performance, reliability, and security-related dependency updates, with migration attention needed for renamed or deprecated settings and APIs.

Action needed (2)

securityThe infinispan dependency upgrade
infinispan was upgraded from ^0.12.0 to ^0.13.0 to address known vulnerabilities.
breakingThe unused json-schema runtime dependency, removed
The unused json-schema runtime dependency has been removed.

Check if affected (7)

breakingThe catalog.stitchingStrategy.mode: 'immediate' setting, removed
Applies if you configure catalog.stitchingStrategy.mode.
The deprecated catalog.stitchingStrategy.mode: 'immediate' setting has been removed.
breakingComboboxProps as a union type
Applies if you use ComboboxProps.
ComboboxProps is now a union type.
breakingThe default /kubernetes page, removed
Applies if you use /kubernetes.
The default Kubernetes standalone page registered at /kubernetes has been removed because it was registered by mistake.
+ 4 more on the release page

Plan ahead (9)

deprecatedTop-level Combobox input state props, deprecated
Applies if you use plain-array options.
The existing top-level input state props remain supported as a deprecated compatibility path for plain-array options.
deprecatedPrevious tokens, deprecatedremoval date not announced
Applicability is not stated in the release notes.
The previous tokens remain in place for backward compatibility, but they are now deprecated and will be removed in a future release.
deprecatedThe single-module runCliModule helper, deprecated
Applies if you use runCliModule.
The single-module runCliModule helper is now deprecated.
+ 6 more on the release page

Source ↗

Backstagev1.51.0CI/CD & App DeliveryMay 19, 2026

ACTION 2CHECK 9PLAN 4OTHER 61View full analysis

A broad release with breaking API removals, changed defaults and constraints, and many new operator-facing capabilities. It also includes performance improvements and an explicitly described dependency security update.

Action needed (2)

securityModule Federation packages at v2.3.3
Module Federation packages were upgraded to v2.3.3 to address known vulnerabilities.
breakingThe @remixicon/react version constraint
The @remixicon/react dependency is limited to versions below 4.9.0 because of a license change.

Check if affected (9)

securitySpecific defaults for known MCP clients
Applies if you configure CIMD or DCR.
The previous permissive ['*'] wildcards were replaced with specific defaults for known MCP clients.
breakingThe NavItemBlueprint API, removed
Applies if you use NavItemBlueprint.
The deprecated NavItemBlueprint was removed from @backstage/frontend-plugin-api.
breakingSidebar and legacy nav-item rendering in renderInTestApp
Applies if you use renderInTestApp.
renderInTestApp from @backstage/frontend-test-utils no longer renders a sidebar or legacy nav-item extensions.
+ 6 more on the release page

Plan ahead (4)

deprecatedThe PolicyQueryUser.identity field, deprecated
Applies if you use PolicyQueryUser.identity.
The PolicyQueryUser.identity field has been deprecated.
deprecatedThe EXPERIMENTAL_formDecorators field, deprecated alias
Applies if you configure EXPERIMENTAL_formDecorators.
The previous EXPERIMENTAL_formDecorators field continues to work as a deprecated alias.
deprecatedThe catalog.stitchingStrategy.mode: 'immediate' setting, deprecated
Applies if you configure catalog.stitchingStrategy.mode.
The catalog.stitchingStrategy.mode: 'immediate' setting has been deprecated.
+ 1 more on the release page

Source ↗

Backstagev1.50.0CI/CD & App DeliveryApr 14, 2026

ACTION 4CHECK 22PLAN 6OTHER 274View full analysis

A substantial feature and maintenance release with API, UI, plugin, authentication-token, catalog, scaffolder, frontend, and SCM changes. It also updates vulnerable glob and rollup dependencies, fixes the .well-known/oauth-protected-resource URL, and includes broad correctness and dependency updates.

Action needed (4)

securityhighThe glob and rollup dependencies, upgraded
The glob dependency was upgraded from v7, v8, and v11 to v13 to address security vulnerabilities in older versions. rollup was upgraded from v4.27 to v4.59+ to fix the path traversal vulnerability identified by GHSA-mw96-cpmx-2vgc.
securityThe glob dependency, upgraded to v13
The glob dependency was upgraded from v7, v8, and v11 to v13 to address security vulnerabilities in older versions.
securityThe rollup dependency, upgraded to v4.59+
rollup was upgraded from v4.27 to v4.59+ to fix the path traversal vulnerability identified by GHSA-mw96-cpmx-2vgc.
securityThe .well-known/oauth-protected-resource URL
The .well-known/oauth-protected-resource resource URL was fixed to comply with RFC 9728 Section 7.3. Dynamic resource paths are enabled.

Check if affected (22)

breakingThe auth.omitIdentityTokenOwnershipClaim setting
Applies if you do not configure auth.omitIdentityTokenOwnershipClaim.
The auth.omitIdentityTokenOwnershipClaim setting now defaults to true. Backstage user tokens issued by the auth backend no longer contain the ent claim with the user's ownership entity refs.
breakingThe SignInResolverFactoryOptions type parameters
Applies if you use SignInResolverFactoryOptions.
The type parameters for SignInResolverFactoryOptions changed from <TAuthResult, TOptionsOutput, TOptionsInput> to <TAuthResult, TSchema extends ZodType>.
breakingThe catalog permission exports, removed
Applies if you use CatalogPermissionRuleInput, CatalogPermissionExtensionPoint, or catalogPermissionExtensionPoint.
The CatalogPermissionRuleInput, CatalogPermissionExtensionPoint, and catalogPermissionExtensionPoint exports were removed. coreServices.permissionsRegistry is used directly instead.
+ 19 more on the release page

Plan ahead (6)

deprecatedThe show and showModal compatibility implementation, deprecated
Applies if you use show or showModal.
The deprecated show and showModal methods now use open internally with a Material UI dialog wrapper for backward compatibility.
deprecatedThe auth.omitIdentityTokenOwnershipClaim setting, deprecatedremoval date not announced
Applies if you configure auth.omitIdentityTokenOwnershipClaim.
The setting can still be set to false, but it will be removed entirely in a future release.
deprecatedThe config.schema callback format, deprecated
Applies if you use config.schema.
The old config.schema callback format is deprecated.
+ 3 more on the release page

Source ↗

Backstagev1.48.5CI/CD & App DeliveryMar 11, 2026

ACTION 1View full analysis

A security-focused maintenance release fixes undisclosed issues in two Backstage backend plugins. The affected plugins are @backstage/plugin-auth-backend and @backstage/plugin-scaffolder-backend.

Action needed (1)

securitySecurity fixes in two Backstage backend plugins
Security fixes ship in @backstage/plugin-auth-backend and @backstage/plugin-scaffolder-backend.

Source ↗

Backstagev1.46.5CI/CD & App DeliveryFeb 2, 2026

ACTION 1View full analysis

This is a maintenance release with security fixes backported from v1.47.3. The fixes affect operators using the v1.46.5 release line.

Action needed (1)

securityBackported security fixes from v1.47.3
This release contains backported security fixes from v1.47.3.

Source ↗

Browse by month