Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Backstagev1.54.0CI/CD & App DeliveryAug 18, 2026

ACTION 2CHECK 16PLAN 3OTHER 238View full analysis

A broad release with dependency updates, breaking changes to commands, authentication patterns, and connection APIs, plus new AWS connection support and updates across the catalog, scaffolder, search, and UI. It also includes Kubernetes plugin security fixes and an undisclosed security announcement.

Action needed (2)

breakingStrict TypeScript configuration schema validation
Package preparation now validates TypeScript configuration schemas strictly before publishing.
breakingPortable configuration schemas for root connection types
Connection types now use portable configuration schemas as the source of root connection types.

Check if affected (16)

securityKubernetes plugin security fixes
Applies if you use the Kubernetes plugin.
breakingBackend connection APIs, removed from package exports
Applies if you use connectionsServiceRef, connectionsServiceFactory, DefaultConnectionsService, declareConnection, RootConnection, or AnyRootConnection.
breakingNode.js snapshots in generated backend Dockerfiles
Applies if you configure generated backend Dockerfiles.
+ 13 more on the release page

Plan ahead (3)

deprecatedThe plugin-web-library template, updated to toastApiRef
Applies if you use the plugin-web-library template.
deprecatedZod v3 schemas, deprecated
Applies if you depend on Zod v3 schemas.
deprecatedThe catalog.providers.backstageOpenapi.plugins option, deprecated
Applies if you configure catalog.providers.backstageOpenapi.plugins.

Source ↗

Backstagev1.53.0CI/CD & App DeliveryJul 14, 2026

ACTION 1CHECK 12PLAN 3OTHER 259View full analysis

A substantial mixed feature and maintenance release adds backend, frontend, catalog, authentication, webhook, and TechDocs capabilities alongside dependency updates and defect fixes. It also includes operator-visible changes to APIs, configuration validation, OpenAPI tooling, and MCP transport behavior; no security advisories or security-specific fixes are disclosed.

Action needed (1)

breakingOpenAPI breaking change detection with oasdiff
@useoptic/optic and @useoptic/openapi-utilities have been replaced with oasdiff for OpenAPI breaking change detection.

Check if affected (12)

breakingSchema loading rejects invalid imports
Applicability is not stated in the release notes.
breakingThe package schema openapi init and repo schema openapi test commands, removed
Applies if you use package schema openapi init or repo schema openapi test.
breakingMutually exclusive userGroupMember.path and user.filter configuration
Applies if you configure both userGroupMember.path and user.filter.
+ 9 more on the release page

Plan ahead (3)

deprecatedOpaque entity header extension point deprecation
Applies if you use the opaque entity header extension point.
deprecatedDynamic Client Registration deprecation warning
Applies if you enable Dynamic Client Registration.
deprecatedStable auth.clientIdMetadataDocuments configuration
Applies if you configure auth.clientIdMetadataDocuments or auth.experimentalClientIdMetadataDocuments.

Source ↗

Backstagev1.52.0CI/CD & App DeliveryJun 16, 2026

ACTION 2CHECK 7PLAN 9OTHER 288View full analysis

A broad feature and maintenance release with breaking configuration and API evolution across catalog, scaffolder, TechDocs, frontend, actions, and Kubernetes capabilities. It also includes correctness, performance, reliability, and security-related dependency updates, with migration attention needed for renamed or deprecated settings and APIs.

Action needed (2)

securityThe infinispan dependency upgrade
infinispan was upgraded from ^0.12.0 to ^0.13.0 to address known vulnerabilities.
breakingThe unused json-schema runtime dependency, removed
The unused json-schema runtime dependency has been removed.

Check if affected (7)

breakingThe catalog.stitchingStrategy.mode: 'immediate' setting, removed
Applies if you configure catalog.stitchingStrategy.mode.
breakingComboboxProps as a union type
Applies if you use ComboboxProps.
breakingThe default /kubernetes page, removed
Applies if you use /kubernetes.
+ 4 more on the release page

Plan ahead (9)

deprecatedTop-level Combobox input state props, deprecated
Applies if you use plain-array options.
deprecatedPrevious tokens, deprecatedremoval date not announced
Applicability is not stated in the release notes.
deprecatedThe single-module runCliModule helper, deprecated
Applies if you use runCliModule.
+ 6 more on the release page

Source ↗

Backstagev1.51.0CI/CD & App DeliveryMay 19, 2026

ACTION 2CHECK 9PLAN 4OTHER 61View full analysis

A broad release with breaking API removals, changed defaults and constraints, and many new operator-facing capabilities. It also includes performance improvements and an explicitly described dependency security update.

Action needed (2)

securityModule Federation packages at v2.3.3
Module Federation packages were upgraded to v2.3.3 to address known vulnerabilities.
breakingThe @remixicon/react version constraint
The @remixicon/react dependency is limited to versions below 4.9.0 because of a license change.

Check if affected (9)

securitySpecific defaults for known MCP clients
Applies if you configure CIMD or DCR.
breakingThe NavItemBlueprint API, removed
Applies if you use NavItemBlueprint.
breakingSidebar and legacy nav-item rendering in renderInTestApp
Applies if you use renderInTestApp.
+ 6 more on the release page

Plan ahead (4)

deprecatedThe PolicyQueryUser.identity field, deprecated
Applies if you use PolicyQueryUser.identity.
deprecatedThe EXPERIMENTAL_formDecorators field, deprecated alias
Applies if you configure EXPERIMENTAL_formDecorators.
deprecatedThe catalog.stitchingStrategy.mode: 'immediate' setting, deprecated
Applies if you configure catalog.stitchingStrategy.mode.
+ 1 more on the release page

Source ↗

Argov3.2.12CI/CD & App DeliveryMay 13, 2026

PLAN 1OTHER 2View full analysis

A maintenance release that closes the 3.2 series and marks it as end of life. It also contains an operator-visible bug fix and a dependency update.

Plan ahead (1)

deprecatedThe 3.2 release series reaches end of life
Applies if you use the 3.2 release series.

Source ↗

Argov3.1.16CI/CD & App DeliveryMay 5, 2026

PLAN 1OTHER 2View full analysis

A maintenance release that ends the 3.1 series on May 06th 2026, after which it will no longer receive bug fixes or security updates. It also includes a fix for an error when attempting a second delete operation.

Plan ahead (1)

deprecatedThe 3.1 release series, end of liferemoval planned in May 06th 2026
Applies if you run the 3.1 release series.

Source ↗

Backstagev1.50.0CI/CD & App DeliveryApr 14, 2026

ACTION 4CHECK 22PLAN 6OTHER 274View full analysis

A substantial feature and maintenance release with API, UI, plugin, authentication-token, catalog, scaffolder, frontend, and SCM changes. It also updates vulnerable glob and rollup dependencies, fixes the .well-known/oauth-protected-resource URL, and includes broad correctness and dependency updates.

Action needed (4)

securityhighThe glob and rollup dependencies, upgraded
The glob dependency was upgraded from v7, v8, and v11 to v13 to address security vulnerabilities in older versions. rollup was upgraded from v4.27 to v4.59+ to fix the path traversal vulnerability identified by GHSA-mw96-cpmx-2vgc.
securityThe glob dependency, upgraded to v13
The glob dependency was upgraded from v7, v8, and v11 to v13 to address security vulnerabilities in older versions.
securityThe rollup dependency, upgraded to v4.59+
rollup was upgraded from v4.27 to v4.59+ to fix the path traversal vulnerability identified by GHSA-mw96-cpmx-2vgc.
securityThe .well-known/oauth-protected-resource URL
The .well-known/oauth-protected-resource resource URL was fixed to comply with RFC 9728 Section 7.3. Dynamic resource paths are enabled.

Check if affected (22)

breakingThe auth.omitIdentityTokenOwnershipClaim setting
Applies if you do not configure auth.omitIdentityTokenOwnershipClaim.
breakingThe SignInResolverFactoryOptions type parameters
Applies if you use SignInResolverFactoryOptions.
breakingThe catalog permission exports, removed
Applies if you use CatalogPermissionRuleInput, CatalogPermissionExtensionPoint, or catalogPermissionExtensionPoint.
+ 19 more on the release page

Plan ahead (6)

deprecatedThe show and showModal compatibility implementation, deprecated
Applies if you use show or showModal.
deprecatedThe auth.omitIdentityTokenOwnershipClaim setting, deprecatedremoval date not announced
Applies if you configure auth.omitIdentityTokenOwnershipClaim.
deprecatedThe config.schema callback format, deprecated
Applies if you use config.schema.
+ 3 more on the release page

Source ↗

Backstagev1.49.0CI/CD & App DeliveryMar 17, 2026

CHECK 14PLAN 7OTHER 38View full analysis

A breaking compatibility release changes defaults and removes or narrows support across the frontend, CLI, catalog, and integrations. It also introduces new frontend, catalog, scaffolder, CLI, and integration capabilities, while deprecated functionality remains in some areas and requires planning. The release contains no security fixes.

Check if affected (14)

breakingThe New Frontend System as the default for new apps
Applicability is not stated in the release notes.
breakingThe create-app frontend selection flag
Applies if you use the --next flag for create-app.
breakingDeprecated types and options
Applies if you use deprecated types and options.
+ 11 more on the release page

Plan ahead (7)

deprecatedDeprecated variant, columns, and tableOptions props
Applies if you use the variant, columns, or tableOptions props.
deprecatedThe RelatedEntitiesCard component
Applies if you use RelatedEntitiesCard.
deprecatedThe CLI built-in set fallback
Applicability is not stated in the release notes.
+ 4 more on the release page

Source ↗

Backstagev1.48.0CI/CD & App DeliveryFeb 17, 2026

CHECK 7PLAN 2OTHER 15View full analysis

A release with breaking API and configuration changes alongside new frontend and catalog capabilities. Operators and plugin authors should review renamed catalog extension imports, rejected cross-plugin API overrides, removed configuration and extension-point behaviors, and the module federation default.

Check if affected (7)

breakingStable catalogProcessingExtensionPoint export
Applies if you use catalogProcessingExtensionPoint when providing custom processors and entity providers into the catalog.
breakingRejected CatalogApi and ErrorApi overrides
Applicability is not stated in the release notes.
breakingRemoved auth.experimentalDynamicClientRegistration.tokenExpiration
Applies if you configure auth.experimentalDynamicClientRegistration.tokenExpiration.
+ 4 more on the release page

Plan ahead (2)

deprecatedDeprecated IconComponent type
Applies if you use IconComponent.
deprecatedDeprecated items prop
Applies if you use the items prop.

Source ↗

Browse by month