AI-analyzed release notes for CNCF graduated and incubating projects.
This is an operator-focused maintenance release with fixes and configuration constraints across controllers. It also adds a feature gate and updates dependency and toolkit components.
Check if affected (1)
breakingRequired audience field on the GCR Receiver secret
Applies if you configure the audience field on the GCR Receiver secret.
This release combines a new TechDocs sidebar styling capability with dependency updates and constraints. It also corrects an active tab indicator issue in Backstage UI.
Action needed (1)
breakingReact Aria dependency ranges constrained to patch-only updates
React Aria dependency ranges are limited to patch-only updates in Backstage v1.50.2.
A release with a breaking configuration-schema replacement, a repo startup correctness fix, and a React Aria dependency update. It changes configuration values used by existing extensions and blueprints and updates React Aria to v1.17.0 with monopackage imports.
Check if affected (1)
breakingConfiguration schema values replaced
Applies if you use existing extensions and blueprints.
A substantial feature and maintenance release with API, UI, plugin, authentication-token, catalog, scaffolder, frontend, and SCM changes. It also updates vulnerable glob and rollup dependencies, fixes the . URL, and includes broad correctness and dependency updates.
Action needed (4)
securityhighThe glob and rollup dependencies, upgraded
The glob dependency was upgraded from v7, v8, and v11 to v13 to address security vulnerabilities in older versions. rollup was upgraded from v4.27 to v4.59+ to fix the path traversal vulnerability identified by GHSA-mw96-cpmx-2vgc.
securityThe glob dependency, upgraded to v13
The glob dependency was upgraded from v7, v8, and v11 to v13 to address security vulnerabilities in older versions.
securityThe rollup dependency, upgraded to v4.59+
rollup was upgraded from v4.27 to v4.59+ to fix the path traversal vulnerability identified by GHSA-mw96-cpmx-2vgc.
securityThe . URL
The . resource URL was fixed to comply with RFC 9728 Section 7.3. Dynamic resource paths are enabled.
Check if affected (22)
breakingThe auth. setting
Applies if you do not configure auth..
breakingThe SignInResolverFactoryOptions type parameters
Applies if you use SignInResolverFactoryOptions.
breakingThe catalog permission exports, removed
Applies if you use CatalogPermissionRuleInput, CatalogPermissionExtensionPoint, or catalogPermissionExtensionPoint.
Plan ahead (6)
deprecatedThe show and showModal compatibility implementation, deprecated
Applies if you use show or showModal.
deprecatedThe auth. setting, deprecatedremoval date not announced
Applies if you configure auth..
deprecatedThe config. callback format, deprecated
Applies if you use config..
A fractional bucketing update changes pseudorandom assignments without changing the API. Consistent assignments require all providers to be updated.
Check if affected (1)
breakingFractional pseudorandom bucketing assignments
Applies if you use providers.
