Backstage v1.53.0 is a feature release with seven breaking changes across auth, CLI, and API layers. The SSE MCP transport, proxy agent bootstrap, and OpenAPI testing CLI commands are removed; OAuth redirect validation is tightened to reject wildcards crossing host-path boundaries and embedded credentials; config-loader enforces strict type checking; and EntityContextMenuItemBlueprint changes output structure. Optic is replaced by oasdiff for OpenAPI tooling. Numerous bugfixes address TechDocs, Scaffolder, and catalog issues; new features include breadcrumbs framework, user settings storage, and extended auth/database options. No security fixes are included.
breakingSSE MCP transport removed
The Server-Sent Events (SSE) transport for MCP actions has been removed from @backstage/plugin-mcp-actions-backend. If your deployment uses the SSE transport, switch to the Streamable HTTP endpoint or update your MCP configuration.
breakingStricter config-loader type validation
Config-loader now validates imported types in TypeScript configuration schemas instead of treating them as unconstrained. Invalid imports will cause schema loading to fail. Review your configuration schemas for unresolved or missing type imports.
breakingTighter OAuth redirect URI and CIMD allowlist matching
Wildcard patterns in OAuth redirect URIs are now constrained: patterns must include an explicit protocol, wildcards no longer match across host and path boundaries, and embedded credentials are always rejected. Patterns like http://localhost:* now match only the root path; use http://localhost:*/* to allow any path. Update your auth configuration to match this stricter syntax.
breakingEntityContextMenuItemBlueprint output type change
The EntityContextMenuItemBlueprint API now outputs menu item data instead of a rendered MUI element; the icon type is now IconElement. Update any code that depends on the catalog entity context menu to use the new data structure.
breakingLegacy proxy agent bootstrap removed
The bootstrapEnvProxyAgents export has been removed from @backstage/cli-common, along with global-agent and undici dependencies. If you rely on this export, use Node's native NODE_USE_ENV_PROXY environment variable instead.
breakingOpenAPI CLI commands and wrapInOpenApiTestServer removed
The package schema openapi init and repo schema openapi test CLI commands have been removed. Runtime OpenAPI validation is still available via wrapServer from @backstage/backend-openapi-utils/testUtils. The wrapInOpenApiTestServer function has also been removed; use wrapServer instead.
breakingOpenAPI tooling switched from Optic to oasdiff
Optic (@useoptic/optic and @useoptic/openapi-utilities) has been replaced with oasdiff in @backstage/repo-tools for OpenAPI breaking change detection. Update any tooling or CI/CD pipelines that reference Optic.
Key changes (10)
- SSE MCP transport removed from @backstage/plugin-mcp-actions-backend; use Streamable HTTP endpoint
- Config-loader now enforces strict type validation; invalid imports cause schema load failure
- OAuth redirect URI validation tightened: explicit protocol required, credentials rejected, wildcards constrained (http://localhost:* matches root only; use http://localhost:*/* for any path)
- EntityContextMenuItemBlueprint changed to output data instead of MUI elements (icon is now IconElement)
- bootstrapEnvProxyAgents removed from @backstage/cli-common; use NODE_USE_ENV_PROXY instead
- OpenAPI CLI commands (package schema openapi init, repo schema openapi test) and wrapInOpenApiTestServer removed; use wrapServer
- Optic replaced with oasdiff for OpenAPI breaking change detection in @backstage/repo-tools
- Catalog entity page migration to BUI and entity header extension deprecation in progress
- Fixes for TechDocs metadata loop, DatabaseTaskStore string cast, Bitbucket pickers, catalog export crashes, EntityTypePicker regression, scheduled task registration, React key warnings, Kubernetes schema inclusion, yeoman-environment v4 compatibility, and TechDocs blank page rendering
- Enhancements: breadcrumbs framework, TextAreaField UI component, react-aria-components re-export, user settings plugin, multi-config BACKSTAGE_ENV stacking, Azure DevOps webhooks, CIMD token revocation, Redis connection options, S3 PrivateLink, Auth0 prompt parameters, embedded postgres flags, extension predicate action attributes
