Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

All Security Breaking Deprecated

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Project: BackstageClear ×

Backstagev1.54.0CI/CD & App DeliveryAug 18, 2026

ACTION 2CHECK 16PLAN 3OTHER 238View full analysis

A broad release with dependency updates, breaking changes to commands, authentication patterns, and connection APIs, plus new AWS connection support and updates across the catalog, scaffolder, search, and UI. It also includes Kubernetes plugin security fixes and an undisclosed security announcement.

Action needed (2)

breakingStrict TypeScript configuration schema validation
Package preparation now validates TypeScript configuration schemas strictly before publishing.
breakingPortable configuration schemas for root connection types
Connection types now use portable configuration schemas as the source of root connection types.

Check if affected (16)

securityKubernetes plugin security fixes
Applies if you use the Kubernetes plugin.
This release contains security fixes for the Kubernetes plugin.
breakingBackend connection APIs, removed from package exports
Applies if you use connectionsServiceRef, connectionsServiceFactory, DefaultConnectionsService, declareConnection, RootConnection, or AnyRootConnection.
Backend-only APIs and configuration types, including connectionsServiceRef, connectionsServiceFactory, DefaultConnectionsService, declareConnection, RootConnection, and AnyRootConnection, are no longer exported from this package.
breakingNode.js snapshots in generated backend Dockerfiles
Applies if you configure generated backend Dockerfiles.
Generated backend Dockerfiles no longer disable the Node.js snapshot.
+ 13 more on the release page

Plan ahead (3)

deprecatedThe plugin-web-library template, updated to toastApiRef
Applies if you use the plugin-web-library template.
The plugin-web-library template now uses toastApiRef from @backstage/frontend-plugin-api instead of the deprecated alertApiRef from @backstage/core-plugin-api.
deprecatedZod v3 schemas, deprecated
Applies if you depend on Zod v3 schemas.
Zod v3 schemas remain supported but are deprecated.
deprecatedThe catalog.providers.backstageOpenapi.plugins option, deprecated
Applies if you configure catalog.providers.backstageOpenapi.plugins.
The catalog.providers.backstageOpenapi.plugins configuration option is now optional and deprecated.

Backstagev1.53.1CI/CD & App DeliveryJul 29, 2026

View full analysis

Backstage v1.53.1 contains no operator-facing change details in the available release note. The release note provides only the version heading, so there are no documented changes to assess.

Backstagev1.53.0CI/CD & App DeliveryJul 14, 2026

ACTION 1CHECK 12PLAN 3OTHER 259View full analysis

A substantial mixed feature and maintenance release adds backend, frontend, catalog, authentication, webhook, and TechDocs capabilities alongside dependency updates and defect fixes. It also includes operator-visible changes to APIs, configuration validation, OpenAPI tooling, and MCP transport behavior; no security advisories or security-specific fixes are disclosed.

Action needed (1)

breakingOpenAPI breaking change detection with oasdiff
@useoptic/optic and @useoptic/openapi-utilities have been replaced with oasdiff for OpenAPI breaking change detection.

Check if affected (12)

breakingSchema loading rejects invalid imports
Applicability is not stated in the release notes.
Invalid imports now cause schema loading to fail in @backstage/config-loader.
breakingThe package schema openapi init and repo schema openapi test commands, removed
Applies if you use package schema openapi init or repo schema openapi test.
The package schema openapi init and repo schema openapi test commands have been removed.
breakingMutually exclusive userGroupMember.path and user.filter configuration
Applies if you configure both userGroupMember.path and user.filter.
Configuring userGroupMember.path together with user.filter is rejected with a configuration error because the two options are mutually exclusive.
+ 9 more on the release page

Plan ahead (3)

deprecatedOpaque entity header extension point deprecation
Applies if you use the opaque entity header extension point.
The existing opaque entity header extension point is deprecated.
deprecatedDynamic Client Registration deprecation warning
Applies if you enable Dynamic Client Registration.
Dynamic Client Registration now logs a deprecation warning when enabled.
deprecatedStable auth.clientIdMetadataDocuments configuration
Applies if you configure auth.clientIdMetadataDocuments or auth.experimentalClientIdMetadataDocuments.
OAuth discovery now uses the stable auth.clientIdMetadataDocuments configuration while retaining compatibility with the deprecated experimental key.

Backstagev1.52.1CI/CD & App DeliveryJun 26, 2026

OTHER 2View full analysis

Backstage v1.52.1 is a maintenance release focused on operator-facing defect fixes. It addresses scheduler task state during trigger changes and a broken configuration schema in the Kubernetes React plugin.

Backstagev1.52.0CI/CD & App DeliveryJun 16, 2026

ACTION 2CHECK 7PLAN 9OTHER 288View full analysis

A broad feature and maintenance release with breaking configuration and API evolution across catalog, scaffolder, TechDocs, frontend, actions, and Kubernetes capabilities. It also includes correctness, performance, reliability, and security-related dependency updates, with migration attention needed for renamed or deprecated settings and APIs.

Action needed (2)

securityThe infinispan dependency upgrade
infinispan was upgraded from ^0.12.0 to ^0.13.0 to address known vulnerabilities.
breakingThe unused json-schema runtime dependency, removed
The unused json-schema runtime dependency has been removed.

Check if affected (7)

breakingThe catalog.stitchingStrategy.mode: 'immediate' setting, removed
Applies if you configure catalog.stitchingStrategy.mode.
The deprecated catalog.stitchingStrategy.mode: 'immediate' setting has been removed.
breakingComboboxProps as a union type
Applies if you use ComboboxProps.
ComboboxProps is now a union type.
breakingThe default /kubernetes page, removed
Applies if you use /kubernetes.
The default Kubernetes standalone page registered at /kubernetes has been removed because it was registered by mistake.
+ 4 more on the release page

Plan ahead (9)

deprecatedTop-level Combobox input state props, deprecated
Applies if you use plain-array options.
The existing top-level input state props remain supported as a deprecated compatibility path for plain-array options.
deprecatedPrevious tokens, deprecatedremoval date not announced
Applicability is not stated in the release notes.
The previous tokens remain in place for backward compatibility, but they are now deprecated and will be removed in a future release.
deprecatedThe single-module runCliModule helper, deprecated
Applies if you use runCliModule.
The single-module runCliModule helper is now deprecated.
+ 6 more on the release page

Backstagev1.51.2CI/CD & App DeliveryJun 10, 2026

OTHER 1View full analysis

This release contains a documented operator-facing defect fix. The recorded release heading has no actionable change.

Backstagev1.51.1CI/CD & App DeliveryMay 29, 2026

OTHER 4View full analysis

Backstage v1.51.1 is a maintenance release focused on corrected defects and package dependency behavior. The available release information indicates fixes in query handling, GitLab repository retrieval, runtime dependency classification, and Microsoft Graph group-member filtering.

Backstagev1.51.0CI/CD & App DeliveryMay 19, 2026

ACTION 2CHECK 9PLAN 4OTHER 61View full analysis

A broad release with breaking API removals, changed defaults and constraints, and many new operator-facing capabilities. It also includes performance improvements and an explicitly described dependency security update.

Action needed (2)

securityModule Federation packages at v2.3.3
Module Federation packages were upgraded to v2.3.3 to address known vulnerabilities.
breakingThe @remixicon/react version constraint
The @remixicon/react dependency is limited to versions below 4.9.0 because of a license change.

Check if affected (9)

securitySpecific defaults for known MCP clients
Applies if you configure CIMD or DCR.
The previous permissive ['*'] wildcards were replaced with specific defaults for known MCP clients.
breakingThe NavItemBlueprint API, removed
Applies if you use NavItemBlueprint.
The deprecated NavItemBlueprint was removed from @backstage/frontend-plugin-api.
breakingSidebar and legacy nav-item rendering in renderInTestApp
Applies if you use renderInTestApp.
renderInTestApp from @backstage/frontend-test-utils no longer renders a sidebar or legacy nav-item extensions.
+ 6 more on the release page

Plan ahead (4)

deprecatedThe PolicyQueryUser.identity field, deprecated
Applies if you use PolicyQueryUser.identity.
The PolicyQueryUser.identity field has been deprecated.
deprecatedThe EXPERIMENTAL_formDecorators field, deprecated alias
Applies if you configure EXPERIMENTAL_formDecorators.
The previous EXPERIMENTAL_formDecorators field continues to work as a deprecated alias.
deprecatedThe catalog.stitchingStrategy.mode: 'immediate' setting, deprecated
Applies if you configure catalog.stitchingStrategy.mode.
The catalog.stitchingStrategy.mode: 'immediate' setting has been deprecated.
+ 1 more on the release page

Backstagev1.50.4CI/CD & App DeliveryApr 29, 2026

CHECK 1View full analysis

A security maintenance release with fixes affecting three Backstage catalog packages. The affected packages are @backstage/plugin-catalog-backend-module-unprocessed, @backstage/plugin-catalog-unprocessed-entities-common version, and @backstage/plugin-catalog-unprocessed-entities.

Check if affected (1)

securitySecurity fixes for Backstage catalog packages
Applies if you use any of @backstage/plugin-catalog-backend-module-unprocessed, @backstage/plugin-catalog-unprocessed-entities-common version, or @backstage/plugin-catalog-unprocessed-entities.
This release contains security fixes for @backstage/plugin-catalog-backend-module-unprocessed, @backstage/plugin-catalog-unprocessed-entities-common version, and @backstage/plugin-catalog-unprocessed-entities.

Backstagev1.50.3CI/CD & App DeliveryApr 22, 2026

OTHER 3View full analysis

This is a maintenance release for Backstage with ordinary correctness fixes. It addresses home page widget interactions, facets endpoint performance under filters or permissions, and external links under a non-root base path.

Backstagev1.50.2CI/CD & App DeliveryApr 18, 2026

ACTION 1OTHER 4View full analysis

This release combines a new TechDocs sidebar styling capability with dependency updates and constraints. It also corrects an active tab indicator issue in Backstage UI.

Action needed (1)

breakingReact Aria dependency ranges constrained to patch-only updates
React Aria dependency ranges are limited to patch-only updates in Backstage v1.50.2.

Backstagev1.49.5CI/CD & App DeliveryApr 17, 2026

OTHER 1View full analysis

This release narrows the allowed React Aria dependency range to prevent unintended breaking updates. The version heading itself carries no operator-facing change.

Backstagev1.47.4CI/CD & App DeliveryApr 17, 2026

OTHER 1View full analysis

This release changes the dependency range for React Aria dependencies to prevent unintended breaking changes from minor-version updates. The release version is not stated as increasing.

Backstagev1.48.6CI/CD & App DeliveryApr 17, 2026

OTHER 1View full analysis

This release tightens the React Aria dependency range to avoid unintended breaking minor updates. It has no operator-facing change.

Backstagev1.46.7CI/CD & App DeliveryApr 17, 2026

OTHER 1View full analysis

This release has no operator-facing change. Its dependency constraints narrow the React Aria version range to avoid breaking updates from minor releases.

Backstagev1.45.6CI/CD & App DeliveryApr 17, 2026

OTHER 1View full analysis

This release updates the React Aria dependency version constraint to prevent breaking changes from entering through minor updates. It carries no operator-facing change.

Backstagev1.43.5CI/CD & App DeliveryApr 16, 2026

OTHER 1View full analysis

This release upgrades the deprecated tar v6 dependency to tar v7. The release heading carries no operator-facing change.

Backstagev1.45.5CI/CD & App DeliveryApr 16, 2026

OTHER 1View full analysis

This release upgrades the deprecated tar dependency from v6 to v7. No security issue or operator action is identified.

Backstagev1.46.6CI/CD & App DeliveryApr 16, 2026

OTHER 1View full analysis

This release updates the deprecated tar dependency from v6 to v7. No security issue is stated.

Backstagev1.44.3CI/CD & App DeliveryApr 16, 2026

OTHER 1View full analysis

This release updates the deprecated tar dependency from v6 to v7. It has no recorded operator-facing changes.

Backstagev1.50.1CI/CD & App DeliveryApr 15, 2026

CHECK 1OTHER 2View full analysis

A release with a breaking configuration-schema replacement, a repo startup correctness fix, and a React Aria dependency update. It changes configuration values used by existing extensions and blueprints and updates React Aria to v1.17.0 with monopackage imports.

Check if affected (1)

breakingConfiguration schema values replaced
Applies if you use existing extensions and blueprints.
This release replaces old configuration schema values from existing extensions and blueprints.

Backstagev1.50.0CI/CD & App DeliveryApr 14, 2026

ACTION 4CHECK 22PLAN 6OTHER 274View full analysis

A substantial feature and maintenance release with API, UI, plugin, authentication-token, catalog, scaffolder, frontend, and SCM changes. It also updates vulnerable glob and rollup dependencies, fixes the .well-known/oauth-protected-resource URL, and includes broad correctness and dependency updates.

Action needed (4)

securityhighThe glob and rollup dependencies, upgraded
The glob dependency was upgraded from v7, v8, and v11 to v13 to address security vulnerabilities in older versions. rollup was upgraded from v4.27 to v4.59+ to fix the path traversal vulnerability identified by GHSA-mw96-cpmx-2vgc.
securityThe glob dependency, upgraded to v13
The glob dependency was upgraded from v7, v8, and v11 to v13 to address security vulnerabilities in older versions.
securityThe rollup dependency, upgraded to v4.59+
rollup was upgraded from v4.27 to v4.59+ to fix the path traversal vulnerability identified by GHSA-mw96-cpmx-2vgc.
securityThe .well-known/oauth-protected-resource URL
The .well-known/oauth-protected-resource resource URL was fixed to comply with RFC 9728 Section 7.3. Dynamic resource paths are enabled.

Check if affected (22)

breakingThe auth.omitIdentityTokenOwnershipClaim setting
Applies if you do not configure auth.omitIdentityTokenOwnershipClaim.
The auth.omitIdentityTokenOwnershipClaim setting now defaults to true. Backstage user tokens issued by the auth backend no longer contain the ent claim with the user's ownership entity refs.
breakingThe SignInResolverFactoryOptions type parameters
Applies if you use SignInResolverFactoryOptions.
The type parameters for SignInResolverFactoryOptions changed from <TAuthResult, TOptionsOutput, TOptionsInput> to <TAuthResult, TSchema extends ZodType>.
breakingThe catalog permission exports, removed
Applies if you use CatalogPermissionRuleInput, CatalogPermissionExtensionPoint, or catalogPermissionExtensionPoint.
The CatalogPermissionRuleInput, CatalogPermissionExtensionPoint, and catalogPermissionExtensionPoint exports were removed. coreServices.permissionsRegistry is used directly instead.
+ 19 more on the release page

Plan ahead (6)

deprecatedThe show and showModal compatibility implementation, deprecated
Applies if you use show or showModal.
The deprecated show and showModal methods now use open internally with a Material UI dialog wrapper for backward compatibility.
deprecatedThe auth.omitIdentityTokenOwnershipClaim setting, deprecatedremoval date not announced
Applies if you configure auth.omitIdentityTokenOwnershipClaim.
The setting can still be set to false, but it will be removed entirely in a future release.
deprecatedThe config.schema callback format, deprecated
Applies if you use config.schema.
The old config.schema callback format is deprecated.
+ 3 more on the release page

Backstagev1.49.4CI/CD & App DeliveryApr 7, 2026

OTHER 3View full analysis

This is a patch release for Backstage with operator-relevant correctness fixes. The recorded note tail points to fixes for OAuth 2.0 metadata URL handling, the legacy-frontend-plugin template name, and permissions on the scaffolder plugin's /.well-known endpoint.

Backstagev1.49.3CI/CD & App DeliveryMar 28, 2026

OTHER 3View full analysis

This is a patch release for Backstage with one new TablePagination API prop and two correctness fixes. The changes concern pagination labeling, relative link resolution, and entity relation cards.

Backstagev1.49.2CI/CD & App DeliveryMar 22, 2026

OTHER 1View full analysis

This patch release corrects CIMD redirect URI matching for loopback addresses. No operator configuration change is indicated.

Backstagev1.49.1CI/CD & App DeliveryMar 20, 2026

CHECK 1OTHER 6View full analysis

This release contains API and template changes, new DevTools functionality, frontend behavior changes, and defect corrections. No security advisories or security-specific fixes are stated.

Check if affected (1)

breakingThe catalog entity page layout header is disabled
Applies if you use the catalog entity page in the new frontend system.
The new frontend system disables the page layout header for the catalog entity page.

Backstagev1.49.0CI/CD & App DeliveryMar 17, 2026

CHECK 14PLAN 7OTHER 38View full analysis

A breaking compatibility release changes defaults and removes or narrows support across the frontend, CLI, catalog, and integrations. It also introduces new frontend, catalog, scaffolder, CLI, and integration capabilities, while deprecated functionality remains in some areas and requires planning. The release contains no security fixes.

Check if affected (14)

breakingThe New Frontend System as the default for new apps
Applicability is not stated in the release notes.
Newly created Backstage apps use the New Frontend System by default in this release.
breakingThe create-app frontend selection flag
Applies if you use the --next flag for create-app.
The --next flag for create-app has been replaced with the --legacy flag.
breakingDeprecated types and options
Applies if you use deprecated types and options.
Several deprecated types and options have been removed.
+ 11 more on the release page

Plan ahead (7)

deprecatedDeprecated variant, columns, and tableOptions props
Applies if you use the variant, columns, or tableOptions props.
The old variant, columns, and tableOptions props are deprecated but remain supported.
deprecatedThe RelatedEntitiesCard component
Applies if you use RelatedEntitiesCard.
RelatedEntitiesCard is deprecated in favor of the new EntityRelationCard.
deprecatedThe CLI built-in set fallback
Applicability is not stated in the release notes.
The CLI falls back to the built-in set with a deprecation warning.
+ 4 more on the release page

Backstagev1.48.5CI/CD & App DeliveryMar 11, 2026

ACTION 1View full analysis

A security-focused maintenance release fixes undisclosed issues in two Backstage backend plugins. The affected plugins are @backstage/plugin-auth-backend and @backstage/plugin-scaffolder-backend.

Action needed (1)

securitySecurity fixes in two Backstage backend plugins
Security fixes ship in @backstage/plugin-auth-backend and @backstage/plugin-scaffolder-backend.

Backstagev1.48.4CI/CD & App DeliveryMar 4, 2026

CHECK 1View full analysis

Backstage v1.48.4 is a security-fix release affecting three Backstage packages. Operators using these packages are the audience for this update.

Check if affected (1)

securitySecurity fixes for three Backstage packages
Applies to users of @backstage/plugin-techdocs-node, @backstage/integration, or @backstage/plugin-scaffolder-backend.
This release contains security fixes for @backstage/plugin-techdocs-node, @backstage/integration, and @backstage/plugin-scaffolder-backend. The fixes ship in Backstage v1.48.4.

Backstagev1.48.3CI/CD & App DeliveryFeb 26, 2026

OTHER 2View full analysis

Version v1.48.3 is a correctness-fix release for Backstage. It fixes MUI module resolution by correcting the @mui/material/styles shared dependency key and fixes entity page tab groups so they follow the configured ordering.

Backstagev1.48.2CI/CD & App DeliveryFeb 24, 2026

OTHER 3View full analysis

Backstage v1.48.2 restores two scaffolder alpha API exports, changes search behavior on the first navigation, and updates a third-party dependency to fix a compatibility defect. The release concerns users of the scaffolder APIs, first-navigation search, or the affected API extraction tooling.

Backstagev1.48.1CI/CD & App DeliveryFeb 18, 2026

OTHER 1View full analysis

This release contains an operator-facing defect correction. No detailed change entry is available here.

Backstagev1.48.0CI/CD & App DeliveryFeb 17, 2026

CHECK 7PLAN 2OTHER 15View full analysis

A release with breaking API and configuration changes alongside new frontend and catalog capabilities. Operators and plugin authors should review renamed catalog extension imports, rejected cross-plugin API overrides, removed configuration and extension-point behaviors, and the module federation default.

Check if affected (7)

breakingStable catalogProcessingExtensionPoint export
Applies if you use catalogProcessingExtensionPoint when providing custom processors and entity providers into the catalog.
Several catalog extension points, including catalogProcessingExtensionPoint, have moved from alpha exports to regular stable exports. Import it from @backstage/plugin-catalog-node instead of @backstage/plugin-catalog-node/alpha.
breakingRejected CatalogApi and ErrorApi overrides
Applicability is not stated in the release notes.
API overrides for CatalogApi and ErrorApi are now rejected with an error instead of triggering a warning as in 1.47.
breakingRemoved auth.experimentalDynamicClientRegistration.tokenExpiration
Applies if you configure auth.experimentalDynamicClientRegistration.tokenExpiration.
The auth.experimentalDynamicClientRegistration.tokenExpiration configuration field has been removed in favor of using the new method.
+ 4 more on the release page

Plan ahead (2)

deprecatedDeprecated IconComponent type
Applies if you use IconComponent.
The IconComponent type is deprecated and is being replaced by the element-based IconElement.
deprecatedDeprecated items prop
Applies if you use the items prop.
The items prop is deprecated in favor of the new navItems prop.

Backstagev1.46.5CI/CD & App DeliveryFeb 2, 2026

ACTION 1View full analysis

This is a maintenance release with security fixes backported from v1.47.3. The fixes affect operators using the v1.46.5 release line.

Action needed (1)

securityBackported security fixes from v1.47.3
This release contains backported security fixes from v1.47.3.

Backstagev1.47.3CI/CD & App DeliveryFeb 2, 2026

CHECK 1View full analysis

A security-focused release with fixes for the TechDocs Node plugin. The release is relevant to deployments that use @backstage/plugin-techdocs-node.

Check if affected (1)

securitySecurity fixes for @backstage/plugin-techdocs-node
Applies if you use @backstage/plugin-techdocs-node.
This release contains security fixes for @backstage/plugin-techdocs-node.

Browse by month