Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Project: BackstageClear ×

Backstagev1.54.0CI/CD & App DeliveryAug 18, 2026

ACTION 2CHECK 16PLAN 3OTHER 238View full analysis

A broad release with dependency updates, breaking changes to commands, authentication patterns, and connection APIs, plus new AWS connection support and updates across the catalog, scaffolder, search, and UI. It also includes Kubernetes plugin security fixes and an undisclosed security announcement.

Action needed (2)

breakingStrict TypeScript configuration schema validation
Package preparation now validates TypeScript configuration schemas strictly before publishing.
breakingPortable configuration schemas for root connection types
Connection types now use portable configuration schemas as the source of root connection types.

Check if affected (16)

securityKubernetes plugin security fixes
Applies if you use the Kubernetes plugin.
This release contains security fixes for the Kubernetes plugin.
breakingBackend connection APIs, removed from package exports
Applies if you use connectionsServiceRef, connectionsServiceFactory, DefaultConnectionsService, declareConnection, RootConnection, or AnyRootConnection.
Backend-only APIs and configuration types, including connectionsServiceRef, connectionsServiceFactory, DefaultConnectionsService, declareConnection, RootConnection, and AnyRootConnection, are no longer exported from this package.
breakingNode.js snapshots in generated backend Dockerfiles
Applies if you configure generated backend Dockerfiles.
Generated backend Dockerfiles no longer disable the Node.js snapshot.
+ 13 more on the release page

Plan ahead (3)

deprecatedThe plugin-web-library template, updated to toastApiRef
Applies if you use the plugin-web-library template.
The plugin-web-library template now uses toastApiRef from @backstage/frontend-plugin-api instead of the deprecated alertApiRef from @backstage/core-plugin-api.
deprecatedZod v3 schemas, deprecated
Applies if you depend on Zod v3 schemas.
Zod v3 schemas remain supported but are deprecated.
deprecatedThe catalog.providers.backstageOpenapi.plugins option, deprecated
Applies if you configure catalog.providers.backstageOpenapi.plugins.
The catalog.providers.backstageOpenapi.plugins configuration option is now optional and deprecated.

Source ↗

Backstagev1.53.0CI/CD & App DeliveryJul 14, 2026

ACTION 1CHECK 12PLAN 3OTHER 259View full analysis

A substantial mixed feature and maintenance release adds backend, frontend, catalog, authentication, webhook, and TechDocs capabilities alongside dependency updates and defect fixes. It also includes operator-visible changes to APIs, configuration validation, OpenAPI tooling, and MCP transport behavior; no security advisories or security-specific fixes are disclosed.

Action needed (1)

breakingOpenAPI breaking change detection with oasdiff
@useoptic/optic and @useoptic/openapi-utilities have been replaced with oasdiff for OpenAPI breaking change detection.

Check if affected (12)

breakingSchema loading rejects invalid imports
Applicability is not stated in the release notes.
Invalid imports now cause schema loading to fail in @backstage/config-loader.
breakingThe package schema openapi init and repo schema openapi test commands, removed
Applies if you use package schema openapi init or repo schema openapi test.
The package schema openapi init and repo schema openapi test commands have been removed.
breakingMutually exclusive userGroupMember.path and user.filter configuration
Applies if you configure both userGroupMember.path and user.filter.
Configuring userGroupMember.path together with user.filter is rejected with a configuration error because the two options are mutually exclusive.
+ 9 more on the release page

Plan ahead (3)

deprecatedOpaque entity header extension point deprecation
Applies if you use the opaque entity header extension point.
The existing opaque entity header extension point is deprecated.
deprecatedDynamic Client Registration deprecation warning
Applies if you enable Dynamic Client Registration.
Dynamic Client Registration now logs a deprecation warning when enabled.
deprecatedStable auth.clientIdMetadataDocuments configuration
Applies if you configure auth.clientIdMetadataDocuments or auth.experimentalClientIdMetadataDocuments.
OAuth discovery now uses the stable auth.clientIdMetadataDocuments configuration while retaining compatibility with the deprecated experimental key.

Source ↗

Backstagev1.52.0CI/CD & App DeliveryJun 16, 2026

ACTION 2CHECK 7PLAN 9OTHER 288View full analysis

A broad feature and maintenance release with breaking configuration and API evolution across catalog, scaffolder, TechDocs, frontend, actions, and Kubernetes capabilities. It also includes correctness, performance, reliability, and security-related dependency updates, with migration attention needed for renamed or deprecated settings and APIs.

Action needed (2)

securityThe infinispan dependency upgrade
infinispan was upgraded from ^0.12.0 to ^0.13.0 to address known vulnerabilities.
breakingThe unused json-schema runtime dependency, removed
The unused json-schema runtime dependency has been removed.

Check if affected (7)

breakingThe catalog.stitchingStrategy.mode: 'immediate' setting, removed
Applies if you configure catalog.stitchingStrategy.mode.
The deprecated catalog.stitchingStrategy.mode: 'immediate' setting has been removed.
breakingComboboxProps as a union type
Applies if you use ComboboxProps.
ComboboxProps is now a union type.
breakingThe default /kubernetes page, removed
Applies if you use /kubernetes.
The default Kubernetes standalone page registered at /kubernetes has been removed because it was registered by mistake.
+ 4 more on the release page

Plan ahead (9)

deprecatedTop-level Combobox input state props, deprecated
Applies if you use plain-array options.
The existing top-level input state props remain supported as a deprecated compatibility path for plain-array options.
deprecatedPrevious tokens, deprecatedremoval date not announced
Applicability is not stated in the release notes.
The previous tokens remain in place for backward compatibility, but they are now deprecated and will be removed in a future release.
deprecatedThe single-module runCliModule helper, deprecated
Applies if you use runCliModule.
The single-module runCliModule helper is now deprecated.
+ 6 more on the release page

Source ↗

Backstagev1.51.0CI/CD & App DeliveryMay 19, 2026

ACTION 2CHECK 9PLAN 4OTHER 61View full analysis

A broad release with breaking API removals, changed defaults and constraints, and many new operator-facing capabilities. It also includes performance improvements and an explicitly described dependency security update.

Action needed (2)

securityModule Federation packages at v2.3.3
Module Federation packages were upgraded to v2.3.3 to address known vulnerabilities.
breakingThe @remixicon/react version constraint
The @remixicon/react dependency is limited to versions below 4.9.0 because of a license change.

Check if affected (9)

securitySpecific defaults for known MCP clients
Applies if you configure CIMD or DCR.
The previous permissive ['*'] wildcards were replaced with specific defaults for known MCP clients.
breakingThe NavItemBlueprint API, removed
Applies if you use NavItemBlueprint.
The deprecated NavItemBlueprint was removed from @backstage/frontend-plugin-api.
breakingSidebar and legacy nav-item rendering in renderInTestApp
Applies if you use renderInTestApp.
renderInTestApp from @backstage/frontend-test-utils no longer renders a sidebar or legacy nav-item extensions.
+ 6 more on the release page

Plan ahead (4)

deprecatedThe PolicyQueryUser.identity field, deprecated
Applies if you use PolicyQueryUser.identity.
The PolicyQueryUser.identity field has been deprecated.
deprecatedThe EXPERIMENTAL_formDecorators field, deprecated alias
Applies if you configure EXPERIMENTAL_formDecorators.
The previous EXPERIMENTAL_formDecorators field continues to work as a deprecated alias.
deprecatedThe catalog.stitchingStrategy.mode: 'immediate' setting, deprecated
Applies if you configure catalog.stitchingStrategy.mode.
The catalog.stitchingStrategy.mode: 'immediate' setting has been deprecated.
+ 1 more on the release page

Source ↗

Backstagev1.50.0CI/CD & App DeliveryApr 14, 2026

ACTION 4CHECK 22PLAN 6OTHER 274View full analysis

A substantial feature and maintenance release with API, UI, plugin, authentication-token, catalog, scaffolder, frontend, and SCM changes. It also updates vulnerable glob and rollup dependencies, fixes the .well-known/oauth-protected-resource URL, and includes broad correctness and dependency updates.

Action needed (4)

securityhighThe glob and rollup dependencies, upgraded
The glob dependency was upgraded from v7, v8, and v11 to v13 to address security vulnerabilities in older versions. rollup was upgraded from v4.27 to v4.59+ to fix the path traversal vulnerability identified by GHSA-mw96-cpmx-2vgc.
securityThe glob dependency, upgraded to v13
The glob dependency was upgraded from v7, v8, and v11 to v13 to address security vulnerabilities in older versions.
securityThe rollup dependency, upgraded to v4.59+
rollup was upgraded from v4.27 to v4.59+ to fix the path traversal vulnerability identified by GHSA-mw96-cpmx-2vgc.
securityThe .well-known/oauth-protected-resource URL
The .well-known/oauth-protected-resource resource URL was fixed to comply with RFC 9728 Section 7.3. Dynamic resource paths are enabled.

Check if affected (22)

breakingThe auth.omitIdentityTokenOwnershipClaim setting
Applies if you do not configure auth.omitIdentityTokenOwnershipClaim.
The auth.omitIdentityTokenOwnershipClaim setting now defaults to true. Backstage user tokens issued by the auth backend no longer contain the ent claim with the user's ownership entity refs.
breakingThe SignInResolverFactoryOptions type parameters
Applies if you use SignInResolverFactoryOptions.
The type parameters for SignInResolverFactoryOptions changed from <TAuthResult, TOptionsOutput, TOptionsInput> to <TAuthResult, TSchema extends ZodType>.
breakingThe catalog permission exports, removed
Applies if you use CatalogPermissionRuleInput, CatalogPermissionExtensionPoint, or catalogPermissionExtensionPoint.
The CatalogPermissionRuleInput, CatalogPermissionExtensionPoint, and catalogPermissionExtensionPoint exports were removed. coreServices.permissionsRegistry is used directly instead.
+ 19 more on the release page

Plan ahead (6)

deprecatedThe show and showModal compatibility implementation, deprecated
Applies if you use show or showModal.
The deprecated show and showModal methods now use open internally with a Material UI dialog wrapper for backward compatibility.
deprecatedThe auth.omitIdentityTokenOwnershipClaim setting, deprecatedremoval date not announced
Applies if you configure auth.omitIdentityTokenOwnershipClaim.
The setting can still be set to false, but it will be removed entirely in a future release.
deprecatedThe config.schema callback format, deprecated
Applies if you use config.schema.
The old config.schema callback format is deprecated.
+ 3 more on the release page

Source ↗

Backstagev1.49.0CI/CD & App DeliveryMar 17, 2026

CHECK 14PLAN 7OTHER 38View full analysis

A breaking compatibility release changes defaults and removes or narrows support across the frontend, CLI, catalog, and integrations. It also introduces new frontend, catalog, scaffolder, CLI, and integration capabilities, while deprecated functionality remains in some areas and requires planning. The release contains no security fixes.

Check if affected (14)

breakingThe New Frontend System as the default for new apps
Applicability is not stated in the release notes.
Newly created Backstage apps use the New Frontend System by default in this release.
breakingThe create-app frontend selection flag
Applies if you use the --next flag for create-app.
The --next flag for create-app has been replaced with the --legacy flag.
breakingDeprecated types and options
Applies if you use deprecated types and options.
Several deprecated types and options have been removed.
+ 11 more on the release page

Plan ahead (7)

deprecatedDeprecated variant, columns, and tableOptions props
Applies if you use the variant, columns, or tableOptions props.
The old variant, columns, and tableOptions props are deprecated but remain supported.
deprecatedThe RelatedEntitiesCard component
Applies if you use RelatedEntitiesCard.
RelatedEntitiesCard is deprecated in favor of the new EntityRelationCard.
deprecatedThe CLI built-in set fallback
Applicability is not stated in the release notes.
The CLI falls back to the built-in set with a deprecation warning.
+ 4 more on the release page

Source ↗

Backstagev1.48.0CI/CD & App DeliveryFeb 17, 2026

CHECK 7PLAN 2OTHER 15View full analysis

A release with breaking API and configuration changes alongside new frontend and catalog capabilities. Operators and plugin authors should review renamed catalog extension imports, rejected cross-plugin API overrides, removed configuration and extension-point behaviors, and the module federation default.

Check if affected (7)

breakingStable catalogProcessingExtensionPoint export
Applies if you use catalogProcessingExtensionPoint when providing custom processors and entity providers into the catalog.
Several catalog extension points, including catalogProcessingExtensionPoint, have moved from alpha exports to regular stable exports. Import it from @backstage/plugin-catalog-node instead of @backstage/plugin-catalog-node/alpha.
breakingRejected CatalogApi and ErrorApi overrides
Applicability is not stated in the release notes.
API overrides for CatalogApi and ErrorApi are now rejected with an error instead of triggering a warning as in 1.47.
breakingRemoved auth.experimentalDynamicClientRegistration.tokenExpiration
Applies if you configure auth.experimentalDynamicClientRegistration.tokenExpiration.
The auth.experimentalDynamicClientRegistration.tokenExpiration configuration field has been removed in favor of using the new method.
+ 4 more on the release page

Plan ahead (2)

deprecatedDeprecated IconComponent type
Applies if you use IconComponent.
The IconComponent type is deprecated and is being replaced by the element-based IconElement.
deprecatedDeprecated items prop
Applies if you use the items prop.
The items prop is deprecated in favor of the new navItems prop.

Source ↗

Browse by month