Releases

Backstage v1.52.1 was released, but the published notes are too brief to summarize. See the original release notes for details.

v1.52.0 has three breaking changes (discovery API default, immediate stitching removed, BUI union types) alongside significant catalog PostgreSQL performance fixes and a batch of UX and reliability improvements.

• breakingCheck discovery.endpoints and remove immediate stitching config

  Two breaking changes need attention before upgrading. First, if you use `discovery.endpoints` with internal-only string targets, convert them to object form with `target.internal` set to the internal URL and `target.external` set to a browser-reachable URL — otherwise the frontend will try to reach internal addresses directly. Second, remove `catalog.stitchingStrategy.mode: 'immediate'` from your config; it's now a no-op and will log deprecation warnings. Both changes are straightforward config edits.

• breakingMigrate ComboboxProps and SelectProps extensions before upgrading

  `ComboboxProps` and `SelectProps` are now union types. If your codebase has interfaces that extend either type, they will fail to compile — switch them to type intersections. Also audit CSS selectors that target list content as a direct child of `.bui-SelectPopover`, as that structure changed. These are frontend component-layer changes with no runtime fallback.

• enhancementCatalog query performance improvements for PostgreSQL — no action needed, just upgrade

  Several PostgreSQL-specific query planner fixes ship in this release: multi-column statistics on the search table, a dropped redundant index, tuned vacuum thresholds, and a split count/list query. If your catalog list views are slow with large entity counts, this upgrade is worth prioritizing. No config changes needed — the improvements apply automatically via migration. Teams on MySQL/SQLite won't see the same gains.

Backstage v1.51.2 was released, but the published notes are too brief to summarize. See the original release notes for details.

Backstage v1.51.1 was released, but the published notes are too brief to summarize. See the original release notes for details.

v1.51.0 lands six breaking changes alongside major catalog performance wins, a new AiResource entity kind, and MCP/OIDC hardening. Plan migration time before upgrading.

• breakingRun catalog DB migration SQL before deploying to large installs

  The new catalog migration adds covering indices and a UNIQUE constraint on the search table, which can be slow on large datasets. The release notes explicitly recommend running the provided SQL commands manually before deploying v1.51.0. Skipping this turns a controlled maintenance window into an uncontrolled deployment stall. Check the changelog for the exact SQL before you upgrade.

• breakingAudit six breaking changes before upgrading — OIDC and MsgGraph need immediate config review

  The OIDC CIMD/DCR patterns changed from wildcard '*' to specific MCP client defaults — any custom MCP clients will silently stop working unless you explicitly add their patterns to the allow list. Separately, Microsoft Graph now excludes disabled user accounts; if your org tracks disabled users in Backstage, add an explicit filter before upgrading. Also migrate NavItemBlueprint usages to PageBlueprint title/icon params, and update PolicyQueryUser code to use credentials instead of the removed token/expiresInSeconds fields.

• enhancementAdopt incremental Microsoft Graph ingestion for large orgs

  The new msgraph-incremental module processes users and groups one page at a time and persists cursor state, meaning a pod restart no longer forces a full re-ingest. For orgs with tens of thousands of users, this is a practical operational improvement worth switching to. Install the new module and migrate your provider config — the old MicrosoftGraphOrgEntityProvider remains available but holds the full dataset in memory.

Backstage v1.50.4 was released, but the published notes are too brief to summarize. See the original release notes for details.

Backstage v1.50.3 was released, but the published notes are too brief to summarize. See the original release notes for details.

Backstage v1.50.2 was released, but the published notes are too brief to summarize. See the original release notes for details.

Backstage v1.49.5 was released, but the published notes are too brief to summarize. See the original release notes for details.

Backstage v1.47.4 was released, but the published notes are too brief to summarize. See the original release notes for details.

Backstage v1.48.6 was released, but the published notes are too brief to summarize. See the original release notes for details.

Backstage v1.46.7 was released, but the published notes are too brief to summarize. See the original release notes for details.

Backstage v1.45.6 was released, but the published notes are too brief to summarize. See the original release notes for details.

Backstage v1.43.5 was released, but the published notes are too brief to summarize. See the original release notes for details.

Backstage v1.45.5 was released, but the published notes are too brief to summarize. See the original release notes for details.

Backstage v1.46.6 was released, but the published notes are too brief to summarize. See the original release notes for details.

Backstage v1.44.3 was released, but the published notes are too brief to summarize. See the original release notes for details.

Backstage v1.50.1 was released, but the published notes are too brief to summarize. See the original release notes for details.

v1.50.0 is a wide-ranging release with several breaking changes across auth, frontend APIs, and catalog. Key practical upgrades: AWS RDS IAM auth, Auth0 federated logout, catalog deadlock fixes, and security patches for rollup/glob.

• securityUpdate CLI and build tooling to pick up rollup path traversal fix

  rollup < v4.59 has a high severity path traversal vulnerability (GHSA-mw96-cpmx-2vgc). The @backstage/cli, repo-tools, and several CLI modules have been updated. Run the upgrade helper and update your lockfile. If you pin rollup versions anywhere in your workspace, update those pins to v4.59+. The glob dependency was also bumped to v13 to address vulnerabilities in v7/v8/v11.

• breakingVerify token decoding code before upgrading — ent claim removed by default

  auth.omitIdentityTokenOwnershipClaim now defaults to true, so Backstage user tokens no longer include the ent ownership claim. Any code that manually decodes tokens and reads ent will silently get nothing. Audit your codebase for raw token decoding and replace it with the userInfo core service. If you need time, set auth.omitIdentityTokenOwnershipClaim: false in your config temporarily, but plan to remove it — the setting will be dropped in a future release.

• breakingMigrate createSchemaFromZod to configSchema before upgrading frontend-plugin-api

  The deprecated createSchemaFromZod helper is gone in @backstage/[email protected]. Any extension or blueprint using it will fail at runtime. Check the 1.50 migration docs at backstage.io/docs/frontend-system/architecture/migrations#150 and switch to the configSchema option. Note that plain zod v3 schemas are not supported — use import { z } from 'zod/v4' from the zod v3 package or upgrade to zod v4.

Backstage v1.49.4 was released, but the published notes are too brief to summarize. See the original release notes for details.

Backstage v1.49.3 was released, but the published notes are too brief to summarize. See the original release notes for details.

Backstage v1.49.2 was released, but the published notes are too brief to summarize. See the original release notes for details.

Backstage v1.49.1 is a patch release cleaning up new frontend system rough edges, fixing UI issues in TechDocs/Scaffolder, and adding small DX improvements to the create-app template.

• enhancementUnprocessed entities DevTools tab is now on by default

  If you're debugging entity ingestion issues, you no longer need to configure the DevTools unprocessed entities tab manually. Upgrade and it's there. Useful for catching catalog processing failures faster in development and staging environments.

• enhancementNew frontend system adopters: pick up layout fixes now

  If your team is migrating to or testing the new Backstage frontend system, this patch fixes concrete layout problems in both the Scaffolder and Catalog entity pages. Skip 1.49.0 and go straight to 1.49.1 to avoid dealing with those visual regressions.

• enhancementPlugin headers can now carry navigation links

  The new titleLink prop on PageLayoutProps lets plugin header titles act as navigation anchors back to the plugin root. Worth adopting if you're building or maintaining custom plugins — it aligns with the expected UX pattern for Backstage's evolving plugin header system.

v1.49.0 is a landmark release: the New Frontend System hits 1.0 RC, the CLI becomes extensible via modules, and there are multiple breaking changes in UI components, integrations, and entity cards requiring migration work.

• breakingMigrate entity cards and BUI components before upgrading `@backstage/plugin-catalog`

  The major version bump on `@backstage/plugin-catalog` means direct action is required. Remove all `variant` prop usage from EntityAboutCard, EntityLinksCard, EntityLabelsCard, GroupProfileCard, and UserProfileCard. Wrap your app in a `BUIProvider` inside a React Router context — without it, Link, ButtonLink, Tabs, Menu, and Table lose client-side navigation. Also rename any CSS selectors using old `bui-HeaderPage` class patterns and camelCase data attributes. Audit custom components that implement the old `Checkbox` `selected`/`indeterminate` props and switch to `isSelected`/`isIndeterminate`.

• breakingRemove all deprecated Bitbucket and legacy integration config immediately

  The old `bitbucket` config key and Azure DevOps `token`/`credential` fields are gone — not deprecated, gone. If your `app-config.yaml` still references these, your backend will fail to start after upgrading. Replace `bitbucket` with `bitbucketCloud` or `bitbucketServer`, migrate Azure DevOps to the `credentials` array, and update any Gerrit URL utility calls. Check scaffolder templates too, as `parseRepoUrl` no longer handles `bitbucket`.

• enhancementAdd `@backstage/cli-defaults` as a devDependency now, not later

  The CLI module system is live, and the fallback to built-in commands already emits a deprecation warning. Add `@backstage/cli-defaults` to your root `devDependencies` today to silence the warning and future-proof your setup before the fallback is removed entirely. If you maintain custom CLI tooling, look at `createCliModule` in `@backstage/cli-node` to package it properly as a first-class CLI extension.

Backstage v1.48.5 was released, but the published notes are too brief to summarize. See the original release notes for details.

Backstage v1.48.4 was released, but the published notes are too brief to summarize. See the original release notes for details.

Backstage v1.48.3 was released, but the published notes are too brief to summarize. See the original release notes for details.

Backstage v1.48.2 was released, but the published notes are too brief to summarize. See the original release notes for details.

Backstage v1.48.1 was released, but the published notes are too brief to summarize. See the original release notes for details.