RATATOSKRATATOSK
ログイン

Backstage

v1.55.0CI/CD & App Delivery
2026年9月15日

ACTION 6CHECK 6PLAN 1OTHER 213

スキャフォルダーのタスク復旧や認証情報の制御、TechDocs、通知とストリーミング、Kubernetesと認証に関する機能を追加し、広範な修正と依存関係・互換性の更新を含むリリースです。既知の脆弱性を避ける依存関係とツールの更新に加え、早めのアップグレードが必要なセキュリティ修正があります。利用中の非推奨機能や互換性の変更を確認する必要があります。

要対応 (6)

  • securityModule Federation依存関係の更新

    Module Federationの依存関係を、既知のセキュリティ脆弱性を回避するバージョンに更新しました。

  • securityYarnツール依存関係の更新

    Yarnツールの依存関係を、既知のセキュリティ脆弱性を回避するバージョンに更新しました。

  • securityModule Federationの更新

    Module Federationを、既知のセキュリティ脆弱性を回避するバージョンに更新しました。

  • securityOpenAPIジェネレーターツールの更新

    OpenAPIジェネレーターツールを、既知のセキュリティ脆弱性を回避するよう更新しました。

  • securityOpenAPIジェネレーターツールの更新

    OpenAPIジェネレーターツールを、既知のセキュリティ脆弱性を回避するよう更新しました。

  • breakingUnicode文字列変換の一貫性向上

    環境によらず文字列を一貫して処理できるよう、ロケールに依存しないUnicodeの大文字・小文字変換を使用するようにしました。

影響確認 (6)

  • securityKubernetesカタログクラスター ロケーターのURL検証

    カタログクラスター ロケーターを使用している場合に適用されます。

    カタログクラスター ロケーターがKubernetes APIサーバーのURLを検証し、非公開アドレス、クラウドのメタデータエンドポイント、デフォルトでHTTPS以外のURLを拒否するようになりました。dangerouslyAllowClusterUrlsに信頼するホスト名を指定した場合に限り、そのホストへのHTTP接続や非公開アドレスを許可できます。カタログエンティティではserviceAccount認証プロバイダーを使用できず、TLS検証のスキップにはロケーターメソッドでdangerouslyAllowSkipTLSVerifyを設定する必要があります。認証メタデータとして渡されるのは許可されたアノテーションだけになり、Kubernetes APIの取得時にHTTPリダイレクトを自動追従しなくなりました。

  • securityプルリクエストのワークスペース処理の修正

    プルリクエストのワークスペース処理を使用している場合に適用されます。

    プルリクエストのワークスペース処理にあったセキュリティ上の問題を修正しました。

  • breakingGitHubユーザーIDカタログ検索の一致条件変更

    GitHubユーザーIDによるカタログ検索を使用している場合に適用されます。

    GitHubユーザーIDによるカタログ検索で完全一致を求めるようになり、大文字と小文字だけが異なる候補も処理するようになりました。

  • breakingKubernetesエンティティコンテンツの遅延読み込み

    Kubernetesエンティティのコンテンツを使用している場合に適用されます。

    Kubernetesエンティティのコンテンツは、タブを開くまでUIを読み込まなくなり、初期バンドルから除外されます。タブの表示状態はエンティティフィルター述語になり、アプリ設定で上書きできます。Kubernetesアノテーションが空のエンティティにも、以前は非表示だったタブを表示します。

  • breakingデフォルトMCPサーバーの公開方法変更

    mcpActions.serversを設定している場合に適用されます。

    デフォルトのMCPサーバー/api/mcp-actions/v1を常に公開するようになりました。mcpActions.serversを設定してもデフォルトのエンドポイントは置き換えられず、名前付きサーバーはデフォルトサーバーのサブセットとして動作します。デフォルトサーバーは登録済みのすべてのアクションを公開し、同じアクションをデフォルトサーバーと複数の名前付きサーバーに公開できます。

  • breakingタスク復旧用ワークスペースプロバイダーの分離

    タスク復旧にワークスペースシリアライズを使用している場合に適用されます。

    タスク復旧用のワークスペースシリアライズで、従来の設定を使用する場合も含め、別途ワークスペースプロバイダーモジュールのインストールが必要になりました。

事前準備 (1)

  • deprecatedGitHubユーザー名サインインリゾルバーの非推奨化

    GitHubのユーザー名によるサインインリゾルバーを使用している場合に適用されます。

    GitHubのユーザー名によるサインインリゾルバーを非推奨とし、安定版のユーザーIDリゾルバーを推奨する形に変更しました。

その他の記録済み変更 213 件すべてvalue changes 154 · fixes 35 · additions 20 · constraints 2 · deprecations 1 · renames 1

value changes (154)

fixes (35)

  • ffaca06: Fixed a connection leak in the scaffolder event stream where unsubscribing did not abort the underlying SSE connection. Also changed unexpected server disconnects to signal an error instead of silently completing, enabling consumers to retry.
  • ffaca06: Fixed several issues with scaffolder task event stream reconnection: retry timers are now properly cancelled on cleanup, concurrent reconnect attempts are guarded against, and tab visibility changes reconnect the stream using the last seen event cursor without re-fetching the task.
  • 7c1019c: Fixed the scaffolder wizard not scrolling to the top on step change when the app uses the new frontend system (no <main> element).
  • 78656f8: Fixed several issues in the alpha catalog model layer system. Schema updates now preserve sibling field validation when changing a property named type, support deleting inherited fields and constraints, and retain literal JSON values in const and default. Kind schemas without an explicit root type retain their fields, and invalid combined schemas are rejected during model compilation. Empty kind descriptions and reverse relation titles are now applied correctly.
  • 96badbc: Fixed a bug where plugin packages installed through feature discovery were loaded before the app's own code ran. This could cause bootstrap-order-sensitive setup code in the app, such as configuring MUI 5's class name prefix, to be skipped if a discovered plugin's dependencies loaded MUI 5 components first. Discovered plugin packages are now loaded after the app's own code instead.
  • 277a125: Fixed declaration bundling of imports that use the node: built-in module prefix.
  • 1134d4b: Fixed reading a duration from configuration so that an all-zero ISO 8601 duration (such as PT0S) now yields a consistent zero value instead of an empty result.
  • bfb6497: Fixed CopyTextButton showing its tooltip on hover/focus instead of only after the user clicks to copy the text.
  • 603e704: The JSON Schema exported for filter predicates can now be compiled by validators built on RE2 (for example Go's regexp, used by Amazon Bedrock AgentCore Gateway), which previously rejected the predicate key pattern and failed every call to tools such as query-catalog-entities. Accepted keys are unchanged, except that a key whose first character is U+2028 or U+2029 is no longer rejected.
  • 52022b9: Fixed app.extensions shorthand and disabled field to accept boolean-ish strings ('true'/'false'), so environment variable substitution can be used to toggle extensions, e.g. ${CATALOG_OVERVIEW_ENABLED}.
  • bd6cf43: Fixed a bug where overriding a plugin extension with withOverrides moved the overridden extension to the end of the plugin's extension list. This caused overridden extensions to lose their original position, for example making an overridden sub page tab move to the end of the tabs on its page. Overridden extensions now keep their original order, while extensions that don't override an existing one are appended at the end.
  • 23705f3: Fixed an issue where reading or downloading files from Bitbucket Server could fail when the branch name contained special characters such as an ampersand or a plus sign. The branch name is now correctly encoded in the request URL.
  • e592bc5: Fixed an issue where reading files from GitLab could fail when the branch name contained special characters such as an ampersand or a plus sign. The branch name is now correctly encoded in the request URL.
  • e895def: Fixed handling of GitLab URLs for instances configured with a relative base path.
  • f914343: Fixed toast text layout when the application does not define a global line height.
  • 4cba335: Fixes published entry point configurations so it can be imported reliably in Jest/Node resolution.
  • 08c5d9b: Fixed inconsistent URL pattern matching in token revocation.
  • Prevented an unavailable Pinniped supervisor during provider startup from causing an unhandled promise rejection before the first authentication request.
  • Fixed a regression where the About card's field labels (OWNER, SYSTEM, TAGS, etc.) lost their vertical gap above the value.
  • Fixed circular dependency warnings when building the catalog plugin.
  • Fixed the About card to safely show and hide filtered icon links when navigating between entities, without initializing hidden links.
  • Fixed entity context menus to report errors from contributed items without disrupting the menu.
  • Use locale-insensitive Unicode casing for consistent string handling across environments.
  • - 348bea1: Fixed GitlabDiscoveryEntityProvider to only process push events targeting the configured branch.
  • - b7db066: Fixed a scope validation issue in GitLab organization discovery.
  • - 7ac10da: Fixed accumulating abort listeners on MicrosoftGraphClient.
  • - 5d6a62b: Fixed the owner selected in the import stepper being written to the generated catalog-info.yaml as a display name instead of an entity reference. Groups are still suggested by their display name, but selecting one now sets a valid spec.owner, for example picking My Team results in my-team.
  • - a7b14b5: Fixed EntityOwnerPicker crashing with Entity reference "<name>" had missing or empty kind when the owners query parameter contains humanized entity refs, as produced by the OwnershipCard links in @backstage/plugin-org. Query parameters were stored as-is in the initial state and only converted to full entity refs by an effect, which runs after the first render. That first render passed the raw value to the entity presentation API, whose parseEntityRef call rejects a ref without a kind. The same raw value was also sent to catalogApi.getEntitiesByRefs on mount, and made the option checkboxes render unselected until the effect ran. The query parameters are now normalized through EntityOwnerFilter when the state is initialized, matching what the existing effect already did and what the filters code path already produced.
  • - bca8281: Fix clock configuration handling and use lazy initialization for the clocks state.
  • - cd4a9c7: Fixed CardExtension to avoid requiring app context when a custom Renderer is provided.
  • - fe0ec65: Fixed ownership card catalog links to filter by stable entity references instead of display titles.
  • - 3026628: Validate repository file paths before transforming Confluence content.
  • Workspace upload failures are now propagated so that a task does not record a completed step without its corresponding workspace.
  • - b11c9b4: Fixed a bug where the search engine could receive an unfiltered query when no document types were permitted.
  • - 0ae9229: Fixed WebSocket upgrade error responses to prevent load balancers from returning 502 when authentication fails. Error responses now use valid HTTP headers, ensuring the actual error status (401 or 500) is delivered to the client instead of being masked.

additions (20)

  • 1a705ca: Added templateDryRunPermission, which allows permission policies to control who can submit inline Software Template dry runs.
  • 5ff93bf: Added functionality to register a Template Outputs Component in the new frontend system.
  • ee97130: Added support for techdocs.generator.pullOptions when pulling the TechDocs generator Docker image from private registries that require authentication.
  • 62d1a6f: Added techdocs.generator.mkdocs.dangerouslyAllowAdditionalPlugins configuration option, allowing operators to extend the set of permitted MkDocs plugins during TechDocs generation.
  • bf1f82d: Added the required OpenAPI types dependency for Swagger Parser.
  • de957f6: Added @backstage/cli-module-package-manager-yarn with backstage-cli pm verify-patches to validate Yarn patch references, local patch files, lockfile consistency, and patched Backstage package versions against the selected Backstage release. The command is included in @backstage/cli-defaults.
  • b80a9f3: Added an onCopyLog prop to the LogViewer component that renders a copy button in the toolbar, allowing users to copy all log content to the clipboard.
  • a15bac8: Added an optional variant prop to CopyTextButton to allow configuring its visual style (primary, secondary, or tertiary).
  • 279fdf6: Declared the DOM Testing Library dependency required by React Testing Library.
  • 40838dc: Added an extension boundary around custom navigation content.
  • - bf7e890: Added the missing Material UI dependency used by catalog popovers.
  • - ad8f2a8: Added actions to get kubernetes clusters and entity resources
  • - d9a57de: Add KubernetesWatcher interface for streaming Kubernetes resource changes via an async iterator. The watcher is separated from KubernetesFetcher because watching is a long-lived streaming connection that only works with server-side auth providers. Watch supports all event types (ADDED, MODIFIED, DELETED, BOOKMARK, ERROR) with errors yielded as data rather than thrown.
  • - 2a19159: Hardened notification email delivery with format validation and optional allowedEmailDomains. Invalid or disallowed addresses are skipped; allowlistEmailAddresses and denylistEmailAddresses match case-insensitively, allowlist still overrides the domain list, and denied addresses win last.
  • - 80a548a: Added resolveNotificationLink utility function that resolves relative notification links to absolute URLs using a provided base URL. This can be used by notification processor modules to ensure links are absolute before forwarding them to external systems.
  • - bbba6b5: Added support for requiring user-provided credentials for Azure DevOps mutation actions when scaffolder.requireScmUserCredentials is enabled.
  • - bbba6b5: Added support for requiring user-provided credentials for Bitbucket Cloud mutation actions when scaffolder.requireScmUserCredentials is enabled.
  • Added new config path scaffolder.taskRecovery.gcsBucket.name for GCS workspace provider.
  • - 3bb3710: Added optional cancellation support when waiting to claim a scaffolder task.
  • Added task recovery feature with new scaffolder.taskRecovery config section.

constraints (2)

  • 61809fe: Allow independently registered catalog model sources to share identical layers, while reporting a clear error for conflicting layers with the same ID.
  • d9a949e: Added support for rendering custom link elements inside HeaderIconLinkRow.

deprecations (1)

  • - 38441ff: Migrate to toastApi from deprecated alertApi

renames (1)

  • 89743dc: Replaced the deprecated dependency used by repo list-deprecations with the equivalent TypeScript ESLint rule.
Backstageをスタックに追加

対応が必要なリリースが出たときに、週次メールでお知らせします。 今回のセキュリティパッチと破壊的変更も、その一例です。

スタックに追加 →
公式リリースノート ↗Backstageのリリース一覧 →