RATATOSKRATATOSK
ログイン

Backstage

v1.56.0CI/CD & App Delivery
2026年10月20日

ACTION 1CHECK 14PLAN 7OTHER 256

新しいバックエンド、CLI、TechDocs、カタログ、検索、プラグイン機能を含む、機能範囲の広いリリースです。既存の構成によってはAPI、データベース、認証、設定、デフォルト動作の変更に伴う移行と検証が必要です。依存関係、性能、正確性、信頼性の改善に加え、`nodemailer`の更新とSignals WebSocket認証の強化も含まれています。

要対応 (1)

  • securitynodemailerのバージョン10への更新

    セキュリティ上の脆弱性に対応するため、nodemailerがバージョン10へ更新されました。

影響確認 (14)

  • breakingFilterPredicateの述語ルートをオブジェクトに限定

    FilterPredicateを使用している場合に該当します。

    FilterPredicateの述語ルートで受け付ける値がオブジェクトだけになりました。

  • breakingusernameMatchingUserEntityNameサインインリゾルバーの削除

    usernameMatchingUserEntityNameサインインリゾルバーを使用している場合に該当します。

    usernameMatchingUserEntityNameサインインリゾルバーが削除されました。

  • breakingサービスのカスタム実装とモックにinstance IDを要求

    サービスのカスタム実装またはモックを使用している場合に該当します。

    サービスのカスタム実装とモックで、instance IDの提供が必要になりました。

  • breakingingestion_mark_entitiesマイグレーションの適用条件変更

    ローリング方式の無停止アップグレードを実施する場合に該当します。

    ingestion_mark_entitiesのマイグレーションは、ローリング方式の無停止アップグレードの一部として適用できなくなりました。source_keyとentity_refを使用する構成では、アップグレード手順の確認が必要です。

  • breakingカタログバックエンドの必要バージョン変更

    Backstage 1.49以降のカタログバックエンドを使用している場合に該当します。

    Backstage 1.49以降のカタログバックエンドが必要になりました。

  • breakingスティッチング設定の起動時検証

    スティッチングのポーリング間隔またはリース期間を設定している場合に該当します。

    スティッチングのポーリング間隔とリース期間に、0以下の値を設定すると起動時に拒否されるようになりました。

  • breakingSignals WebSocketエンドポイントの認証要件変更

    Signals WebSocketエンドポイントを公開している場合に該当します。

    Signals WebSocketエンドポイントで、有効なユーザーIDトークンが必要になりました。

  • breakingルートインスタンスメタデータサービスのID要件変更

    ルートインスタンスメタデータサービスのカスタム実装またはモックを使用している場合に該当します。

    ルートインスタンスメタデータサービスのカスタム実装とモックで、実行中のバックエンドインスタンスの存続期間にわたって変わらないグローバル一意のIDを提供する必要があります。

  • breakingMenuSectionのdisabledKeys削除

    disabledKeysを指定したMenuSectionを使用している場合に該当します。

    MenuSectionでdisabledKeysを受け付けなくなりました。

  • breakingusernameMatchingUserEntityNameサインインリゾルバーの削除

    usernameMatchingUserEntityNameサインインリゾルバーを使用している場合に該当します。

    usernameMatchingUserEntityNameサインインリゾルバーが削除されました。

  • breakingテーブル列refのentity_refへの改名

    テーブルのref列を使用している場合に該当します。

    テーブルのref列がentity_ref列に改名されました。

  • breakingデータベース接続維持クエリと接続プールのデフォルト変更

    backend.database.keepaliveをtrueに設定していない場合に該当します。

    プラグインごとのデータベース接続維持クエリがデフォルトでは発行されなくなり、PostgreSQLとMySQLの接続プール最小サイズのデフォルトが0になりました。アイドル接続は設定したタイムアウト後に破棄されます。backend.database.keepalive: trueを設定した場合は、定期クエリが継続します。

  • breakingスティッチング設定の起動時検証

    スティッチングのポーリング間隔またはリース期間を設定している場合に該当します。

    スティッチングのポーリング間隔とリース期間に、0以下の値を設定すると起動時に拒否されるようになりました。

  • breakingSignals WebSocket接続のユーザー認証強化

    Signals WebSocketエンドポイントを公開している場合に該当します。

    Signals WebSocketエンドポイントで、有効なユーザーIDトークンが必要になりました。トークンは要求されたWebSocketプロトコルのどこにでも含められます。トークンがない接続、無効なトークンの接続、サービス用トークンを使う接続は拒否され、未認証のゲスト接続も受け付けなくなりました。

事前準備 (7)

  • deprecatedgetCatalogFiltersの非推奨化

    getCatalogFiltersを使用している場合に該当します。

    getCatalogFiltersは非推奨になりました。

  • deprecatedMkDocs関連コマンドとフラグの非推奨警告

    serve:mkdocsまたは--mkdocs-parameter-*フラグを使用している場合に該当します。

    serve:mkdocsと--mkdocs-parameter-*フラグの実行時に、非推奨警告が出力されるようになりました。

  • deprecatedトークンの生出力の非推奨化

    トークンの生出力を使用し、variableKeyを設定していない場合に該当します。

    variableKeyを設定しない場合、トークンの生出力は非推奨になりました。

  • deprecatedtotalItemsオプションの非推奨化

    totalItemsを設定している場合に該当します。

    totalItemsオプションは非推奨になりました。

  • deprecatedMkDocs関連機能の非推奨警告

    serve:mkdocsまたは--mkdocs-parameter-*フラグを使用している場合に該当します。

    serve:mkdocsと--mkdocs-parameter-*フラグの実行時に、非推奨警告が出力されるようになりました。

  • deprecatedStreamEntitiesRequest.totalItemsの非推奨化

    totalItemsを使用している場合に該当します。

    StreamEntitiesRequestのtotalItemsオプションは非推奨となり、無視されるようになりました。

  • deprecatedトークンの生出力の非推奨化

    トークンの生出力を使用し、variableKeyを設定していない場合に該当します。

    variableKeyを設定しない場合、トークンの生出力は非推奨になりました。

その他の記録済み変更 256 件すべてvalue changes 131 · fixes 64 · additions 43 · constraints 11 · renames 4 · defaults 3

value changes (131)

fixes (64)

  • Successfully processed entities no longer remain unavailable if stitch scheduling is interrupted
  • Entities no longer disappear from filtered and sorted catalog queries after a database error during stitching
  • Combobox keyboard selection while filtering has been fixed
  • useRouteRef now resolves routes again after finalization
  • Fixed the catalog entity list rewriting the URL on every render
  • Fixed catalog processing error messages to report stable processor names in minified builds.×2
  • Fixed the Gitea entity provider registering locations against a hardcoded main branch
  • Reading a number from an empty or whitespace-only config value now fails with a clear error instead of returning 0.
  • fixed AWS RDS IAM authentication tokens being reused after their signing credentials expire
  • Fixed serializeError to strip stack traces from all nested error causes.
  • The selected sign-in provider is no longer cleared when a sign-in loader is cancelled.
  • Fixed protected app sign-in returning a 404 when the sign-in handoff is repeated.
  • Fixed long words in toast notifications overlapping the close button.
  • Fixed Azure DevOps downloads to use the requested branch or tag.
  • Fixed importing @backstage/integration from ESM projects.
  • now throws a clear ConflictError when the target repository already exists.
  • Fixed a regression where scaffolder step values consisting of a single template statement block, such as if conditions, were rendered as strings instead of booleans.
  • Fixed Elasticsearch search queries intermittently failing when a collator finishes indexing.
  • Fixed PostgreSQL search highlighting with delimiters that need quoting.
  • Fixed TechDocs asset caching on reused HTTP connections.
  • Fixed TechDocs rejecting mkdocs.yml files that use Material for MkDocs emoji and superfences configuration
  • Fixed the no-mixed-plugin-imports lint rule silently reporting nothing
  • Fixed root setupFilesAfterEnv Jest configuration being shared between workspace packages
  • Fixed Combobox keyboard selection while filtering.
  • Fixed the catalog entity list re-writing the URL on every render
  • Fixed TechDocs addons silently not rendering in apps using the new frontend system
  • Fixed TechDocs asset caching on reused HTTP connections to avoid listener leaks and cross-request response corruption.
  • Fixed TechDocs allowing custom_icons paths in mkdocs.yml that resolve outside the documentation input directory.
  • Fixed TechDocs generation rejecting mkdocs.yml files that use the emoji indexes and generators or the pymdownx.superfences custom fence formats
  • Fixed Material UI styles for TechDocs addons in module-federated applications.
  • a lazy addon no longer hides the surrounding reader while it loads.
  • Prevented TechDocs content from briefly appearing before page styles load.
  • Fixed AWS RDS IAM authentication tokens being reused after their signing credentials expire, which could cause database connection failures when using temporary AWS credentials.
  • Fixed the conversion of legacy filters that happens when a request has both a filter and a query, so that it matches the semantics of the legacy filter query parameter. Empty filters no longer turn into a predicate that matches nothing, empty records no longer match everything, and string values take precedence over CATALOG_FILTER_EXISTS for the same key.
  • Fixed backstage-cli pm verify-patches failing to load unless projects installed the Yarn CLI package separately.
  • jest-cli, jest-runtime and the default Node.js test environment are now loaded through the installed jest package, so tests also run with strict node_modules layouts. An unsupported Jest version, or a missing jest, now fails with a clear error instead of a module resolution error.
  • Fixed setupFilesAfterEnv from the root package.json Jest configuration being shared between workspace packages, which caused each package's src/setupTests file to also be added to every other package.
  • Fixed CommonJS frontend test execution with ESM dependencies on Node.js 24.
  • Commands run through runCli now wait for stdout and stderr to be flushed before exiting, so large command output is no longer truncated on platforms where writes to stdout and stderr are asynchronous.
  • Fixed CLIs created with runCli silently exiting when the root or a command group is invoked without a subcommand. They now display help for that level and complete successfully.
  • Reading a number from a configuration value that is an empty or whitespace-only string now fails with a clear conversion error, instead of silently returning 0. Numeric strings, including ones with surrounding whitespace such as ' 42 ', continue to be parsed as expected.
  • Fixed the Connection type so that auth is a union of method variants instead of an array when no specific auth method is provided.
  • Declared the dependencies of internally bundled code so that the package works with strict node_modules layouts.
  • Stop clearing the selected provider from localStorage when a sign-in loader is cancelled. Only clear it when the loader actually fails.
  • Fixed default landing page configuration in the app template so the Home page path override is inside the existing page:home block.
  • Fixed serializeError so that stack traces are stripped from all nested error causes when stacks are not requested, not just the first-level cause.
  • Fixed Azure DevOps file and archive downloads to use the requested branch or tag, including when checking whether a repository tree has changed. Branches and tags with the same name are now distinguished.
  • Bitbucket Cloud OAuth access tokens returned by getBitbucketCloudOAuthToken are now cached separately for each set of OAuth client credentials. Previously a single token was cached globally, which could cause the wrong token to be used when more than one Bitbucket Cloud integration was configured or when OAuth credentials were rotated.
  • Fixed importing this package from ECMAScript module (ESM) projects, which failed since 2.1.0 with an error saying that lodash does not provide an export named trimEnd.
  • Fixed CLI report generation failing when the FORCE_COLOR environment variable is set.
  • Declared the dependencies of internally bundled code so that the package works with strict node_modules layouts
  • Fixed long words in toast titles and descriptions overflowing the notification and overlapping the close button.
  • - c55505e: Fix protected app sign-in returning a 404 when an authenticated browser repeats the sign-in handoff for the same user.
  • Fixed an issue where successfully processed entities could remain unavailable if stitch scheduling was interrupted.
  • Entity and location queries with a primitive value at the root of the filter predicate are now rejected with an "Invalid query" error, rather than "Query must be an object".
  • Pending stitching work is no longer lost when entities are deleted and re-added
  • Fixed entities disappearing from filtered and sorted catalog queries after a database error during stitching.
  • PostgreSQL and MySQL deadlocks trigger prompt, bounded retries of the entire write transaction
  • - f181c5f: Fixed the Gitea entity provider registering catalog-info.yaml locations against a hardcoded 'main' branch instead of each repository's actual default branch.
  • - 6e08d65: Fixes a regression where scaffolder step values consisting of a singular template statement block (ex. if: "{% if parameters.foo == 'bar' %}true{% else %}false{% endif %}"), were rendered as the strings "true" and "false" instead of their boolean values. This caused steps with if conditions to always run. Step values with a single statement block that renders nothing, such as {% if false %}x{% endif %}, are once again left out of the action input instead of being passed as an empty string.
  • - 06128be: Throw a ConflictError with a clear message when publish:gitlab is called and the target repository already exists, instead of letting the GitLab API return a GitbeakerRequestError with a raw JSON body such as {"name":["has already been taken"]}.
  • - 2153e90: Fixed search queries intermittently failing with a 500 error when a collator finished indexing. The index that the search alias pointed to before the rotation is no longer deleted immediately, so queries already running against it can complete. It is instead removed during the next indexing run for that document type. Note that this means the previous index is now retained between runs, so search storage usage per document type is roughly doubled. Also improved error reporting for failed search queries. An index that disappears while a query is running is now reported as a missing index, and other query failures now include the underlying cause in the logs instead of undefined.
  • - 7535616: Fixed PostgreSQL search highlighting when configured delimiters or selection tags contain punctuation that requires quoting.

additions (43)

  • has a new getCatalogQuery method
  • Three new CLI modules provide domain-oriented commands that talk directly to the corresponding plugin APIs
  • @backstage/cli-module-catalog: catalog list, catalog get, catalog validate, catalog register, catalog unregister
  • @backstage/cli-module-scaffolder: template list, template execute, template dry-run
  • @backstage/cli-module-search: search, docs search
  • This introduces an --engine flag in the TechDocs CLI, an engine configuration map, a generator registry
  • A new withoutFeedbackLink option
  • registers a get-techdocs-metadata action
  • Backends created with createBackend now provide the experimental connections service by default.
  • provides a Featured Templates home page widget
  • a swappable UserAvatar component
  • have a new variableKey input
  • A new theme CSS cascade layer
  • Added AppLifecycleApi
  • Added a backend.logger.redactAllowlist configuration option
  • Added bounded retries for transient Cloud SQL connection failures
  • Added a service-authenticated action registry status endpoint
  • Added a defaultCloseDelayMs option to SubmenuOptions.
  • Added a --fix mode to backstage-cli pm verify-patches.
  • Added an instanceId option to createSpecializedBackend.
  • Added experimental declareConnection and connectionsServiceRef exports
  • Add intent-based CLI modules for catalog, scaffolder, and search.×2
  • A new AnyFilterPredicate type describes predicates that may also be primitive values at the root
  • Introduces --engine flag, engine config map, generator registry with backstage.io/techdocs-engine annotation support, engine field in techdocs_metadata.json, serve:raw command, and live-reload adapter interface.
  • Added a theme CSS cascade layer between components and utilities.
  • Added a source_key column and a UNIQUE(source_key, entity_ref) constraint
  • Added getCatalogQuery to EntityFilter
  • Added a swappable UserAvatar component
  • Added a Featured Templates homepage widget
  • Added withoutFeedbackLink prop to page:techdocs/reader and entity-content:techdocs extensions
  • Added a get-techdocs-metadata action to the TechDocs backend plugin
  • Added a service-authenticated action registry status endpoint that reports whether a plugin provides actions without exposing action metadata.
  • Added an instanceId option to createBackend, allowing deployments to use an externally provided backend instance identifier. Each backend instance uses a random UUID by default.
  • Added bounded retries for transient failures while initializing Cloud SQL database connections.
  • Added support for backend.logger.redactAllowlist configuration option, which allows specific secret values to pass through log redaction when they are known to be safe to log.
  • Added a conservative --fix mode to backstage-cli pm verify-patches that can update project-owned Backstage package patches when an automated release upgrade leaves them pinned to older versions. The repair requires Yarn 3 or later.
  • Added defaultCloseDelayMs option to SubmenuOptions to configure a delay before a submenu closes.
  • Provided an implementation of AppLifecycleApi and updated the app preparation and finalization process to utilize this API.
  • Added AppLifecycleApi and appLifecycleApiRef, which let you check whether the app has been finalized and subscribe to changes in its lifecycle.
  • - a18df8f: Added optional app.publicConfig allowlists for config key paths and extension IDs exposed to unauthenticated users of protected apps. Authenticated users retain access to all frontend-visible configuration, and existing behavior is unchanged unless filtering is enabled.
  • - fe51d40: Added a secure variableKey input to gitlab:projectAccessToken:create and gitlab:projectDeployToken:create actions. When provided, the generated token is stored directly as a masked GitLab CI/CD variable instead of being exposed in task outputs and checkpoint state.
  • - 45b0b89: Added a new techdocs.actions.read permission, available from the /alpha entry point, which controls access to the TechDocs actions registered with the Actions Registry.

constraints (11)

  • EntityTagFilter with multiple tags now requires all of them
  • Added Bitbucket Cloud support for bearer API tokens.
  • removed custom_icons paths that resolve outside the docs directory
  • Declared the per-cluster assumeRole and externalId options in the Kubernetes backend configuration schema.
  • now reports named imports from lodash, which break ESM builds.
  • Several packages now work with strict node_modules layouts.
  • The no-mixed-plugin-imports rule now also applies when the repository is checked out below a directory whose name starts with a dot, such as ~/.worktrees/my-repo.
  • Update Bitbucket Cloud Authentication logic to support bearer API token
  • CLI API reports now support help output with separate groups and commands sections, including commands nested within groups.
  • Updated SQL report generation to support newer Knex releases.
  • 0c9d72c: Update Bitbucket Cloud Authentication logic to support bearer API token

renames (4)

  • The built-in generator is now registered as mkdocs, with techdocs kept as an alias
  • Updated the plugin-web-library template to use @backstage/ui instead of the deprecated @material-ui/core.
  • - 66f8cf8: Replace deprecated createPermissionIntegrationRouter API call with permissionsRegistry
  • - 298f908: Replaced the unmaintained react-relative-time dependency with an internal component based on luxon.

defaults (3)

  • The backend no longer issues periodic per-plugin database keepalive queries by default, and the default minimum PostgreSQL and MySQL connection pool size is now zero.
  • The --bui-bg-app token now follows the page's color-scheme until a theme mode is set.
  • Backends created with createBackend now provide the experimental connections service by default. Custom backends can install connectionsServiceFactory from @backstage/backend-defaults/alpha.
Backstageをスタックに追加

対応が必要なリリースが出たときに、週次メールでお知らせします。 今回のセキュリティパッチと破壊的変更も、その一例です。

スタックに追加 →
公式リリースノート ↗Backstageのリリース一覧 →