RATATOSKRATATOSK
로그인

Backstage

v1.55.0CI/CD & App Delivery
2026년 9월 15일

ACTION 6CHECK 6PLAN 1OTHER 213

기능 확장과 유지보수 변경이 함께 포함된 릴리스로, 작업 복구와 인증, 문서, 알림, 스트리밍, 쿠버네티스 관련 동작이 보완되었습니다. 보안 취약점을 피하도록 의존성과 도구를 업데이트했으며, 풀 리퀘스트 작업 공간 처리의 보안 문제도 수정했으므로 신속한 업그레이드가 필요합니다. 일부 사용 중단 및 호환성 변경은 해당 기능을 사용하는 환경에서 검토가 필요합니다.

조치 필요 (6)

  • securityModule Federation 의존성 업데이트

    Module Federation 의존성을 알려진 보안 취약점이 없는 버전으로 업데이트했습니다.

  • securityYarn 도구 의존성 업데이트

    Yarn 도구 의존성을 알려진 보안 취약점이 없는 버전으로 업데이트했습니다.

  • securityModule Federation 보안 문제 수정

    Module Federation 의존성을 알려진 보안 취약점이 없는 버전으로 업데이트해 관련 문제를 수정했습니다.

  • securityOpenAPI 생성 도구 업데이트

    OpenAPI 생성 도구를 알려진 보안 취약점이 없도록 업데이트했습니다.

  • securityOpenAPI 생성 도구 보안 업데이트

    OpenAPI 생성 도구를 알려진 보안 취약점이 없도록 업데이트했습니다.

  • breaking로케일 비의존 유니코드 대소문자 처리

    환경마다 문자열을 일관되게 처리하도록 로케일의 영향을 받지 않는 유니코드 대소문자 변환을 사용합니다.

영향 확인 (6)

  • security카탈로그 클러스터 URL 검증 강화

    카탈로그 클러스터 위치 확인자를 사용하는 경우에 해당합니다.

    카탈로그 클러스터 위치 확인자가 쿠버네티스 API 서버 URL을 검증해 비공개 주소, 클라우드 메타데이터 엔드포인트, 기본적으로 허용되지 않는 비HTTPS URL을 차단합니다. 신뢰할 호스트 이름은 dangerouslyAllowClusterUrls에 등록해 해당 호스트에 한해 HTTP나 비공개 주소를 허용할 수 있습니다. 카탈로그 엔터티의 serviceAccount 인증 제공자 사용과 TLS 검증 건너뛰기는 제한되며, 쿠버네티스 API 요청은 HTTP 리디렉션을 자동으로 따라가지 않습니다.

  • security풀 리퀘스트 작업 공간 보안 문제 수정

    풀 리퀘스트 작업 공간 처리를 사용하는 경우에 해당합니다.

    풀 리퀘스트 작업 공간 처리에서 발생한 보안 문제를 수정했습니다.

  • breakingGitHub 사용자 ID 카탈로그 조회 조건 변경

    GitHub 사용자 ID 카탈로그 조회를 사용하는 경우에 해당합니다.

    GitHub 사용자 ID 카탈로그 조회가 이제 정확히 일치하는 결과만 사용하며, 대소문자만 다른 후보도 처리합니다.

  • breaking쿠버네티스 엔터티 탭 지연 로딩

    쿠버네티스 엔터티 콘텐츠를 사용하는 경우에 해당합니다.

    쿠버네티스 엔터티 콘텐츠는 탭을 열 때까지 화면을 불러오지 않아 초기 번들에 포함되지 않습니다. 탭 표시 여부는 엔터티 필터 조건이 되었고 앱 설정으로 재정의할 수 있으며, 쿠버네티스 주석이 비어 있는 엔터티에도 탭이 표시됩니다.

  • breaking기본 MCP 서버 노출 유지

    mcpActions.servers를 설정하는 경우에 해당합니다.

    mcpActions.servers를 설정해도 기본 MCP 서버인 /api/mcp-actions/v1가 항상 노출됩니다. 이름이 지정된 서버는 기본 서버의 일부로 동작하며, 등록된 모든 작업을 노출하는 기본 서버와 여러 이름 지정 서버에서 같은 작업을 함께 제공할 수 있습니다.

  • breaking작업 복구용 작업 공간 제공자 분리

    작업 복구에 작업 공간 직렬화를 사용하는 경우에 해당합니다.

    작업 복구에 사용하는 작업 공간 직렬화에는 이제 별도의 작업 공간 제공자 모듈 설치가 필요합니다. 기존 설정을 사용하는 경우에도 같은 조건이 적용됩니다.

미리 준비 (1)

  • deprecatedGitHub 사용자 이름 로그인 확인자 사용 중단

    GitHub 사용자 이름 로그인 확인자를 사용하는 경우에 해당합니다.

    GitHub 사용자 이름 로그인 확인자를 더 안정적인 사용자 ID 확인자로 대체하는 방향으로 사용 중단 처리했습니다.

그 외 기록된 변경 213건 전체value changes 154 · fixes 35 · additions 20 · constraints 2 · deprecations 1 · renames 1

value changes (154)

fixes (35)

  • ffaca06: Fixed a connection leak in the scaffolder event stream where unsubscribing did not abort the underlying SSE connection. Also changed unexpected server disconnects to signal an error instead of silently completing, enabling consumers to retry.
  • ffaca06: Fixed several issues with scaffolder task event stream reconnection: retry timers are now properly cancelled on cleanup, concurrent reconnect attempts are guarded against, and tab visibility changes reconnect the stream using the last seen event cursor without re-fetching the task.
  • 7c1019c: Fixed the scaffolder wizard not scrolling to the top on step change when the app uses the new frontend system (no <main> element).
  • 78656f8: Fixed several issues in the alpha catalog model layer system. Schema updates now preserve sibling field validation when changing a property named type, support deleting inherited fields and constraints, and retain literal JSON values in const and default. Kind schemas without an explicit root type retain their fields, and invalid combined schemas are rejected during model compilation. Empty kind descriptions and reverse relation titles are now applied correctly.
  • 96badbc: Fixed a bug where plugin packages installed through feature discovery were loaded before the app's own code ran. This could cause bootstrap-order-sensitive setup code in the app, such as configuring MUI 5's class name prefix, to be skipped if a discovered plugin's dependencies loaded MUI 5 components first. Discovered plugin packages are now loaded after the app's own code instead.
  • 277a125: Fixed declaration bundling of imports that use the node: built-in module prefix.
  • 1134d4b: Fixed reading a duration from configuration so that an all-zero ISO 8601 duration (such as PT0S) now yields a consistent zero value instead of an empty result.
  • bfb6497: Fixed CopyTextButton showing its tooltip on hover/focus instead of only after the user clicks to copy the text.
  • 603e704: The JSON Schema exported for filter predicates can now be compiled by validators built on RE2 (for example Go's regexp, used by Amazon Bedrock AgentCore Gateway), which previously rejected the predicate key pattern and failed every call to tools such as query-catalog-entities. Accepted keys are unchanged, except that a key whose first character is U+2028 or U+2029 is no longer rejected.
  • 52022b9: Fixed app.extensions shorthand and disabled field to accept boolean-ish strings ('true'/'false'), so environment variable substitution can be used to toggle extensions, e.g. ${CATALOG_OVERVIEW_ENABLED}.
  • bd6cf43: Fixed a bug where overriding a plugin extension with withOverrides moved the overridden extension to the end of the plugin's extension list. This caused overridden extensions to lose their original position, for example making an overridden sub page tab move to the end of the tabs on its page. Overridden extensions now keep their original order, while extensions that don't override an existing one are appended at the end.
  • 23705f3: Fixed an issue where reading or downloading files from Bitbucket Server could fail when the branch name contained special characters such as an ampersand or a plus sign. The branch name is now correctly encoded in the request URL.
  • e592bc5: Fixed an issue where reading files from GitLab could fail when the branch name contained special characters such as an ampersand or a plus sign. The branch name is now correctly encoded in the request URL.
  • e895def: Fixed handling of GitLab URLs for instances configured with a relative base path.
  • f914343: Fixed toast text layout when the application does not define a global line height.
  • 4cba335: Fixes published entry point configurations so it can be imported reliably in Jest/Node resolution.
  • 08c5d9b: Fixed inconsistent URL pattern matching in token revocation.
  • Prevented an unavailable Pinniped supervisor during provider startup from causing an unhandled promise rejection before the first authentication request.
  • Fixed a regression where the About card's field labels (OWNER, SYSTEM, TAGS, etc.) lost their vertical gap above the value.
  • Fixed circular dependency warnings when building the catalog plugin.
  • Fixed the About card to safely show and hide filtered icon links when navigating between entities, without initializing hidden links.
  • Fixed entity context menus to report errors from contributed items without disrupting the menu.
  • Use locale-insensitive Unicode casing for consistent string handling across environments.
  • - 348bea1: Fixed GitlabDiscoveryEntityProvider to only process push events targeting the configured branch.
  • - b7db066: Fixed a scope validation issue in GitLab organization discovery.
  • - 7ac10da: Fixed accumulating abort listeners on MicrosoftGraphClient.
  • - 5d6a62b: Fixed the owner selected in the import stepper being written to the generated catalog-info.yaml as a display name instead of an entity reference. Groups are still suggested by their display name, but selecting one now sets a valid spec.owner, for example picking My Team results in my-team.
  • - a7b14b5: Fixed EntityOwnerPicker crashing with Entity reference "<name>" had missing or empty kind when the owners query parameter contains humanized entity refs, as produced by the OwnershipCard links in @backstage/plugin-org. Query parameters were stored as-is in the initial state and only converted to full entity refs by an effect, which runs after the first render. That first render passed the raw value to the entity presentation API, whose parseEntityRef call rejects a ref without a kind. The same raw value was also sent to catalogApi.getEntitiesByRefs on mount, and made the option checkboxes render unselected until the effect ran. The query parameters are now normalized through EntityOwnerFilter when the state is initialized, matching what the existing effect already did and what the filters code path already produced.
  • - bca8281: Fix clock configuration handling and use lazy initialization for the clocks state.
  • - cd4a9c7: Fixed CardExtension to avoid requiring app context when a custom Renderer is provided.
  • - fe0ec65: Fixed ownership card catalog links to filter by stable entity references instead of display titles.
  • - 3026628: Validate repository file paths before transforming Confluence content.
  • Workspace upload failures are now propagated so that a task does not record a completed step without its corresponding workspace.
  • - b11c9b4: Fixed a bug where the search engine could receive an unfiltered query when no document types were permitted.
  • - 0ae9229: Fixed WebSocket upgrade error responses to prevent load balancers from returning 502 when authentication fails. Error responses now use valid HTTP headers, ensuring the actual error status (401 or 500) is delivered to the client instead of being masked.

additions (20)

  • 1a705ca: Added templateDryRunPermission, which allows permission policies to control who can submit inline Software Template dry runs.
  • 5ff93bf: Added functionality to register a Template Outputs Component in the new frontend system.
  • ee97130: Added support for techdocs.generator.pullOptions when pulling the TechDocs generator Docker image from private registries that require authentication.
  • 62d1a6f: Added techdocs.generator.mkdocs.dangerouslyAllowAdditionalPlugins configuration option, allowing operators to extend the set of permitted MkDocs plugins during TechDocs generation.
  • bf1f82d: Added the required OpenAPI types dependency for Swagger Parser.
  • de957f6: Added @backstage/cli-module-package-manager-yarn with backstage-cli pm verify-patches to validate Yarn patch references, local patch files, lockfile consistency, and patched Backstage package versions against the selected Backstage release. The command is included in @backstage/cli-defaults.
  • b80a9f3: Added an onCopyLog prop to the LogViewer component that renders a copy button in the toolbar, allowing users to copy all log content to the clipboard.
  • a15bac8: Added an optional variant prop to CopyTextButton to allow configuring its visual style (primary, secondary, or tertiary).
  • 279fdf6: Declared the DOM Testing Library dependency required by React Testing Library.
  • 40838dc: Added an extension boundary around custom navigation content.
  • - bf7e890: Added the missing Material UI dependency used by catalog popovers.
  • - ad8f2a8: Added actions to get kubernetes clusters and entity resources
  • - d9a57de: Add KubernetesWatcher interface for streaming Kubernetes resource changes via an async iterator. The watcher is separated from KubernetesFetcher because watching is a long-lived streaming connection that only works with server-side auth providers. Watch supports all event types (ADDED, MODIFIED, DELETED, BOOKMARK, ERROR) with errors yielded as data rather than thrown.
  • - 2a19159: Hardened notification email delivery with format validation and optional allowedEmailDomains. Invalid or disallowed addresses are skipped; allowlistEmailAddresses and denylistEmailAddresses match case-insensitively, allowlist still overrides the domain list, and denied addresses win last.
  • - 80a548a: Added resolveNotificationLink utility function that resolves relative notification links to absolute URLs using a provided base URL. This can be used by notification processor modules to ensure links are absolute before forwarding them to external systems.
  • - bbba6b5: Added support for requiring user-provided credentials for Azure DevOps mutation actions when scaffolder.requireScmUserCredentials is enabled.
  • - bbba6b5: Added support for requiring user-provided credentials for Bitbucket Cloud mutation actions when scaffolder.requireScmUserCredentials is enabled.
  • Added new config path scaffolder.taskRecovery.gcsBucket.name for GCS workspace provider.
  • - 3bb3710: Added optional cancellation support when waiting to claim a scaffolder task.
  • Added task recovery feature with new scaffolder.taskRecovery config section.

constraints (2)

  • 61809fe: Allow independently registered catalog model sources to share identical layers, while reporting a clear error for conflicting layers with the same ID.
  • d9a949e: Added support for rendering custom link elements inside HeaderIconLinkRow.

deprecations (1)

  • - 38441ff: Migrate to toastApi from deprecated alertApi

renames (1)

  • 89743dc: Replaced the deprecated dependency used by repo list-deprecations with the equivalent TypeScript ESLint rule.
Backstage 스택에 추가

조치가 필요한 릴리스가 나왔을 때 주간 메일로 알려드립니다. 이번 릴리스의 보안 패치와 브레이킹 체인지 같은 것들입니다.

스택에 추가 →
공식 릴리스 노트 ↗Backstage 릴리스 전체 →