RATATOSKRATATOSK
로그인

Backstage

v1.56.0CI/CD & App Delivery
2026년 10월 20일

ACTION 1CHECK 14PLAN 7OTHER 256

백엔드, 명령줄 도구, 문서, 카탈로그, 검색, 플러그인 기능을 넓히면서 API와 데이터베이스, 인증, 설정, 기본 동작에도 호환성 변경이 포함된 릴리스입니다. 관련 기능을 사용하는 환경은 마이그레이션과 동작 검증이 필요하며, 신뢰성, 성능, 정확성, 의존성 개선과 보안 취약점 대응도 함께 반영되었습니다.

조치 필요 (1)

  • securitynodemailer 버전 10 업데이트

    이전 버전의 보안 취약점에 대응하기 위해 nodemailer를 버전 10으로 업데이트했습니다.

영향 확인 (14)

  • breakingFilterPredicate 루트 객체 제한

    FilterPredicate를 사용하는 경우에 적용됩니다.

    FilterPredicate의 predicate 루트에는 이제 객체만 허용됩니다.

  • breakingusernameMatchingUserEntityName 로그인 확인자 제거

    usernameMatchingUserEntityName 로그인 확인자를 사용하는 경우에 적용됩니다.

    usernameMatchingUserEntityName 로그인 확인자가 제거되었습니다.

  • breaking서비스 구현의 instance ID 제공 요구

    서비스의 사용자 지정 구현이나 모의 객체를 사용하는 경우에 적용됩니다.

    서비스의 사용자 지정 구현과 모의 객체는 이제 instance ID를 제공해야 합니다.

  • breaking순차 무중단 업그레이드에서 마이그레이션 적용 제한

    순차 방식의 무중단 업그레이드를 수행하는 경우에 적용됩니다.

    이 마이그레이션은 순차 방식의 무중단 업그레이드에 포함해 적용할 수 없습니다.

  • breakingcatalog backend 버전 호환성 요구

    Backstage 1.49 이상에서 제공하는 catalog backend를 사용하는 경우에 적용됩니다.

    Backstage 1.49 이상에서 제공하는 catalog backend가 필요합니다.

  • breaking스티칭 간격 및 임대 기간 값 검증

    스티칭 폴링 간격이나 임대 기간을 설정하는 경우에 적용됩니다.

    0 이하로 설정한 스티칭 폴링 간격과 임대 기간은 시작할 때 거부됩니다.

  • breakingSignals WebSocket 사용자 토큰 인증

    Signals WebSocket 엔드포인트를 외부에 공개하는 경우에 적용됩니다.

    Signals WebSocket 엔드포인트가 유효한 사용자 신원 토큰을 요구합니다.

  • breaking루트 인스턴스 메타데이터의 고유 ID 요구

    루트 인스턴스 메타데이터 서비스의 사용자 지정 구현이나 모의 객체를 사용하는 경우에 적용됩니다.

    루트 인스턴스 메타데이터 서비스의 사용자 지정 구현과 모의 객체는 실행 중인 백엔드 인스턴스의 수명 동안 변하지 않는 전역 고유 ID를 제공해야 합니다.

  • breakingMenuSection의 disabledKeys 제거

    disabledKeys와 함께 MenuSection을 사용하는 경우에 적용됩니다.

    MenuSection이 더 이상 disabledKeys를 허용하지 않습니다.

  • breaking로그인 확인자 usernameMatchingUserEntityName 제거

    usernameMatchingUserEntityName 로그인 확인자를 사용하는 경우에 적용됩니다.

    usernameMatchingUserEntityName 로그인 확인자가 제거되었습니다.

  • breaking테이블 열 ref의 entity_ref 변경

    테이블의 ref 열을 사용하는 경우에 적용됩니다.

    테이블의 ref 열 이름이 entity_ref로 바뀌었습니다.

  • breaking데이터베이스 연결 유지 기본값 변경

    backend.database.keepalive를 true로 설정하지 않은 경우에 적용됩니다.

    플러그인별 데이터베이스 연결 유지 쿼리를 기본적으로 더 이상 실행하지 않으며, PostgreSQL과 MySQL 연결 풀의 기본 최소 크기를 0으로 변경했습니다. 설정한 제한 시간이 지나면 유휴 연결을 정리하고, 명시적으로 설정한 최소 풀 크기는 유지합니다. 주기적인 쿼리를 계속 실행하려면 backend.database.keepalive: true를 설정해야 합니다.

  • breaking스티칭 설정의 양수 값 검증

    스티칭 폴링 간격이나 임대 기간을 설정하는 경우에 적용됩니다.

    0 이하로 설정한 스티칭 폴링 간격과 임대 기간은 시작할 때 거부됩니다.

  • breakingSignals WebSocket 연결 인증 강화

    Signals WebSocket 엔드포인트를 외부에 공개하는 경우에 적용됩니다.

    Signals WebSocket 엔드포인트는 요청된 WebSocket 프로토콜의 어느 위치에든 포함된 유효한 사용자 신원 토큰을 요구합니다. 토큰이 없거나 유효하지 않거나 서비스 토큰이면 연결을 거부하며, 인증되지 않은 게스트 연결도 더 이상 허용하지 않습니다.

미리 준비 (7)

  • deprecatedgetCatalogFilters 사용 중단 예정

    getCatalogFilters를 사용하는 경우에 적용됩니다.

    getCatalogFilters가 사용 중단 예정으로 지정되었습니다.

  • deprecatedserve:mkdocs 및 --mkdocs-parameter-* 사용 중단 예정

    serve:mkdocs 또는 --mkdocs-parameter-* 플래그를 사용하는 경우에 적용됩니다.

    serve:mkdocs와 --mkdocs-parameter-* 플래그를 사용하면 사용 중단 예정 경고가 출력됩니다.

  • deprecated원시 토큰 출력 사용 중단 예정

    원시 토큰 출력을 사용하면서 variableKey를 설정하지 않은 경우에 적용됩니다.

    variableKey를 사용하지 않을 때 원시 토큰 출력이 사용 중단 예정으로 지정되었습니다.

  • deprecatedtotalItems 옵션 사용 중단 예정

    totalItems를 설정하는 경우에 적용됩니다.

    totalItems 옵션이 사용 중단 예정으로 지정되었습니다.

  • deprecatedserve:mkdocs 및 --mkdocs-parameter-* 경고

    serve:mkdocs 또는 --mkdocs-parameter-* 플래그를 사용하는 경우에 적용됩니다.

    serve:mkdocs와 --mkdocs-parameter-* 플래그를 사용하면 사용 중단 예정 경고가 출력됩니다.

  • deprecatedStreamEntitiesRequest.totalItems 사용 중단 예정

    totalItems를 사용하는 경우에 적용됩니다.

    StreamEntitiesRequest의 totalItems 옵션이 사용 중단 예정으로 지정되었고 무시됩니다.

  • deprecated원시 토큰 출력의 variableKey 전환

    원시 토큰 출력을 사용하면서 variableKey를 설정하지 않은 경우에 적용됩니다.

    variableKey를 사용하지 않을 때 원시 토큰 출력이 사용 중단 예정으로 지정되었습니다.

그 외 기록된 변경 256건 전체value changes 131 · fixes 64 · additions 43 · constraints 11 · renames 4 · defaults 3

value changes (131)

fixes (64)

  • Successfully processed entities no longer remain unavailable if stitch scheduling is interrupted
  • Entities no longer disappear from filtered and sorted catalog queries after a database error during stitching
  • Combobox keyboard selection while filtering has been fixed
  • useRouteRef now resolves routes again after finalization
  • Fixed the catalog entity list rewriting the URL on every render
  • Fixed catalog processing error messages to report stable processor names in minified builds.×2
  • Fixed the Gitea entity provider registering locations against a hardcoded main branch
  • Reading a number from an empty or whitespace-only config value now fails with a clear error instead of returning 0.
  • fixed AWS RDS IAM authentication tokens being reused after their signing credentials expire
  • Fixed serializeError to strip stack traces from all nested error causes.
  • The selected sign-in provider is no longer cleared when a sign-in loader is cancelled.
  • Fixed protected app sign-in returning a 404 when the sign-in handoff is repeated.
  • Fixed long words in toast notifications overlapping the close button.
  • Fixed Azure DevOps downloads to use the requested branch or tag.
  • Fixed importing @backstage/integration from ESM projects.
  • now throws a clear ConflictError when the target repository already exists.
  • Fixed a regression where scaffolder step values consisting of a single template statement block, such as if conditions, were rendered as strings instead of booleans.
  • Fixed Elasticsearch search queries intermittently failing when a collator finishes indexing.
  • Fixed PostgreSQL search highlighting with delimiters that need quoting.
  • Fixed TechDocs asset caching on reused HTTP connections.
  • Fixed TechDocs rejecting mkdocs.yml files that use Material for MkDocs emoji and superfences configuration
  • Fixed the no-mixed-plugin-imports lint rule silently reporting nothing
  • Fixed root setupFilesAfterEnv Jest configuration being shared between workspace packages
  • Fixed Combobox keyboard selection while filtering.
  • Fixed the catalog entity list re-writing the URL on every render
  • Fixed TechDocs addons silently not rendering in apps using the new frontend system
  • Fixed TechDocs asset caching on reused HTTP connections to avoid listener leaks and cross-request response corruption.
  • Fixed TechDocs allowing custom_icons paths in mkdocs.yml that resolve outside the documentation input directory.
  • Fixed TechDocs generation rejecting mkdocs.yml files that use the emoji indexes and generators or the pymdownx.superfences custom fence formats
  • Fixed Material UI styles for TechDocs addons in module-federated applications.
  • a lazy addon no longer hides the surrounding reader while it loads.
  • Prevented TechDocs content from briefly appearing before page styles load.
  • Fixed AWS RDS IAM authentication tokens being reused after their signing credentials expire, which could cause database connection failures when using temporary AWS credentials.
  • Fixed the conversion of legacy filters that happens when a request has both a filter and a query, so that it matches the semantics of the legacy filter query parameter. Empty filters no longer turn into a predicate that matches nothing, empty records no longer match everything, and string values take precedence over CATALOG_FILTER_EXISTS for the same key.
  • Fixed backstage-cli pm verify-patches failing to load unless projects installed the Yarn CLI package separately.
  • jest-cli, jest-runtime and the default Node.js test environment are now loaded through the installed jest package, so tests also run with strict node_modules layouts. An unsupported Jest version, or a missing jest, now fails with a clear error instead of a module resolution error.
  • Fixed setupFilesAfterEnv from the root package.json Jest configuration being shared between workspace packages, which caused each package's src/setupTests file to also be added to every other package.
  • Fixed CommonJS frontend test execution with ESM dependencies on Node.js 24.
  • Commands run through runCli now wait for stdout and stderr to be flushed before exiting, so large command output is no longer truncated on platforms where writes to stdout and stderr are asynchronous.
  • Fixed CLIs created with runCli silently exiting when the root or a command group is invoked without a subcommand. They now display help for that level and complete successfully.
  • Reading a number from a configuration value that is an empty or whitespace-only string now fails with a clear conversion error, instead of silently returning 0. Numeric strings, including ones with surrounding whitespace such as ' 42 ', continue to be parsed as expected.
  • Fixed the Connection type so that auth is a union of method variants instead of an array when no specific auth method is provided.
  • Declared the dependencies of internally bundled code so that the package works with strict node_modules layouts.
  • Stop clearing the selected provider from localStorage when a sign-in loader is cancelled. Only clear it when the loader actually fails.
  • Fixed default landing page configuration in the app template so the Home page path override is inside the existing page:home block.
  • Fixed serializeError so that stack traces are stripped from all nested error causes when stacks are not requested, not just the first-level cause.
  • Fixed Azure DevOps file and archive downloads to use the requested branch or tag, including when checking whether a repository tree has changed. Branches and tags with the same name are now distinguished.
  • Bitbucket Cloud OAuth access tokens returned by getBitbucketCloudOAuthToken are now cached separately for each set of OAuth client credentials. Previously a single token was cached globally, which could cause the wrong token to be used when more than one Bitbucket Cloud integration was configured or when OAuth credentials were rotated.
  • Fixed importing this package from ECMAScript module (ESM) projects, which failed since 2.1.0 with an error saying that lodash does not provide an export named trimEnd.
  • Fixed CLI report generation failing when the FORCE_COLOR environment variable is set.
  • Declared the dependencies of internally bundled code so that the package works with strict node_modules layouts
  • Fixed long words in toast titles and descriptions overflowing the notification and overlapping the close button.
  • - c55505e: Fix protected app sign-in returning a 404 when an authenticated browser repeats the sign-in handoff for the same user.
  • Fixed an issue where successfully processed entities could remain unavailable if stitch scheduling was interrupted.
  • Entity and location queries with a primitive value at the root of the filter predicate are now rejected with an "Invalid query" error, rather than "Query must be an object".
  • Pending stitching work is no longer lost when entities are deleted and re-added
  • Fixed entities disappearing from filtered and sorted catalog queries after a database error during stitching.
  • PostgreSQL and MySQL deadlocks trigger prompt, bounded retries of the entire write transaction
  • - f181c5f: Fixed the Gitea entity provider registering catalog-info.yaml locations against a hardcoded 'main' branch instead of each repository's actual default branch.
  • - 6e08d65: Fixes a regression where scaffolder step values consisting of a singular template statement block (ex. if: "{% if parameters.foo == 'bar' %}true{% else %}false{% endif %}"), were rendered as the strings "true" and "false" instead of their boolean values. This caused steps with if conditions to always run. Step values with a single statement block that renders nothing, such as {% if false %}x{% endif %}, are once again left out of the action input instead of being passed as an empty string.
  • - 06128be: Throw a ConflictError with a clear message when publish:gitlab is called and the target repository already exists, instead of letting the GitLab API return a GitbeakerRequestError with a raw JSON body such as {"name":["has already been taken"]}.
  • - 2153e90: Fixed search queries intermittently failing with a 500 error when a collator finished indexing. The index that the search alias pointed to before the rotation is no longer deleted immediately, so queries already running against it can complete. It is instead removed during the next indexing run for that document type. Note that this means the previous index is now retained between runs, so search storage usage per document type is roughly doubled. Also improved error reporting for failed search queries. An index that disappears while a query is running is now reported as a missing index, and other query failures now include the underlying cause in the logs instead of undefined.
  • - 7535616: Fixed PostgreSQL search highlighting when configured delimiters or selection tags contain punctuation that requires quoting.

additions (43)

  • has a new getCatalogQuery method
  • Three new CLI modules provide domain-oriented commands that talk directly to the corresponding plugin APIs
  • @backstage/cli-module-catalog: catalog list, catalog get, catalog validate, catalog register, catalog unregister
  • @backstage/cli-module-scaffolder: template list, template execute, template dry-run
  • @backstage/cli-module-search: search, docs search
  • This introduces an --engine flag in the TechDocs CLI, an engine configuration map, a generator registry
  • A new withoutFeedbackLink option
  • registers a get-techdocs-metadata action
  • Backends created with createBackend now provide the experimental connections service by default.
  • provides a Featured Templates home page widget
  • a swappable UserAvatar component
  • have a new variableKey input
  • A new theme CSS cascade layer
  • Added AppLifecycleApi
  • Added a backend.logger.redactAllowlist configuration option
  • Added bounded retries for transient Cloud SQL connection failures
  • Added a service-authenticated action registry status endpoint
  • Added a defaultCloseDelayMs option to SubmenuOptions.
  • Added a --fix mode to backstage-cli pm verify-patches.
  • Added an instanceId option to createSpecializedBackend.
  • Added experimental declareConnection and connectionsServiceRef exports
  • Add intent-based CLI modules for catalog, scaffolder, and search.×2
  • A new AnyFilterPredicate type describes predicates that may also be primitive values at the root
  • Introduces --engine flag, engine config map, generator registry with backstage.io/techdocs-engine annotation support, engine field in techdocs_metadata.json, serve:raw command, and live-reload adapter interface.
  • Added a theme CSS cascade layer between components and utilities.
  • Added a source_key column and a UNIQUE(source_key, entity_ref) constraint
  • Added getCatalogQuery to EntityFilter
  • Added a swappable UserAvatar component
  • Added a Featured Templates homepage widget
  • Added withoutFeedbackLink prop to page:techdocs/reader and entity-content:techdocs extensions
  • Added a get-techdocs-metadata action to the TechDocs backend plugin
  • Added a service-authenticated action registry status endpoint that reports whether a plugin provides actions without exposing action metadata.
  • Added an instanceId option to createBackend, allowing deployments to use an externally provided backend instance identifier. Each backend instance uses a random UUID by default.
  • Added bounded retries for transient failures while initializing Cloud SQL database connections.
  • Added support for backend.logger.redactAllowlist configuration option, which allows specific secret values to pass through log redaction when they are known to be safe to log.
  • Added a conservative --fix mode to backstage-cli pm verify-patches that can update project-owned Backstage package patches when an automated release upgrade leaves them pinned to older versions. The repair requires Yarn 3 or later.
  • Added defaultCloseDelayMs option to SubmenuOptions to configure a delay before a submenu closes.
  • Provided an implementation of AppLifecycleApi and updated the app preparation and finalization process to utilize this API.
  • Added AppLifecycleApi and appLifecycleApiRef, which let you check whether the app has been finalized and subscribe to changes in its lifecycle.
  • - a18df8f: Added optional app.publicConfig allowlists for config key paths and extension IDs exposed to unauthenticated users of protected apps. Authenticated users retain access to all frontend-visible configuration, and existing behavior is unchanged unless filtering is enabled.
  • - fe51d40: Added a secure variableKey input to gitlab:projectAccessToken:create and gitlab:projectDeployToken:create actions. When provided, the generated token is stored directly as a masked GitLab CI/CD variable instead of being exposed in task outputs and checkpoint state.
  • - 45b0b89: Added a new techdocs.actions.read permission, available from the /alpha entry point, which controls access to the TechDocs actions registered with the Actions Registry.

constraints (11)

  • EntityTagFilter with multiple tags now requires all of them
  • Added Bitbucket Cloud support for bearer API tokens.
  • removed custom_icons paths that resolve outside the docs directory
  • Declared the per-cluster assumeRole and externalId options in the Kubernetes backend configuration schema.
  • now reports named imports from lodash, which break ESM builds.
  • Several packages now work with strict node_modules layouts.
  • The no-mixed-plugin-imports rule now also applies when the repository is checked out below a directory whose name starts with a dot, such as ~/.worktrees/my-repo.
  • Update Bitbucket Cloud Authentication logic to support bearer API token
  • CLI API reports now support help output with separate groups and commands sections, including commands nested within groups.
  • Updated SQL report generation to support newer Knex releases.
  • 0c9d72c: Update Bitbucket Cloud Authentication logic to support bearer API token

renames (4)

  • The built-in generator is now registered as mkdocs, with techdocs kept as an alias
  • Updated the plugin-web-library template to use @backstage/ui instead of the deprecated @material-ui/core.
  • - 66f8cf8: Replace deprecated createPermissionIntegrationRouter API call with permissionsRegistry
  • - 298f908: Replaced the unmaintained react-relative-time dependency with an internal component based on luxon.

defaults (3)

  • The backend no longer issues periodic per-plugin database keepalive queries by default, and the default minimum PostgreSQL and MySQL connection pool size is now zero.
  • The --bui-bg-app token now follows the page's color-scheme until a theme mode is set.
  • Backends created with createBackend now provide the experimental connections service by default. Custom backends can install connectionsServiceFactory from @backstage/backend-defaults/alpha.
Backstage 스택에 추가

조치가 필요한 릴리스가 나왔을 때 주간 메일로 알려드립니다. 이번 릴리스의 보안 패치와 브레이킹 체인지 같은 것들입니다.

스택에 추가 →
공식 릴리스 노트 ↗Backstage 릴리스 전체 →