# Backstage v1.55.0

> CI/CD & App Delivery · 2026-09-15

A broad feature and maintenance release adds scaffolder recovery and credential controls, TechDocs, notification and streaming capabilities, and Kubernetes and authentication improvements. It also includes dependency and tooling security updates, a security fix, and compatibility changes that affect users of the listed resolvers, catalog integrations, MCP configuration, and task recovery.

## Action needed
- **[security]** Module Federation dependency updates for security
  - This release updates the Module Federation dependencies to versions that avoid known security vulnerabilities.
- **[security]** Yarn tooling dependency updates for security
  - This release updates the Yarn tooling dependencies to versions that avoid known security vulnerabilities.
- **[security]** Module Federation security dependency update
  - This release updates the Module Federation dependencies to versions that avoid known security vulnerabilities.
- **[security]** OpenAPI generator tooling security update
  - This release updates the OpenAPI generator tooling to avoid known security vulnerabilities.
- **[security]** OpenAPI generator tooling security update
  - This release updates the OpenAPI generator tooling to avoid known security vulnerabilities.
- **[breaking]** Locale-insensitive Unicode casing
  - String handling now uses locale-insensitive Unicode casing for consistent results across environments.

## Check if affected
- **[security]** Kubernetes catalog cluster locator URL validation
  - Applies if you use the catalog cluster locator.
  - The catalog cluster locator now validates Kubernetes API server URLs to block non-public addresses, cloud metadata endpoints, and non-HTTPS URLs by default. Trusted hostnames can be listed in `dangerouslyAllowClusterUrls` to permit HTTP or non-public addresses for those hosts, while TLS verification skipping requires `dangerouslyAllowSkipTLSVerify`; catalog entities cannot use the `serviceAccount` auth provider, only permitted annotations are passed as auth metadata, and Kubernetes API fetches no longer follow HTTP redirects automatically.
- **[security]** Pull request workspace handling security fix
  - Applies if you use pull request workspace handling.
  - This release fixes a security issue in pull request workspace handling.
- **[breaking]** GitHub user ID catalog lookup matching
  - Applies if you use GitHub user ID catalog lookups.
  - GitHub user ID catalog lookups now require an exact match and handle candidates that differ only by letter casing.
- **[breaking]** Kubernetes entity content loading and tab visibility
  - Applies if you use Kubernetes entity content.
  - Kubernetes entity content no longer loads its UI until the tab is opened, keeping it out of the initial bundle. Tab visibility is now an entity filter predicate that can be overridden through app config, and entities with an empty Kubernetes annotation now show the tab.
- **[breaking]** Default MCP server exposure
  - Applies if you configure `mcpActions.servers`.
  - The default MCP server at `/api/mcp-actions/v1` is now always exposed. Configuring `mcpActions.servers` no longer replaces it; named servers are subsets of the default server, which continues to expose every registered action.
- **[breaking]** Workspace provider requirement for task recovery
  - Applies if you use Workspace serialization for task recovery.
  - Workspace serialization for task recovery now requires a separate workspace provider module, including when the legacy configuration is used.

## Plan ahead
- **[deprecated]** GitHub username sign-in resolver deprecation
  - Applies if you use the GitHub username sign-in resolver.
  - The GitHub username sign-in resolver is deprecated in favor of the stable user ID resolver.

## Other recorded changes
- 213 (value_changed 154, defect_corrected 35, added 20, constraint_changed 2, renamed 1, deprecated 1)

[Full analysis](https://ratatosk.io/en/releases/backstage/v1.55.0)

[Original release notes](https://github.com/backstage/backstage/releases/tag/v1.55.0)