# Backstage v1.56.0

> CI/CD & App Delivery · 2026-10-20

A feature-rich platform release adds backend, CLI, TechDocs, catalog, search, and plugin capabilities. It also includes breaking API, database, authentication, configuration, and default-behavior changes, plus reliability, performance, correctness, dependency, and security updates that may require targeted migration and validation.

## Action needed
- **[security]** `nodemailer` version 10
  - `nodemailer` was updated to version 10 to address security vulnerabilities in older releases.

## Check if affected
- **[breaking]** Object-only `FilterPredicate` roots
  - Applies if you use `FilterPredicate`.
  - `FilterPredicate` now accepts only objects at the root of a predicate. This constraint is enforced by `parseFilterPredicate`.
- **[breaking]** Removal of `usernameMatchingUserEntityName`
  - Applies if you use the `usernameMatchingUserEntityName` sign-in resolver.
  - The `usernameMatchingUserEntityName` sign-in resolver has been removed. The change also affects sign-in configurations that used this resolver.
- **[breaking]** Required service instance ID
  - Applies if you use custom implementations or mocks of the service.
  - Custom implementations and mocks of the service must now provide an instance ID. The identifier is represented by `instanceId`.
- **[breaking]** Non-rolling `ingestion_mark_entities` migration
  - Applies if you perform a rolling, zero-downtime upgrade.
  - The migration cannot be applied as part of a rolling, zero-downtime upgrade. It affects the `ingestion_mark_entities` migration and its `source_key` and `entity_ref` data.
- **[breaking]** Backstage 1.49 catalog backend requirement
  - Applies if you use a catalog backend from Backstage release 1.49 or later.
  - This change requires a catalog backend from Backstage release 1.49 or later.
- **[breaking]** Startup rejection of non-positive stitching intervals and lease durations
  - Applies if you configure stitching polling intervals or lease durations.
  - Non-positive stitching polling intervals and lease durations are rejected at startup.
- **[breaking]** User identity token requirement for the signals WebSocket endpoint
  - Applies if you expose the signals WebSocket endpoint.
  - The signals WebSocket endpoint now requires a valid user identity token.
- **[breaking]** Stable unique ID for the root instance metadata service
  - Applies if you use custom implementations or mocks of the root instance metadata service.
  - Custom implementations and mocks of the root instance metadata service must now provide a globally unique ID that remains stable for the lifetime of the running backend instance.
- **[breaking]** Removal of `disabledKeys` from `MenuSection`
  - Applies if you use `MenuSection` with `disabledKeys`.
  - `MenuSection` no longer accepts `disabledKeys`.
- **[breaking]** Removal of `usernameMatchingUserEntityName`
  - Applies if you use the `usernameMatchingUserEntityName` sign-in resolver.
  - The `usernameMatchingUserEntityName` sign-in resolver has been removed. Sign-in configurations using this resolver are affected.
- **[breaking]** The table `ref` column renamed to `entity_ref`
  - Applies if you use the table's `ref` column.
  - The table's `ref` column has been renamed to `entity_ref`.
- **[breaking]** Disabled database keepalive queries by default
  - Applies unless you set `backend.database.keepalive` to `true`.
  - Periodic per-plugin database keepalive queries are no longer issued by default, and the default minimum PostgreSQL and MySQL connection pool size is now zero. Idle connections can be retired after the configured timeout, while explicitly configured pool minimums are preserved. Set `backend.database.keepalive` to `true` to continue issuing the periodic queries.
- **[breaking]** Startup rejection of non-positive stitching intervals and lease durations
  - Applies if you configure stitching polling intervals or lease durations.
  - Non-positive stitching polling intervals and lease durations are rejected at startup.
- **[breaking]** User identity token requirement for the signals WebSocket endpoint
  - Applies if you expose the signals WebSocket endpoint.
  - The signals WebSocket endpoint now requires a valid user identity token. The token can appear anywhere in the requested WebSocket protocols. Connections without a token, with an invalid token, or with a non-user service token are rejected, and unauthenticated guest connections are no longer accepted.

## Plan ahead
- **[deprecated]** Deprecated `getCatalogFilters`
  - Applies if you use `getCatalogFilters`.
  - `getCatalogFilters` is deprecated. Existing uses of this API are affected by the deprecation.
- **[deprecated]** Deprecation warnings for `serve:mkdocs` and `--mkdocs-parameter-*`
  - Applies if you use `serve:mkdocs` or the `--mkdocs-parameter-*` flags.
  - The `serve:mkdocs` command and `--mkdocs-parameter-*` flags now print deprecation warnings.
- **[deprecated]** Deprecated raw token outputs without `variableKey`
  - Applies if you use raw token outputs and do not configure `variableKey`.
  - Raw token outputs are deprecated when `variableKey` is not used.
- **[deprecated]** Deprecated `totalItems` option
  - Applies if you configure `totalItems`.
  - The `totalItems` option is deprecated.
- **[deprecated]** Deprecation warnings for `serve:mkdocs` and `--mkdocs-parameter-*`
  - Applies if you use `serve:mkdocs` or the `--mkdocs-parameter-*` flags.
  - The `serve:mkdocs` command and `--mkdocs-parameter-*` flags now print deprecation warnings.
- **[deprecated]** Deprecated and ignored `StreamEntitiesRequest.totalItems`
  - Applies if you use `totalItems`.
  - The `totalItems` option of `StreamEntitiesRequest` is deprecated and ignored.
- **[deprecated]** Deprecated raw token outputs without `variableKey`
  - Applies if you use raw token outputs and do not configure `variableKey`.
  - Raw token outputs are deprecated when `variableKey` is not used.

## Other recorded changes
- 256 (value_changed 131, defect_corrected 64, added 43, constraint_changed 11, renamed 4, default_changed 3)

[Full analysis](https://ratatosk.io/en/releases/backstage/v1.56.0)

[Original release notes](https://github.com/backstage/backstage/releases/tag/v1.56.0)