Backstage v1.55.0
security++++++++++++++++!!
Backstage v1.55.0 was released with 53 changes, seven of which are security fixes across several auth, catalog, proxy, scaffolder and TechDocs backend packages. The other changes are mostly fixes and additions, including new GitLab and GitHub scaffolder actions, a scaffolder task worker fix, and a default MCP server that is now always exposed at /api/mcp-actions/v1.
What changes for platform teams
Platform teams running Backstage should plan to upgrade to pick up the security fixes in the auth, proxy and scaffolder packages. Teams using the MCP actions endpoint or the GitLab scaffolder actions should check the changed behavior before upgrading.
Changes
- @backstage/plugin-auth-backend-module-cloudflare-access-providersecurity
- @backstage/plugin-auth-backend-module-oidc-providersecurity
- @backstage/plugin-auth-nodesecurity
- @backstage/plugin-catalog-backend-module-bitbucket-serversecurity
- @backstage/plugin-proxy-backendsecurity
- @backstage/plugin-scaffolder-backend-module-sentrysecurity
- @backstage/plugin-techdocs-nodesecurity
- The FixDialog, ContainerCard, and PodLogs components in @backstage/plugin-kubernetes-react no longer accept an implicit children prop, aligning with ADR006. Contributed by @suletetes in #35154.added
- Fixed the owner selected in the catalog import stepper being written to the generated catalog-info.yaml as a display name instead of an entity reference. Contributed by @MFA-G in #35235.added
- Fixed EntityOwnerPicker crashing with missing or empty kind errors when the owners query parameter contains humanized entity refs. Contributed by @mythrilium in #35270.added
- Fixed CopyTextButton showing its tooltip on hover/focus instead of only after clicking. Contributed by @reachsanjivbhagat-gif in #34920.added
- Added an optional variant prop to CopyTextButton for configuring its visual style. Contributed by @victoriacheng15 in #35567.added
41 more lines
- Added an onCopyLog prop to the LogViewer component that renders a copy button in the toolbar. Contributed by @tobiasp284 in #35006.added
- Added support for rendering custom link elements inside HeaderIconLinkRow.added
- Fixed app.extensions shorthand and disabled field to accept boolean-ish strings so environment variable substitution can toggle extensions. Contributed by @tanaysingh2512 in #35261.added
- Fixed a bug where overriding a plugin extension with withOverrides moved the overridden extension to the end of the plugin's extension list. Contributed by @gustavolira in #35613.added
- Fixed a bug where plugin packages installed through feature discovery were loaded before the app's own code ran. Contributed by @kuangp in #35053.added
- The default MCP server at /api/mcp-actions/v1 is now always exposed even when named servers are configured. Contributed by @majdsalman2 in #35383.added
- Added an unread notifications home page card and new frontend system home widget. Contributed by @ciiay in #34869.added
- The gitlab:issues:create action now accepts a full project path for projectId, and projectId is optional. Contributed by @kersten in #34544.added
- Added an autoMerge boolean input to publish:gitlab:merge-request. Contributed by @PG2000 in #34947.added
- Fixed gitlab:repo:push failing with a 400 error when the workspace has no file changes to commit. Contributed by @Naga15 in #34480.added
- Fixed GitlabDiscoveryEntityProvider to only process push events targeting the configured branch. Contributed by @iamEAP in #35255.added
- The GitHub multi-org entity provider now logs a clear warning when no GitHub App installation is found for an org. Contributed by @Dasmat13 in #34833.added
- Fixed the scaffolder task worker silently giving up after a transient failure, where a single error while picking up a task would stop the backend from running any further templates. Contributed by @Mahanmmi in #35359.added
- The workspace:template* actions are now exported by default. Contributed by @mbenson in #34915.added
- Restored support for intrinsic string, number, array, Map, and Set methods in software templates.added
- Software template inline conditionals without an else branch now render an empty string when their condition is false, matching Nunjucks behavior.added
- Fixed a connection leak in the scaffolder event stream where unsubscribing did not abort the underlying SSE connection. Contributed by @carlerikjohan in #35401.added
- Fixed several issues with scaffolder task event stream reconnection. Contributed by @carlerikjohan in #35401.added
- Fixed the scaffolder wizard not scrolling to the top on step change in the new frontend system. Contributed by @sohailriyas01 in #35318.added
- The catalog:query-catalog-entities action now accepts limit and offset as strings, coercing them to numbers before validation. Contributed by @anshgoyalevil in #34954.added
- Fixed AwsS3UrlReader and AwsCodeCommitUrlReader to resolve account-specific AWS credentials when an assume role ARN is configured. Contributed by @beatleboy501 in #34938.added
- Added optional accountId config to search.elasticsearch for resolving account-specific AWS credentials. Contributed by @beatleboy501 in #34938.added
- Fixed Bitbucket Server file operations failing when the branch name contains special characters. Contributed by @suletetes in #35638.added
- Fixed reading a duration from configuration so that an all-zero ISO 8601 duration yields a consistent zero value. Contributed by @suletetes in #35542.added
- Fixed catalog model relations to inherit the source entity namespace when no default namespace is configured.added
- Fixed a bug where catalog entities could fail to process when catalog model sources mix backstage.io/v1alpha1 and backstage.io/v1beta1 for the same kind. Contributed by @GabDug in #34552.added
- Fixed WebSocket upgrade error responses in the signals backend to prevent load balancers from returning 502 on auth failures. Contributed by @jlawrie in #34761.added
- Fixed accumulating abort listeners on MicrosoftGraphClient. Contributed by @csuich2 in #35321.added
- Fixed CardExtension to avoid requiring app context when a custom Renderer is provided. Contributed by @ciiay in #34869.added
- Fixed AWS S3 publishing to paginate existing objects to properly remove all stale TechDocs files. Contributed by @alecjacobs5401 in #35391.added
- Fixed local TechDocs generation when temporary source paths resolve through filesystem aliases.added
- Use the catalog presentation API for TechDocs document titles and owner labels. Contributed by @AarishMansur in #34760.added
- Fixed techdocs-cli serve silently stopping live reload detection with click 8.3.x. Contributed by @GabDug in #35160.added
- Fixed home clock configuration handling. Contributed by @NithinU2802 in #35192.added
- Fixed ownership card catalog links to filter by stable entity references instead of display titles.added
- Added resolveNotificationLink utility for resolving relative notification links to absolute URLs. Contributed by @gaelgoth in #33845.added
- Added support for calling Connections find without authMethods. Contributed by @neoreddog in #35253.added
- The JSON Schema exported for filter predicates can now be compiled by RE2-based validators. Contributed by @rhart in #35631.added
- Added Kubernetes actions to get clusters and entity resources. Contributed by @drodil in #33832.added
- Increased the test database cleanup timeout to 60 seconds. Contributed by @mtlewis in #35607.added
- Significantly improved the performance of build-workspace when packaging many Backstage packages.added
53 lines7 security46 addedtyped from the source notes
Full release notes ↗ · all Backstage releases
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules