docs/releases/v1.54.0-next.2-changelog.md
Upgrade Helper: https://backstage.github.io/upgrade-helper/?to=1.54.0-next.2
config.schema option for extensions and extension blueprints. Use the top-level configSchema option with Standard Schema-compatible schema values, such as Zod v4.refresh-catalog-entity action so agents and MCP clients can re-queue a single entity for processing after creating or updating it — useful for reading back fresh data immediately after a scaffolder run without waiting for the next scheduled processing loop.EntityFilter to FilterPredicate, simplifying the filter parsing and query application pipeline.relations table with a diff-based sync that only touches rows that actually changed. In steady state (the common case), zero writes occur, eliminating write churn, dead tuples, and WAL traffic from the processing path. Stitching is now also skipped for relation neighbors that did not change.updateProcessedEntity transaction on deadlock errors.location.moved events would generate new locations in the database for files that were not actively tracked.tar from 7.5.15 to 7.5.21shell-quote from 1.8.4 to 1.9.0tar from 7.5.15 to 7.5.21--strict flag for config:check now treats TypeScript configuration schema errors as fatal. The same flag is now also available for config:schema.shell-quote from 1.8.4 to 1.9.0permission-policy-module template for scaffolding custom permission policies via backstage-cli new. The template generates a backend module that wires a PermissionPolicy implementation into the permission backend using the policyExtensionPoint, along with a test example.search-collator-module template for scaffolding new search collator modules via backstage-cli new.catalog-processor-module template for scaffolding catalog processor modules via backstage-cli new.plugin-web-library template to use toastApiRef from @backstage/frontend-plugin-api instead of the deprecated alertApiRef from @backstage/core-plugin-api.UserInfoService to the permission-policy-module template so that scaffolded permission policies have the service already wired up for ownership lookups.backstage-cli config:check --strict would incorrectly reject valid configuration for open-ended object schemas, such as plain objects or map-like structures.onSchemaError callback that allows callers to report TypeScript configuration schema errors and continue loading. The callback receives a ConfigSchemaError containing the source package and underlying cause. Without a handler, schema errors are thrown.create-app now include a .github/workflows/ci.yml that runs lint, type checking, tests, configuration validation, and a Docker image build on every pull request.tar from 7.5.15 to 7.5.21app.extensions[].app/routes.config.redirects silently dropped everything after ? or # in the incoming URL.client_id matches an exact (non-wildcard) entry in allowedClientIdPatterns. Exact patterns mean the administrator explicitly listed a specific URL, so the DNS resolution is trusted. Wildcard patterns still enforce the SSRF check to protect against attacker-controlled subdomains resolving to internal addresses.allowedClientIdPatterns is configured for Client ID Metadata Documents.AboutField label in the About card using variant="inherit" instead of variant="h2" to prevent theme typography overrides from changing the intended 10px label size.e766061: Fixed an issue where the "Owned" count in UserListPicker would display the total number of catalog entities instead of 0 when the logged-in user has no ownership entity refs. The empty relations.ownedBy filter was being silently dropped by the catalog client, causing the backend to return all entities with no ownership filter applied.
This was a regression introduced in #22131, which removed an explicit ownershipEntityRefs?.length === 0 guard that had been present since #20339.
Updated dependencies
@opentelemetry/core to ^2.0.0.http-proxy-middleware from 3.0.5 to 3.0.7backstage.io.nodemailer from v8 to v9. The new major version validates TLS certificates by default when fetching remote content such as attachments or OAuth2 tokens. If your SMTP relay or OAuth2 endpoint uses a self-signed or otherwise untrusted certificate, email delivery may start failing. You can opt out per transport by setting tls: { rejectUnauthorized: false } in your nodemailer transport options.--no-node-snapshot Node.js option.tar from 7.5.15 to 7.5.21