docs/releases/v1.54.0.md
These are the release notes for the v1.54.0 release of Backstage.
A huge thanks to the whole team of maintainers and contributors as well as the amazing Backstage Community for the hard work in getting this release developed and done.
The OAuth redirect URI and client ID metadata document allowlists in @backstage/plugin-auth-backend now match patterns against each URL component separately instead of against the full URL string. Wildcards no longer match across the host and path boundary, patterns must include an explicit protocol and are otherwise rejected as invalid configuration instead of being silently ignored, and redirect URIs that contain embedded credentials are always rejected.
A wildcard port also no longer implicitly matches every path: a pattern such as http://localhost:* now only matches the root path. Use http://localhost:*/* to allow any port and any path. The built-in loopback defaults have been updated accordingly, so this only affects explicitly configured patterns.
config.schema removedThe deprecated config.schema option for extensions and extension blueprints has been removed from @backstage/frontend-plugin-api. Use the top-level configSchema option with Standard Schema-compatible schema values, such as Zod v4.
The Connections API is still early, so this only applies to you if you are experimenting with it already. Update backend-only imports from @backstage/connections, update connection lookups to pass a typed query object instead of a top-level url, and rename RootConnectionAuth to ConfiguredConnectionAuth. New GitHub and AWS connection types have also been added.
Contributed by @neoreddog in #34718, #35029, #35059, and #35209
The backstage-repo-tools repo schema openapi verify command has been renamed to backstage-repo-tools repo schema openapi validate. A new backstage-repo-tools package schema openapi validate command has also been added to validate OpenAPI 3.x documents for individual packages.
Create-app: New apps created with @backstage/create-app now include a GitHub Actions CI workflow that runs linting, type checking, tests, configuration validation, and a Docker image build on pull requests. The app template also includes a pre-configured Home page with a customizable widget grid, and create-app now checks the Node.js LTS version and Yarn availability before scaffolding.
Home plugin: The Home plugin now includes new frontend system widget blueprints for Most Visited, Recently Visited, World Clocks, a configurable Toolkit, and a search bar from the Search plugin. The home page layout now supports a defaultConfig for defining the initial widget grid through app configuration.
Relation sync: The Catalog backend now syncs entity relations by applying only the diff of changed rows instead of deleting and reinserting all relations. In steady state, this avoids unnecessary writes, dead tuples, WAL traffic, and stitching work for unchanged relation neighbors.
Write resilience: Entity provider mutations on PostgreSQL now retry automatically on deadlocks, and concurrent entity processing on MySQL now retries the updateProcessedEntity transaction on deadlock errors. SCM location.moved events are also ignored for files that are not actively tracked, preventing spurious locations from being created.
AiResource kind: The alpha AiResource catalog kind now supports plugin and marketplace spec types, plus allowedTools, license, and compatibility fields for skill resources. Catalog relation generation also now honors declared kind combinations and completes reverse relations for existing AiResource fields.
Contributed by @nickwtan in #34890, #34891, and #34892
@backstage/plugin-catalog-backend now includes a refresh-catalog-entity action that agents and MCP clients can use to re-queue a single entity for processing after creating or updating it. This makes it possible to read back fresh catalog data immediately after a scaffolder run without waiting for the next scheduled processing loop.
Contributed by @Naga15 in #34447
Kubernetes: @backstage/plugin-kubernetes-backend now emits auditor events for cluster list, cluster proxy, entity workload, custom resource, and deprecated services endpoint requests. Administrators can filter audit logs by eventId values such as cluster-fetch and resource-fetch, and by queryType metadata.
API proxy: The Kubernetes API proxy now refreshes cached middleware when cluster details change, after a configurable TTL, or when the cache reaches its size limit. It also logs startup warnings for clusters configured with skipTLSVerify: true.
MCP actions: @backstage/plugin-mcp-actions-backend now emits audit events for MCP server connection, tool discovery, and tool execution operations. MCP servers can also be configured with instructions for both default and named servers.
Contributed by @04kash in #34863 and #35017, and @thepetk in #33339
coreServices.rootSystemMetadata is now available as a stable backend service for reading metadata about the running Backstage system, including installed plugins. The service is registered automatically by @backstage/backend-defaults, test utilities now include mockServices.rootSystemMetadata, and the internal OpenAPI documentation provider can use system metadata to discover installed plugins automatically.
The TechDocs page extension now accepts an initialFilter configuration value for page:techdocs. Valid values are all, owned, and starred; the default is owned.
Stricter validation: Package preparation now validates TypeScript configuration schemas strictly before publishing. Other build and bundle paths report schema errors as warnings, and the --strict flag for backstage-cli config:check and backstage-cli config:schema now treats TypeScript configuration schema errors as fatal.
Recoverable errors: @backstage/config-loader also adds an onSchemaError callback that callers can use to report schema errors and continue loading. A bug where strict config checks incorrectly rejected valid open-ended object schemas has been fixed.
Fixed Table not filling the container width in Firefox when TableRoot is used directly inside ResizableTableContainer. Contributed by @robingileborg in #34755.
Check the BUI Changelog for more details.
SubRouteRef as the parent of another SubRouteRef in the new frontend system.DependencyGraph component so nodes no longer briefly overlap before the initial layout settles.EntityOwnerPicker in owners-only mode to display human-readable entity titles and keep large owner lists responsive through virtualization. Contributed by @Parsifal-M in #34873.UserListPicker showing all catalog entities as "Owned" when the logged-in user has no ownership entity refs. Contributed by @jozsefurak-seon in #34629.renderInTestApp so mocked identity APIs reliably take effect instead of being overwritten by the default guest fallback. Contributed by @KrishnaParihar1 in #34635.allowedClientIdPatterns is configured for Client ID Metadata Documents. Contributed by @arogozin in #34990.payload.metadata.slackChannel. Contributed by @sspadotto in #34968.kubernetes.clusterLocatorContinueOnError configuration option so a failing cluster locator can be skipped while clusters from other locators are still returned. Contributed by @alde in #34861.description parameter optional in the publish:gerrit scaffolder action. Contributed by @tcardonne in #34453.backstage-cli new templates for permission policy modules, search collator modules, and catalog processor modules.backstage-cli new failing with "No version available" for several templates.toastApiRef, add UserInfoService to permission policy modules, and include better table accessibility and backend module dependencies.nodemailer from v8 to v9 in the email notifications module. The new major version validates TLS certificates by default when fetching remote content such as attachments or OAuth2 tokens.This release contains critical security fixes for the Kubernetes plugin.
Big shoutout to all 36 of you amazing folks who chipped in on this release: @04kash, @AntonioEreiz, @Believe-SA, @JasonColapietro, @Kartikupadhyay44, @KrishnaParihar1, @Naga15, @Nikshaan, @NithinU2802, @Parsifal-M, @alde, @arogozin, @baraka-akeyless, @deejay1, @djamaile, @dotboris, @drodil, @gaelgoth, @hudsonb, @jozsefurak-seon, @karthikjeeyar, @kz-masa, @marttimourujarvi, @meganide, @mohamedaminehamdi, @mylonasg88, @neoreddog, @nickwtan, @niklasR, @piyushtripathi9424, @robingileborg, @sebastian-danielsson, @sspadotto, @tcardonne, @thepetk, @vetom
We recommend that you keep your Backstage project up to date with this latest release. For more guidance on how to upgrade, check out the documentation for keeping Backstage updated.
Below you can find a list of links and references to help you learn about and start using this new release.
Sign up for our newsletter if you want to be informed about what is happening in the world of Backstage.