Skip to content

fix(deps): update backstage core#988

Merged
secustor merged 2 commits intomainfrom
renovate/backstage-core
Feb 28, 2026
Merged

fix(deps): update backstage core#988
secustor merged 2 commits intomainfrom
renovate/backstage-core

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Feb 22, 2026 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update
@backstage/backend-defaults (source) 0.15.1 → 0.15.2 age confidence dependencies patch
@backstage/cli (source) 0.35.3 → 0.35.4 age confidence devDependencies patch
@backstage/cli (source) 0.35.3 → 0.35.4 age confidence dependencies patch
@backstage/core-compat-api (source) 0.5.7 → 0.5.8 age confidence dependencies patch
@backstage/core-components (source) 0.18.6 → 0.18.7 age confidence dependencies patch
@backstage/core-plugin-api (source) 1.12.2 → 1.12.3 age confidence dependencies patch
@backstage/e2e-test-utils (source) 0.1.1 → 0.1.2 age confidence devDependencies patch
@backstage/frontend-defaults (source) ^0.3.4 → ^0.4.0 age confidence devDependencies minor
@backstage/frontend-defaults (source) ^0.3.4 → ^0.4.0 age confidence dependencies minor
@backstage/frontend-plugin-api (source) ^0.13.2 → ^0.14.0 age confidence dependencies minor
@backstage/frontend-test-utils (source) 0.4.5 → 0.5.0 age confidence devDependencies minor
@backstage/integration-react (source) 1.2.14 → 1.2.15 age confidence dependencies patch
@backstage/plugin-app-backend (source) 0.5.10 → 0.5.11 age confidence dependencies patch
@backstage/plugin-app-visualizer (source) ^0.1.26 → ^0.2.0 age confidence dependencies minor
@backstage/plugin-auth-backend (source) ^0.26.0 → ^0.27.0 age confidence dependencies minor
@backstage/plugin-auth-backend-module-github-provider (source) ^0.4.0 → ^0.5.0 age confidence dependencies minor
@backstage/plugin-auth-backend-module-guest-provider (source) 0.2.15 → 0.2.16 age confidence dependencies patch
@backstage/plugin-auth-node (source) 0.6.12 → 0.6.13 age confidence dependencies patch
@backstage/plugin-catalog (source) 1.32.2 → 1.33.1 age confidence dependencies minor
@backstage/plugin-catalog-backend (source) 3.3.2 → 3.4.0 age confidence dependencies minor
@backstage/plugin-catalog-backend-module-logs (source) 0.1.18 → 0.1.19 age confidence dependencies patch
@backstage/plugin-catalog-backend-module-scaffolder-entity-model (source) 0.2.16 → 0.2.17 age confidence dependencies patch
@backstage/plugin-catalog-react (source) ^1.21.4 → ^2.0.0 age confidence dependencies major
@backstage/plugin-kubernetes-backend (source) 0.21.0 → 0.21.1 age confidence dependencies patch
@backstage/plugin-notifications (source) 0.5.13 → 0.5.14 age confidence dependencies patch
@backstage/plugin-notifications-backend (source) 0.6.1 → 0.6.2 age confidence dependencies patch
@backstage/plugin-org (source) 0.6.48 → 0.6.49 age confidence dependencies patch
@backstage/plugin-permission-backend (source) 0.7.8 → 0.7.9 age confidence dependencies patch
@backstage/plugin-permission-backend-module-allow-all-policy (source) 0.2.15 → 0.2.16 age confidence dependencies patch
@backstage/plugin-permission-common (source) 0.9.5 → 0.9.6 age confidence dependencies patch
@backstage/plugin-permission-node (source) 0.10.9 → 0.10.10 age confidence dependencies patch
@backstage/plugin-scaffolder (source) 1.35.2 → 1.35.4 age confidence dependencies patch
@backstage/plugin-search (source) 1.5.3 → 1.6.1 age confidence dependencies minor
@backstage/plugin-search-backend (source) 2.0.11 → 2.0.12 age confidence dependencies patch
@backstage/plugin-search-backend-module-catalog (source) 0.3.11 → 0.3.12 age confidence dependencies patch
@backstage/plugin-search-backend-module-pg (source) 0.5.51 → 0.5.52 age confidence dependencies patch
@backstage/plugin-search-backend-node (source) 1.4.0 → 1.4.1 age confidence dependencies patch
@backstage/plugin-signals (source) ^0.0.27 → ^0.0.28 age confidence dependencies patch
@backstage/plugin-signals-backend (source) 0.3.11 → 0.3.12 age confidence dependencies patch
@backstage/plugin-user-settings (source) ^0.8.30 → ^0.9.0 age confidence dependencies minor
@backstage/ui (source) ^0.11.0 → ^0.12.0 age confidence dependencies minor
backstage/backstage 1.47.3 → 1.48.3 age confidence minor

Release Notes

backstage/backstage (@​backstage/backend-defaults)

v0.15.2

Compare Source

Patch Changes
backstage/backstage (@​backstage/cli)

v0.35.4

Compare Source

Patch Changes

  • cfd8103: Updated catalog provider module template to use stable catalog extension points from @backstage/plugin-catalog-node instead of alpha exports.

  • 20131c5: Added support for CSS exports in package builds. When a package declares a CSS file in its exports field (e.g., "./styles.css": "./src/styles.css"), the CLI will automatically bundle it during backstage-cli package build, resolving any @import statements. The export path is rewritten from src/ to dist/ at publish time.

    Fixed backstage-cli repo fix to not add typesVersions entries for non-script exports like CSS files.

  • 7455dae: Use node prefix on native imports

  • 6ce4a13: Removed /alpha from scaffolderActionsExtensionPoint import

  • fdbd404: Removed the EXPERIMENTAL_MODULE_FEDERATION environment variable flag, making module federation host support always available during package start. The host shared dependencies are now managed through @backstage/module-federation-common and injected as a versioned runtime script at build time.

  • fdbd404: Updated @module-federation/enhanced, @module-federation/runtime, and @module-federation/sdk dependencies from ^0.9.0 to ^0.21.6.

  • 4fc7bf0: Bump to tar v7

  • 5e3ef57: Added support for the new peerModules metadata field in package.json. This field allows plugin packages to declare modules that should be installed alongside them for cross-plugin integrations. The field is validated by backstage-cli repo fix --publish.

  • 122d39c: Completely removed support for the deprecated app.experimental.packages configuration. Replace existing usage directly with app.packages.

  • 73351c2: Updated dependency webpack to ~5.104.0.

  • 69d880e: Bump to latest zod to ensure it has the latest features

  • Updated dependencies

backstage/backstage (@​backstage/core-compat-api)

v0.5.8

Compare Source

Patch Changes
  • c38b74d: Internal updates for blueprint moves to @backstage/plugin-app-react.
  • ef6916e: Added IconElement type as a replacement for the deprecated IconComponent. The IconsApi now has a new icon() method that returns IconElement, while the existing getIcon() method is deprecated. The IconBundleBlueprint now accepts both IconComponent and IconElement values.
  • 53b6549: Plugins in the new frontend system now have a pluginId field rather than id to better align with naming conventions used throughout the frontend and backend systems. The old field is still present but marked as deprecated. All internal code has been updated to prefer pluginId while maintaining backward compatibility by falling back to id when needed.
  • a7e0d50: Updated react-router-dom peer dependency to ^6.30.2 and explicitly disabled v7 future flags to suppress deprecation warnings.
  • 69d880e: Bump to latest zod to ensure it has the latest features
  • Updated dependencies
backstage/backstage (@​backstage/core-components)

v0.18.7

Compare Source

Patch Changes
backstage/backstage (@​backstage/core-plugin-api)

v1.12.3

Compare Source

Patch Changes
  • 53b6549: Plugins in the new frontend system now have a pluginId field rather than id to better align with naming conventions used throughout the frontend and backend systems. The old field is still present but marked as deprecated. All internal code has been updated to prefer pluginId while maintaining backward compatibility by falling back to id when needed.
  • a7e0d50: Updated react-router-dom peer dependency to ^6.30.2 and explicitly disabled v7 future flags to suppress deprecation warnings.
  • 69d880e: Bump to latest zod to ensure it has the latest features
  • Updated dependencies
backstage/backstage (@​backstage/e2e-test-utils)

v0.1.2

Compare Source

Patch Changes

  • b96c20e: Added optional channel option to generateProjects() to allow customizing the Playwright browser channel for testing against different browsers variants. When not provided, the function defaults to 'chrome' to maintain backward compatibility.

    Example usage:

    import { generateProjects } from '@​backstage/e2e-test-utils';

export default defineConfig({
  projects: generateProjects({ channel: 'msedge' }),
});

  • 7455dae: Use node prefix on native imports

backstage/backstage (@​backstage/frontend-defaults)

v0.4.0

Compare Source

Minor Changes
  • 55b2ef6: BREAKING: The API_FACTORY_CONFLICT warning is now treated as an error and will prevent the app from starting.
Patch Changes
  • 122d39c: Completely removed support for the deprecated app.experimental.packages configuration. Replace existing usage directly with app.packages.
  • c38b74d: Dependency update for tests.
  • 53b6549: Plugins in the new frontend system now have a pluginId field rather than id to better align with naming conventions used throughout the frontend and backend systems. The old field is still present but marked as deprecated. All internal code has been updated to prefer pluginId while maintaining backward compatibility by falling back to id when needed.
  • a7e0d50: Updated react-router-dom peer dependency to ^6.30.2 and explicitly disabled v7 future flags to suppress deprecation warnings.
  • Updated dependencies
backstage/backstage (@​backstage/frontend-plugin-api)

v0.14.1

Compare Source

v0.14.0

Compare Source

Minor Changes

  • ef6916e: Added IconElement type as a replacement for the deprecated IconComponent. The IconsApi now has a new icon() method that returns IconElement, while the existing getIcon() method is deprecated. The IconBundleBlueprint now accepts both IconComponent and IconElement values.

  • bb9b471: Plugin IDs that do not match the standard format are deprecated (letters, digits, and dashes only, starting with a letter). Plugin IDs that do no match this format will be rejected in a future release.

  • ef6916e: Added SubPageBlueprint for creating sub-page tabs, PluginHeaderActionBlueprint and PluginHeaderActionsApi for plugin-scoped header actions, and PageLayout as a swappable component. The PageBlueprint now supports sub-pages with tabbed navigation, page title, icon, and header actions. Plugins can now specify a title and icon in createFrontendPlugin.

  • c38b74d: BREAKING: The following blueprints have been removed and are now only available from @backstage/plugin-app-react:

    • IconBundleBlueprint
    • NavContentBlueprint
    • RouterBlueprint
    • SignInPageBlueprint
    • SwappableComponentBlueprint
    • ThemeBlueprint
    • TranslationBlueprint

  • 10ebed4: BREAKING: Removed type support for multiple attachment points in the ExtensionDefinitionAttachTo type. Extensions can no longer specify an array of attachment points in the attachTo property.

    The runtime still supports multiple attachment points for backward compatibility with existing compiled code, but new code will receive type errors if attempting to use this pattern.

    Extensions that previously used multiple attachment points should migrate to using a Utility API pattern instead. See the Sharing Extensions Across Multiple Locations guide for the recommended approach.

Patch Changes

  • 7edb810: Added a new internal option to createExtensionInput that marks the input as only allowing attachments from the same plugin.

  • 9554c36: DEPRECATED: Multiple attachment points for extensions have been deprecated. The functionality continues to work for backward compatibility, but will log a deprecation warning and be removed in a future release.

    Extensions using array attachment points should migrate to using Utility APIs instead. See the Sharing Extensions Across Multiple Locations guide for the recommended pattern.

  • 53b6549: Plugins in the new frontend system now have a pluginId field rather than id to better align with naming conventions used throughout the frontend and backend systems. The old field is still present but marked as deprecated. All internal code has been updated to prefer pluginId while maintaining backward compatibility by falling back to id when needed.

  • a7e0d50: Updated react-router-dom peer dependency to ^6.30.2 and explicitly disabled v7 future flags to suppress deprecation warnings.

  • 69d880e: Bump to latest zod to ensure it has the latest features

  • Updated dependencies

backstage/backstage (@​backstage/frontend-test-utils)

v0.5.0

Compare Source

Minor Changes

  • 09a6aad: BREAKING: Removed the TestApiRegistry class, use TestApiProvider directly instead, storing reused APIs in a variable, e.g. const apis = [...] as const.

  • d2ac2ec: Added MockAlertApi and MockFeatureFlagsApi implementations to the mockApis namespace. The mock implementations include useful testing methods like clearAlerts(), waitForAlert(), getState(), setState(), and clearState() for better test ergonomics.

  • 09a6aad: BREAKING: The mockApis namespace is no longer a re-export from @backstage/test-utils. It's now a standalone namespace with mock implementations of most core APIs. Mock API instances can be passed directly to TestApiProvider, renderInTestApp, and renderTestApp without needing [apiRef, impl] tuples. As part of this change, the .factory() method on some mocks has been removed, since it's now redundant.

    // Before
import { mockApis } from '@​backstage/frontend-test-utils';

renderInTestApp(<MyComponent />, {
  apis: [[identityApiRef, mockApis.identity()]],
});

// After - mock APIs can be passed directly
renderInTestApp(<MyComponent />, {
  apis: [mockApis.identity()],
});

    This change also adds createApiMock, a public utility for creating mock API factories, intended for plugin authors to create their own .mock() variants.

Patch Changes

  • 22864b7: Added an apis option to createExtensionTester, renderInTestApp, and renderTestApp to override APIs when testing extensions. Use the mockApis helpers to create mock implementations:

    import { identityApiRef } from '@&#8203;backstage/frontend-plugin-api';
import { mockApis } from '@&#8203;backstage/frontend-test-utils';

// Override APIs in createExtensionTester
const tester = createExtensionTester(myExtension, {
  apis: [
    [
      identityApiRef,
      mockApis.identity({ userEntityRef: 'user:default/guest' }),
    ],
  ],
});

// Override APIs in renderInTestApp
renderInTestApp(<MyComponent />, {
  apis: [
    [
      identityApiRef,
      mockApis.identity({ userEntityRef: 'user:default/guest' }),
    ],
  ],
});

// Override APIs in renderTestApp
renderTestApp({
  extensions: [myExtension],
  apis: [
    [
      identityApiRef,
      mockApis.identity({ userEntityRef: 'user:default/guest' }),
    ],
  ],
});

  • 15ed3f9: Added snapshot() method to ExtensionTester, which returns a tree-shaped representation of the resolved extension hierarchy. Convenient to use with toMatchInlineSnapshot().

  • 013ec22: Added mountedRoutes option to renderTestApp for binding route refs to paths, matching the existing option in renderInTestApp:

    renderTestApp({
  extensions: [...],
  mountedRoutes: {
    '/my-path': myRouteRef,
  },
});

  • d7dd5bd: Fixed Router deprecation warning and switched to using new RouterBlueprint from @backstage/plugin-app-api.

  • a7e0d50: Updated react-router-dom peer dependency to ^6.30.2 and explicitly disabled v7 future flags to suppress deprecation warnings.

  • 69d880e: Bump to latest zod to ensure it has the latest features

  • Updated dependencies

backstage/backstage (@​backstage/integration-react)

v1.2.15

Compare Source

Patch Changes
backstage/backstage (@​backstage/plugin-app-backend)

v0.5.11

Compare Source

Patch Changes
backstage/backstage (@​backstage/plugin-app-visualizer)

v0.2.0

Compare Source

Minor Changes
  • ef6916e: Migrated to use SubPageBlueprint for tabbed navigation and added a copy-tree-as-JSON plugin header action using PluginHeaderActionBlueprint. The plugin now specifies a title and icon.
Patch Changes
backstage/backstage (@​backstage/plugin-auth-backend)

v0.27.0

Compare Source

Minor Changes

  • 31de2c9: Added experimental support for Client ID Metadata Documents (CIMD).

    This allows Backstage to act as an OAuth 2.0 authorization server that supports the IETF Client ID Metadata Document draft. External OAuth clients can use HTTPS URLs as their client_id, and Backstage will fetch metadata from those URLs to validate the client.

    Configuration example:

    auth:
  experimentalClientIdMetadataDocuments:
    enabled: true
    # Optional: restrict which `client_id` URLs are allowed (defaults to ['*'])
    allowedClientIdPatterns:
      - 'https://example.com/*'
      - 'https://*.trusted-domain.com/*'
    # Optional: restrict which redirect URIs are allowed (defaults to ['*'])
    allowedRedirectUriPatterns:
      - 'http://localhost:*'
      - 'https://*.example.com/*'

    Clients using CIMD must host a JSON metadata document at their client_id URL containing at minimum:

    {
  "client_id": "https://example.com/.well-known/oauth-client/my-app",
  "client_name": "My Application",
  "redirect_uris": ["http://localhost:8080/callback"],
  "token_endpoint_auth_method": "none"
}

  • d0786b9: Added experimental support for refresh tokens via the auth.experimentalRefreshToken.enabled configuration option. When enabled, clients can request the offline_access scope to receive refresh tokens that can be used to obtain new access tokens without re-authentication.

Patch Changes

  • 7dc3dfe: Removed the auth.experimentalDynamicClientRegistration.tokenExpiration config option. DCR tokens now use the default 1 hour expiration.

    If you need longer-lived access, use refresh tokens via the offline_access scope instead. DCR clients should already have the offline_access scope available. Enable refresh tokens by setting:

    auth:
  experimentalRefreshToken:
    enabled: true

  • 7455dae: Use node prefix on native imports

  • Updated dependencies

backstage/backstage (@​backstage/plugin-auth-backend-module-github-provider)

v0.5.0

Compare Source

Minor Changes
  • ff07934: Added the userIdMatchingUserEntityAnnotation sign-in resolver that matches users by their GitHub user ID.
Patch Changes
backstage/backstage (@​backstage/plugin-auth-backend-module-guest-provider)

v0.2.16

Compare Source

Patch Changes
backstage/backstage (@​backstage/plugin-auth-node)

v0.6.13

Compare Source

Patch Changes
backstage/backstage (@​backstage/plugin-catalog)

v1.33.1

Compare Source

Patch Changes

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added the renovate label Feb 22, 2026
@renovate renovate bot force-pushed the renovate/backstage-core branch from 6c3dec5 to 0c0f19d Compare February 22, 2026 21:38
@renovate renovate bot force-pushed the renovate/backstage-core branch from 0c0f19d to 4ca41aa Compare February 28, 2026 08:14
@secustor secustor enabled auto-merge (squash) February 28, 2026 09:43
@secustor secustor merged commit f8cb797 into main Feb 28, 2026
4 checks passed
@secustor secustor deleted the renovate/backstage-core branch February 28, 2026 09:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

renovate

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@secustor