fix(deps): update backstage monorepo - #100
Conversation
6b8c2e9 to
b288ac0
Compare
b288ac0 to
b1fd31e
Compare
64ae8a4 to
25b2554
Compare
25b2554 to
98b013b
Compare
04bd8ac to
d7ab646
Compare
c917612 to
26894e5
Compare
2d77666 to
7d48e46
Compare
f673f86 to
8a6178b
Compare
a164125 to
6ecc5f7
Compare
814374e to
d998c45
Compare
71a61bc to
ef457d7
Compare
67fe262 to
fc5130f
Compare
6b54637 to
3bcfe13
Compare
acd5df9 to
ef78b20
Compare
d0735f3 to
2998585
Compare
6607909 to
ab96b50
Compare
883b8d4 to
8e1bd14
Compare
8e1bd14 to
bdb787e
Compare
4317d59 to
669d0aa
Compare
df184dc to
ad895c8
Compare
ad895c8 to
b44b3f7
Compare
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
| "axios@npm:^1.16.0": | ||
| version: 1.18.1 | ||
| resolution: "axios@npm:1.18.1" | ||
| dependencies: | ||
| follow-redirects: "npm:^1.16.0" | ||
| form-data: "npm:^4.0.5" | ||
| https-proxy-agent: "npm:^5.0.1" | ||
| proxy-from-env: "npm:^2.1.0" | ||
| checksum: 10c0/9d9378a3af0d0ad730a52ad9d15ec7201f3926ad6e7e8bbffc5ae21ca2835ad11d1d9598698f5dd9718917486039f55ea1d7dc23d8e44fa827a55cc3262c02fc | ||
| languageName: node | ||
| linkType: hard |
There was a problem hiding this comment.
security (CVE-2026-25639): Axios affected by Denial of Service via proto Key in mergeConfig
Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing proto as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service. This vulnerability is fixed in versions 0.30.3 and 1.13.5.
Source: trivy
| "axios@npm:^1.16.0": | ||
| version: 1.18.1 | ||
| resolution: "axios@npm:1.18.1" | ||
| dependencies: | ||
| follow-redirects: "npm:^1.16.0" | ||
| form-data: "npm:^4.0.5" | ||
| https-proxy-agent: "npm:^5.0.1" | ||
| proxy-from-env: "npm:^2.1.0" | ||
| checksum: 10c0/9d9378a3af0d0ad730a52ad9d15ec7201f3926ad6e7e8bbffc5ae21ca2835ad11d1d9598698f5dd9718917486039f55ea1d7dc23d8e44fa827a55cc3262c02fc | ||
| languageName: node | ||
| linkType: hard |
There was a problem hiding this comment.
security (CVE-2026-42033): Axios: HTTP Transport Hijacking via Prototype Pollution
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can (a) silently intercept and modify every JSON response before the application sees it, or (b) fully hijack the underlying HTTP transport, gaining access to request credentials, headers, and body. The precondition is prototype pollution from a separate source in the same process. This vulnerability is fixed in 1.15.1 and 0.31.1.
Source: trivy
| "axios@npm:^1.16.0": | ||
| version: 1.18.1 | ||
| resolution: "axios@npm:1.18.1" | ||
| dependencies: | ||
| follow-redirects: "npm:^1.16.0" | ||
| form-data: "npm:^4.0.5" | ||
| https-proxy-agent: "npm:^5.0.1" | ||
| proxy-from-env: "npm:^2.1.0" | ||
| checksum: 10c0/9d9378a3af0d0ad730a52ad9d15ec7201f3926ad6e7e8bbffc5ae21ca2835ad11d1d9598698f5dd9718917486039f55ea1d7dc23d8e44fa827a55cc3262c02fc | ||
| languageName: node | ||
| linkType: hard |
There was a problem hiding this comment.
security (CVE-2026-42035): Axios: Arbitrary HTTP header injection via prototype pollution
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type checking of the data payload, where if Object.prototype is polluted with getHeaders, append, pipe, on, once, and Symbol.toStringTag, Axios misidentifies any plain object payload as a FormData instance and calls the attacker-controlled getHeaders() function, merging the returned headers into the outgoing request. The vulnerable code resides exclusively in lib/adapters/http.js. The prototype pollution source does not need to originate from Axios itself — any prototype pollution primitive in any dependency in the application's dependency tree is sufficient to trigger this gadget. This vulnerability is fixed in 1.15.1 and 0.31.1.
Source: trivy
| "axios@npm:^1.16.0": | ||
| version: 1.18.1 | ||
| resolution: "axios@npm:1.18.1" | ||
| dependencies: | ||
| follow-redirects: "npm:^1.16.0" | ||
| form-data: "npm:^4.0.5" | ||
| https-proxy-agent: "npm:^5.0.1" | ||
| proxy-from-env: "npm:^2.1.0" | ||
| checksum: 10c0/9d9378a3af0d0ad730a52ad9d15ec7201f3926ad6e7e8bbffc5ae21ca2835ad11d1d9598698f5dd9718917486039f55ea1d7dc23d8e44fa827a55cc3262c02fc | ||
| languageName: node | ||
| linkType: hard |
There was a problem hiding this comment.
security (CVE-2026-42043): Axios: NO_PROXY bypass via crafted URL
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 range (other than 127.0.0.1) to completely bypass the NO_PROXY protection. This vulnerability is due to an incomplete for CVE-2025-62718, This vulnerability is fixed in 1.15.1 and 0.31.1.
Source: trivy
| "axios@npm:^1.16.0": | ||
| version: 1.18.1 | ||
| resolution: "axios@npm:1.18.1" | ||
| dependencies: | ||
| follow-redirects: "npm:^1.16.0" | ||
| form-data: "npm:^4.0.5" | ||
| https-proxy-agent: "npm:^5.0.1" | ||
| proxy-from-env: "npm:^2.1.0" | ||
| checksum: 10c0/9d9378a3af0d0ad730a52ad9d15ec7201f3926ad6e7e8bbffc5ae21ca2835ad11d1d9598698f5dd9718917486039f55ea1d7dc23d8e44fa827a55cc3262c02fc | ||
| languageName: node | ||
| linkType: hard |
There was a problem hiding this comment.
security (CVE-2026-42264): Axios: Prototype pollution allows information disclosure and request manipulation
Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser) in the HTTP adapter are read via direct property access without hasOwnProperty guards, making them exploitable as prototype pollution gadgets. When Object.prototype is polluted by another dependency in the same process, axios silently picks up these polluted values on every outbound HTTP request. This issue has been patched in version 1.15.2.
Source: trivy
| "axios@npm:^1.16.0": | ||
| version: 1.18.1 | ||
| resolution: "axios@npm:1.18.1" | ||
| dependencies: | ||
| follow-redirects: "npm:^1.16.0" | ||
| form-data: "npm:^4.0.5" | ||
| https-proxy-agent: "npm:^5.0.1" | ||
| proxy-from-env: "npm:^2.1.0" | ||
| checksum: 10c0/9d9378a3af0d0ad730a52ad9d15ec7201f3926ad6e7e8bbffc5ae21ca2835ad11d1d9598698f5dd9718917486039f55ea1d7dc23d8e44fa827a55cc3262c02fc | ||
| languageName: node | ||
| linkType: hard |
There was a problem hiding this comment.
security (CVE-2026-44487): Axios: Information disclosure of proxy credentials via redirect flows
Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage, where an initial HTTP request is sent through an authenticated HTTP proxy, redirects are followed, and the redirected URL is no longer proxied. Under affected redirect shapes, the final origin can receive the proxy credential that was intended only for the outbound proxy. This vulnerability is fixed in 0.32.0 and 1.16.0.
Source: trivy
| "axios@npm:^1.16.0": | ||
| version: 1.18.1 | ||
| resolution: "axios@npm:1.18.1" | ||
| dependencies: | ||
| follow-redirects: "npm:^1.16.0" | ||
| form-data: "npm:^4.0.5" | ||
| https-proxy-agent: "npm:^5.0.1" | ||
| proxy-from-env: "npm:^2.1.0" | ||
| checksum: 10c0/9d9378a3af0d0ad730a52ad9d15ec7201f3926ad6e7e8bbffc5ae21ca2835ad11d1d9598698f5dd9718917486039f55ea1d7dc23d8e44fa827a55cc3262c02fc | ||
| languageName: node | ||
| linkType: hard |
There was a problem hiding this comment.
security (CVE-2026-44488): Axios: Denial of Service due to unenforced request and response size limits
Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter. Applications that selected adapter: 'fetch', or ran in environments where axios resolved to the fetch adapter, could receive or send bodies larger than maxContentLength or maxBodyLength despite those limits being explicitly configured. This can cause resource exhaustion in server-side usage when a malicious or compromised server returns an oversized response, when an attacker can supply a large data: URL, or when an application forwards attacker-controlled request bodies through axios while relying on maxBodyLength as a boundary. This vulnerability is fixed in 0.32.0 and 1.16.0.
Source: trivy
| "axios@npm:^1.16.0": | ||
| version: 1.18.1 | ||
| resolution: "axios@npm:1.18.1" | ||
| dependencies: | ||
| follow-redirects: "npm:^1.16.0" | ||
| form-data: "npm:^4.0.5" | ||
| https-proxy-agent: "npm:^5.0.1" | ||
| proxy-from-env: "npm:^2.1.0" | ||
| checksum: 10c0/9d9378a3af0d0ad730a52ad9d15ec7201f3926ad6e7e8bbffc5ae21ca2835ad11d1d9598698f5dd9718917486039f55ea1d7dc23d8e44fa827a55cc3262c02fc | ||
| languageName: node | ||
| linkType: hard |
There was a problem hiding this comment.
security (CVE-2026-44494): Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution
Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into a full Man-in-the-Middle (MITM) attack — intercepting, reading, and modifying all HTTP traffic including authentication credentials. The HTTP adapter at lib/adapters/http.js:670 reads config.proxy via standard property access, which traverses the prototype chain. Because proxy is not present in Axios defaults, the merged config object has no own proxy property, making it trivially injectable via prototype pollution. Once injected, setProxy() routes all HTTP requests through the attacker's proxy server. This vulnerability is fixed in 1.16.0.
Source: trivy
| "axios@npm:^1.16.0": | ||
| version: 1.18.1 | ||
| resolution: "axios@npm:1.18.1" | ||
| dependencies: | ||
| follow-redirects: "npm:^1.16.0" | ||
| form-data: "npm:^4.0.5" | ||
| https-proxy-agent: "npm:^5.0.1" | ||
| proxy-from-env: "npm:^2.1.0" | ||
| checksum: 10c0/9d9378a3af0d0ad730a52ad9d15ec7201f3926ad6e7e8bbffc5ae21ca2835ad11d1d9598698f5dd9718917486039f55ea1d7dc23d8e44fa827a55cc3262c02fc | ||
| languageName: node | ||
| linkType: hard |
There was a problem hiding this comment.
security (CVE-2026-44495): Axios: Information disclosure due to prototype pollution vulnerability
Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Object.prototype.transformResponse, affected Axios versions may treat that inherited value as request configuration or as an option validator. Axios does not itself create the prototype pollution. Exploitability requires a separate prototype-pollution vulnerability or equivalent attacker control over Object.prototype before Axios creates a request. This vulnerability is fixed in 0.31.1 and 1.15.2.
Source: trivy
| "axios@npm:^1.16.0": | ||
| version: 1.18.1 | ||
| resolution: "axios@npm:1.18.1" | ||
| dependencies: | ||
| follow-redirects: "npm:^1.16.0" | ||
| form-data: "npm:^4.0.5" | ||
| https-proxy-agent: "npm:^5.0.1" | ||
| proxy-from-env: "npm:^2.1.0" | ||
| checksum: 10c0/9d9378a3af0d0ad730a52ad9d15ec7201f3926ad6e7e8bbffc5ae21ca2835ad11d1d9598698f5dd9718917486039f55ea1d7dc23d8e44fa827a55cc3262c02fc | ||
| languageName: node | ||
| linkType: hard |
There was a problem hiding this comment.
security (CVE-2026-44496): Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name
Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF cookie name without escaping regex metacharacters. In standard browser environments, an attacker who can influence the cookie name passed to axios can cause expensive regex backtracking while axios reads document.cookie. The practical impact is client-side availability degradation, such as freezing the affected browser tab while axios prepares a request. The issue does not affect ordinary Node.js HTTP adapter usage, React Native, or web workers, where axios does not read document.cookie. This vulnerability is fixed in 0.32.0 and 1.16.0.
Source: trivy
2692184 to
da62059
Compare
da62059 to
95b6ce7
Compare
| "js-yaml@npm:=4.3.0, js-yaml@npm:^4.2.0": | ||
| version: 4.3.0 | ||
| resolution: "js-yaml@npm:4.3.0" | ||
| dependencies: | ||
| argparse: "npm:^2.0.1" | ||
| bin: | ||
| js-yaml: bin/js-yaml.js | ||
| checksum: 10c0/184a24b4eaacfce40ad9074c64fd42ac83cf74d8c8cd137718d456ced75051229e5061b8633c3366b8aada17945a7a356b337828c19da92b51ae62126575018f | ||
| checksum: 10c0/058b30473d6915ca5b4feb11e2f7d4d97242f98d00a798ed48dd90b46b7c640398afe9128c5db22c5300f8c6528fe2a174b9a93f351a70ebc28c6203938d8bff | ||
| languageName: node | ||
| linkType: hard |
There was a problem hiding this comment.
security (CVE-2026-59869): js-yaml: Denial of Service via crafted YAML documents
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.
Source: trivy
| "js-yaml@npm:=4.3.0, js-yaml@npm:^4.2.0": | ||
| version: 4.3.0 | ||
| resolution: "js-yaml@npm:4.3.0" | ||
| dependencies: | ||
| argparse: "npm:^2.0.1" | ||
| bin: | ||
| js-yaml: bin/js-yaml.js | ||
| checksum: 10c0/184a24b4eaacfce40ad9074c64fd42ac83cf74d8c8cd137718d456ced75051229e5061b8633c3366b8aada17945a7a356b337828c19da92b51ae62126575018f | ||
| checksum: 10c0/058b30473d6915ca5b4feb11e2f7d4d97242f98d00a798ed48dd90b46b7c640398afe9128c5db22c5300f8c6528fe2a174b9a93f351a70ebc28c6203938d8bff | ||
| languageName: node | ||
| linkType: hard |
There was a problem hiding this comment.
security (CVE-2026-59869): js-yaml: Denial of Service via crafted YAML documents
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.
Source: trivy
| "js-yaml@npm:=4.3.0, js-yaml@npm:^4.2.0": | ||
| version: 4.3.0 | ||
| resolution: "js-yaml@npm:4.3.0" | ||
| dependencies: | ||
| argparse: "npm:^2.0.1" | ||
| bin: | ||
| js-yaml: bin/js-yaml.js | ||
| checksum: 10c0/184a24b4eaacfce40ad9074c64fd42ac83cf74d8c8cd137718d456ced75051229e5061b8633c3366b8aada17945a7a356b337828c19da92b51ae62126575018f | ||
| checksum: 10c0/058b30473d6915ca5b4feb11e2f7d4d97242f98d00a798ed48dd90b46b7c640398afe9128c5db22c5300f8c6528fe2a174b9a93f351a70ebc28c6203938d8bff | ||
| languageName: node | ||
| linkType: hard |
There was a problem hiding this comment.
security (CVE-2026-59869): js-yaml: Denial of Service via crafted YAML documents
js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.
Source: trivy
95b6ce7 to
6cd65dd
Compare
This PR contains the following updates:
1.6.5→1.7.101.11.0→1.16.11.7.5→1.9.0^0.34.0→^0.36.01.3.3→1.3.81.18.0→1.20.3^0.17.0→^0.18.01.10.9→1.12.81.2.9→1.2.20^0.12.4→^0.14.00.5.5→0.5.16^0.27.0→^0.29.0^0.6.0→^0.7.01.31.2→1.33.13.0.1→3.8.11.1.5→1.1.10^0.4.16→^0.6.00.13.4→0.13.151.20.1→1.21.60.12.10→0.12.21^0.6.36→^0.7.00.9.1→0.9.9^0.10.0→^0.11.0^0.4.31→^0.5.00.6.5→0.6.151.34.0→1.38.11.4.29→1.7.62.0.5→2.1.40.5.47→0.5.571.3.14→1.4.61.9.3→1.11.61.14.1→1.17.82.0.5→2.2.21.1.27→1.1.381.3.2→1.3.13^0.8.19→^0.9.01.7.11→1.7.20^0.6.4→^0.7.0Release Notes
backstage/backstage (@backstage/app-defaults)
v1.7.10Compare Source
Patch Changes
v1.7.9Compare Source
Patch Changes
74ed625: Provide toastApi for old frontend systemFixes 'No implementation available for apiRef{core.toast}' on old frontend system.
Updated dependencies
v1.7.8Compare Source
Patch Changes
v1.7.7Compare Source
Patch Changes
400aa23: AddedFetchMiddlewares.clarifyFailures()to the default fetch API middleware stack.v1.7.6Compare Source
Patch Changes
v1.7.5Compare Source
Patch Changes
a7e0d50: Updatedreact-router-dompeer dependency to^6.30.2and explicitly disabled v7 future flags to suppress deprecation warnings.v1.7.4Compare Source
Patch Changes
v1.7.3Compare Source
Patch Changes
v1.7.2Compare Source
Patch Changes
v1.7.1Compare Source
Patch Changes
v1.7.0Compare Source
Minor Changes
9956704: Add and configure the OpenShift authentication provider to the default APIs.Patch Changes
backstage/backstage (@backstage/catalog-client)
v1.16.1Compare Source
Patch Changes
v1.16.0Compare Source
Minor Changes
8f20cc2:CatalogApi.queryEntitiesnow accepts atotalItemsoption ('include'or'exclude', default'include') on initial requests. Pass'exclude'to skip thetotalItemscount when the caller doesn't need it.Patch Changes
378784e: Moved dependencies that are re-exported in the public API fromdevDependenciestodependencies. These were incorrectly demoted in #33936 because the source code only uses type imports, but the types still appear in the published API surface and need to be resolvable by consumers at build time.v1.15.2Compare Source
v1.15.1Compare Source
Patch Changes
v1.15.0Compare Source
Minor Changes
c384fff: BREAKING PRODUCERS: Added requiredentityReffield to theLocationtype, exposing the stable entity reference for each registered location. Any code that producesLocationobjects must now include this field. AddedupdateLocationmethod toCatalogApifor updating the type and target of an existing location.Patch Changes
v1.14.0Compare Source
Minor Changes
972f686: Added support for thequeryfield ingetEntitiesByRefsrequests, enabling predicate-based filtering with$all,$any,$not,$exists,$in,$contains, and$hasPrefixoperators.5d95e8e: Add anonConflictoption to location creation that can refresh an existing location instead of throwing a conflict error.56c908e: Added support for thequeryfield ingetEntityFacetsrequests, enabling predicate-based filtering with$all,$any,$not,$exists,$in,$contains, and$hasPrefixoperators.0fbcf23: Migrated OpenAPI schemas to 3.1.51e23eb: Added predicate-based entity filtering via POST /entities/by-query endpoint.Supports
$all,$any,$not,$exists,$in,$hasPrefix, and (partially)$containsoperators for expressive entity queries. Integrated into the existingqueryEntitiesflow with full cursor-based pagination, permission enforcement, andtotalItemssupport.The catalog client's
queryEntities()method automatically routes to the POST endpoint when aquerypredicate is provided.Patch Changes
d2494d6: Minor update to catalog client docsv1.13.0Compare Source
Minor Changes
b4e8249: Implemented support for the newqueryLocationsandstreamLocationsthat allow paginated/streamed and filtered location queriesPatch Changes
9cf6762: Improved theInMemoryCatalogClienttest utility to support ordering, pagination, full-text search, and field projection for entity query methods. Also fixedgetEntityFacetsto correctly handle multi-valued fields.v1.12.1Compare Source
Patch Changes
v1.12.0Compare Source
Minor Changes
0e9ec44: Introduced newstreamEntitiesasync generator method for the catalog.Catalog API and Catalog Service now includes a
streamEntitiesmethod that allows for streaming entities from the catalog.This method is designed to handle large datasets efficiently by processing entities in a stream rather than loading them
all into memory at once. This is useful when you need to fetch a large number of entities but do not want to use pagination
or fetch all entities at once.
Example usage:
Patch Changes
0efcc97: Updated generated schemasbackstage/backstage (@backstage/catalog-model)
v1.9.0Compare Source
Minor Changes
3664148: Introduced theAiResourcecatalog entity kind. Entity types, validators, type guards, and the model layer are exported from@backstage/catalog-model/alpha. Install@backstage/plugin-catalog-backend-module-ai-modelin your backend to register the kind with the catalog.be71476: Addedspec.type: 'mcp-server'as a structured subtype of theAPIkind underv1alpha1/v1beta1. MCP server entities carry aspec.remoteslist instead of a stringdefinition, for representing Model Context Protocol servers in the catalog. See RFC #32062. New public exports:McpServerApiEntity,McpServerRemote,mcpServerApiEntityValidator, andisMcpServerApiEntity. Also addsaddKindVersiontoCatalogModelLayerBuilder(alpha) so layers can add new versions or spec types to existing kinds.Patch Changes
ab1cdbb: Removed a handful of internal imports that referenced the package by its own name. Value imports were switched to relative paths, and type-only imports toimport type. These self-referential imports could trigger circular initialization errors in bundled ESM and when the package was loaded viajest.requireActual— most visiblyCannot access '_AppRootElementBlueprintesm' before initializationfrom@backstage/frontend-plugin-api. There are no user-facing API changes.v1.8.0Compare Source
Minor Changes
e5fcfcb: Added a new catalog model layer system that allows plugins to declare and extend catalog entity kinds, annotations, labels, tags, and relations using JSON Schema. The newcreateCatalogModelLayerAPI provides a builder for composing model definitions, and acompileCatalogModelfunction validates and merges them into a unified model. Built-in entity kinds now include model layer definitions.Patch Changes
v1.7.7Compare Source
Patch Changes
a49a40d: Updated dependencyzodto^3.25.76 || ^4.0.0& migrated to/v3or/v4imports.v1.7.6Compare Source
Patch Changes
05f60e1: Refactored constructor parameter properties to explicit property declarations for compatibility with TypeScript'serasableSyntaxOnlysetting. This internal refactoring maintains all existing functionality while ensuring TypeScript compilation compatibility.backstage/backstage (@backstage/cli)
v0.36.4Compare Source
Patch Changes
61d4881: The shared ESLint configuration now reports unused imports inconfig.d.tsconfiguration schema files. These declaration files are not covered by the TypeScript compiler's unused-variable checks, which previously allowed a stray import to slip through. Such an import can resolve during local development but break configuration schema loading for consumers of the published package, so it is now caught at lint time.v0.36.3Compare Source
Patch Changes
b521571: Improved validation of conflicting CLI module commands, including conflicts between parent and nested command paths.v0.36.2Compare Source
Patch Changes
744fa1f: Removed duplicated entries that appeared in bothdependenciesanddevDependencies.v0.36.1Compare Source
Patch Changes
2e5c5f8: Bumpedglobdependency from v7/v8/v11 to v13 to address security vulnerabilities in older versions. Bumpedrollupfrom v4.27 to v4.59+ to fix a high severity path traversal vulnerability (GHSA-mw96-cpmx-2vgc).482ceed: Migrated fromassertErrortotoErrorfor error handling.a2f0c72: Removed the unusedisDevexport from the internal version module.a7a14b7: AddedDOM.AsyncIterableto the defaultlibin the shared TypeScript configuration, enabling standard async iteration support for DOM APIs such asFileSystemDirectoryHandle. This aligns behavior with TypeScript 6.0, where this lib is included inDOMby default.v0.36.0Compare Source
Minor Changes
d0f4cd2: Added newauthcommand group for authenticating the CLI with Backstage instances using OAuth 2.0 with a pre-registered client metadata document. Commands includelogin,logout,list,show,print-token, andselectfor managing multiple authenticated instances.d806b0c: The CLI now automatically discovers CLI modules from the project root'sdependenciesanddevDependencies. Any installed package with thecli-moduleBackstage role will be loaded automatically without needing to be hardcoded in the CLI itself.If no CLI modules are found in the project dependencies, the CLI falls back to the built-in set of modules and prints a deprecation warning. This fallback will be removed in a future release. To prepare for this, add
@backstage/cli-defaultsas adevDependencyin your rootpackage.json:{ "devDependencies": { "@​backstage/cli-defaults": "backstage:^" } }If you are not using the Backstage Yarn plugin, run the following instead:
For fine-grained control you can instead install individual CLI modules:
{ "devDependencies": { "@​backstage/cli-module-auth": "backstage:^", "@​backstage/cli-module-build": "backstage:^", "@​backstage/cli-module-config": "backstage:^", "@​backstage/cli-module-github": "backstage:^", "@​backstage/cli-module-info": "backstage:^", "@​backstage/cli-module-lint": "backstage:^", "@​backstage/cli-module-maintenance": "backstage:^", "@​backstage/cli-module-migrate": "backstage:^", "@​backstage/cli-module-new": "backstage:^", "@​backstage/cli-module-test-jest": "backstage:^", "@​backstage/cli-module-translations": "backstage:^" } }08d9770: BREAKING: The CLI templates for frontend plugins have been renamed:new-frontend-plugin→frontend-pluginnew-frontend-plugin-module→frontend-plugin-modulefrontend-plugin(legacy) →legacy-frontend-pluginTo smooth out this breaking change, the CLI now auto-detects which frontend system your app uses based on the dependencies in
packages/app/package.json. When using the default templates (no explicittemplatesconfiguration):@backstage/frontend-defaultswill see the new frontend system templates (frontend-plugin,frontend-plugin-module)@backstage/app-defaultswill see the legacy template (displayed asfrontend-plugin)This means existing projects that haven't migrated to the new frontend system will continue to create legacy plugins by default, while new projects will get the new frontend system templates. If you have explicit template configuration in your
package.json, it will be used as-is without any auto-detection.b36a60d: BREAKING: Themigrate package-exportscommand has been removed. Userepo fixinstead.Patch Changes
edf2b77: Added a newcli-moduletemplate for creating CLI module packages.246877a: Updated dependencybfjto^9.0.2.0d2d0f2: Internal refactor of CLI modularization, moving individual commands to be implemented with cleye.a4e5902: Internal refactor of the CLI command registrationbba2e49: Internal refactor to use new concurrency utilities from@backstage/cli-node.2fcba39: Internal refactor to move shared utilities into their consuming modules, reducing cross-module dependencies.c85ac86: Internal refactor to splitloadCliConfiginto separate implementations for the build and config CLI modules, removing a cross-module dependency.94a885a: Added support for the newcli-modulepackage role in the build system, ESLint configuration, Jest configuration, and maintenance commands.fd50cb3: Addedtranslations exportandtranslations importcommands for managing translation files.The
translations exportcommand discovers allTranslationRefdefinitions across frontend plugin dependencies and exports their default messages as JSON files. Thetranslations importcommand generatesTranslationResourcewiring code from translated JSON files, ready to be plugged into the app.Both commands support a
--patternoption for controlling the message file layout, for example--pattern '{lang}/{id}.json'for language-based directory grouping.0be3eab: Migrated CLI plugin modules to usecreateCliModulefrom@backstage/cli-node.61cb976: Migrated internal versioning utilities to use@backstage/cli-nodeinstead of a local implementation.6738cf0: build(deps): bumpminimatchfrom 9.0.5 to 10.2.1ff4a45a: Migrated remaining CLI command handlers fromcommandertocleyefor argument parsing. Several camelCase CLI flags have been deprecated in favor of their kebab-case equivalents (e.g.--successCache→--success-cache). The old camelCase forms still work but will now log a deprecation warning. Please update any scripts or CI configurations to use the kebab-case versions.70fc178: Migrated from deprecatedfindPathstotargetPathsandfindOwnPathsfrom@backstage/cli-common.825c81d: Internal refactor of CLI command modules.ea90ab0: The built-inyarn newtemplates have been moved to@backstage/cli-module-new. Existing references to@backstage/cli/templates/*in your rootpackage.jsonwill continue to work through a backwards compatibility rewrite in thenewcommand.ebeb0d4: Updated the new frontend plugin template to use@backstage/frontend-dev-utilsin itsdev/entry point instead of wiringcreateAppmanually. Generated plugins now get the same dev app helper setup as the built-in examples.971cc94: Thenewcommand now prompts for the plugin package name when creating plugin modules, in order to properly populate thepackage.jsonfile.de62a9d: Upgradedcommanderdependency from^12.0.0to^14.0.3across all CLI packages.092b41f: Updated dependencywebpackto~5.105.0.4a75544: Updated dependencyreact-refreshto^0.18.0.a9d23c4: Properly supportpackage.jsonworkspacesfieldUpdated dependencies
v0.35.4Compare Source
Patch Changes
cfd8103: Updated catalog provider module template to use stable catalog extension points from@backstage/plugin-catalog-nodeinstead of alpha exports.20131c5: Added support for CSS exports in package builds. When a package declares a CSS file in itsexportsfield (e.g.,"./styles.css": "./src/styles.css"), the CLI will automatically bundle it duringbackstage-cli package build, resolving any@importstatements. The export path is rewritten fromsrc/todist/at publish time.Fixed
backstage-cli repo fixto not addtypesVersionsentries for non-script exports like CSS files.7455dae: Use node prefix on native imports6ce4a13: Removed/alphafromscaffolderActionsExtensionPointimportfdbd404: Removed theEXPERIMENTAL_MODULE_FEDERATIONenvironment variable flag, making module federation host support always available duringpackage start. The host shared dependencies are now managed through@backstage/module-federation-commonand injected as a versioned runtime script at build time.fdbd404: Updated@module-federation/enhanced,@module-federation/runtime, and@module-federation/sdkdependencies from^0.9.0to^0.21.6.4fc7bf0: Bump to tar v75e3ef57: Added support for the newpeerModulesmetadata field inpackage.json. This field allows plugin packages to declare modules that should be installed alongside them for cross-plugin integrations. The field is validated bybackstage-cli repo fix --publish.122d39c: Completely removed support for the deprecatedapp.experimental.packagesconfiguration. Replace existing usage directly withapp.packages.73351c2: Updated dependencywebpackto~5.104.0.69d880e: BConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.