v1.24.1

This release fixes an issue where installing the @backstage/plugin-catalog-backend-module-unprocessed, while having permissions enabled, interfered with the way that permissions were resolved by the catalog backend itself.

v1.24.0

These are the release notes for the v1.24.0 release of Backstage.

A huge thanks to the whole team of maintainers and contributors as well as the amazing Backstage Community for the hard work in getting this release developed and done.

Highlights

BREAKING: Auth improvements

This release is a big milestone for the authentication system of Backstage and includes a large collection of new APIs and services. The full proposal can be found in BEP-0003, including the motivation for this change. The main highlight of these changes is that we’re adding security by default to Backstage, meaning that you will no longer be forced to protect your Backstage instance from unauthorized access. It also brings several other improvements, such as slimmer user tokens and better handling of user credentials.

The majority of these improvements only apply to the new backend system, but the new service interfaces have backwards compatibility layers that allow them to be used in the old backend system too.

This is the first phase of the rollout of these changes, and includes all breaking changes that we are expecting. The new service interfaces introduced in this release set us up for the ability to add further improvements to the system without the need for additional breaking changes.

For information on how to migrate existing Backstage projects and plugins, refer to the migration documentation.

Due to this change, some backend plugins now require the discovery service to be forwarded from the plugin environment in the old backend system.

As part of this change, the getBearerTokenFromAuthorizationHeader export from @backstage/plugin-auth-node has been deprecated and we discourage any usage of it.

BREAKING: Events system improvements

The events system has been changed to have better compatibility with the new backend system, by handling all communication through a new events service.

Existing modules have been refactored to accept the new EventsService as input, rather than implementing the EventSubscriber interface. Refer to the changesets for each module for information on how to migrate.

For information on how to wire up the events service in the old backend system, see the events-node README.

This has also affected how the events backend is installed in the old backend system, see the events-backend README and events-backend CHANGELOG for details.

Contributed by @pjungermann in #22344.

New backend system by default

When creating a new project with @backstage/create-app you now get a backend built on top of the new backend system. Plugins created with the @backstage/cli now also support the new system.

Auth backend guest module

A new guest auth provider is now available for use in local development and testing. In contrast to the existing guest auth, this provider lets you get a valid session and Backstage user token.

Contributed by @aramissennyeydd in #22565

Accepting null in configuration

A null value is now treated as an explicitly undefined value, and does not fall back to other configuration files. This means that you can use a null value in configuration to reset or unset parts of configuration, such as disabling an auth provider.

Scaffolder actions testing utilities

A new @backstage/plugin-scaffolder-node-test-utils package has been published, which provides createMockActionContext to make it easier to write tests for scaffolder actions, and avoid breakages as additions to the actions context is made. More details can be found in the documentation for writing tests for actions.

We encourage you to migrate existing tests to use this new utility, in order to avoid breaking changes in the future.

New backend plugin extension points

The catalogModelExtensionPoint from @backstage/plugin-catalog-node/alpha can now be used to replace the default entity data parser and field validation rules in the new backend system.

The techdocsGeneratorExtensionPoint from @backstage/plugin-techdocs-node can now be used to set a custom TechDocs generator.

I18n for core components

The majority of components from @backstage/core-components now support internationalization. Message customizations are available through the coreComponentsTranslationRef export from @backstage/core-components/alpha. See the internationalization documentation for details on how to customize these messages in your application.

Contributed by @mario-mui in #20932

Security Fixes

This release does not contain any security fixes.

Upgrade path

We recommend that you keep your Backstage project up to date with this latest release. For more guidance on how to upgrade, check out the documentation for keeping Backstage updated.

Links and References

Below you can find a list of links and references to help you learn about and start using this new release.

• Backstage official website, documentation, and getting started guide
• GitHub repository
• Backstage's versioning and support policy
• Community Discord for discussions and support
• Changelog
• Backstage Demos, Blog, Roadmap and Plugins

Sign up for our newsletter if you want to be informed about what is happening in the world of Backstage.

v1.24.0-next.2

See docs/releases/v1.24.0-next.2-changelog.md for more information.

v1.24.0-next.1

See docs/releases/v1.24.0-next.1-changelog.md for more information.

v1.23.4

This release fixes an issue where configuration schema for the purpose of redacting secrets from logs was not being read correctly.

v1.24.0-next.0

See docs/releases/v1.24.0-next.0-changelog.md for more information.

v1.23.3

This release fixes an issue where some of the templating operations were broken on some systems.

v1.22.3

This is a security patch release for the @backstage/backend-common package.

v1.20.4

This is a security patch release for the @backstage/backend-common package.

v1.23.2

This is a security patch release for the @backstage/backend-common package.