fix(deps): update backstage core - #1143
Open
secustors-renovate[bot] wants to merge 1 commit into
Open
Conversation
secustors-renovate
Bot
force-pushed
the
renovate/backstage-core
branch
from
July 30, 2026 20:35
9ab9938 to
4487b88
Compare
secustors-renovate
Bot
force-pushed
the
renovate/backstage-core
branch
7 times, most recently
from
August 23, 2026 13:47
9f8c47b to
25f3d05
Compare
secustors-renovate
Bot
force-pushed
the
renovate/backstage-core
branch
from
August 24, 2026 19:01
25f3d05 to
68ef6e1
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
0.17.5→0.17.70.36.4→0.36.50.36.4→0.36.50.1.4→0.1.50.5.13→0.5.140.18.12→0.18.131.12.8→1.12.90.5.4→0.5.5^0.17.3→^0.18.00.6.2→0.6.31.2.20→1.2.210.5.16→0.5.170.2.5→0.2.60.2.6→0.2.7^0.29.2→^0.30.00.5.5→0.5.60.2.21→0.2.220.7.3→0.7.42.0.7→2.0.83.8.1→3.9.00.1.24→0.1.250.2.22→0.2.230.21.6→0.21.90.5.19→0.5.200.6.7→0.6.80.7.6→0.7.70.7.14→0.7.150.2.21→0.2.220.9.9→0.9.100.11.2→0.11.31.38.1→1.38.21.7.6→1.7.72.1.4→2.1.60.3.17→0.3.180.5.57→0.5.581.4.6→1.4.7^0.0.33→^0.0.340.3.17→0.3.180.9.5→0.9.6^0.18.0→^0.19.00.17.0→0.17.11.53.0→1.54.4Release Notes
backstage/backstage (@backstage/backend-defaults)
v0.17.7Compare Source
Patch Changes
79c1d58: Fixed a bug in the Azure DevOps URL reader where the abort signal was not forwarded to the commits API fetch, causing the fetch to hang indefinitely when a build timeout or cancellation was triggered.b1b6c80: Read-only actions now default to non-destructive when the destructive attribute is omitted.78bf918: chore(deps): bumptarfrom 7.5.15 to 7.5.21bb98419: TypeScript configuration schema warnings discovered while setting up secret redaction are now reported through the Backstage logger.74d8cbf: Added a new public@backstage/backend-defaults/rootSystemMetadataentrypoint, exportingrootSystemMetadataServiceFactoryandDefaultRootSystemMetadataService. The system metadata service is now registered automatically as a default service, so backends no longer need to add it manually.e56d23c: Throw an error whenpayload.uipis missing increateLimitedUserTokeninstead of constructing an invalid limited token with an undefined signature.v0.17.6Compare Source
Patch Changes
backstage/backstage (@backstage/cli)
v0.36.5Compare Source
Patch Changes
backstage/backstage (@backstage/cli-defaults)
v0.1.5Compare Source
Patch Changes
backstage/backstage (@backstage/core-compat-api)
v0.5.14Compare Source
Patch Changes
backstage/backstage (@backstage/core-components)
v0.18.13Compare Source
Patch Changes
226817d: chore(deps): bumpjs-yamlfrom 4.2.0 to 4.3.0a4759e6: Migrated tests from MSW v1 to MSW v2.96cd953: Fixed theDependencyGraphcomponent to avoid a jarring initial render where nodes briefly pile up at overlapping positions before animating into place. The graph content is now hidden until node measurements are complete and the layout has fully settled, then revealed at the correct positions with transitions suppressed for the first frame.Also fixed a
containerRefrecreation chain where every graph dimension change caused the container measurement callback to be recreated and re-triggered, producing unnecessary re-renders during initial layout.Updated dependencies
backstage/backstage (@backstage/core-plugin-api)
v1.12.9Compare Source
Patch Changes
9fcfbc9: Fixed a performance issue where all components using analytics, including every link, would rerender unnecessarily whenever a surrounding analytics context rendered again without its attributes having changed, for example when a URL query parameter changed on an entity page.backstage/backstage (@backstage/frontend-defaults)
v0.5.5Compare Source
Patch Changes
backstage/backstage (@backstage/frontend-plugin-api)
v0.18.0Compare Source
Minor Changes
907793c: BREAKING: Removed the deprecatedconfig.schemaoption for extensions and extension blueprints. Use the top-levelconfigSchemaoption with Standard Schema-compatible schema values, such as Zod v4.Patch Changes
e156f1e: Added support for using aSubRouteRefas the parent of anotherSubRouteRef. Child paths are combined with ancestor paths at creation, and nested sub-routes inherit parameters from their complete ancestor chain.backstage/backstage (@backstage/frontend-test-utils)
v0.6.3Compare Source
Patch Changes
bd435c3: Identity mocks passed torenderInTestApp(for example viamockApis.identity(...)) are now applied before the app's built-in guest fallback, so the configureduserEntityRefreliably takes effect in tests instead of being silently overwritten by the default guest user.backstage/backstage (@backstage/integration-react)
v1.2.21Compare Source
Patch Changes
backstage/backstage (@backstage/plugin-app-backend)
v0.5.17Compare Source
Patch Changes
backstage/backstage (@backstage/plugin-app-react)
v0.2.6Compare Source
Patch Changes
a8b5ba6: Updated dependencies.backstage/backstage (@backstage/plugin-app-visualizer)
v0.2.7Compare Source
Patch Changes
backstage/backstage (@backstage/plugin-auth-backend)
v0.30.0Compare Source
Minor Changes
274acc5: BREAKING: The OAuth redirect URI and client ID metadata document allowlists now match patterns against each URL component separately instead of against the full URL string. Wildcards no longer match across the host and path boundary, patterns must include an explicit protocol and are otherwise rejected as invalid configuration instead of being silently ignored, and redirect URIs that contain embedded credentials are always rejected.A wildcard port also no longer implicitly matches every path: a pattern such as
http://localhost:*now only matches the root path. Usehttp://localhost:*/*to allow any port and any path. The built-in loopback defaults have been updated accordingly, so this only affects explicitly configured patterns.Patch Changes
4e884d2: Skip SSRF protection for CIMD metadata fetches when theclient_idmatches an exact (non-wildcard) entry inallowedClientIdPatterns. Exact patterns mean the administrator explicitly listed a specific URL, so the DNS resolution is trusted. Wildcard patterns still enforce the SSRF check to protect against attacker-controlled subdomains resolving to internal addresses.a995892: Allow ChatGPT Codex clients to use Client ID Metadata Documents by default.827989d: Fixed the built-in CLI client being rejected whenallowedClientIdPatternsis configured for Client ID Metadata Documents.backstage/backstage (@backstage/plugin-auth-backend-module-github-provider)
v0.5.6Compare Source
Patch Changes
backstage/backstage (@backstage/plugin-auth-backend-module-guest-provider)
v0.2.22Compare Source
Patch Changes
backstage/backstage (@backstage/plugin-auth-node)
v0.7.4Compare Source
Patch Changes
7ca2955: Fix OAuth start handler crashing with a 500 error on malformed origins, now returns a 400 error.backstage/backstage (@backstage/plugin-catalog)
v2.0.8Compare Source
Patch Changes
80b37b3: Fixed theAboutFieldlabel in the About card usingvariant="inherit"instead ofvariant="h2"to prevent theme typography overrides from changing the intended 10px label size.05aed2e: Fixed a brief "Entity not found" flash when navigating between catalog entity pages.1d026b0: Added explicit type annotations toFilterContainerandEntityListContainerre-exports for forward-compatibility with TypeScript 7.backstage/backstage (@backstage/plugin-catalog-backend)
v3.9.0Compare Source
Minor Changes
c7c0ec3: Added arefresh-catalog-entityaction so agents and MCP clients can re-queue a single entity for processing after creating or updating it — useful for reading back fresh data immediately after a scaffolder run without waiting for the next scheduled processing loop.Patch Changes
aa318d0: Migrated internal query filter handling fromEntityFiltertoFilterPredicate, simplifying the filter parsing and query application pipeline.10f0713: Replaced the delete-all and reinsert pattern for therelationstable with a diff-based sync that only touches rows that actually changed. In steady state (the common case), zero writes occur, eliminating write churn, dead tuples, and WAL traffic from the processing path. Stitching is now also skipped for relation neighbors that did not change.ee40136: Fixed a missing promise return in a database migration rollback function.eb6dff2: Fixed an issue where PostgreSQL deadlock errors during entity provider mutations were silently swallowed, causing entities to be dropped until the next full refresh. Transactions are now automatically retried on deadlock with exponential back-off.dd562f0: Fixed a potential MySQL deadlock during concurrent entity processing by retrying theupdateProcessedEntitytransaction on deadlock errors.b031a48: Fixed an issue where SCMlocation.movedevents would generate new locations in the database for files that were not actively tracked.b7650ad: Simplified internal router setup by removing unnecessary conditional guards around route registrations.backstage/backstage (@backstage/plugin-catalog-backend-module-logs)
v0.1.25Compare Source
Patch Changes
backstage/backstage (@backstage/plugin-catalog-backend-module-scaffolder-entity-model)
v0.2.23Compare Source
Patch Changes
backstage/backstage (@backstage/plugin-kubernetes-backend)
v0.21.9Compare Source
v0.21.8Compare Source
v0.21.7Compare Source
Patch Changes
684c9b9: FixedAwsIamStrategyto resolve account-specific AWS credentials when an assume role ARN is configured, enabling support forwebIdentityTokenFileandaccountDefaultsin environments without default AWS credentials.c6af8ac: Added audit logging for kubernetes-backend routes. The plugin now emits auditor events for cluster list, cluster proxy, entity workload queries, custom resource queries, and the deprecated services endpoint. Administrators can filter audit logs byeventIdvaluescluster-fetchandresource-fetch, and byqueryTypein event metadata.KubernetesProxyOptionsaccepts an optionalauditorfor adopters that construct the proxy directly. When omitted, proxy requests are handled as before without audit events.bac00a5: The Kubernetes API proxy now refreshes cached middleware when cluster details change, after a configurable TTL, or when the cache reaches its size limit. At startup, the backend logs a warning for each cluster configured withskipTLSVerify: true. Invalid cache configuration values fall back to defaults. Optional configuration is available underkubernetes.proxy.middlewareCache.f0834bd: Added akubernetes.clusterLocatorContinueOnErrorconfiguration option. When set totrue, a failing cluster locator no longer causes the entire cluster list request to fail — errors are logged and clusters from the remaining successful locators are still returned. The default isfalse, preserving the existing behavior.Updated dependencies
backstage/backstage (@backstage/plugin-notifications)
v0.5.20Compare Source
Patch Changes
backstage/backstage (@backstage/plugin-notifications-backend)
v0.6.8Compare Source
Patch Changes
3222945: Fixed notification recipient resolution to safely handle cyclic group relationships during group traversal, preventing endless recursion.backstage/backstage (@backstage/plugin-org)
v0.7.7Compare Source
Patch Changes
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate CLI.