Merge branch 'master' of https://github.com/backstage/backstage into fix/scaffolder-after-zero-query-param

2026-04-09 10:50:16 +05:30
parent 8a42f77daa 48b3883497
commit 4ec08648d7
842 changed files with 21947 additions and 6976 deletions
@@ -0,0 +1,7 @@
+---
+'@backstage/ui': patch
+---
+
+Added new `Badge` component for non-interactive labeling and categorization of content. It shares the visual appearance of `Tag` but renders as a plain DOM element with no interactive states.
+
+**Affected components:** Badge
@@ -0,0 +1,5 @@
+---
+'@backstage/errors': minor
+---
+
+A new `toError` utility function is now available for converting unknown values to `ErrorLike` objects. If the value is already error-like it is returned as-is, strings are used directly as the error message, and all other values are wrapped as `unknown error '<stringified>'`. Non-error causes passed to `CustomErrorBase` are now converted and stored using `toError` rather than discarded.
@@ -0,0 +1,5 @@
+---
+'@backstage/cli-module-new': patch
+---
+
+Rename the legacy `frontend-plugin` to `frontend-plugin-legacy`
@@ -0,0 +1,5 @@
+---
+'@backstage/backend-defaults': patch
+---
+
+Refactored auditor severity log level mappings to use `zod/v4` with schema-driven defaults and type inference.
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-node': patch
+---
+
+Added `OAuthAuthenticatorLogoutResult` type. The `logout` method on `OAuthAuthenticator` can now optionally return `{ logoutUrl }` to trigger a browser redirect after sign-out. This allows providers like Auth0 to clear their session cookies by redirecting to their logout endpoint.
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend-module-auth0-provider': patch
+---
+
+Added `createAuth0Authenticator` factory function that accepts a `CacheService` to cache Auth0 profile API responses for 1 minute during token refreshes. This avoids hitting Auth0 rate limits on repeated page refreshes. The module now uses the cached variant by default. The existing `auth0Authenticator` export remains available for use without caching.
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend-module-auth0-provider': minor
+---
+
+Added federated logout support. Set `federatedLogout: true` in the Auth0 provider config to clear both the Auth0 session and any upstream IdP session on sign-out. The authenticator returns a logout URL that redirects the browser to Auth0's `/v2/logout?federated` endpoint, ensuring users must fully re-authenticate after signing out.
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-catalog-backend-module-azure': patch
+---
+
+Add Azure DevOps SCM event translation layer for instant catalog reprocessing.
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-catalog-backend-module-bitbucket-cloud': patch
+---
+
+Added Bitbucket Cloud SCM event translation layer for the catalog backend module. The module now subscribes to Bitbucket Cloud webhook events and translates them into generic catalog SCM events, enabling instant catalog reprocessing when repositories are pushed to, renamed, transferred, or deleted. The `analyzeBitbucketCloudWebhookEvent` function is exported from the alpha entry point for custom integrations.
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-mcp-actions-backend': patch
+---
+
+Fix OAuth 2.0 Protected Resource Metadata endpoint returning internal plugin URL, preventing some MCP clients like Claude Code from authenticating
@@ -0,0 +1,7 @@
+---
+'@backstage/theme': patch
+---
+
+Fixes occasional duplication of v5 class name prefix for MUI 5 components.
+
+Documentation added to explain how to resolve missing v5 prefix in class names when using MUI 5 components in main app.
@@ -0,0 +1,11 @@
+---
+'@backstage/plugin-catalog-backend': patch
+'@backstage/cli-module-auth': patch
+'@backstage/cli-module-build': patch
+'@backstage/cli-module-test-jest': patch
+'@backstage/cli': patch
+'@backstage/ui': patch
+'@backstage/repo-tools': patch
+---
+
+Bumped `glob` dependency from v7/v8/v11 to v13 to address security vulnerabilities in older versions. Bumped `rollup` from v4.27 to v4.59+ to fix a high severity path traversal vulnerability (GHSA-mw96-cpmx-2vgc).
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-catalog-backend': minor
+---
+
+Added a `location_entity_ref` column to the `locations` database table that stores the full entity ref of the corresponding `kind: Location` catalog entity for each registered location row. The value is pre-computed and persisted so that it no longer needs to be recomputed from the location's type and target on every read.
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-catalog-backend': patch
+---
+
+Removed deprecated `PermissionAuthorizer` support and the `createPermissionIntegrationRouter` fallback path from `CatalogBuilder`. The `permissionsRegistry` service is now required, and `permissions` is always a `PermissionsService`.
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-catalog-backend': patch
+---
+
+Removed the internal `addPermissions` and `addPermissionRules` methods from `CatalogBuilder`, and removed the `catalogPermissionExtensionPoint` wiring from `CatalogPlugin`. Custom permission rules and permissions should be registered via `coreServices.permissionsRegistry` directly.
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-catalog': patch
+---
+
+Exported the NFS variant of the catalog index page as `CatalogIndexPage` from the `./alpha` entry point, along with supporting types `CatalogIndexPageProps`, `CatalogTableRow`, and `CatalogTableColumnsFunc`. This allows adopters to use and customize the catalog index page within a `PageBlueprint` in the new frontend system.
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-catalog-node': minor
+---
+
+**BREAKING ALPHA**: Removed the deprecated `CatalogPermissionRuleInput`, `CatalogPermissionExtensionPoint`, and `catalogPermissionExtensionPoint` exports. Use `coreServices.permissionsRegistry` directly to register catalog entity permission rules and permissions.
@@ -0,0 +1,7 @@
+---
+'@backstage/ui': patch
+---
+
+Added automatic active tab detection to the Header component. When `activeTabId` is omitted, the active tab is now auto-detected from the current route using `matchRoutes`. Pass an explicit `activeTabId` to override, or `null` for no active tab.
+
+**Affected components:** Header
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-events-backend-module-google-pubsub': patch
+---
+
+Migrated internal metrics in `GooglePubSubConsumingEventPublisher` and `EventConsumingGooglePubSubPublisher` to use the new alpha `MetricsService`
@@ -0,0 +1,6 @@
+---
+'@backstage/core-app-api': patch
+'@backstage/plugin-app': patch
+---
+
+The default auth implementation now checks for a `logoutUrl` in the logout response body. If the auth provider returns one (e.g. Auth0 federated logout), the browser is redirected to that URL to clear the provider's session cookies. This is backward compatible — providers that return an empty response are unaffected.
@@ -0,0 +1,5 @@
+---
+'@backstage/create-app': patch
+---
+
+Bumped create-app version.
@@ -0,0 +1,5 @@
+---
+'@backstage/create-app': patch
+---
+
+Bumped create-app version.
@@ -0,0 +1,30 @@
+---
+'@backstage/backend-app-api': patch
+'@backstage/backend-defaults': patch
+'@backstage/cli': patch
+'@backstage/cli-common': patch
+'@backstage/cli-module-migrate': patch
+'@backstage/cli-module-new': patch
+'@backstage/cli-node': patch
+'@backstage/config-loader': patch
+'@backstage/core-components': patch
+'@backstage/repo-tools': patch
+'@backstage/plugin-auth': patch
+'@backstage/plugin-auth-backend': patch
+'@backstage/plugin-catalog': patch
+'@backstage/plugin-catalog-backend': patch
+'@backstage/plugin-catalog-backend-module-incremental-ingestion': patch
+'@backstage/plugin-catalog-import': patch
+'@backstage/plugin-catalog-react': patch
+'@backstage/plugin-catalog-unprocessed-entities': patch
+'@backstage/plugin-devtools-backend': patch
+'@backstage/plugin-mcp-actions-backend': patch
+'@backstage/plugin-notifications-backend-module-slack': patch
+'@backstage/plugin-scaffolder-backend': patch
+'@backstage/plugin-scaffolder-backend-module-github': patch
+'@backstage/plugin-search-backend-node': patch
+'@backstage/plugin-techdocs-backend': patch
+'@backstage/plugin-techdocs-node': patch
+---
+
+Migrated from `assertError` to `toError` for error handling.
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-scaffolder-backend': patch
+---
+
+Migrated OpenTelemetry metrics to use the `MetricsService` from `@backstage/backend-plugin-api/alpha` instead of the raw `@opentelemetry/api` meter.
@@ -0,0 +1,5 @@
+---
+'@backstage/ui': patch
+---
+
+Exported the `TableBodySkeleton` component as a public API for use outside of the built-in `Table` component. The component now accepts any column array whose items have an `id` property, making it compatible with custom column types.
@@ -0,0 +1,5 @@
+---
+'@backstage/cli-module-build': patch
+---
+
+Fixed the embedded-postgres PID file being written before database initialization, which prevented the database from initializing successfully.
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-catalog-backend-module-gitlab': patch
+---
+
+Add GitLab SCM event translation layer for instant catalog reprocessing.
@@ -0,0 +1,11 @@
+---
+'@backstage/ui': minor
+---
+
+**BREAKING**: Tab `href` values in the Header component are now resolved through the router context instead of being passed raw to the `<a>` tag. This means relative `href` values (e.g. `sub3`, `./sub4`, `../catalog`) are now resolved against the current route, and absolute `href` values may be affected by the router's `basename` configuration.
+
+**Migration:**
+
+Tab navigation should work the same for absolute `href` values in most setups. If you use relative `href` values in tabs, verify they resolve as expected. If your app configures a router `basename`, check that absolute tab `href` values still navigate correctly.
+
+**Affected components:** Header
@@ -0,0 +1,5 @@
+---
+'@backstage/backend-defaults': patch
+---
+
+`HostDiscovery` now logs a warning when `backend.baseUrl` is set to a localhost address while `NODE_ENV` is `production`, and when `backend.baseUrl` is not a valid URL.
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-catalog': patch
+---
+
+Added Kind field to the About Card. Tags moved before Type and Lifecycle, Kind placed after them. A new `aboutCard.kindField.label` translation key was added.
@@ -0,0 +1,5 @@
+---
+'@backstage/backend-defaults': patch
+---
+
+DefaultActionsRegistryService: add json middleware to /.backstage/actions/ routes only
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-notifications': patch
+---
+
+Migrated notifications plugin to use backstage UI
@@ -0,0 +1,6 @@
+---
+'@backstage/plugin-search-backend-module-techdocs': patch
+'@backstage/plugin-techdocs-backend': patch
+---
+
+Migrated internal usage of the deprecated `catalogServiceRef` from `@backstage/plugin-catalog-node/alpha` to the stable `catalogServiceRef` from `@backstage/plugin-catalog-node`.
@@ -0,0 +1,5 @@
+---
+'@backstage/ui': patch
+---
+
+Add an initial CheckboxGroup component implementation and docs coverage.
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-catalog-graph': patch
+---
+
+Support configuring `showArrowHeads` on `page:catalog-graph` and `entity-card:catalog-graph/relations`.
@@ -0,0 +1,8 @@
+---
+'@backstage/plugin-scaffolder': patch
+---
+
+Fix the display of the description in `GitlabRepoPicker`:
+
+- Move `owner.description` helper text outside the `allowedOwners` conditional so it renders for both `Select` and `Autocomplete` modes.
+- Update the `Autocomplete` label to use `fields.gitlabRepoPicker.owner.inputTitle` instead of `fields.gitlabRepoPicker.owner.title`.
@@ -0,0 +1,5 @@
+---
+'@backstage/cli-module-build': patch
+---
+
+Suppressed false-positive Module Federation warning for shared dependencies that use secondary entry points (e.g. `@mui/material/styles`). These sub-path `package.json` files lack a `version` field, causing the bundler to emit "No version specified" warnings that fail CI builds.
@@ -225,36 +225,123 @@
    "@backstage/plugin-user-settings-common": "0.1.0"
  },
  "changesets": [
+    "add-actions-registry-examples",
+    "add-badge-component",
+    "add-to-error-utility",
+    "angry-clouds-tell",
+    "app-defaults-clarify-failures",
+    "app-routes-redirect-config",
+    "auditor-zod-v4-refactor",
+    "auth-node-logout-result",
+    "auth0-federated-logout",
+    "azure-scm-events-layer",
+    "bitbucket-cloud-scm-events-layer",
+    "brave-suits-pay",
+    "breezy-bushes-divide",
+    "bump-glob-rollup-security",
+    "catalog-backend-location-entity-ref",
+    "catalog-backend-permissions-cleanup-step-1",
+    "catalog-backend-permissions-cleanup-step-2",
    "catalog-entity-page-no-header",
+    "catalog-exists-query-optimization",
+    "catalog-graph-nfs-page",
+    "catalog-import-nfs-page",
+    "catalog-nfs-page-header",
+    "catalog-node-permissions-cleanup-step-2",
+    "catalog-search-table-sync",
    "chatty-cups-create",
+    "clarify-fetch-failures",
+    "cold-bikes-beam",
+    "cold-ways-double",
+    "common-plums-chew",
+    "cool-shoes-hide",
+    "core-app-api-logout-redirect",
+    "create-app-1774970958",
+    "create-app-1775575768",
+    "deep-ripe-rats",
    "dependabot-03b295a",
+    "dependabot-2a735a0",
    "dependabot-cc35625",
    "drop-react-17-packages-ui",
    "easy-pens-judge",
+    "evil-seals-smell",
+    "fix-avatar-flex-shrink",
+    "fix-aws-s3-url-reader-custom-endpoints",
+    "fix-bui-relative-href-resolution",
    "fix-catalog-filter-flicker",
    "fix-catalog-refresh-state-deadlock",
    "fix-catalog-table-loading-flash",
+    "fix-entity-info-card-header-overflow",
+    "fix-org-profile-card-overflow",
    "fix-sidebar-settings-nav",
+    "fix-translation-ref-ts6",
+    "fix-zod-generic-auth-node",
+    "fix-zod-generic-frontend-plugin-api",
+    "frontend-app-api-permission-error",
+    "funny-items-wink",
    "fuzzy-mangos-design",
+    "gitlab-scm-events-layer",
    "happy-masks-allow",
+    "header-nav-resolve-href",
+    "hide-compat-wrapper-headers",
+    "hip-parents-fall",
+    "host-discovery-baseurl-warnings",
    "hot-yaks-crash",
+    "kubernetes-nfs-metadata",
    "lazy-jars-shake",
    "loopback-redirect-uri-port",
+    "lucky-adults-talk",
    "lucky-things-write",
+    "major-actors-stand",
+    "major-banks-prove",
+    "migrate-techdocs-catalog-service-ref",
+    "nine-parrots-melt",
+    "nine-signs-end",
+    "notifications-nfs-metadata",
+    "olive-peaches-fly",
    "olive-ravens-smell",
+    "orange-friends-march",
+    "org-nfs-metadata",
+    "parallelize-cli-reports",
    "plugin-header-remove-toolbar-wrapper",
+    "quiet-streets-laugh",
    "remove-cli-module-new-dep",
+    "remove-deprecated-catalog-node-alpha-exports",
+    "remove-empty-examples-scaffolder-bridge",
+    "remove-jest-when-dep",
+    "remove-legacy-proxy-techdocs-cli",
    "remove-plugin-header-action-define-params",
    "remove-type-fest-github",
+    "renovate-9d44e41",
    "renovate-ced70c0",
+    "replace-humanize-entity-ref-catalog-react",
+    "replace-humanize-entity-ref-plugins",
    "repo-tools-peer-deps-react18",
+    "scaffolder-backend-permissions-registry",
    "scaffolder-nfs-page-layout",
+    "scaffolder-node-permission-refs",
+    "show-pagination-label",
    "shy-doors-repair",
+    "signals-nfs-metadata",
+    "simplify-compat-route-ref",
+    "simplify-route-ref-types",
+    "six-suits-write",
+    "smart-cycles-fall",
+    "soft-beers-bathe",
+    "solid-pianos-act",
    "specialized-app-apis",
    "swift-lizards-bathe",
+    "thin-elephants-joke",
+    "true-groups-slide",
+    "ts6-cli-dom-asynciterable",
+    "ts6-eslint-plugin",
+    "ts6-plugin-scaffolder",
+    "two-zoos-teach",
    "ui-menu-item-style-refactor",
    "ui-react-aria-deps",
    "unprocessed-entities-devtools",
-    "update-app-visualizer-header-action"
+    "update-app-visualizer-header-action",
+    "wicked-impalas-fry",
+    "witty-tools-cough"
  ]
 }
@@ -0,0 +1,10 @@
+---
+'@backstage/plugin-catalog-node': minor
+---
+
+**BREAKING ALPHA**: Removed the following deprecated exports from `@backstage/plugin-catalog-node/alpha`:
+
+- `catalogServiceRef` — use `catalogServiceRef` from `@backstage/plugin-catalog-node` instead
+- `CatalogLocationsExtensionPoint` / `catalogLocationsExtensionPoint` — use the non-alpha equivalents from `@backstage/plugin-catalog-node` instead
+- `CatalogProcessingExtensionPoint` / `catalogProcessingExtensionPoint` — use the non-alpha equivalents from `@backstage/plugin-catalog-node` instead
+- `CatalogAnalysisExtensionPoint` / `catalogAnalysisExtensionPoint` — use the non-alpha equivalents from `@backstage/plugin-catalog-node` instead
@@ -0,0 +1,5 @@
+---
+'@techdocs/cli': patch
+---
+
+Updated proxy documentation to recommend Node.js built-in proxy support via `NODE_USE_ENV_PROXY` instead of `global-agent`.
@@ -0,0 +1,5 @@
+---
+'@backstage/ui': patch
+---
+
+Updated dependency `@types/use-sync-external-store` to `^1.0.0`.
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-catalog-react': patch
+---
+
+Deprecated `humanizeEntityRef` and `humanizeEntity` in favor of the Catalog Presentation API. Use `useEntityPresentation`, `EntityDisplayName`, or `entityPresentationApiRef` instead.
@@ -0,0 +1,9 @@
+---
+'@backstage/plugin-catalog': patch
+'@backstage/plugin-catalog-import': patch
+'@backstage/plugin-org-react': patch
+'@backstage/plugin-scaffolder': patch
+'@backstage/plugin-techdocs': patch
+---
+
+Replaced deprecated `humanizeEntityRef` usage with the Catalog Presentation API.
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-scaffolder-backend': minor
+---
+
+Migrated permission registration to use the `PermissionsRegistryService` instead of the deprecated `createPermissionIntegrationRouter`. This fixes an issue where scaffolder permissions were not visible to RBAC plugins because the `actionsRegistryServiceRef` dependency caused an empty permissions metadata router to shadow the scaffolder's actual permission metadata. The old `createPermissionIntegrationRouter` path is retained as a fallback for standalone `createRouter` usage.
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-scaffolder-node': patch
+---
+
+Added `PermissionResourceRef` definitions for scaffolder resource types: `scaffolderTemplatePermissionResourceRef`, `scaffolderActionPermissionResourceRef`, and `scaffolderTaskPermissionResourceRef`. These are exported from `@backstage/plugin-scaffolder-node/alpha`.
@@ -0,0 +1,5 @@
+---
+'@backstage/integration': patch
+---
+
+Fixed `SingleInstanceGithubCredentialsProvider` to return app credentials when `getCredentials` is called with a bare host URL (e.g. `https://github.com`) instead of falling back to a personal access token.
@@ -0,0 +1,5 @@
+---
+'@backstage/cli-module-build': patch
+---
+
+When building dist-workspaces with --always-pack, batch `yarn pack` operations to avoid packing packages and their dependencies simultaneously.
@@ -0,0 +1,5 @@
+---
+'@backstage/core-components': patch
+---
+
+Use Backstage Link component for markdown anchor rendering to ensure consistent internal and external link behavior.
@@ -0,0 +1,6 @@
+---
+'@backstage/cli-module-build': patch
+'@backstage/backend-defaults': patch
+---
+
+Added experimental support for using `embedded-postgres` as the database for local development. Set `backend.database.client` to `embedded-postgres` in your app config to enable this. The `embedded-postgres` package must be installed as an explicit dependency in your project.
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-catalog-backend-module-github': patch
+---
+
+Added automatic retry on temporary errors (like 5XX) to the shared GitHub GraphQL client used by `GithubOrgEntityProvider` and replaced the GraphQL client in `GithubEntityProvider` by this one as well, improving resilience against intermittent GitHub API failures.
@@ -0,0 +1,7 @@
+---
+'@backstage/ui': patch
+---
+
+Fixed the Tabs active indicator not hiding when no tab matches the current route.
+
+**Affected components:** Tabs
@@ -0,0 +1,7 @@
+---
+'@backstage/ui': patch
+---
+
+Fixed HeaderNav hover indicator covering tab text when theme uses opaque background colors. Also fixed an incorrect CSS variable reference (`--bui-font-family` → `--bui-font-regular`).
+
+**Affected components:** Header
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-catalog-react': patch
+---
+
+Migrated `InspectEntityDialog` from Material UI to Backstage UI components. Added new translation keys: `inspectEntityDialog.overviewPage.copyAriaLabel`, `inspectEntityDialog.overviewPage.copiedStatus`, `inspectEntityDialog.overviewPage.helpLinkAriaLabel`, and `inspectEntityDialog.colocatedPage.entityListAriaLabel`.