Merge branch 'master' into broadcast-notifications-to-specified-slack-channels

Signed-off-by: Henrik Edegård <158468178+henrikedegrd@users.noreply.github.com>

.changeset/afraid-items-drum.md

@@ -0,0 +1,5 @@
+---
+'@backstage/cli-node': patch
+---
+
+Updated to use new utilities from `@backstage/cli-common`.

.changeset/alert-api-replay.md

@@ -0,0 +1,5 @@
+---
+'@backstage/core-app-api': patch
+---
+
+Added replay functionality to `AlertApiForwarder` to buffer and replay recent alerts to new subscribers, preventing missed alerts that were posted before subscription.

.changeset/all-socks-taste.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-scaffolder-backend-module-gitlab': minor
+---
+
+In the `gitlabRepoPush` action, add 'auto' possibility for `commitAction` input.

.changeset/angry-views-win.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-events-backend-module-kafka': minor
+---
+
+Added support for multiple named instances in `kafkaConsumingEventPublisher` configuration. The previous single configuration format is still supported for backward compatibility.

.changeset/blue-signs-fry.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-mcp-actions-backend': patch
+---
+
+Added `@cfworker/json-schema` as a dependency to this package part of the `@modelcontextprotocol/sdk` bump as it's required in the types

.changeset/bright-lions-unite.md

@@ -0,0 +1,5 @@
+---
+'@backstage/cli': minor
+---
+
+Provide `--no-node-snapshot` by default when running the `package start` or `package test`. You can disable this behavior by providing `NODE_OPTIONS='--node-snapshot'`.

.changeset/bumpy-pens-swim.md

@@ -0,0 +1,5 @@
+---
+'@backstage/integration': patch
+---
+
+Added support for using a GitHub App installation to generate tokens for public repository access when the `publicAccess` option is enabled. When all other authentication methods fail (e.g., the app is not installed in that organization), the provider will now use an available installation to generate a token that can be used to access public repositories as read only.

.changeset/bumpy-planets-go.md

@@ -0,0 +1,7 @@
+---
+'@backstage/ui': patch
+---
+
+Fixed Checkbox indicator showing checkmark color when unchecked.
+
+Affected components: Checkbox

.changeset/chilly-bikes-rule.md

@@ -0,0 +1,5 @@
+---
+'@techdocs/cli': patch
+---
+
+Updated to use new utilities from `@backstage/cli-common`.

.changeset/chilly-waves-relate.md

@@ -0,0 +1,11 @@
+---
+'@backstage/cli': minor
+---
+
+Switched the default module resolution to `bundler` and the `module` setting to `ES2020`.
+
+You may need to bump some dependencies as part of this change and fix imports in code. The most common source of this is that type checking will now consider the `exports` field in `package.json` when resolving imports. This in turn can break older versions of packages that had incompatible `exports` fields. Generally these issues will have already been fixed in the upstream packages.
+
+You might be tempted to use `--skipLibCheck` to hide issues due to this change, but it will weaken the type safety of your project. If you run into a large number of issues and want to keep the old behavior, you can reset the `moduleResolution` and `module` settings your own `tsconfig.json` file to `node` and `ESNext` respectively. But keep in mind that the `node` option will be removed in future versions of TypeScript.
+
+A future version of Backstage will make these new settings mandatory, as we move to rely on the `exports` field for type resolution in packages, rather than the `typesVersions` field.

.changeset/common-coins-stare.md

@@ -0,0 +1,7 @@
+---
+'@backstage/ui': patch
+---
+
+Fixed `ButtonIcon` incorrectly applying `className` to inner elements instead of only the root element.
+
+Affected components: ButtonIcon

.changeset/crazy-hornets-spend.md

@@ -0,0 +1,11 @@
+---
+'@backstage/plugin-catalog-graph': patch
+'@backstage/plugin-api-docs': patch
+'@backstage/plugin-techdocs': patch
+'@backstage/plugin-catalog': patch
+'@backstage/plugin-search': patch
+'@backstage/plugin-app': patch
+'@backstage/plugin-org': patch
+---
+
+Minor extension type updates after frontend API bump

.changeset/create-app-1764689798.md

@@ -0,0 +1,5 @@
+---
+'@backstage/create-app': patch
+---
+
+Bumped create-app version.

.changeset/curvy-things-call.md

@@ -0,0 +1,21 @@
+---
+'@backstage/plugin-notifications-backend-module-email': patch
+---
+
+SES config for the notification email processor now supports utilizing an ARN for the SES identity when sending an email after the SES SDK V2 update.
+
+The `sesConfig.fromArn` will set the `fromEmailAddressIdentityArn` option for the SES `SendEmailCommand`. The `sesConfig.sourceArn` field is removed since no equivalent option is available in the send email command options. Setting `sesConfig.sourceArn` will have no effect and log a warning. Example changes:
+
+```diff
+notifications:
+  processors:
+    email:
+      transportConfig:
+        transport: "ses"
+        region: "us-west-2"
+      sender: "sender@mycompany.com"
+      replyTo: "no-reply@mycompany.com"
+      sesConfig:
+-       sourceArn: "arn:aws:ses:us-west-2:123456789012:identity/example.com"
+        fromArn: "arn:aws:ses:us-west-2:123456789012:identity/example.com"
+```

.changeset/dependabot-0d8f6de.md

@@ -0,0 +1,47 @@
+---
+'@backstage/backend-defaults': patch
+'@backstage/backend-dynamic-feature-service': patch
+'@backstage/backend-openapi-utils': patch
+'@backstage/backend-test-utils': patch
+'@backstage/cli': patch
+'@backstage/plugin-app-backend': patch
+'@backstage/plugin-app-node': patch
+'@backstage/plugin-auth-backend-module-atlassian-provider': patch
+'@backstage/plugin-auth-backend-module-auth0-provider': patch
+'@backstage/plugin-auth-backend-module-aws-alb-provider': patch
+'@backstage/plugin-auth-backend-module-azure-easyauth-provider': patch
+'@backstage/plugin-auth-backend-module-bitbucket-provider': patch
+'@backstage/plugin-auth-backend-module-cloudflare-access-provider': patch
+'@backstage/plugin-auth-backend-module-gcp-iap-provider': patch
+'@backstage/plugin-auth-backend-module-gitlab-provider': patch
+'@backstage/plugin-auth-backend-module-guest-provider': patch
+'@backstage/plugin-auth-backend-module-microsoft-provider': patch
+'@backstage/plugin-auth-backend-module-oidc-provider': patch
+'@backstage/plugin-auth-backend-module-okta-provider': patch
+'@backstage/plugin-auth-backend-module-onelogin-provider': patch
+'@backstage/plugin-auth-backend-module-openshift-provider': patch
+'@backstage/plugin-auth-backend-module-pinniped-provider': patch
+'@backstage/plugin-auth-backend': patch
+'@backstage/plugin-auth-node': patch
+'@backstage/plugin-catalog-backend-module-incremental-ingestion': patch
+'@backstage/plugin-catalog-backend': patch
+'@backstage/plugin-devtools-backend': patch
+'@backstage/plugin-events-backend': patch
+'@backstage/plugin-events-node': patch
+'@backstage/plugin-gateway-backend': patch
+'@backstage/plugin-kubernetes-backend': patch
+'@backstage/plugin-mcp-actions-backend': patch
+'@backstage/plugin-notifications-backend': patch
+'@backstage/plugin-permission-backend': patch
+'@backstage/plugin-permission-node': patch
+'@backstage/plugin-proxy-backend': patch
+'@backstage/plugin-scaffolder-backend': patch
+'@backstage/plugin-search-backend': patch
+'@backstage/plugin-signals-backend': patch
+'@backstage/plugin-signals-node': patch
+'@backstage/plugin-techdocs-backend': patch
+'@backstage/plugin-techdocs-node': patch
+'@backstage/plugin-user-settings-backend': patch
+---
+
+chore(deps): bump `express` from 4.21.2 to 4.22.0

.changeset/dependabot-5e654fe.md

@@ -0,0 +1,5 @@
+---
+'@backstage/backend-defaults': patch
+---
+
+build(deps): bump `node-forge` from 1.3.1 to 1.3.2

.changeset/early-carpets-rush.md

@@ -0,0 +1,16 @@
+---
+'@backstage/cli': patch
+---
+
+Add missing peer/dev dependencies to the frontend plugin template.
+
+`react-dom` was not declared as a peer dependency, causing module resolution
+errors when generating plugins outside a Backstage monorepo. This adds
+`react-dom` to `peerDependencies` (for consuming apps) and `devDependencies`
+(for local development). `react-router-dom` is also added to `peerDependencies` (for consuming apps) and `devDependencies`
+to support routing during plugin development.
+
+Fixes:
+
+- Module not found: Can't resolve 'react-dom'
+- Module not found: Can't resolve 'react-router-dom'

.changeset/early-doors-visit.md

@@ -0,0 +1,5 @@
+---
+'@backstage/backend-defaults': patch
+---
+
+Allow configuration of the `referrerPolicy`

.changeset/error-boundary-api.md

@@ -0,0 +1,7 @@
+---
+'@backstage/frontend-plugin-api': patch
+---
+
+Added a new `errorPresentation` prop to `ExtensionBoundary` to control how errors are presented to the user. The default is `'error-display'`, which is the current behavior of showing the error in the `ErrorDisplay` component. The new option is `'error-api'`, posts errors to the `ErrorApi` and does not allow retries.
+
+The `AppRootElementBlueprint` now wraps its element in an `ErrorBoundary` using the new `'error-api'` presentation mode.

.changeset/fifty-coats-feel.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-kubernetes-react': patch
+---
+
+Enabled a pod terminal at GKE

.changeset/fifty-lights-marry.md

@@ -0,0 +1,9 @@
+---
+'@backstage/plugin-catalog-backend-module-incremental-ingestion': patch
+'@backstage/plugin-kubernetes-backend': patch
+'@backstage/backend-defaults': patch
+'@backstage/plugin-scaffolder-react': patch
+'@backstage/integration': patch
+---
+
+Updated luxon types

.changeset/floppy-bobcats-serve.md

@@ -0,0 +1,12 @@
+---
+'@backstage/core-components': patch
+---
+
+Fixed bug in the `LogViewer` component where shift + click always opened a new window instead of just changing the selection.
+
+In addition, improved the `LogViewer` component by a few usability enhancements:
+
+- Added support for multiple selections using cmd/ctrl + click
+- Improved the generated hash that is added to the URL to also support ranges & multiple selections
+- Added an hover effect & info tooltip to the "Copy to clipboard" button to indicate its functionality
+- Added some color and a separator to the line numbers to improve readability

.changeset/fruity-words-melt.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-techdocs-module-addons-contrib': patch
+---
+
+Updated tests to match test-utils change

.changeset/full-needles-drive.md

@@ -0,0 +1,6 @@
+---
+'@backstage/plugin-kubernetes-backend': minor
+'@backstage/plugin-kubernetes-node': minor
+---
+
+Add possibility to extends Kubernetes REST API. Add fetcher to parameters for custom objects provider

.changeset/funny-hornets-peel.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-scaffolder-backend': patch
+---
+
+Updated `isolated-vm` to `6.0.1`

.changeset/funny-papayas-rest.md

@@ -0,0 +1,6 @@
+---
+'@backstage/repo-tools': patch
+'@backstage/codemods': patch
+---
+
+Updated to use new utilities from `@backstage/cli-common`.

.changeset/fuzzy-phones-own.md

@@ -0,0 +1,9 @@
+---
+'@backstage/plugin-catalog-backend-module-github-org': patch
+'@backstage/plugin-catalog-backend-module-github': patch
+---
+
+Introduce new configuration option to exclude suspended users from GitHub Enterprise instances.
+
+When it’s set to true, suspended users won’t be returned when querying the organization users for GitHub Enterprise instances.
+Note that this option should be used only against GitHub Enterprise instances, the property does not exist in the github.com GraphQL schema, setting it will cause a schema validation error and the syncing of users will fail.

.changeset/fuzzy-rivers-travel.md

@@ -0,0 +1,5 @@
+---
+'@backstage/frontend-plugin-api': patch
+---
+
+Made the return type of `.withOverrides` to be simplified.

.changeset/fuzzy-trees-live.md

@@ -0,0 +1,5 @@
+---
+'@backstage/core-components': patch
+---
+
+long words like urls now breaks to new line on warning panels instead of overflowing the container

.changeset/gentle-results-lie.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-techdocs': patch
+---
+
+Fixed schema type for additionalAllowedURIProtocols

.changeset/gentle-singers-love.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-app': patch
+---
+
+Support to set `defaultLanguage` and `availableLanguages` for the app language API in the new frontend system

.changeset/great-files-shave.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-catalog-react': patch
+---
+
+Fixed an issue where `EntityOwnerPicker` failed to filter options when the input text contained uppercase characters.

.changeset/green-lizards-boil.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-catalog-react': patch
+---
+
+Use a versioned context for `useEntityList`, to better work with mixed `@backstage/plugin-catalog-react` versions.

.changeset/happy-streets-dress.md

@@ -0,0 +1,5 @@
+---
+'@backstage/create-app': patch
+---
+
+Updated engines to support Node 22 or 24

.changeset/honest-bears-itch.md

@@ -0,0 +1,5 @@
+---
+'@backstage/backend-test-utils': patch
+---
+
+Switched `textextensions` dependency for `text-extensions`.

.changeset/large-planes-punch.md

@@ -0,0 +1,5 @@
+---
+'@backstage/backend-defaults': patch
+---
+
+Fix for `jose` types

.changeset/legal-otters-punch.md

@@ -0,0 +1,7 @@
+---
+'@backstage/plugin-kubernetes-backend': patch
+'@backstage/plugin-kubernetes-common': patch
+'@backstage/plugin-kubernetes-react': patch
+---
+
+Add Kubernetes Plugin Secrets Accordion with masked secret datas

.changeset/lemon-corners-hug.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-techdocs-node': patch
+---
+
+There was an issue in the uploading of large size files to the AWS S3. We have modified the logic by adding retry along with multipart uploading functionality.

.changeset/loud-yaks-watch.md

@@ -0,0 +1,5 @@
+---
+'@backstage/repo-tools': patch
+---
+
+Bump `@microsoft/api-documenter` and `@microsoft/api-extractor` to latest versions.

.changeset/modern-taxes-start.md

@@ -0,0 +1,5 @@
+---
+'@backstage/cli-common': patch
+---
+
+Added new `run`, `runOutput`, and `runCheck` utilities to help run child processes in a safe and portable way.

.changeset/neat-pens-clean.md

@@ -0,0 +1,5 @@
+---
+'@backstage/repo-tools': patch
+---
+
+Properly create workspace in OS temporary directory for `generate-patch` command

.changeset/nice-humans-cry.md

@@ -0,0 +1,6 @@
+---
+'@backstage/plugin-scaffolder-backend': patch
+'@backstage/backend-defaults': patch
+---
+
+Internal change to support new versions of the `logform` library

.changeset/old-cats-shake.md

@@ -0,0 +1,6 @@
+---
+'@backstage/backend-defaults': patch
+'@backstage/backend-plugin-api': minor
+---
+
+Adds a new experimental `RootSystemMetadataService` for tracking the collection of Backstage instances that may be deployed at any one time. It currently offers a single API, `getInstalledPlugins` that returns a list of installed plugins based on config you have set up in `discovery.endpoints` as well as the plugins installed on the instance you're calling the API with. It does not handle wildcard values or fallback values. The intention is for this plugin to provide plugin authors with a simple interface to fetch a trustworthy list of all installed plugins.

.changeset/old-parks-smell.md

@@ -0,0 +1,20 @@
+---
+'@backstage/plugin-techdocs-addons-test-utils': major
+---
+
+**BREAKING**: `TechDocsAddonTester.renderWithEffects()` no longer returns a screen; this means that you can no longer grab assertions such as `getByText` from its return value.
+
+Newer versions of `@testing-library` recommends using the `screen` export for assertions - and removing this from the addon tester contract allows us to more freely iterate on which underlying version of the testing library is being used.
+
+One notable effect of this, however, is that the `@testing-library` `screen` does NOT support assertions on the shadow DOM, which techdocs relies on. You will therefore want to add a dependency on [the `shadow-dom-testing-library` package](https://github.com/konnorrogers/shadow-dom-testing-library/) in your tests, and using its `screen` and its dedicated `*Shadow*` methods. As an example, if you keep doing `getByText` you will not get matches inside the shadow DOM - switch to `getByShadowText` instead.
+
+```ts
+import { screen } from 'shadow-dom-testing-library';
+
+// ... render the addon ...
+await TechDocsAddonTester.buildAddonsInTechDocs([<AnAddon />])
+  .withDom(<body>TEST_CONTENT</body>)
+  .renderWithEffects();
+
+expect(screen.getByShadowText('TEST_CONTENT')).toBeInTheDocument();
+```

.changeset/open-points-beam.md

@@ -0,0 +1,37 @@
+---
+'@backstage/ui': minor
+---
+
+**Breaking change** The `Cell` component has been refactored to be a generic wrapper component that accepts `children` for custom cell content. The text-specific functionality (previously part of `Cell`) has been moved to a new `CellText` component.
+
+### Migration Guide
+
+If you were using `Cell` with text-specific props (`title`, `description`, `leadingIcon`, `href`), you need to update your code to use `CellText` instead:
+
+**Before:**
+
+```tsx
+<Cell
+  title="My Title"
+  description="My description"
+  leadingIcon={<Icon />}
+  href="/path"
+/>
+```
+
+**After:**
+
+```tsx
+<CellText
+  title="My Title"
+  description="My description"
+  leadingIcon={<Icon />}
+  href="/path"
+/>
+```
+
+For custom cell content, use the new generic `Cell` component:
+
+```tsx
+<Cell>{/* Your custom content */}</Cell>
+```

.changeset/pre.json

@@ -1,5 +1,5 @@
 {
-  "mode": "pre",
+  "mode": "exit",
   "tag": "next",
   "initialVersions": {
     "example-app": "0.2.115",
@@ -207,28 +207,92 @@
     "@backstage/plugin-user-settings-common": "0.0.1"
   },
   "changesets": [
+    "afraid-items-drum",
+    "alert-api-replay",
+    "all-socks-taste",
+    "blue-signs-fry",
+    "bumpy-planets-go",
     "chatty-sides-wear",
+    "chilly-bikes-rule",
     "chilly-hotels-walk",
+    "chilly-waves-relate",
     "clean-toys-reply",
+    "common-coins-stare",
+    "crazy-hornets-spend",
+    "create-app-1764689798",
+    "dependabot-0d8f6de",
+    "dependabot-5e654fe",
+    "early-doors-visit",
+    "error-boundary-api",
     "famous-jars-lose",
+    "fifty-coats-feel",
+    "fifty-lights-marry",
     "fine-eagles-sleep",
     "flat-pillows-rush",
+    "floppy-bobcats-serve",
     "four-peaches-train",
     "fruity-rivers-arrive",
+    "fruity-words-melt",
+    "full-needles-drive",
+    "funny-hornets-peel",
+    "funny-papayas-rest",
+    "fuzzy-phones-own",
+    "fuzzy-rivers-travel",
+    "fuzzy-trees-live",
+    "gentle-singers-love",
     "gentle-trains-juggle",
+    "great-files-shave",
+    "green-lizards-boil",
     "happy-bottles-invite",
+    "happy-streets-dress",
+    "honest-bears-itch",
     "kind-hoops-double",
+    "large-planes-punch",
     "legal-cloths-spend",
+    "legal-otters-punch",
+    "lemon-corners-hug",
     "loose-pets-slide",
+    "loud-yaks-watch",
     "lucky-days-hug",
     "many-planes-join",
     "metal-boxes-laugh",
     "metal-humans-lose",
+    "modern-taxes-start",
+    "neat-pens-clean",
+    "nice-humans-cry",
+    "nice-trams-shake",
+    "old-cats-shake",
+    "old-parks-smell",
+    "open-points-beam",
     "quiet-hats-sleep",
+    "rare-rice-throw",
+    "ready-results-march",
+    "renovate-7b76d6d",
+    "renovate-959c095",
+    "renovate-97eef4b",
+    "renovate-9ec01ff",
+    "renovate-a3c2cbd",
+    "renovate-aa0bb93",
+    "renovate-ad7bf17",
+    "renovate-d7ceb06",
+    "renovate-ea25c93",
+    "rotten-melons-sleep",
+    "salty-camels-wash",
+    "seven-games-rest",
     "short-groups-knock",
     "slick-books-sleep",
+    "slick-onions-wash",
+    "slimy-islands-play",
+    "slimy-mugs-taste",
+    "sour-bats-press",
     "spicy-teeth-study",
     "stale-eagles-rush",
+    "stupid-cases-fold",
+    "tall-ideas-lead",
+    "tame-mirrors-sit",
+    "tender-dancers-hunt",
+    "tired-dogs-remain",
+    "tough-lies-grow",
     "twenty-ducks-relate"
   ]
 }

.changeset/pretty-breads-speak.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-notifications-backend-module-slack': patch
+---
+
+Slack notification handler throttling can now be configured with the `concurrencyLimit` and `throttleInterval` options.

.changeset/rare-rice-throw.md

@@ -0,0 +1,5 @@
+---
+'@backstage/core-components': patch
+---
+
+Add `tooltipClasses` prop to `OverflowTooltip` component to allow customisation of the tooltip

.changeset/ready-results-march.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-catalog': patch
+---
+
+Fixed `catalogAboutEntityCard` to filter icon links before calling useProps(), preventing side effects from hooks in filtered-out links

.changeset/renovate-7b76d6d.md

@@ -0,0 +1,6 @@
+---
+'@backstage/cli': patch
+'@backstage/plugin-scaffolder-backend': patch
+---
+
+Updated dependency `esbuild` to `^0.27.0`.

.changeset/renovate-959c095.md

@@ -0,0 +1,11 @@
+---
+'@backstage/plugin-home-react': patch
+'@backstage/plugin-home': patch
+'@backstage/plugin-scaffolder-react': patch
+'@backstage/plugin-scaffolder': patch
+---
+
+Updated dependency `@rjsf/utils` to `5.24.13`.
+Updated dependency `@rjsf/core` to `5.24.13`.
+Updated dependency `@rjsf/material-ui` to `5.24.13`.
+Updated dependency `@rjsf/validator-ajv8` to `5.24.13`.

.changeset/renovate-97eef4b.md

@@ -0,0 +1,5 @@
+---
+'@backstage/config-loader': patch
+---
+
+Updated dependency `typescript-json-schema` to `^0.67.0`.

.changeset/renovate-9ec01ff.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-search-backend-module-explore': patch
+---
+
+Updated dependency `@backstage-community/plugin-explore-common` to `^0.9.0`.

.changeset/renovate-a3c2cbd.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-scaffolder-react': patch
+---
+
+Updated dependency `use-immer` to `^0.11.0`.

.changeset/renovate-aa0bb93.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-notifications-backend-module-email': patch
+---
+
+Updated dependency `@types/nodemailer` to `^7.0.0`.

.changeset/renovate-ad7bf17.md

@@ -0,0 +1,5 @@
+---
+'@backstage/backend-defaults': patch
+---
+
+Updated dependency `@types/archiver` to `^7.0.0`.

.changeset/renovate-d7ceb06.md

@@ -0,0 +1,5 @@
+---
+'@backstage/cli': patch
+---
+
+Updated dependency `@pmmmwh/react-refresh-webpack-plugin` to `^0.6.0`.

.changeset/renovate-ea25c93.md

@@ -0,0 +1,5 @@
+---
+'@backstage/cli': patch
+---
+
+Updated dependency `webpack` to `~5.103.0`.

.changeset/rotten-carrots-relax.md

@@ -0,0 +1,8 @@
+---
+'@backstage/plugin-notifications': patch
+---
+
+Move long notification descriptions behind `Show more/less` button.
+
+This improves readability of the notifications list by preventing long descriptions from taking up too much space
+or rendering very small scrollable areas.

.changeset/rotten-melons-sleep.md

@@ -0,0 +1,15 @@
+---
+'@backstage/plugin-catalog-unprocessed-entities-common': patch
+'@backstage/plugin-catalog-unprocessed-entities': patch
+---
+
+Moved types, API and client to the common package, allowing both frontend and
+backend plugins to use the `CatalogUnprocessedEntitiesClient`.
+
+The following types, clients and interfaces have been deprecated and should be
+imported from the `@backstage/plugin-catalog-unprocessed-entities-common` instead:
+`CatalogUnprocessedEntitiesApi`, `CatalogUnprocessedEntitiesApiResponse`, `UnprocessedEntity`,
+`UnprocessedEntityCache`, `UnprocessedEntityError`, `CatalogUnprocessedEntitiesClient`.
+
+All those types, clients and interfaces are re-exported temporarily in the
+`@backstage/plugin-catalog-unprocessed-entities` package until cleaned up.

.changeset/salty-camels-wash.md

@@ -0,0 +1,5 @@
+---
+'@backstage/cli': patch
+---
+
+Fixed internal usage of `yargs`.

.changeset/seven-games-rest.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-techdocs-backend': patch
+---
+
+Corrected `ErrorCallback` type to work with Node 22 types

.changeset/short-cloths-tie.md

@@ -0,0 +1,5 @@
+---
+'@backstage/backend-defaults': patch
+---
+
+Don't warn when parsing `storeOptions` for `memory` cache

.changeset/short-lizards-find.md

@@ -0,0 +1,7 @@
+---
+'@backstage/plugin-devtools-common': patch'
+'@backstage/plugin-devtools-backend': patch
+'@backstage/plugin-devtools': patch
+---
+
+Added scheduled tasks UI feature for the DevTools plugin

.changeset/slimy-islands-play.md

@@ -0,0 +1,7 @@
+---
+'@backstage/ui': patch
+---
+
+Added row selection support with visual state styling for hover, selected, and pressed states. Fixed checkbox rendering to only show for multi-select toggle mode.
+
+Affected components: Table, TableHeader, Row, Column

.changeset/slimy-mugs-taste.md

@@ -0,0 +1,5 @@
+---
+'@backstage/backend-test-utils': patch
+---
+
+Fix PostgreSQL 18 `TestDatabases` by pinning the data directory

.changeset/sour-bats-press.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-node': patch
+---
+
+fix flawed cookie removal logic with chunked tokens

.changeset/spicy-sides-grow.md

@@ -0,0 +1,5 @@
+---
+'@backstage/core-components': patch
+---
+
+added support for wrapLongLines option in CodeSnippet

.changeset/stale-poets-battle.md

@@ -0,0 +1,7 @@
+---
+'@backstage/plugin-events-backend-module-kafka': minor
+---
+
+Added `KafkaPublishingEventConsumer` to support sending Backstage events to Kafka topics.
+
+This addition enables Backstage to publish events to external Kafka systems, complementing the existing ability to receive events from Kafka. This allows for better integration with external systems that rely on Kafka for event streaming.

.changeset/stupid-cases-fold.md

@@ -0,0 +1,7 @@
+---
+'@backstage/cli': patch
+---
+
+Switched compilation target to ES2022 in order to match the new set of supported Node.js versions, which are 22 and 24.
+
+The TypeScript compilation target has been set to ES2022, because setting it to a higher target will break projects on older TypeScript versions. If you use a newer TypeScript version in your own project, you can bump `compilerOptions.target` to ES2023 or ES2024 in your own `tsconfig.json` file.

.changeset/swift-moments-think.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-catalog-backend-module-github': patch
+---
+
+Added configurable `pageSizes` option to `GithubOrgEntityProvider` for GitHub GraphQL API queries to prevent `RESOURCE_LIMITS_EXCEEDED` errors with organizations with large number of teams and members. This aligns the configuration options with `GithubMultiOrgEntityProvider`.

.changeset/swift-wolves-judge.md

@@ -0,0 +1,5 @@
+---
+'@backstage/frontend-plugin-api': patch
+---
+
+Removed unnecessary dependencies on `@backstage/core-components`, `@backstage/config`, `@material-ui/core`, and `lodash`.

.changeset/tall-ideas-lead.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-scaffolder-backend-module-bitbucket-server': patch
+---
+
+Improve error message when provided target branch is missing

.changeset/tame-mirrors-sit.md

@@ -0,0 +1,5 @@
+---
+'@backstage/backend-dev-utils': patch
+---
+
+Internal update for Node.js v24 support.

.changeset/tender-dancers-hunt.md

@@ -0,0 +1,5 @@
+---
+'@backstage/cli': patch
+---
+
+Updated to use new utilities from `@backstage/cli-common`.

.changeset/tired-dogs-remain.md

@@ -0,0 +1,12 @@
+---
+'@backstage/plugin-scaffolder-backend-module-rails': patch
+'@backstage/plugin-kubernetes-cluster': patch
+'@techdocs/cli': patch
+'@backstage/cli-common': patch
+'@backstage/create-app': patch
+'@backstage/repo-tools': patch
+'@backstage/codemods': patch
+'@backstage/cli': patch
+---
+
+Bumped dev dependencies `@types/node`

.github/workflows/api-breaking-changes-comment.yml

@@ -23,7 +23,7 @@ jobs:
       comment-cache-key: ${{ steps.hash.outputs.COMMENT_FILE_HASH }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
         with:
           disable-sudo: true
           egress-policy: block
@@ -32,7 +32,7 @@ jobs:
 
       - name: 'Download artifacts'
         # Fetch output (zip archive) from the workflow run that triggered this workflow.
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             let allArtifacts = await github.rest.actions.listWorkflowRunArtifacts({
@@ -99,7 +99,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
 
       - name: Fetch cached Manifests File
         id: cache

.github/workflows/api-breaking-changes.yml

@@ -14,11 +14,11 @@ jobs:
     if: ${{ github.event_name != 'pull_request' || github.event.action != 'closed' }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           # Fetch the commit that's merged into the base rather than the target ref
           # This will let us diff only the contents of the PR, without fetching more history
@@ -29,13 +29,13 @@ jobs:
       - name: setup-node
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: 20.x
+          node-version: 22.x
           registry-url: https://registry.npmjs.org/
 
       - name: yarn install
         uses: backstage/actions/yarn-install@b3c1841fd69e1658ac631afafd0fb140a2309024 # v0.6.17
         with:
-          cache-prefix: linux-v20
+          cache-prefix: linux-v22
 
       - name: breaking changes check
         run: |

.github/workflows/automate_area-labels.yml

@@ -13,11 +13,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
         with:
           egress-policy: audit
 
-      - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
+      - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
         with:
           repo-token: '${{ secrets.GITHUB_TOKEN }}'
           sync-labels: true

.github/workflows/automate_changeset_feedback.yml

@@ -23,11 +23,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           # Fetch the commit that's merged into the base rather than the target ref
           # This will let us diff only the contents of the PR, without fetching more history

.github/workflows/automate_merge_message.yml

@@ -24,11 +24,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           ref: '${{ github.event.pull_request.merge_commit_sha }}'
 
@@ -44,7 +44,7 @@ jobs:
           node generate.js ${{ github.event.pull_request.base.sha }} ${{ github.event.pull_request.head.sha }} > message.txt
 
       - name: Post Message
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           ISSUE_NUMBER: ${{ github.event.pull_request.number }}
         with:

.github/workflows/automate_stale.yml

@@ -15,12 +15,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
         with:
           egress-policy: audit
 
       - name: Stale check - base
-        uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0
+        uses: actions/stale@997185467fa4f803885201cee163a9f38240193d # v10.1.1
         with:
           stale-issue-message: >
             This issue has been automatically marked as stale because it has not had
@@ -42,7 +42,7 @@ jobs:
           operations-per-run: 100
 
       - name: Stale check - bugs without repro
-        uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0
+        uses: actions/stale@997185467fa4f803885201cee163a9f38240193d # v10.1.1
         with:
           stale-issue-message: >
             This bug report has been automatically marked as stale because it has not had

.github/workflows/ci-noop.yml

@@ -19,7 +19,7 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [20.x, 22.x]
+        node-version: [22.x, 24.x]
 
     name: Verify ${{ matrix.node-version }}
     steps:
@@ -35,12 +35,12 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [20.x, 22.x]
+        node-version: [22.x, 24.x]
 
     name: Test ${{ matrix.node-version }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
         with:
           egress-policy: audit
 

.github/workflows/ci.yml

@@ -19,7 +19,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node-version: [20.x, 22.x]
+        node-version: [22.x, 24.x]
 
     env:
       CI: true
@@ -28,11 +28,11 @@ jobs:
     name: Install ${{ matrix.node-version }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: use node.js ${{ matrix.node-version }}
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
@@ -55,7 +55,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node-version: [20.x, 22.x]
+        node-version: [22.x, 24.x]
 
     env:
       CI: true
@@ -64,11 +64,11 @@ jobs:
     name: Verify ${{ matrix.node-version }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: use node.js ${{ matrix.node-version }}
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
@@ -154,7 +154,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node-version: [20.x, 22.x]
+        node-version: [22.x, 24.x]
 
     name: Test ${{ matrix.node-version }}
     services:
@@ -203,14 +203,14 @@ jobs:
 
     env:
       CI: true
-      NODE_OPTIONS: --max-old-space-size=8192 --no-node-snapshot --experimental-vm-modules
+      NODE_OPTIONS: --max-old-space-size=8192 --experimental-vm-modules
       INTEGRATION_TEST_GITHUB_TOKEN: ${{ secrets.INTEGRATION_TEST_GITHUB_TOKEN }}
       INTEGRATION_TEST_GITLAB_TOKEN: ${{ secrets.INTEGRATION_TEST_GITLAB_TOKEN }}
       INTEGRATION_TEST_BITBUCKET_TOKEN: ${{ secrets.INTEGRATION_TEST_BITBUCKET_TOKEN }}
       INTEGRATION_TEST_AZURE_TOKEN: ${{ secrets.INTEGRATION_TEST_AZURE_TOKEN }}
 
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - name: fetch master branch
         run: git fetch origin master
 

.github/workflows/cleanup_patch-files.yml

@@ -17,12 +17,12 @@ jobs:
       contents: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
         with:
           egress-policy: audit
 
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           fetch-depth: 0
           token: ${{ secrets.GH_SERVICE_ACCOUNT_TOKEN }}
@@ -34,7 +34,7 @@ jobs:
 
       - name: Extract PR numbers from commit messages
         id: extract-pr-numbers
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ secrets.GH_SERVICE_ACCOUNT_TOKEN }}
           script: |
@@ -89,14 +89,14 @@ jobs:
 
       - name: Checkout master
         if: steps.extract-pr-numbers.outputs.has_pr_numbers == 'true'
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           ref: master
           token: ${{ secrets.GH_SERVICE_ACCOUNT_TOKEN }}
 
       - name: Delete patch files
         if: steps.extract-pr-numbers.outputs.has_pr_numbers == 'true'
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           PR_NUMBERS: ${{ steps.extract-pr-numbers.outputs.pr_numbers }}
           REF_NAME: ${{ github.ref_name }}

.github/workflows/cron.yml

@@ -10,7 +10,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
         with:
           egress-policy: audit
 

.github/workflows/deploy_docker-image.yml

@@ -16,16 +16,16 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node-version: [20.x]
+        node-version: [22.x]
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
         with:
           egress-policy: audit
 
       - name: checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           path: backstage
           ref: ${{ github.event.client_payload.version && env.RELEASE_VERSION || github.ref }}
@@ -52,7 +52,7 @@ jobs:
         working-directory: ./example-app
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.github/workflows/deploy_microsite.yml

@@ -23,12 +23,12 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
         with:
           egress-policy: audit
 
       - name: find latest release
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         id: find-release
         with:
           script: |
@@ -54,20 +54,20 @@ jobs:
           result-encoding: string
 
       - name: checkout latest release
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           ref: refs/tags/${{ steps.find-release.outputs.result }}
 
-      - name: Use Node.js 20.x
+      - name: Use Node.js 22.x
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: 20.x
+          node-version: 22.x
           registry-url: https://registry.npmjs.org/ # Needed for auth
 
       - name: yarn install
         uses: backstage/actions/yarn-install@b3c1841fd69e1658ac631afafd0fb140a2309024 # v0.6.17
         with:
-          cache-prefix: ${{ runner.os }}-v20.x
+          cache-prefix: ${{ runner.os }}-v22.x
 
       - name: build API reference
         run: yarn build:api-docs
@@ -135,23 +135,23 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
         with:
           egress-policy: audit
 
       - name: checkout master
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
-      - name: Use Node.js 20.x
+      - name: Use Node.js 22.x
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: 20.x
+          node-version: 22.x
           registry-url: https://registry.npmjs.org/ # Needed for auth
 
       - name: yarn install
         uses: backstage/actions/yarn-install@b3c1841fd69e1658ac631afafd0fb140a2309024 # v0.6.17
         with:
-          cache-prefix: ${{ runner.os }}-v20.x
+          cache-prefix: ${{ runner.os }}-v22.x
 
       - name: build API reference
         run: yarn build:api-docs
@@ -240,19 +240,19 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
         with:
           egress-policy: audit
 
-      - name: Use Node.js 20.x
+      - name: Use Node.js 22.x
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: 20.x
+          node-version: 22.x
           registry-url: https://registry.npmjs.org/ # Needed for auth
 
       # Stable docs
       - name: checkout latest release
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           ref: refs/tags/${{ needs.stable.outputs.release }}
 
@@ -286,7 +286,7 @@ jobs:
 
       # Next docs
       - name: checkout master
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           clean: false
 

.github/workflows/deploy_packages.yml

@@ -13,7 +13,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node-version: [20.x, 22.x]
+        node-version: [22.x, 24.x]
 
     services:
       postgres18:
@@ -68,7 +68,7 @@ jobs:
       INTEGRATION_TEST_AZURE_TOKEN: ${{ secrets.INTEGRATION_TEST_AZURE_TOKEN }}
 
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: use node.js ${{ matrix.node-version }}
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
@@ -147,11 +147,11 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [20.x]
+        node-version: [22.x]
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
         with:
           egress-policy: audit
 

.github/workflows/issue.yaml

@@ -16,13 +16,13 @@ jobs:
     if: github.repository == 'backstage/backstage'
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
         with:
           egress-policy: audit
 
       # We need to checkout the `.github/ISSUE_TEMPLATE` for the advanced labeler action to be able to read the templates
       # While at it we might as well checkout all of `.github` so that the labeling actions don't need to fetch their configs
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
         with:
           sparse-checkout: .github
 
@@ -38,7 +38,7 @@ jobs:
 
       # These two steps add labels based on user input in the issue form
       - name: Parse issue form
-        uses: stefanbuck/github-issue-parser@2ea9b35a8c584529ed00891a8f7e41dc46d0441e # v3
+        uses: stefanbuck/github-issue-parser@25f1485edffc1fee3ea68eb9f59a72e58720ffc4 # v3
         id: issue-parser
         with:
           template-path: .github/ISSUE_TEMPLATE/.common.yaml

.github/workflows/mui-migration-tracker.yml

@@ -18,23 +18,23 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
         with:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
 
       - name: Setup Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: 20.x
+          node-version: 22.x
           registry-url: https://registry.npmjs.org/ # Needed for auth
 
       - name: yarn install
         uses: backstage/actions/yarn-install@b3c1841fd69e1658ac631afafd0fb140a2309024 # v0.6.17
         with:
-          cache-prefix: ${{ runner.os }}-v20.x
+          cache-prefix: ${{ runner.os }}-v22.x
 
       - name: Run migration analysis
         id: analysis
@@ -48,7 +48,7 @@ jobs:
           echo "EOF" >> $GITHUB_ENV
 
       - name: Update GitHub Issue
-        uses: actions/github-script@v7
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
@@ -62,7 +62,7 @@ jobs:
                 issue_number: issueNumber,
                 body: reportBody
               });
-              
+
               console.log(`✅ Successfully updated issue #${issueNumber}`);
             } catch (error) {
               console.error(`❌ Error updating issue: ${error.message}`);

.github/workflows/pr-review-comment-trigger.yaml

@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
         with:
           egress-policy: audit
 

.github/workflows/pr-review-comment.yaml

@@ -17,13 +17,13 @@ jobs:
     steps:
       # Inspired by https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#using-data-from-the-triggering-workflow
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
         with:
           egress-policy: audit
 
       - name: Read PR Number
         id: pr-number
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |

.github/workflows/pr.yaml

@@ -18,7 +18,7 @@ jobs:
     if: github.repository == 'backstage/backstage' && ( github.event.pull_request || github.event.issue.pull_request )
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
         with:
           egress-policy: audit
 

.github/workflows/scorecard.yml

@@ -29,12 +29,12 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
         with:
           egress-policy: audit
 
       - name: 'Checkout code'
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           persist-credentials: false
 
@@ -67,6 +67,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: 'Upload to code-scanning'
-        uses: github/codeql-action/upload-sarif@a4e1a019f5e24960714ff6296aee04b736cbc3cf # v3.29.6
+        uses: github/codeql-action/upload-sarif@497990dfed22177a82ba1bbab381bc8f6d27058f # v3.31.6
         with:
           sarif_file: results.sarif

.github/workflows/sync_canon.yml

@@ -8,26 +8,26 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
         with:
           egress-policy: audit
 
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
-      - name: Use Node.js 20.x
+      - name: Use Node.js 22.x
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: 20.x
+          node-version: 22.x
           registry-url: https://registry.npmjs.org/ # Needed for auth
 
       - name: yarn install
         uses: backstage/actions/yarn-install@b3c1841fd69e1658ac631afafd0fb140a2309024 # v0.6.17
         with:
-          cache-prefix: ${{ runner.os }}-v20.x
+          cache-prefix: ${{ runner.os }}-v22.x
 
       - name: Checkout backstage/docs-ui
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           repository: backstage/docs-ui
           path: bui-external-docs

.github/workflows/sync_code-formatting.yml

@@ -10,11 +10,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           # Fetch changes to previous commit - required for 'only_changed' in Prettier action
           fetch-depth: 0

.github/workflows/sync_dependabot-changesets.yml

@@ -11,12 +11,12 @@ jobs:
     if: github.actor == 'dependabot[bot]' && github.repository == 'backstage/backstage'
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
         with:
           egress-policy: audit
 
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           fetch-depth: 2
           ref: ${{ github.head_ref }}
@@ -26,7 +26,7 @@ jobs:
           git config --global user.email noreply@backstage.io
           git config --global user.name 'Github changeset workflow'
       - name: Generate changeset
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             const { promises: fs } = require('fs');

.github/workflows/sync_patch-release.yml

@@ -25,12 +25,12 @@ jobs:
       pull-requests: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
         with:
           egress-policy: audit
 
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           fetch-depth: 20000
           fetch-tags: true
@@ -55,7 +55,7 @@ jobs:
       - name: Find existing PR
         id: find-pr
         if: steps.check-patches.outputs.has_patches == 'true'
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ secrets.GH_SERVICE_ACCOUNT_TOKEN }}
           script: |
@@ -82,7 +82,7 @@ jobs:
 
       - name: Close PR and delete branch if no patches
         if: steps.check-patches.outputs.has_patches == 'false'
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ secrets.GH_SERVICE_ACCOUNT_TOKEN }}
           script: |
@@ -131,7 +131,7 @@ jobs:
       - name: Read patch files for PR metadata
         if: steps.check-patches.outputs.has_patches == 'true'
         id: read-patches
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ secrets.GH_SERVICE_ACCOUNT_TOKEN }}
           script: |
@@ -203,7 +203,7 @@ jobs:
 
       - name: Create or update PR
         if: steps.check-patches.outputs.has_patches == 'true'
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           PR_EXISTS: ${{ steps.find-pr.outputs.pr_exists }}
           PR_NUMBER: ${{ steps.find-pr.outputs.pr_number }}

.github/workflows/sync_release-manifest.yml

@@ -8,26 +8,26 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
         with:
           egress-policy: audit
 
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           # 'v' prefix is added here for the tag, we keep it out of the manifest logic
           ref: v${{ github.event.client_payload.version }}
 
-      - name: Use Node.js 20.x
+      - name: Use Node.js 22.x
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: 20.x
+          node-version: 22.x
           registry-url: https://registry.npmjs.org/ # Needed for auth
 
       - name: yarn install
         uses: backstage/actions/yarn-install@b3c1841fd69e1658ac631afafd0fb140a2309024 # v0.6.17
         with:
-          cache-prefix: ${{ runner.os }}-v20.x
+          cache-prefix: ${{ runner.os }}-v22.x
 
       - name: Build yarn plugin
         working-directory: packages/yarn-plugin
@@ -35,7 +35,7 @@ jobs:
 
       # Checkout backstage/versions into /backstage/versions, which is where store the output
       - name: Checkout versions
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           repository: backstage/versions
           path: versions
@@ -71,7 +71,7 @@ jobs:
           git push
 
       - name: Dispatch update-helper update
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ secrets.GH_SERVICE_ACCOUNT_TOKEN }}
           # TODO(Rugvip): Remove the create-app dispatch once we've been on the release version for a while