Merge branch 'master' into blam/actions-permissions

Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>

.changeset/actions-service-plugin-id.md

@@ -0,0 +1,7 @@
+---
+'@backstage/backend-plugin-api': patch
+'@backstage/backend-defaults': patch
+'@backstage/backend-test-utils': patch
+---
+
+Added `pluginId` field to `ActionsServiceAction` type, populated from the registering plugin's metadata.

.changeset/add-cli-plugin-role.md

@@ -0,0 +1,5 @@
+---
+'@backstage/cli-node': patch
+---
+
+Added a new `cli-module` package role for packages that provide CLI plugin extensions.

.changeset/add-frontend-dev-utils.md

@@ -0,0 +1,5 @@
+---
+'@backstage/frontend-dev-utils': minor
+---
+
+Added `@backstage/frontend-dev-utils`, a new package that provides a minimal helper for wiring up a development app for frontend plugins using the new frontend system. It exports a `createDevApp` function that handles creating and rendering a development app from a `dev/` entry point. The dev app automatically bypasses the sign-in page and loads the `@backstage/ui` CSS. The options interface accepts `features` together with route bindings through `bindRoutes`.

.changeset/app-visualizer-use-frontend-dev-utils.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-app-visualizer': patch
+---
+
+Switched dev entry point to use `createDevApp` from `@backstage/frontend-dev-utils`.

.changeset/auth-migrate-to-bui.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth': patch
+---
+
+Migrated the ConsentPage UI from Material-UI and `@backstage/core-components` to `@backstage/ui`.

.changeset/auth-provider-icon-element-core-components.md

@@ -0,0 +1,5 @@
+---
+'@backstage/core-components': patch
+---
+
+The login request dialog now handles auth provider icons passed as `IconElement` in addition to `IconComponent`.

.changeset/auth-provider-icon-element-user-settings.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-user-settings': patch
+---
+
+The `ProviderSettingsItem` `icon` prop now accepts `IconElement` in addition to `IconComponent`.

.changeset/auth-provider-icon-element.md

@@ -0,0 +1,5 @@
+---
+'@backstage/frontend-plugin-api': patch
+---
+
+The `icon` field on `AuthProviderInfo` now accepts `IconElement` in addition to `IconComponent`, letting you pass `<MyIcon />` instead of `MyIcon`.

.changeset/brave-pens-argue.md

@@ -0,0 +1,5 @@
+---
+'@backstage/backend-dynamic-feature-service': patch
+---
+
+Fixed `resolvePackagePath` resolution for bundled dynamic plugins. When a plugin bundles its own copy of `@backstage/backend-plugin-api` inside `node_modules`, the `CommonJSModuleLoader` fallback now correctly resolves the plugin's `package.json` by name. Previously the fallback only applied when the resolution originated from the host application; it now also applies when originating from a bundled dependency, which is the case for plugins produced by the `backstage-cli package bundle` command.

.changeset/bui-table-root-loading-prop.md

@@ -0,0 +1,7 @@
+---
+'@backstage/ui': patch
+---
+
+Added a `loading` prop and `data-loading` data attribute to `TableRoot`, allowing consumers to distinguish between stale data and initial loading states. Both `stale` and `loading` set `aria-busy` on the table.
+
+Affected components: TableRoot

.changeset/bui-table-skeleton-loading.md

@@ -0,0 +1,7 @@
+---
+'@backstage/ui': patch
+---
+
+Improved the `Table` component loading state to show a skeleton UI with visible headers instead of plain "Loading..." text. The table now renders its full structure during loading, with animated skeleton rows in place of data. The loading state includes proper accessibility support with `aria-busy` on the table and screen reader announcements.
+
+Affected components: Table

.changeset/catalog-remove-entity-transaction.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-catalog-backend': patch
+---
+
+Improved catalog entity deletion so parent invalidation and deferred relation restitch scheduling are coordinated more safely.

.changeset/cli-defaults-introduce.md

@@ -0,0 +1,5 @@
+---
+'@backstage/cli-defaults': minor
+---
+
+Introduced `@backstage/cli-defaults`, a convenience package that bundles all standard Backstage CLI modules. Install this single package as a `devDependency` to get the full default set of CLI commands without listing each module individually.

.changeset/cli-discover-modules.md

@@ -0,0 +1,41 @@
+---
+'@backstage/cli': minor
+---
+
+The CLI now automatically discovers CLI modules from the project root's `dependencies` and `devDependencies`. Any installed package with the `cli-module` Backstage role will be loaded automatically without needing to be hardcoded in the CLI itself.
+
+If no CLI modules are found in the project dependencies, the CLI falls back to the built-in set of modules and prints a deprecation warning. This fallback will be removed in a future release. To prepare for this, add `@backstage/cli-defaults` as a `devDependency` in your root `package.json`:
+
+```json
+{
+  "devDependencies": {
+    "@backstage/cli-defaults": "backstage:^"
+  }
+}
+```
+
+If you are not using the Backstage Yarn plugin, run the following instead:
+
+```sh
+yarn workspace root add --dev @backstage/cli-defaults
+```
+
+For fine-grained control you can instead install individual CLI modules:
+
+```json
+{
+  "devDependencies": {
+    "@backstage/cli-module-auth": "backstage:^",
+    "@backstage/cli-module-build": "backstage:^",
+    "@backstage/cli-module-config": "backstage:^",
+    "@backstage/cli-module-github": "backstage:^",
+    "@backstage/cli-module-info": "backstage:^",
+    "@backstage/cli-module-lint": "backstage:^",
+    "@backstage/cli-module-maintenance": "backstage:^",
+    "@backstage/cli-module-migrate": "backstage:^",
+    "@backstage/cli-module-new": "backstage:^",
+    "@backstage/cli-module-test-jest": "backstage:^",
+    "@backstage/cli-module-translations": "backstage:^"
+  }
+}
+```

.changeset/cli-node-add-cli-plugin.md

@@ -0,0 +1,5 @@
+---
+'@backstage/cli-node': minor
+---
+
+Added `createCliModule` API and related types for building Backstage CLI plugins.

.changeset/cli-package-bundle.md

@@ -0,0 +1,5 @@
+---
+'@backstage/cli-module-build': minor
+---
+
+Added `package bundle` command to create self-contained plugin bundles for dynamic loading, to be used by the `backend-dynamic-feature-service`. Supports backend and frontend plugins, with optional `--pre-packed-dir` for batch bundling from a pre-built workspace.

.changeset/cli-support-cli-plugin-role.md

@@ -0,0 +1,5 @@
+---
+'@backstage/cli': patch
+---
+
+Added support for the new `cli-module` package role in the build system, ESLint configuration, Jest configuration, and maintenance commands.

.changeset/cli-use-cli-plugin-api.md

@@ -0,0 +1,5 @@
+---
+'@backstage/cli': patch
+---
+
+Migrated CLI plugin modules to use `createCliModule` from `@backstage/cli-node`.

.changeset/create-app-cli-modules.md

@@ -0,0 +1,5 @@
+---
+'@backstage/create-app': patch
+---
+
+The create-app templates now include `@backstage/cli-defaults` as a `devDependency`, enabling the CLI's automatic module discovery for newly created projects.

.changeset/cruel-cities-jump.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-scaffolder-node': patch
+---
+
+Added `removeFiles` helper function for staging file removals in Git.

.changeset/devtools-cancel-scheduled-task.md

@@ -0,0 +1,6 @@
+---
+'@backstage/plugin-devtools-common': patch
+'@backstage/plugin-devtools': patch
+---
+
+Added `cancelScheduledTask` to the DevTools API and a cancel button to the scheduled tasks UI.

.changeset/docs-frontend-plugin-installation.md

@@ -0,0 +1,16 @@
+---
+'@backstage/plugin-api-docs': patch
+'@backstage/plugin-catalog': patch
+'@backstage/plugin-catalog-graph': patch
+'@backstage/plugin-catalog-import': patch
+'@backstage/plugin-catalog-unprocessed-entities': patch
+'@backstage/plugin-devtools': patch
+'@backstage/plugin-home': patch
+'@backstage/plugin-kubernetes': patch
+'@backstage/plugin-mui-to-bui': patch
+'@backstage/plugin-org': patch
+'@backstage/plugin-scaffolder': patch
+'@backstage/plugin-user-settings': patch
+---
+
+Updated installation documentation to use feature discovery as the default.

.changeset/document-table-cell-requirement.md

@@ -0,0 +1,5 @@
+---
+'@backstage/ui': patch
+---
+
+Added documentation for the table cell wrapper requirement to TSDoc comments for `Cell`, `CellText`, `CellProfile`, `ColumnConfig`, and `RowRenderFn`.

.changeset/few-clouds-pull.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-scaffolder-backend-module-github': patch
+---
+
+Added optional `returnWorkflowRunDetails` input to `github:actions:dispatch` action. When true, exposes `workflowRunId`, `workflowRunUrl`, and `workflowRunHtmlUrl` as outputs using the GitHub API `return_run_details` parameter.

.changeset/fine-dragons-scream.md

@@ -0,0 +1,7 @@
+---
+'@backstage/ui': patch
+---
+
+Added `SearchAutocomplete` and `SearchAutocompleteItem` components for building accessible search-with-results patterns. Built on React Aria's Autocomplete with keyboard navigation and screen reader support. Designed for async/external search results with a configurable popover width.
+
+**Affected components:** SearchAutocomplete, SearchAutocompleteItem

.changeset/fix-dialog-height-overflow.md

@@ -0,0 +1,7 @@
+---
+'@backstage/ui': patch
+---
+
+Fixed `Dialog` content overflowing when no `height` prop is set. The dialog now grows with its content and scrolls when content exceeds the viewport height.
+
+**Affected components**: Dialog

.changeset/fix-header-container-padding.md

@@ -0,0 +1,7 @@
+---
+'@backstage/ui': patch
+---
+
+Fixed incorrect bottom spacing caused by `Container` using `padding-bottom` for its default bottom spacing. Changed to `margin-bottom` and prevented it from applying when `Container` is used as the `Header` root element.
+
+**Affected components:** Container, Header

.changeset/fix-plugin-header-resizeobserver-loop.md

@@ -0,0 +1,7 @@
+---
+'@backstage/ui': patch
+---
+
+Fixed `PluginHeader` to avoid triggering `ResizeObserver loop completed with undelivered notifications` warnings when used in layouts that react to the header height, such as pages that use `FullPage`.
+
+**Affected components:** PluginHeader

.changeset/fix-table-bui-bg-tint-tokens.md

@@ -0,0 +1,5 @@
+---
+'@backstage/ui': patch
+---
+
+Fixed Table component to use current `--bui-bg-neutral-1` tokens instead of the removed `--bui-bg-tint` tokens, restoring row hover, selected, pressed, and disabled background colors.

.changeset/fix-table-complete-mode-loading.md

@@ -0,0 +1,5 @@
+---
+'@backstage/ui': patch
+---
+
+Fixed a bug in the `useTable` hook where the loading skeleton was never shown for `complete` mode when using `getData`. The initial data state was an empty array instead of `undefined`, causing the `Table` component to skip the loading state.

.changeset/fix-table-row-external-href.md

@@ -0,0 +1,7 @@
+---
+'@backstage/ui': patch
+---
+
+Fixed `Table` rows with external `href` values to open in a new tab by automatically applying `target="_blank"` and `rel="noopener noreferrer"`.
+
+**Affected components**: Table

.changeset/giant-carpets-train.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-techdocs-module-addons-contrib': patch
+---
+
+Avoid enabling the TechDocs LightBox addon for images wrapped in links, so image links keep working.

.changeset/gke-dns-endpoint-support.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-kubernetes-backend': patch
+---
+
+Added `endpointType` config option to the GKE cluster locator, allowing use of DNS-based control plane endpoints instead of public IP endpoints. Set `endpointType: 'dns'` to use GKE DNS endpoints (e.g. `gke-<uid>.<region>.gke.goog`) which provide proper TLS certificates and IAM-based access control.

.changeset/gold-squids-rescue.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-scaffolder-backend': minor
+---
+
+Adds a new `get-scaffolder-task-logs` action to `@backstage/plugin-scaffolder-backend` that retrieves log events for a given scaffolder task, with optional support for retrieving only new events after a given event ID.

.changeset/introduce-cli-modules.md

@@ -0,0 +1,15 @@
+---
+'@backstage/cli-module-auth': minor
+'@backstage/cli-module-build': minor
+'@backstage/cli-module-config': minor
+'@backstage/cli-module-github': minor
+'@backstage/cli-module-info': minor
+'@backstage/cli-module-lint': minor
+'@backstage/cli-module-maintenance': minor
+'@backstage/cli-module-migrate': minor
+'@backstage/cli-module-new': minor
+'@backstage/cli-module-test-jest': minor
+'@backstage/cli-module-translations': minor
+---
+
+Initial release of the CLI module packages. Each module provides a set of commands that can be discovered automatically by `@backstage/cli` or executed standalone.

.changeset/lovely-corners-refuse.md

@@ -0,0 +1,5 @@
+---
+'@backstage/ui': patch
+---
+
+Added `virtualized` prop to `Table` component for virtualized rendering of large datasets. Accepts `true` for default row height, `{ rowHeight: number }` for fixed height, or `{ estimatedRowHeight: number }` for variable height rows.

.changeset/mcp-server-name-description.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-mcp-actions-backend': patch
+---
+
+Added `mcpActions.name` and `mcpActions.description` config options to customize the MCP server identity. Namespaced tool names now use dot separator to align with the MCP spec convention.

.changeset/mdowryepwlkfidia.md

@@ -0,0 +1,5 @@
+---
+'@backstage/frontend-plugin-api': minor
+---
+
+Removed the `ResolvedExtensionInput` and `ExtensionDataRefToValue` helper types from the public API surface to reduce top-level API clutter. These types were internal plumbing that are not needed by plugin authors. If you were relying on `ResolvedExtensionInput`, use the `ResolvedExtensionInputs` type instead, which maps a full set of inputs. If you were using `ExtensionDataRefToValue`, replace it with `ExtensionDataValue` combined with inferred types from your `ExtensionDataRef`.

.changeset/new-frontend-plugin-template-dev-utils.md

@@ -0,0 +1,6 @@
+---
+'@backstage/cli': patch
+'@backstage/cli-module-new': patch
+---
+
+Updated the new frontend plugin template to use `@backstage/frontend-dev-utils` in its `dev/` entry point instead of wiring `createApp` manually. Generated plugins now get the same dev app helper setup as the built-in examples.

.changeset/nfs-icon-alpha-plugins.md

@@ -0,0 +1,12 @@
+---
+'@backstage/plugin-api-docs': patch
+'@backstage/plugin-catalog': patch
+'@backstage/plugin-catalog-unprocessed-entities': patch
+'@backstage/plugin-devtools': patch
+'@backstage/plugin-scaffolder': patch
+'@backstage/plugin-search': patch
+'@backstage/plugin-techdocs': patch
+'@backstage/plugin-user-settings': patch
+---
+
+Updated alpha plugin icons to follow the new frontend icon sizing rules when rendered in plugin and navigation surfaces.

.changeset/nfs-icon-foundations.md

@@ -0,0 +1,7 @@
+---
+'@backstage/core-components': patch
+'@backstage/frontend-app-api': patch
+'@backstage/frontend-plugin-api': patch
+---
+
+Clarified the `IconElement` sizing contract for the new frontend system and aligned legacy system icon rendering with the new icon API.

.changeset/nfs-icon-plugin-app.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-app': patch
+---
+
+The app nav now falls back to `plugin.icon` for navigation items that don't have an explicit icon set.

.changeset/ninety-onions-ask.md

@@ -0,0 +1,5 @@
+---
+'@backstage/core-app-api': patch
+---
+
+Added `BUIProvider` inside the legacy app router to enable client-side routing for all BUI components.

.changeset/polite-trains-crash.md

@@ -0,0 +1,23 @@
+---
+'@backstage/ui': minor
+---
+
+**BREAKING**: Centralized client-side routing in `BUIProvider`. Components like Link, ButtonLink, Tabs, Menu, TagGroup, and Table now require a `BUIProvider` rendered inside a React Router context for client-side navigation to work.
+
+**Migration:**
+
+This change requires updating `@backstage/plugin-app` and `@backstage/core-app-api` alongside `@backstage/ui`. If you only upgrade `@backstage/ui`, BUI components will fall back to full-page navigation.
+
+If you cannot upgrade all packages together, or if you have a custom app shell, add a `BUIProvider` inside your Router:
+
+```diff
++ import { BUIProvider } from '@backstage/ui';
+
+  <BrowserRouter>
++   <BUIProvider>
+      <AppContent />
++   </BUIProvider>
+  </BrowserRouter>
+```
+
+**Affected components:** Link, ButtonLink, Tabs, Menu, TagGroup, Table

.changeset/pre.json

@@ -1,5 +1,5 @@
 {
-  "mode": "pre",
+  "mode": "exit",
   "tag": "next",
   "initialVersions": {
     "example-app": "0.0.32",

.changeset/promote-plugin-wrapper-api.md

@@ -0,0 +1,9 @@
+---
+'@backstage/frontend-plugin-api': minor
+---
+
+**BREAKING**: Promoted `PluginWrapperApi`, `pluginWrapperApiRef`, `PluginWrapperBlueprint`, and the new `PluginWrapperDefinition` type from `@alpha` to `@public`. These are now available from the main package entry point rather than only through `/alpha`.
+
+The `PluginWrapperApi` type now has a required `getRootWrapper()` method that returns a root wrapper component. The `pluginWrapperApiRef` ID changed from `core.plugin-wrapper.alpha` to `core.plugin-wrapper`.
+
+The `PluginWrapperBlueprint` now accepts `PluginWrapperDefinition` as the loader return type, which supports an optional `useWrapperValue` hook that allows sharing state between wrapper instances.

.changeset/promote-plugin-wrapper-app.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-app': patch
+---
+
+Updated the default `PluginWrapperApi` implementation to support the new `useWrapperValue` hook and root wrapper. The root wrapper is now rendered in the app root to manage shared hook state across plugin wrapper instances.

.changeset/ready-ghosts-fail.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-catalog-backend': patch
+---
+
+Make the `search` foreign key catalog migration non-blocking on large tables by using batch deletes and PostgreSQL `NOT VALID`/`VALIDATE` to reduce lock duration

.changeset/rename-header-css-classes.md

@@ -0,0 +1,15 @@
+---
+'@backstage/ui': minor
+---
+
+**BREAKING**: Renamed internal CSS classes to match the `Header` component name.
+
+**Migration:**: If you are targeting these classes directly in your styles, update the following:
+
+- `bui-HeaderPage` → `bui-Header`
+- `bui-HeaderPageContent` → `bui-HeaderContent`
+- `bui-HeaderPageBreadcrumbs` → `bui-HeaderBreadcrumbs`
+- `bui-HeaderPageTabsWrapper` → `bui-HeaderTabsWrapper`
+- `bui-HeaderPageControls` → `bui-HeaderControls`
+
+**Affected components:**: Header

.changeset/renovate-422217b.md

@@ -0,0 +1,5 @@
+---
+'@backstage/ui': patch
+---
+
+Updated dependency `globals` to `^17.0.0`.

.changeset/small-feet-arrive.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-app': patch
+---
+
+Moved `BUIProvider` inside the app router to enable automatic client-side routing for all BUI components.

.changeset/tidy-friends-act.md

@@ -0,0 +1,7 @@
+---
+'@backstage/ui': patch
+---
+
+Fixed `Card` interactive cards not firing the `onPress` handler when clicking the card surface.
+
+**Affected components**: Card

.changeset/young-squids-end.md

@@ -0,0 +1,10 @@
+---
+'@backstage/ui': minor
+---
+
+Removed redundant `selected` and `indeterminate` props from the `Checkbox` component. Use the `isSelected` and `isIndeterminate` props instead, which are the standard React Aria props and already handle both the checkbox behaviour and the corresponding CSS data attributes.
+
+**Migration:**
+Replace any usage of the `selected` and `indeterminate` props on `Checkbox` with the `isSelected` and `isIndeterminate` props. Note that the checked state and related CSS data attributes (such as `data-selected` and `data-indeterminate`) are now driven by React Aria, so any custom logic that previously inspected or set these via the old props should instead rely on the React Aria-managed state and attributes exposed through the new props.
+
+**Affected components:** Checkbox

.github/vale/config/vocabularies/Backstage/accept.txt

@@ -555,6 +555,7 @@ validators
 Valkey
 varchar
 viewport
+virtualized
 vite
 VMware
 Vodafone

.github/workflows/api-breaking-changes-comment.yml

@@ -23,7 +23,7 @@ jobs:
       comment-cache-key: ${{ steps.hash.outputs.COMMENT_FILE_HASH }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           disable-sudo: true
           egress-policy: block

.github/workflows/api-breaking-changes.yml

@@ -14,7 +14,7 @@ jobs:
     if: ${{ github.event_name != 'pull_request' || github.event.action != 'closed' }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/automate_area-labels.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/automate_changeset_feedback.yml

@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/automate_merge_message.yml

@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/automate_stale.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/ci-noop.yml

@@ -41,7 +41,7 @@ jobs:
     name: Test ${{ matrix.node-version }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/ci.yml

@@ -30,7 +30,7 @@ jobs:
     name: Install ${{ matrix.node-version }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 
@@ -78,7 +78,7 @@ jobs:
     name: Verify ${{ matrix.node-version }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/cron.yml

@@ -10,7 +10,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/deploy_docker-image.yml

@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/deploy_microsite.yml

@@ -23,40 +23,41 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 
-      - name: find latest release
+      - name: find latest release branch
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         id: find-release
         with:
           script: |
-            const { data } = await github.rest.repos.listTags({
+            const data = await octokit.paginate(github.rest.repos.listBranches, {
               owner: context.repo.owner,
               repo: context.repo.repo,
               per_page: 100,
             })
 
-            const [{tag}] = data
+            const [{branch}] = data
               .map(i => i.name)
-              .filter(tag => tag.match(/^v\d+\.\d+\.\d+$/))
-              .map(tag => ({
-                tag,
-                val: tag
+              .filter(branch => branch.match(/^patch\/v\d+\.\d+\.\d+$/))
+              .map(branch => ({
+                branch,
+                val: branch
+                  .split('/')[1]
                   .slice(1)
                   .split('.')
                   .reduce((val, part) => Number(val) * 1000 + Number(part))
               }))
               .sort((a, b) => b.val - a.val)
 
-            return tag
+            return branch
           result-encoding: string
 
       - name: checkout latest release
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          ref: refs/tags/${{ steps.find-release.outputs.result }}
+          ref: refs/heads/${{ steps.find-release.outputs.result }}
 
       - name: Use Node.js 22.x
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
@@ -124,7 +125,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 
@@ -218,7 +219,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 
@@ -232,7 +233,7 @@ jobs:
       - name: checkout latest release
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          ref: refs/tags/${{ needs.stable.outputs.release }}
+          ref: refs/heads/${{ needs.stable.outputs.release }}
 
       - name: microsite yarn install
         run: yarn install --immutable

.github/workflows/deploy_packages.yml

@@ -147,7 +147,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/issue.yaml

@@ -16,7 +16,7 @@ jobs:
     if: github.repository == 'backstage/backstage'
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/mui-migration-tracker.yml

@@ -18,7 +18,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/scorecard.yml

@@ -29,7 +29,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/sync_bui-docs.yml

@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/sync_code-formatting.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/sync_dependabot-changesets.yml

@@ -11,7 +11,7 @@ jobs:
     if: github.actor == 'dependabot[bot]' && github.repository == 'backstage/backstage'
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/sync_patch-release.yml

@@ -20,7 +20,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/sync_pull-requests-scheduled.yml

@@ -19,7 +19,7 @@ jobs:
       count: ${{ steps.batch.outputs.count }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 
@@ -70,7 +70,7 @@ jobs:
       max-parallel: 1
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/sync_pull-requests-trigger.yml

@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/sync_pull-requests.yml

@@ -15,7 +15,7 @@ jobs:
       github.event.workflow_run.event == 'pull_request'
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/sync_release-manifest.yml

@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/sync_renovate-changesets.yml

@@ -11,7 +11,7 @@ jobs:
     if: github.actor == 'renovate[bot]' && github.repository == 'backstage/backstage'
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/sync_snyk-github-issues.yml

@@ -12,7 +12,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/sync_snyk-monitor.yml

@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/sync_version-packages.yml

@@ -19,7 +19,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/verify_accessibility-noop.yml

@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/verify_accessibility.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/verify_chromatic-noop.yml

@@ -20,7 +20,7 @@ jobs:
     name: Chromatic
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/verify_chromatic.yml

@@ -24,7 +24,7 @@ jobs:
     name: Chromatic
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/verify_codeql.yml

@@ -42,7 +42,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/verify_docs-quality.yml

@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/verify_e2e-linux-noop.yml

@@ -29,7 +29,7 @@ jobs:
     name: E2E Linux ${{ matrix.node-version }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/verify_e2e-linux.yml

@@ -43,7 +43,7 @@ jobs:
     name: E2E Linux ${{ matrix.node-version }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/verify_e2e-techdocs.yml

@@ -32,7 +32,7 @@ jobs:
     name: Techdocs
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/verify_e2e-windows-noop.yml

@@ -25,7 +25,7 @@ jobs:
     name: E2E Windows ${{ matrix.node-version }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/verify_e2e-windows.yml

@@ -33,7 +33,7 @@ jobs:
     name: E2E Windows ${{ matrix.node-version }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/verify_fossa.yml

@@ -14,7 +14,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/verify_microsite-noop.yml

@@ -21,7 +21,7 @@ jobs:
     name: Microsite
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/verify_microsite.yml

@@ -28,40 +28,41 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 
-      - name: find latest release
+      - name: find latest release branch
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         id: find-release
         with:
           script: |
-            const { data } = await github.rest.repos.listTags({
+            const data = await octokit.paginate(github.rest.repos.listBranches, {
               owner: context.repo.owner,
               repo: context.repo.repo,
               per_page: 100,
             })
 
-            const [{tag}] = data
+            const [{branch}] = data
               .map(i => i.name)
-              .filter(tag => tag.match(/^v\d+\.\d+\.\d+$/))
-              .map(tag => ({
-                tag,
-                val: tag
+              .filter(branch => branch.match(/^patch\/v\d+\.\d+\.\d+$/))
+              .map(branch => ({
+                branch,
+                val: branch
+                  .split('/')[1]
                   .slice(1)
                   .split('.')
                   .reduce((val, part) => Number(val) * 1000 + Number(part))
               }))
               .sort((a, b) => b.val - a.val)
 
-            return tag
+            return branch
           result-encoding: string
 
       - name: checkout latest release
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          ref: refs/tags/${{ steps.find-release.outputs.result }}
+          ref: refs/heads/${{ steps.find-release.outputs.result }}
 
       - name: Use Node.js 22.x
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
@@ -126,7 +127,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 
@@ -212,7 +213,7 @@ jobs:
     name: Microsite
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/verify_microsite_accessibility-noop.yml

@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/verify_microsite_accessibility.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

.github/workflows/verify_windows.yml

@@ -29,7 +29,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
         with:
           egress-policy: audit
 

AGENTS.md

@@ -4,9 +4,9 @@ Backstage is an open platform for building developer portals. This is a TypeScri
 
 - `/packages`: Core framework packages (prefixed `@backstage/`)
 - `/plugins`: Plugin packages (prefixed `@backstage/plugin-*`)
-- `/packages/app` and `/packages/backend`: Example app for local development
 - `/packages/app`: Main example app using the new frontend system
 - `/packages/app-legacy`: Example app using the old frontend system
+- `/packages/backend`: Example backend for local development
 - `/docs`: Documentation files
 
 Packages prefixed with `core-` (e.g., `@backstage/core-plugin-api`) are part of the old frontend system. Packages prefixed with `frontend-` (e.g., `@backstage/frontend-plugin-api`) are part of the new frontend system (NFS). Packages prefixed with `backend-` (e.g., `@backstage/backend-plugin-api`) are part of the backend system.

app-config.yaml

@@ -27,6 +27,130 @@ app:
 
   packageName: example-app
 
+  routes:
+    bindings:
+      catalog.viewTechDoc: techdocs.docRoot
+      org.catalogIndex: catalog.catalogIndex
+
+  pluginOverrides:
+    - match:
+        pluginId: pages
+      info:
+        description: 'This description was overridden in app-config.yaml'
+    - match:
+        pluginId: /^catalog(-.*)?$/
+      info:
+        ownerEntityRefs: [cubic-belugas]
+    - match:
+        packageName: '@backstage/plugin-scaffolder'
+      info:
+        ownerEntityRefs: [cubic-belugas]
+
+  extensions:
+    # set availableLanguages example
+    - api:app/app-language:
+        config:
+          availableLanguages: ['en', 'es', 'fr', 'de', 'ja']
+          defaultLanguage: 'en'
+    - entity-card:org/members-list:
+        config:
+          showAggregateMembersToggle: true
+          initialRelationAggregation: aggregated
+    - entity-card:org/ownership:
+        config:
+          ownedKinds: ['Component', 'API', 'System']
+
+    # - apis.plugin.graphiql.browse.gitlab: true
+    # - graphiql-endpoint:graphiql/gitlab: true
+
+    - nav-item:search: false
+    - nav-item:user-settings: false
+    - nav-item:catalog
+    - nav-item:api-docs
+    - nav-item:scaffolder
+    - nav-item:app-visualizer
+
+    # Pages
+    - page:catalog/entity:
+        config:
+          showNavItemIcons: true
+          # default content order for all groups, can be 'title' or 'natural'
+          # defaultContentOrder: title
+          groups:
+            # placing a tab at the beginning
+            - overview:
+                title: Overview
+            # example disabling a default group
+            # - development: false
+            # example overriding a default group title
+            - documentation:
+                title: Docs
+                icon: docs
+                # example aliasing a group
+                # aliases:
+                #   - docs
+            - deployment:
+                title: Deployments
+            # example adding a new group
+            - custom:
+                title: Custom
+
+    # Entity page cards
+    - entity-card:catalog/about:
+        config:
+          type: info
+    - entity-card:catalog/labels
+    - entity-card:catalog/links:
+        config:
+          filter:
+            kind: component
+            metadata.links:
+              $exists: true
+          # filter: kind:component has:links
+          type: info
+    # - entity-card:linguist/languages
+    - entity-card:catalog-graph/relations:
+        config:
+          height: 300
+    - entity-card:api-docs/has-apis
+    - entity-card:api-docs/consumed-apis
+    - entity-card:api-docs/provided-apis
+    - entity-card:api-docs/providing-components
+    - entity-card:api-docs/consuming-components
+    # Org Plugin
+    - entity-card:org/group-profile
+    - entity-card:org/members-list
+    - entity-card:org/ownership
+    - entity-card:org/user-profile:
+        config:
+          maxRelations: 5
+          hideIcons: true
+    # - entity-card:azure-devops/readme
+
+    # Entity page contents
+    - entity-content:catalog/overview
+    - entity-content:api-docs/definition
+    - entity-content:api-docs/apis:
+        config:
+          # example overriding the default group
+          group: documentation
+          icon: kind:api
+    - entity-content:techdocs:
+        config:
+          icon: techdocs
+    - entity-content:kubernetes/kubernetes:
+        config:
+          # example disassociating from the default group
+          group: false
+    # - entity-content:azure-devops/pipelines
+    # - entity-content:azure-devops/pull-requests
+    # - entity-content:azure-devops/git-tags
+
+    # Enable the catalog-unprocessed-entities tab in devtools
+    - devtools-content:catalog-unprocessed-entities: true
+    # Disable the catalog-unprocessed-entities element outside devtools
+    - page:catalog-unprocessed-entities: false
+
 backend:
   # Used for enabling authentication, secret is shared by all backend plugins
   # See https://backstage.io/docs/auth/service-to-service-auth for