Merge branch 'master' of https://github.com/backstage/backstage into add-catalog-permissions

.changeset/afraid-boxes-rhyme.md

@@ -0,0 +1,9 @@
+---
+'@backstage/core-components': patch
+'@backstage/plugin-catalog-react': patch
+'@backstage/plugin-techdocs': patch
+'@backstage/plugin-catalog': patch
+'@backstage/plugin-home': patch
+---
+
+Add `FavoriteToggle` in `core-components` to standardise favorite marking

.changeset/afraid-fans-cross.md

@@ -0,0 +1,8 @@
+---
+'@backstage/create-app': patch
+'@backstage/cli': patch
+---
+
+Add `config.d.ts` files to the list of included file in `tsconfig.json`.
+
+This allows ESLint to detect issues or deprecations in those files.

.changeset/angry-hotels-warn.md

@@ -0,0 +1,6 @@
+---
+'@backstage/backend-defaults': minor
+'@backstage/backend-common': minor
+---
+
+**BREAKING**: You can no longer supply a `basePath` option to the host discovery implementation. In the new backend system, the ability to choose this path has been removed anyway at the plugin router level.

.changeset/beige-jobs-begin.md

@@ -0,0 +1,5 @@
+---
+'@backstage/cli': patch
+---
+
+Remove direct `vite` dependency

.changeset/breezy-guests-scream.md

@@ -0,0 +1,5 @@
+---
+'@backstage/frontend-test-utils': patch
+---
+
+The extension tester will no longer unconditionally enable any additional extensions that have been added.

.changeset/bright-pillows-confess.md

@@ -0,0 +1,5 @@
+---
+'@backstage/core-components': patch
+---
+
+Removed default title set to Unknown page on `ContentHeaderTitle` component to support usage of component without title prop.

.changeset/brown-queens-lick.md

@@ -0,0 +1,5 @@
+---
+'@backstage/core-components': patch
+---
+
+Use getOptionalString for optional app.support.items[].links[].title

.changeset/calm-toes-melt.md

@@ -0,0 +1,5 @@
+---
+'@backstage/core-app-api': patch
+---
+
+The `defaultConfigLoader` now also reads configuration from scripts tags with `type="backstage.io/config"`. The tag is expected to contain a JSON-serialized array of `AppConfig` objects. If any of these script tags are present, the injected runtime configuration in the static assets will no longer be used.

.changeset/chilled-cameras-change.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-catalog-backend-module-gitlab': patch
+---
+
+Internal update to use the new cache manager

.changeset/chilly-birds-shout.md

@@ -0,0 +1,7 @@
+---
+'@backstage/backend-common': minor
+---
+
+**BREAKING**: Simplifications and cleanup as part of the Backend System 1.0 work.
+
+- The deprecated `dropDatabase` function has now been removed, without replacement.

.changeset/cool-actors-sin.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend-module-aws-alb-provider': patch
+---
+
+Throw correct error when email is missing from the claims

.changeset/create-app-1725976494.md

@@ -0,0 +1,5 @@
+---
+'@backstage/create-app': patch
+---
+
+Bumped create-app version.

.changeset/cuddly-glasses-battle.md

@@ -0,0 +1,7 @@
+---
+'@backstage/integration-react': patch
+---
+
+Remove unnecessary broad permissions from Gitlab `SCMAuth`
+
+Newer versions of Gitlab (after 2019) do not require the broad api permissions to write to repos.

.changeset/dependabot-b42f054.md

@@ -0,0 +1,7 @@
+---
+'@backstage/backend-app-api': patch
+'@backstage/backend-common': patch
+'@backstage/backend-defaults': patch
+---
+
+chore(deps): bump `path-to-regexp` from 6.2.2 to 8.0.0

.changeset/dry-glasses-push.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-node': patch
+---
+
+Extend the "unable to resolve user identity" message

.changeset/early-cats-deliver.md

@@ -0,0 +1,5 @@
+---
+'@backstage/core-components': patch
+---
+
+Support menu items should not be buttons in favour of links

.changeset/early-swans-grab.md

@@ -0,0 +1,12 @@
+---
+'@backstage/plugin-scaffolder-backend-module-confluence-to-markdown': patch
+'@backstage/plugin-scaffolder-backend-module-cookiecutter': patch
+'@backstage/plugin-scaffolder-backend-module-gitlab': patch
+'@backstage/plugin-scaffolder-backend-module-sentry': patch
+'@backstage/plugin-scaffolder-backend-module-yeoman': patch
+'@backstage/plugin-scaffolder-backend-module-rails': patch
+'@backstage/plugin-user-settings-backend': patch
+'@backstage/plugin-devtools-backend': patch
+---
+
+Update README installation instructions

.changeset/fair-peaches-learn.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-scaffolder-backend': patch
+---
+
+Allow listing file contents with `debug:log` scaffolder action

.changeset/fair-seals-burn.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-node': patch
+---
+
+Accepts an optional options object in the `PassportOAuthAuthenticatorHelper.authenticate` method.

.changeset/fast-experts-grin.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend': patch
+---
+
+Migrated the `Bitbucket Server` auth provider to be implemented using the new `@backstage/plugin-auth-backend-module-bitbucket-server-provider` module.

.changeset/few-icons-end.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-scaffolder': minor
+---
+
+Expose styles for TemplateEditor, TemplateFormPreviewer and CustomFieldExplorer

.changeset/five-walls-carry.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-notifications': patch
+---
+
+Severity filter label newly contains "Min severity" to better describe range instead of exact value.

.changeset/forty-eyes-return.md

@@ -0,0 +1,5 @@
+---
+'@backstage/cli': patch
+---
+
+Update Scaffolder module template to add itself to the backend

.changeset/funny-rocks-pull.md

@@ -0,0 +1,6 @@
+---
+'@backstage/plugin-scaffolder-react': minor
+'@backstage/plugin-scaffolder': minor
+---
+
+Added support for `omitExtraData` and `liveOmit` for rjsf in the scaffolder

.changeset/fuzzy-feet-exist.md

@@ -0,0 +1,34 @@
+---
+'@backstage/frontend-plugin-api': patch
+'@backstage/plugin-app': patch
+---
+
+Deprecated the `namespace` option for `createExtensionBlueprint` and `createExtension`, these are no longer required and will default to the `pluginId` instead.
+
+You can migrate some of your extensions that use `createExtensionOverrides` to using `createFrontendModule` instead and providing a `pluginId` there.
+
+```ts
+// Before
+createExtensionOverrides({
+  extensions: [
+    createExtension({
+      name: 'my-extension',
+      namespace: 'my-namespace',
+      kind: 'test',
+      ...
+    })
+  ],
+});
+
+// After
+createFrontendModule({
+  pluginId: 'my-namespace',
+  extensions: [
+    createExtension({
+      name: 'my-extension',
+      kind: 'test',
+      ...
+    })
+  ],
+});
+```

.changeset/fuzzy-fireants-crash.md

@@ -0,0 +1,6 @@
+---
+'@backstage/plugin-scaffolder-backend': minor
+'@backstage/plugin-scaffolder-backend-module-bitbucket-cloud': patch
+---
+
+Added scaffolder action publish:bitbucketCloud:pull-request

.changeset/gentle-hats-act.md

@@ -0,0 +1,5 @@
+---
+'@backstage/frontend-defaults': patch
+---
+
+Added a new `CreateAppOptions` type for the `createApp` options.

.changeset/great-zebras-hunt.md

@@ -0,0 +1,7 @@
+---
+'@backstage/cli': patch
+---
+
+The app build process now outputs an additional `index.html.tmpl` file. This is an non-templated version of the `index.html` file, which can be used to delay templating until runtime.
+
+The new `index.html.tmpl` file also sets a `backstage-public-path` meta tag to be templated at runtime. The meta tag is in turn picked up by the new `@backstage/cli/config/webpack-public-path.js` entry point script, which uses it to set the runtime public path of the Webpack bundle.

.changeset/green-pumas-build.md

@@ -0,0 +1,11 @@
+---
+'@backstage/backend-plugin-api': major
+'@backstage/backend-app-api': major
+'@backstage/backend-test-utils': major
+---
+
+Release 1.0 of the new backend system! :tada:
+
+The backend system is finally getting promoted to 1.0.0. This means that the API is now stable and breaking changes should not occur until version 2.0.0, see our [package versioning policy](https://backstage.io/docs/overview/versioning-policy/#package-versioning-policy) for more information what this means.
+
+This release also marks the end of the old backend system based on `createRouter` exports. Going forward backend plugins packages will start to deprecate and later this year remove exports supporting the old backend system. If you would like to help out with this transition, see https://github.com/backstage/backstage/issues/26353 or consult the [migration guide](https://backstage.io/docs/backend-system/building-plugins-and-modules/migrating/#remove-support-for-the-old-backend-system).

.changeset/happy-bags-invite.md

@@ -0,0 +1,9 @@
+---
+'@backstage/core-components': patch
+'@backstage/app-defaults': patch
+'@backstage/plugin-catalog-react': patch
+'@backstage/core-app-api': patch
+'@backstage/test-utils': patch
+---
+
+Allow custom star icons to be provided via the `star` and `unstarred` icon overrides. See how to override existing icons in the [Backstage documentation](https://backstage.io/docs/getting-started/app-custom-theme/#custom-icons).

.changeset/hip-bottles-hear.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend': patch
+---
+
+Migrated the `Auth0` auth provider to be implemented using the new `@backstage/plugin-auth-backend-module-auth0-provider` module.

.changeset/hip-fans-decide.md

@@ -0,0 +1,5 @@
+---
+'@backstage/cli-node': patch
+---
+
+Add definition for the new `backstage.inline` field in `package.json`.

.changeset/hip-poems-invent.md

@@ -0,0 +1,8 @@
+---
+'@backstage/catalog-client': minor
+'@backstage/plugin-catalog-backend': minor
+'@backstage/plugin-catalog-react': minor
+'@backstage/plugin-catalog': minor
+---
+
+Allow offset mode paging in entity list provider

.changeset/khaki-clocks-own.md

@@ -0,0 +1,5 @@
+---
+'@backstage/backend-test-utils': patch
+---
+
+Make MySQL pool settings a bit more lax

.changeset/khaki-crews-rule.md

@@ -0,0 +1,11 @@
+---
+'@backstage/plugin-app-backend': patch
+---
+
+**BREAKING**: The app backend now supports the new `index.html.tmpl` output from `@backstage/cli`. If available, the `index.html` will be templated at runtime with the current configuration of the app backend.
+
+This is marked as a breaking change because you must now supply the app build-time configuration to the backend. This change also affects the public path behavior, where it is no longer necessary to build the app with the correct public path upfront. You now only need to supply a correct `app.baseUrl` to the app backend plugin at runtime.
+
+An effect that this change has is that the `index.html` will now contain and present the frontend configuration in an easily readable way, which can aid in debugging. This data was always available in the frontend, but it was injected and hidden in the static bundle.
+
+This templating behavior is enabled by default, but it can be disabled by setting the `app.disableConfigInjection` configuration option to `true`.

.changeset/long-peas-repeat.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-techdocs-node': patch
+---
+
+Add support for mapping custom tags in the techdocs yaml parser that validates the mkdocs.yaml file

.changeset/loud-singers-happen.md

@@ -0,0 +1,16 @@
+---
+'@backstage/plugin-catalog-backend-module-gitlab': patch
+---
+
+Add the `relations` array to allow Backstage to mirror GitLab's membership behavior, including descendant, inherited, and shared-from-group memberships.
+
+The previous `allowInherited` config option will be deprecated in future versions. Use the `relations` array with the `INHERITED` option instead.
+
+```yaml
+catalog:
+  providers:
+    gitlab:
+      development:
+        relations:
+          - INHERITED
+```

.changeset/odd-goats-kiss.md

@@ -0,0 +1,5 @@
+---
+'@backstage/core-components': patch
+---
+
+Added `titleComponent` prop to `SignInPage` component to allow further customization of the title using `ReactNode`

.changeset/odd-insects-behave.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-catalog-import': patch
+---
+
+Support button title should be contained in a single menu item

.changeset/orange-shrimps-pull.md

@@ -0,0 +1,6 @@
+---
+'@backstage/plugin-notifications-backend': patch
+'@backstage/plugin-notifications': patch
+---
+
+Implement icon in backend and show icon in table if available.

.changeset/orange-trainers-allow.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-app': patch
+---
+
+Fix issue with `AlertDisplay` and other components defined with `AppRootElementBlueprint` not being rendered when at the `SignInWrapper`

.changeset/plenty-dragons-know.md

@@ -0,0 +1,5 @@
+---
+'@backstage/frontend-defaults': patch
+---
+
+Added `createPublicSignInApp`, used to creating apps for the public entry point.

.changeset/plenty-hounds-poke.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-scaffolder-backend-module-github': patch
+---
+
+Added the ability for the actions `publish:github` and `github:repo:create` to take inputs for 'custom properties' for organization repositories.

.changeset/popular-pumpkins-rush.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-scaffolder-react': patch
+---
+
+Fix scaffolder review step issue where schema options are not handled for fields on multi-step templates.

.changeset/pre.json

@@ -187,85 +187,188 @@
     "@backstage/plugin-user-settings": "0.8.11",
     "@backstage/plugin-user-settings-backend": "0.2.22",
     "@backstage/plugin-user-settings-common": "0.0.1",
-    "@backstage/plugin-app": "0.0.0"
+    "@backstage/plugin-app": "0.0.0",
+    "@backstage/frontend-defaults": "0.0.0",
+    "@internal/frontend": "0.0.0",
+    "@backstage/plugin-auth-backend-module-auth0-provider": "0.0.0",
+    "@backstage/plugin-auth-backend-module-bitbucket-server-provider": "0.0.0"
   },
   "changesets": [
+    "afraid-boxes-rhyme",
+    "afraid-fans-cross",
+    "angry-hotels-warn",
+    "beige-jobs-begin",
     "big-spies-stare",
     "blue-forks-cry",
     "breezy-flowers-dance",
+    "breezy-guests-scream",
+    "bright-pillows-confess",
     "brown-actors-clap",
     "brown-boxes-arrive",
+    "brown-queens-lick",
     "brown-worms-sneeze",
     "calm-brooms-fail",
+    "calm-toes-melt",
+    "chilled-cameras-change",
+    "chilly-birds-shout",
     "cold-ways-protect",
+    "cool-actors-sin",
     "cool-melons-check",
     "cool-poems-hammer",
+    "create-app-1725976494",
+    "cuddly-glasses-battle",
     "cuddly-rocks-invent",
     "curly-brooms-raise",
+    "dependabot-b42f054",
+    "dry-beers-shake",
+    "dry-glasses-push",
     "dry-monkeys-mate",
+    "early-cats-deliver",
+    "early-swans-grab",
     "eighty-tables-hope",
     "empty-coats-sparkle",
+    "fair-peaches-learn",
+    "fair-seals-burn",
+    "famous-badgers-drop",
+    "fast-experts-grin",
+    "few-icons-end",
     "five-tigers-share",
+    "five-walls-carry",
     "flat-kangaroos-push",
+    "forty-eyes-return",
     "forty-toes-float",
+    "four-parents-buy",
     "four-ties-raise",
     "fresh-apes-dress",
+    "fresh-bears-prove",
     "fresh-pumas-clean",
+    "friendly-days-march",
+    "friendly-months-march",
     "funny-houses-rest",
+    "funny-rocks-pull",
+    "fuzzy-feet-exist",
+    "fuzzy-fireants-crash",
     "fuzzy-mails-walk",
     "fuzzy-spies-share",
+    "gentle-hats-act",
     "giant-jars-mix",
+    "gorgeous-scissors-wave",
+    "great-zebras-hunt",
+    "green-pumas-build",
     "green-worms-rescue",
+    "happy-bags-invite",
     "healthy-moons-drum",
     "heavy-suits-judge",
+    "hip-bottles-hear",
+    "hip-fans-decide",
     "hip-pandas-think",
+    "hip-poems-invent",
+    "khaki-clocks-own",
+    "khaki-crews-rule",
     "kind-moose-learn",
     "kind-walls-speak",
     "large-poets-check",
+    "long-peas-repeat",
+    "loud-brooms-pull",
+    "loud-singers-happen",
     "lucky-sheep-cover",
     "metal-garlics-fetch",
     "metal-rivers-grin",
+    "mighty-cheetahs-call",
     "mighty-days-kiss",
     "nasty-tigers-knock",
     "new-poets-unite",
     "ninety-mayflies-raise",
+    "odd-goats-kiss",
+    "odd-insects-behave",
     "olive-phones-sniff",
+    "orange-shrimps-pull",
+    "orange-trainers-allow",
+    "plenty-dragons-know",
+    "plenty-hounds-poke",
     "popular-cooks-camp",
+    "popular-pumpkins-rush",
+    "proud-forks-buy",
     "purple-cows-sing",
     "purple-glasses-tease",
+    "quick-poets-relax",
+    "quick-suns-swim",
+    "quiet-spies-clean",
+    "rare-dogs-deny",
     "rare-feet-melt",
     "real-pants-rule",
+    "red-squids-own",
+    "renovate-11b1a0c",
+    "renovate-233ed8f",
+    "renovate-2a3da15",
+    "renovate-53b7d25",
+    "renovate-546c524",
+    "renovate-6d3e04e",
+    "renovate-93d032c",
+    "renovate-94fd31b",
+    "renovate-a674163",
+    "renovate-b8911c2",
+    "renovate-c59c91d",
+    "rich-bees-tickle",
+    "rich-cheetahs-vanish",
+    "rotten-crabs-hear",
+    "rude-fireants-accept",
     "serious-cheetahs-help",
+    "serious-spies-knock",
+    "seven-beds-deliver",
     "sharp-fans-tan",
     "sharp-items-study",
     "sharp-mayflies-beg",
+    "shiny-ants-relax",
+    "shiny-carpets-worried",
+    "shiny-carpets-worry",
     "shiny-zoos-film",
     "short-moles-brush",
     "silent-eyes-lie",
+    "silent-oranges-trade",
+    "silent-worms-admire",
+    "silly-icons-agree",
     "six-goats-sort",
     "six-humans-guess",
     "sixty-rabbits-cheat",
+    "slimy-chefs-think",
+    "slimy-hornets-explode",
+    "smart-beers-give",
+    "smart-gifts-report",
+    "smart-owls-sell",
     "spicy-poems-hammer",
     "spicy-vans-eat",
+    "strange-snakes-agree",
+    "stupid-toes-complain",
     "sweet-cows-clean",
+    "swift-fishes-rush",
     "swift-garlics-mix",
     "swift-radios-enjoy",
     "swift-seahorses-share",
+    "tall-camels-march",
     "tame-hornets-shake",
     "tasty-pigs-vanish",
     "thick-walls-share",
+    "thirty-bottles-rest",
+    "three-socks-call",
+    "tiny-icons-sit",
     "tiny-waves-provide",
     "tough-peaches-kneel",
     "tricky-apricots-film",
     "twenty-clouds-melt",
+    "twenty-jobs-repeat",
     "twenty-queens-grow",
+    "two-islands-deny",
     "unlucky-cycles-clean",
+    "violet-apricots-smoke",
     "violet-jokes-tap",
     "warm-boxes-grab-2",
     "warm-boxes-grab",
     "wild-buses-notice",
+    "wise-forks-play",
     "wise-scissors-help",
     "witty-years-cry",
-    "yellow-bees-hope"
+    "yellow-bees-hope",
+    "yellow-panthers-decide"
   ]
 }

.changeset/proud-forks-buy.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-scaffolder': patch
+---
+
+The `ui:options` for `OwnedEntityPicker` field are now passed to `EntityPicker`. This allows you to use any `ui:options` which `EntityPicker` accepts in the `OwnedEntityPicker` field including `allowArbitraryValues` and `defaultNamespace`.

.changeset/quick-poets-relax.md

@@ -0,0 +1,6 @@
+---
+'@backstage/core-components': patch
+'@backstage/plugin-search-react': patch
+---
+
+Internal update to match recent React types

.changeset/quick-suns-swim.md

@@ -0,0 +1,5 @@
+---
+'@backstage/backend-defaults': patch
+---
+
+Accept `ConfigService` instead of `Config` in constructors/factories

.changeset/quiet-spies-clean.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-catalog-graph': patch
+---
+
+Fixed a bug in the `CatalogGraphPage` component where, after clicking on some nodes, clicking the back button would break the navigation. This issue caused the entire navigation to fail and behaved differently across various browsers.

.changeset/rare-dogs-deny.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend-module-auth0-provider': minor
+---
+
+New module for `@backstage/plugin-auth-backend` that adds a Auth0 auth provider.

.changeset/red-squids-own.md

@@ -0,0 +1,11 @@
+---
+'@backstage/integration': minor
+---
+
+The Gerrit integration can now resolve Gitiles urls that point to the following
+refs:
+
+- HEAD
+- A SHA
+- Tag
+- Branch

.changeset/renovate-11b1a0c.md

@@ -0,0 +1,5 @@
+---
+'@backstage/cli': patch
+---
+
+Updated dependency `@module-federation/enhanced` to `^0.6.0`.

.changeset/renovate-233ed8f.md

@@ -0,0 +1,45 @@
+---
+'@backstage/app-defaults': patch
+'@backstage/core-app-api': patch
+'@backstage/core-compat-api': patch
+'@backstage/core-components': patch
+'@backstage/core-plugin-api': patch
+'@backstage/dev-utils': patch
+'@backstage/frontend-app-api': patch
+'@backstage/frontend-defaults': patch
+'@backstage/frontend-plugin-api': patch
+'@backstage/frontend-test-utils': patch
+'@backstage/test-utils': patch
+'@backstage/theme': patch
+'@backstage/version-bridge': patch
+'@backstage/plugin-api-docs': patch
+'@backstage/plugin-app': patch
+'@backstage/plugin-auth-react': patch
+'@backstage/plugin-catalog-graph': patch
+'@backstage/plugin-catalog-import': patch
+'@backstage/plugin-catalog-react': patch
+'@backstage/plugin-catalog-unprocessed-entities': patch
+'@backstage/plugin-catalog': patch
+'@backstage/plugin-config-schema': patch
+'@backstage/plugin-home': patch
+'@backstage/plugin-kubernetes-cluster': patch
+'@backstage/plugin-kubernetes-react': patch
+'@backstage/plugin-kubernetes': patch
+'@backstage/plugin-notifications': patch
+'@backstage/plugin-org-react': patch
+'@backstage/plugin-org': patch
+'@backstage/plugin-permission-react': patch
+'@backstage/plugin-scaffolder-react': patch
+'@backstage/plugin-scaffolder': patch
+'@backstage/plugin-search-react': patch
+'@backstage/plugin-search': patch
+'@backstage/plugin-signals-react': patch
+'@backstage/plugin-signals': patch
+'@backstage/plugin-techdocs-addons-test-utils': patch
+'@backstage/plugin-techdocs-module-addons-contrib': patch
+'@backstage/plugin-techdocs-react': patch
+'@backstage/plugin-techdocs': patch
+'@backstage/plugin-user-settings': patch
+---
+
+Updated dependency `@testing-library/react` to `^16.0.0`.

.changeset/renovate-2a3da15.md

@@ -0,0 +1,5 @@
+---
+'@backstage/config-loader': patch
+---
+
+Updated dependency `typescript-json-schema` to `^0.65.0`.

.changeset/renovate-546c524.md

@@ -0,0 +1,5 @@
+---
+'@backstage/repo-tools': patch
+---
+
+Updated dependency `@useoptic/openapi-utilities` to `^0.55.0`.

.changeset/renovate-6d3e04e.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend': patch
+---
+
+Updated dependency `@node-saml/passport-saml` to `^5.0.0`.

.changeset/renovate-94fd31b.md

@@ -0,0 +1,38 @@
+---
+'@backstage/backend-app-api': patch
+'@backstage/backend-common': patch
+'@backstage/backend-defaults': patch
+'@backstage/backend-openapi-utils': patch
+'@backstage/backend-test-utils': patch
+'@backstage/plugin-app-backend': patch
+'@backstage/plugin-auth-backend-module-atlassian-provider': patch
+'@backstage/plugin-auth-backend-module-bitbucket-provider': patch
+'@backstage/plugin-auth-backend-module-github-provider': patch
+'@backstage/plugin-auth-backend-module-gitlab-provider': patch
+'@backstage/plugin-auth-backend-module-google-provider': patch
+'@backstage/plugin-auth-backend-module-microsoft-provider': patch
+'@backstage/plugin-auth-backend-module-oauth2-provider': patch
+'@backstage/plugin-auth-backend-module-oidc-provider': patch
+'@backstage/plugin-auth-backend-module-okta-provider': patch
+'@backstage/plugin-auth-backend-module-onelogin-provider': patch
+'@backstage/plugin-auth-backend-module-pinniped-provider': patch
+'@backstage/plugin-auth-backend-module-vmware-cloud-provider': patch
+'@backstage/plugin-auth-backend': patch
+'@backstage/plugin-auth-node': patch
+'@backstage/plugin-catalog-backend': patch
+'@backstage/plugin-devtools-backend': patch
+'@backstage/plugin-events-backend': patch
+'@backstage/plugin-kubernetes-backend': patch
+'@backstage/plugin-kubernetes-node': patch
+'@backstage/plugin-notifications-backend': patch
+'@backstage/plugin-permission-backend': patch
+'@backstage/plugin-permission-node': patch
+'@backstage/plugin-scaffolder-backend': patch
+'@backstage/plugin-search-backend': patch
+'@backstage/plugin-signals-backend': patch
+'@backstage/plugin-techdocs-backend': patch
+'@backstage/plugin-techdocs-node': patch
+'@backstage/plugin-user-settings-backend': patch
+---
+
+Updated dependency `supertest` to `^7.0.0`.

.changeset/renovate-a674163.md

@@ -0,0 +1,11 @@
+---
+'@backstage/plugin-home-react': patch
+'@backstage/plugin-home': patch
+'@backstage/plugin-scaffolder-react': patch
+'@backstage/plugin-scaffolder': patch
+---
+
+Updated dependency `@rjsf/utils` to `5.20.1`.
+Updated dependency `@rjsf/core` to `5.20.1`.
+Updated dependency `@rjsf/material-ui` to `5.20.1`.
+Updated dependency `@rjsf/validator-ajv8` to `5.20.1`.

.changeset/renovate-b8911c2.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-scaffolder-react': patch
+---
+
+Updated dependency `use-immer` to `^0.10.0`.

.changeset/renovate-c59c91d.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-search-backend-module-explore': patch
+---
+
+Updated dependency `@backstage-community/plugin-explore-common` to `^0.0.5`.

.changeset/rich-cheetahs-vanish.md

@@ -0,0 +1,6 @@
+---
+'@backstage/backend-common': patch
+'@backstage/plugin-techdocs-node': patch
+---
+
+Internal fixes to match `testcontainers` update

.changeset/rude-fireants-accept.md

@@ -0,0 +1,5 @@
+---
+'@backstage/backend-plugin-api': patch
+---
+
+Add a `toJSON` on refs so that they can appear in expectations in jest tests

.changeset/seven-beds-deliver.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-user-settings': patch
+---
+
+Update README to clarify location of additional tabs example

.changeset/shiny-ants-relax.md

@@ -0,0 +1,5 @@
+---
+'@backstage/cli': patch
+---
+
+Upgrade to `vite@v5`

.changeset/shiny-carpets-worried.md

@@ -0,0 +1,5 @@
+---
+'@backstage/core-compat-api': minor
+---
+
+**BREAKING**: The `namespace` parameter for API's is now defaulted to the `pluginId` which was discovered. This means that if you're overriding API's by using ID's directly, they might have changed to include the plugin ID too.

.changeset/shiny-carpets-worry.md

@@ -0,0 +1,7 @@
+---
+'@backstage/frontend-plugin-api': patch
+'@backstage/frontend-test-utils': patch
+'@backstage/frontend-app-api': patch
+---
+
+Removing deprecated `namespace` parameter in favour of `pluginId` instead

.changeset/silent-oranges-trade.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend-module-bitbucket-server-provider': minor
+---
+
+New module for `@backstage/plugin-auth-backend` that adds a `Bitbucket Server` auth provider.

.changeset/silent-worms-admire.md

@@ -0,0 +1,5 @@
+---
+'@backstage/backend-defaults': minor
+---
+
+**BREAKING** Removed `createLifecycleMiddleware` and `LifecycleMiddlewareOptions` to clean up API surface. These exports have no external usage and do not provide value in its current form. If you were using these exports, please reach out to the maintainers to discuss your use case.

.changeset/silly-icons-agree.md

@@ -0,0 +1,7 @@
+---
+'@backstage/plugin-catalog-graph': patch
+'@backstage/plugin-api-docs': patch
+'@backstage/plugin-org': patch
+---
+
+Updating docs to use `createFrontendModule` instead

.changeset/slimy-chefs-think.md

@@ -0,0 +1,8 @@
+---
+'@backstage/plugin-notifications-backend-module-email': patch
+'@backstage/plugin-catalog-backend-module-github': patch
+'@backstage/plugin-notifications-backend': patch
+'@backstage/plugin-techdocs-backend': patch
+---
+
+Refactor to use injected catalog client in the new backend system

.changeset/slimy-hornets-explode.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-scaffolder': patch
+---
+
+Removed duplicated titles on Scaffolder `TemplateListPage` component

.changeset/smart-beers-give.md

@@ -0,0 +1,6 @@
+---
+'@backstage/frontend-plugin-api': patch
+'@backstage/frontend-test-utils': patch
+---
+
+Internal refactor

.changeset/smart-gifts-report.md

@@ -0,0 +1,8 @@
+---
+'@backstage/plugin-catalog-unprocessed-entities': patch
+---
+
+Show additional info on DevTools unprocessed entities table
+
+- Location path (so that it's easier to search the failed entity from the YAML URL)
+- Time info of last discovery and next refresh time so that users can be aware of it and can sort the errors based on the time.

.changeset/strange-snakes-agree.md

@@ -0,0 +1,5 @@
+---
+'@backstage/dev-utils': minor
+---
+
+Allow using translations in `createDevApp`

.changeset/stupid-toes-complain.md

@@ -0,0 +1,5 @@
+---
+'@backstage/cli': patch
+---
+
+The build commands now support the new `backstage.inline` flag in `package.json`, which causes the contents of private packages to be inlined into the consuming package, rather than be treated as an external dependency.

.changeset/swift-fishes-rush.md

@@ -0,0 +1,5 @@
+---
+'@backstage/cli': patch
+---
+
+Fixed an issue where published frontend packages would end up with an invalid import structure if a single module imported both `.css` and `.svg` files.

.changeset/thirty-bottles-rest.md

@@ -0,0 +1,5 @@
+---
+'@backstage/eslint-plugin': patch
+---
+
+Added support for linting dependencies on workspace packages with the `backstage.inline` flag.

.changeset/three-socks-call.md

@@ -0,0 +1,5 @@
+---
+'@backstage/frontend-plugin-api': patch
+---
+
+The `factory` option is no longer required when overriding an extension.

.changeset/twenty-jobs-repeat.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-techdocs': patch
+---
+
+Enhanced the table hover effect with a lighter color and updated the border radius to align with Backstage's theme styling

.changeset/two-islands-deny.md

@@ -0,0 +1,5 @@
+---
+'@backstage/cli': patch
+---
+
+Add support for `backstage:^` version ranges to versions:bump when using the experimental yarn plugin

.changeset/wise-forks-play.md

@@ -0,0 +1,17 @@
+---
+'@backstage/backend-defaults': minor
+---
+
+**BREAKING**: Simplifications and cleanup as part of the Backend System 1.0 work.
+
+For the `/database` subpath exports:
+
+- The deprecated `dropDatabase` function has now been removed, without replacement.
+- The deprecated `LegacyRootDatabaseService` type has now been removed.
+- The return type from `DatabaseManager.forPlugin` is now directly a `DatabaseService`, as arguably expected.
+- `DatabaseManager.forPlugin` now requires the `deps` argument, with the logger and lifecycle services.
+
+For the `/cache` subpath exports:
+
+- The `PluginCacheManager` type has been removed. You can still import it from `@backstage/backend-common`, but it's deprecated there, and you should move off of that package by migrating fully to the new backend system.
+- Accordingly, `CacheManager.forPlugin` immediately returns a `CacheService` instead of a `PluginCacheManager`. The outcome of this is that you no longer need to make the extra `.getClient()` call. The old `CacheManager` with the old behavior still exists on `@backstage/backend-common`, but the above recommendations apply.

.changeset/yellow-panthers-decide.md

@@ -0,0 +1,5 @@
+---
+'@backstage/repo-tools': patch
+---
+
+Avoid generating API reports for packages with `backstage.inline` set.

.github/workflows/api-breaking-changes.yml

@@ -46,7 +46,7 @@ jobs:
           cat ${{ github.event_path }} > event.json
 
       - name: Upload Artifacts
-        uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4
+        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4
         with:
           name: preview-spec
           path: |

.github/workflows/deploy_docker-image.yml

@@ -61,7 +61,7 @@ jobs:
         uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db # v3.6.1
 
       - name: Build and push
-        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0
+        uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85 # v6.7.0
         with:
           context: './example-app'
           file: ./example-app/packages/backend/Dockerfile

.github/workflows/deploy_microsite.yml

@@ -8,14 +8,148 @@ permissions:
   contents: read
 
 jobs:
-  deploy-microsite-and-storybook:
-    permissions:
-      contents: write # for JamesIves/github-pages-deploy-action to push changes in repo
+  stable:
     runs-on: ubuntu-latest
+    concurrency:
+      group: stable-reference-${{ github.workflow }}-${{ github.ref }}
+      cancel-in-progress: true
 
     env:
       CI: true
       NODE_OPTIONS: --max-old-space-size=8192
+
+    outputs:
+      release: ${{ steps.find-release.outputs.result }}
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
+        with:
+          egress-policy: audit
+
+      - name: find latest release
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
+        id: find-release
+        with:
+          script: |
+            const { data } = await github.rest.repos.listTags({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              per_page: 100,
+            })
+
+            const [{tag}] = data
+              .map(i => i.name)
+              .filter(tag => tag.match(/^v\d+\.\d+\.\d+$/))
+              .map(tag => ({
+                tag,
+                val: tag
+                  .slice(1)
+                  .split('.')
+                  .reduce((val, part) => Number(val) * 1000 + Number(part))
+              }))
+              .sort((a, b) => b.val - a.val)
+
+            return tag
+          result-encoding: string
+
+      - name: checkout latest release
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+        with:
+          ref: refs/tags/${{ steps.find-release.outputs.result }}
+
+      - name: use node.js 18.x
+        uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
+        with:
+          node-version: 18.x
+          registry-url: https://registry.npmjs.org/ # Needed for auth
+
+      - name: yarn install
+        uses: backstage/actions/yarn-install@3c138326f7fcbf253b88170c1f29bae8e975d47c # v0.6.14
+        with:
+          cache-prefix: ${{ runner.os }}-v18.x
+
+      - name: build API reference
+        run: yarn build:api-docs
+
+      - name: upload API reference
+        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4
+        with:
+          name: stable-reference
+          path: docs/reference/
+          if-no-files-found: error
+          retention-days: 1
+
+  next:
+    runs-on: ubuntu-latest
+    concurrency:
+      group: next-reference-${{ github.workflow }}-${{ github.ref }}
+      cancel-in-progress: true
+    env:
+      CI: true
+      NODE_OPTIONS: --max-old-space-size=8192
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
+        with:
+          egress-policy: audit
+
+      - name: checkout master
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+
+      - name: use node.js 18.x
+        uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
+        with:
+          node-version: 18.x
+          registry-url: https://registry.npmjs.org/ # Needed for auth
+
+      - name: yarn install
+        uses: backstage/actions/yarn-install@3c138326f7fcbf253b88170c1f29bae8e975d47c # v0.6.14
+        with:
+          cache-prefix: ${{ runner.os }}-v18.x
+
+      - name: build API reference
+        run: yarn build:api-docs
+
+      - name: upload API reference
+        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4
+        with:
+          name: next-reference
+          path: docs/reference/
+          if-no-files-found: error
+          retention-days: 1
+
+        # Also build and upload storybook
+      - name: storybook yarn install
+        run: yarn install --immutable
+        working-directory: storybook
+
+      - name: storybook build
+        run: yarn build-storybook
+        working-directory: storybook
+
+      - name: storybook upload
+        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4
+        with:
+          name: storybook
+          path: storybook/dist/
+          if-no-files-found: error
+          retention-days: 1
+
+  deploy-microsite-and-storybook:
+    permissions:
+      contents: write # for JamesIves/github-pages-deploy-action to push changes in repo
+
+    runs-on: ubuntu-latest
+
+    needs:
+      - stable
+      - next
+
+    env:
+      CI: true
+      NODE_OPTIONS: --max-old-space-size=16384
       DOCUSAURUS_SSR_CONCURRENCY: 5
 
     concurrency:
@@ -28,45 +162,65 @@ jobs:
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-
       - name: use node.js 18.x
         uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
         with:
           node-version: 18.x
           registry-url: https://registry.npmjs.org/ # Needed for auth
 
-      # We avoid caching in this workflow, as we're running an install of both the top-level
-      # dependencies and the microsite. We leave it to the main master workflow to produce the
-      # cache, as that results in a smaller bundle.
-      - name: top-level yarn install
-        run: yarn install --immutable
+      # Stable docs
+      - name: checkout latest release
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+        with:
+          ref: refs/tags/${{ needs.stable.outputs.release }}
+
       - name: microsite yarn install
         run: yarn install --immutable
         working-directory: microsite
-      - name: storybook yarn install
-        run: yarn install --immutable
-        working-directory: storybook
 
-      - name: build API reference
-        run: yarn build:api-docs
+      - name: download stable reference
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4
+        with:
+          name: stable-reference
+          path: docs/reference
+
+      - name: generate stable docs
+        run: yarn docusaurus docs:version stable
+        working-directory: microsite
+
+      - name: clear API reference
+        run: rm -r docs/reference
+
+      # Next docs
+      - name: checkout master
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+        with:
+          clean: false
+
+      - name: microsite yarn install
+        run: yarn install --immutable
+        working-directory: microsite
+
+      - name: download next reference
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4
+        with:
+          name: next-reference
+          path: docs/reference
 
       - name: build microsite
         run: yarn build
         working-directory: microsite
 
-      - name: build storybook
-        run: yarn build-storybook
-        working-directory: storybook
-
-      - name: move storybook dist into microsite
-        run: mv storybook/dist/ microsite/build/storybook
+      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4
+        with:
+          name: storybook
+          path: microsite/build/storybook
 
       - name: Check the build output
         run: ls microsite/build && ls microsite/build/storybook
 
       - name: Deploy both microsite and storybook to gh-pages
-        uses: JamesIves/github-pages-deploy-action@94f3c658273cf92fb48ef99e5fbc02bd2dc642b2 # v4.6.3
+        uses: JamesIves/github-pages-deploy-action@920cbb300dcd3f0568dbc42700c61e2fd9e6139c # v4.6.4
         with:
           branch: gh-pages
           folder: microsite/build

.github/workflows/pr-review-comment-trigger.yaml

@@ -30,7 +30,7 @@ jobs:
         run: |
           mkdir -p ./pr
           echo $PR_NUMBER > ./pr/pr_number
-      - uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6
+      - uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
         with:
           name: pr_number-${{ github.event.pull_request.number }}
           path: pr/

.github/workflows/scorecard.yml

@@ -58,7 +58,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: 'Upload artifact'
-        uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6
+        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
         with:
           name: SARIF file
           path: results.sarif
@@ -67,6 +67,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: 'Upload to code-scanning'
-        uses: github/codeql-action/upload-sarif@2c779ab0d087cd7fe7b826087247c2c81f27bfa6 # v3.26.5
+        uses: github/codeql-action/upload-sarif@4dd16135b69a43b6c8efb853346f8437d92d3c93 # v3.26.6
         with:
           sarif_file: results.sarif

.github/workflows/sync_snyk-github-issues.yml

@@ -29,7 +29,7 @@ jobs:
           cache-prefix: ${{ runner.os }}-v18.x
 
       - name: Create Snyk report
-        uses: snyk/actions/node@9213221444c2dc9e8b2502c1e857c26d851e84a7 # master
+        uses: snyk/actions/node@cdb760004ba9ea4d525f2e043745dfe85bb9077e # master
         continue-on-error: true # Snyk CLI exits with error when vulnerabilities are found
         with:
           args: >

.github/workflows/sync_snyk-monitor.yml

@@ -31,7 +31,7 @@ jobs:
 
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - name: Monitor and Synchronize Snyk Policies
-        uses: snyk/actions/node@9213221444c2dc9e8b2502c1e857c26d851e84a7 # master
+        uses: snyk/actions/node@cdb760004ba9ea4d525f2e043745dfe85bb9077e # master
         with:
           command: monitor
           args: >
@@ -46,7 +46,7 @@ jobs:
       # Above we run the `monitor` command, this runs the `test` command which is
       # the one that generates the SARIF report that we can upload to GitHub.
       - name: Create Snyk report
-        uses: snyk/actions/node@9213221444c2dc9e8b2502c1e857c26d851e84a7 # master
+        uses: snyk/actions/node@cdb760004ba9ea4d525f2e043745dfe85bb9077e # master
         continue-on-error: true # To make sure that SARIF upload gets called
         with:
           args: >
@@ -58,6 +58,6 @@ jobs:
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
           NODE_OPTIONS: --max-old-space-size=7168
       - name: Upload Snyk report
-        uses: github/codeql-action/upload-sarif@2c779ab0d087cd7fe7b826087247c2c81f27bfa6 # v3.26.5
+        uses: github/codeql-action/upload-sarif@4dd16135b69a43b6c8efb853346f8437d92d3c93 # v3.26.6
         with:
           sarif_file: snyk.sarif

.github/workflows/verify_codeql.yml

@@ -55,7 +55,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@2c779ab0d087cd7fe7b826087247c2c81f27bfa6 # v3.26.5
+        uses: github/codeql-action/init@4dd16135b69a43b6c8efb853346f8437d92d3c93 # v3.26.6
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -66,7 +66,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@2c779ab0d087cd7fe7b826087247c2c81f27bfa6 # v3.26.5
+        uses: github/codeql-action/autobuild@4dd16135b69a43b6c8efb853346f8437d92d3c93 # v3.26.6
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -80,4 +80,4 @@ jobs:
       #   make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@2c779ab0d087cd7fe7b826087247c2c81f27bfa6 # v3.26.5
+        uses: github/codeql-action/analyze@4dd16135b69a43b6c8efb853346f8437d92d3c93 # v3.26.6

.github/workflows/verify_e2e-techdocs.yml

@@ -35,7 +35,7 @@ jobs:
           egress-policy: audit
 
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-      - uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5.1.1
+      - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
         with:
           python-version: '3.9'
 

.github/workflows/verify_e2e-windows.yml

@@ -56,7 +56,7 @@ jobs:
           registry-url: https://registry.npmjs.org/ # Needed for auth
 
       - name: setup python
-        uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5.1.1
+        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
         with:
           python-version: '3.10'
 

.github/workflows/verify_microsite.yml

@@ -34,7 +34,7 @@ jobs:
         uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
         with:
           node-version: 18.x
-      - uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5
+      - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5
         with:
           python-version: '3.9'
 

.gitignore

@@ -42,6 +42,9 @@ coverage
 # Bower dependency directory (https://bower.io/)
 bower_components
 
+# Documentation reference, generated by build:api-docs
+docs/reference
+
 # node-waf configuration
 .lock-wscript
 

CONTRIBUTING.md

@@ -2,7 +2,7 @@
 
 Our vision for Backstage is for it to become the trusted standard toolbox (read: UX layer) for the open source infrastructure landscape. Think of it like Kubernetes for developer experience. We realize this is an ambitious goal. We can’t do it alone.
 
-Therefore we want to create a strong community of contributors -- all working together to create the kind of delightful experience that our developers deserve.
+Therefore, we want to create a strong community of contributors -- all working together to create the kind of delightful experience that our developers deserve.
 
 Contributions are welcome, and they are greatly appreciated! Every little bit helps, and credit will always be given. ❤️
 
@@ -41,7 +41,7 @@ We encourage you to catch any accessibility issues already in the development ph
 
 ## Get Started!
 
-So...feel ready to jump in? Let's do this. 👏🏻💯
+So... feel ready to jump in? Let's do this. 👏🏻💯
 
 ### Cloning the Repository
 
@@ -103,7 +103,7 @@ If you want to get a better understanding of the layout of the repo now that you
 
 ## Coding Guidelines
 
-All code is formatted with `prettier` using the configuration in the repo. If possible we recommend configuring your editor to format automatically, but you can also use the `yarn prettier --write <file>` command to format files.
+All code is formatted with `prettier` using the configuration in the repo. If possible, we recommend configuring your editor to format automatically, but you can also use the `yarn prettier --write <file>` command to format files.
 
 A consistent coding style is included via [EditorConfig](https://editorconfig.org/) with the file [`.editorconfig`](.editorconfig) at the root of the repo. Depending on your editor of choice, it will either support it out of the box or you can [download a plugin](https://editorconfig.org/#download) for the config to be applied.
 
@@ -184,7 +184,7 @@ Changesets **are** needed for new packages, as that is what triggers the package
 
 ### Writing changesets
 
-Changesets are an important part of the development process. They are used to generate Changelog entries for all changes to the project. Ultimately they are read by the end users to learn about important changes and fixes to the project. Some of these fixes might require manual intervention from users so it's important to write changesets that users understand and can take action on.
+Changesets are an important part of the development process. They are used to generate Changelog entries for all changes to the project. Ultimately, they are read by the end users to learn about important changes and fixes to the project. Some of these fixes might require manual intervention from users so it's important to write changesets that users understand and can take action on.
 
 Here are some important do's and don'ts when writing changesets:
 
@@ -274,7 +274,7 @@ These changes are **required** to `packages/backend/src/plugins/catalog.ts`
 
 As with other CNCF projects, Backstage has adopted a [Developers Certificate of Origin (DCO)](https://developercertificate.org/). A DCO is a lightweight way for a developer to certify that they wrote or otherwise have the right to submit code or documentation to a project.
 
-To certify the code you submit to the repository you'll need to add a `Signed-off-by` line to your commits.
+To certify the code you submit to the repository, you'll need to add a `Signed-off-by` line to your commits.
 
 `$ git commit -s -m 'Awesome commit message'`
 
@@ -330,9 +330,9 @@ There are two ways you can do this:
 1. You can run `yarn build:api-reports` from the root of the project and it will go through all of the existing API Reports and update them or create new ones as needed. This may take a while but is generally the best method if you are new to this.
 2. You can run `yarn build:api-reports plugins/<your-plugin-with-changes>` from the root and it will update the existing API Report or create a new one.
 
-> Note: the above commands assume you've run `yarn install` before hand or recently
+> Note: the above commands assume you've run `yarn install` beforehand or recently.
 
-Each plugin/package has its own API Report which means you might see more then one file updated or created depending on your changes. These changes will then need to be committed as well.
+Each plugin/package has its own API Report which means you might see more than one file updated or created depending on your changes. These changes will then need to be committed as well.
 
 ## Submitting a Pull Request
 
@@ -374,7 +374,7 @@ Once you've submitted a Pull Request (PR) the various bots will come out and do
 - checking for commits for their DCO (Developer Certificate of Origin)
 - kick of the various CI builds
 
-Once these have been completed it's just a matter of being patient as the reviewers have time they will begin to review your PR. When the review begins there may be a few layers to this but the general rule is that you need approval from one of the core maintainers and one from the specific area impacted by your PR. You may also have someone from the community review your changes, this can really help speed things up as they may catch some early items making the review for the maintainers simpler. Once you have the two (2) approvals it's ready to be merged, this task is also done by the maintainers.
+Once these steps are completed, it's just a matter of being patient. As the reviewers have time, they will begin reviewing your PR. When the review process begins, there may be a few layers to this, but the general rule is that you need approval from one of the core maintainers and one from the specific area impacted by your PR. You may also have someone from the community review your changes. This can really help speed things up as they may catch some early items making the review for the maintainers simpler. Once you have the two (2) approvals, it's ready to be merged, a task that is also performed by the maintainers.
 
 ### Review Tips
 

README.md

@@ -63,6 +63,10 @@ To engage with our community, you can use the following resources:
 - [Backstage Community Sessions](https://github.com/backstage/community) - Join monthly meetups and explore Backstage community
 - Give us a star ⭐️ - If you are using Backstage or think it is an interesting project, we would love a star ❤️
 
+## Governance
+
+See the [GOVERNANCE.md](https://github.com/backstage/community/blob/main/GOVERNANCE.md) document in the [backstage/community](https://github.com/backstage/community) repository.
+
 ## License
 
 Copyright 2020-2024 © The Backstage Authors. All rights reserved. The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of The Linux Foundation, please see our Trademark Usage page: https://www.linuxfoundation.org/trademark-usage

docs/.gitignore

@@ -1,2 +0,0 @@
-# This is generated by build:api-docs in the root
-reference

docs/accessibility/index.md

@@ -52,7 +52,7 @@ Running this command will use the [Lighthouse config](https://github.com/backsta
 
 :::
 
-### Use Lighthouse Github Action on your own repo
+### Use Lighthouse GitHub Action on your own repo
 
 If your Backstage plugin lives outside of the [Backstage main repository](https://github.com/backstage/backstage/), and you use GitHub Actions for continuous integration, we encourage you to add and modify the [Accessibility GitHub workflow](https://github.com/backstage/backstage/blob/master/.github/workflows/verify_accessibility.yml) to your needs.
 

docs/api/utility-apis.md

@@ -6,10 +6,7 @@ description: Backstage Utility APIs
 
 ## Introduction
 
-Backstage Plugins strive to be self-contained, with as much functionality as
-possible residing within the plugin itself and its backend APIs. There will
-however always be a need for plugins to communicate outside of its boundaries,
-both with other plugins and the app itself.
+Backstage plugins strive to be self-contained, with as much functionality as possible residing within the plugin itself and its backend APIs. There will, however, always be a need for plugins to communicate outside of their boundaries, both with other plugins and with the app itself.
 
 Backstage provides two primary methods for plugins to communicate across their
 boundaries in client-side code. The first one being the
@@ -61,7 +58,7 @@ Note that there is no explicit type given for
 embedded, and [`useApi`](../reference/core-plugin-api.useapi.md) is able to infer
 the type.
 
-Also note that consuming Utility APIs is not limited to plugins, it can be done
+Also note that consuming Utility APIs is not limited to plugins; it can be done
 from any component inside Backstage, including the ones in
 [`@backstage/core-plugin-api`](../reference/core-plugin-api.md). The only
 requirement is that they are beneath the `AppProvider` in the react tree.
@@ -93,7 +90,7 @@ createApiFactory({
 });
 ```
 
-In this example the [`errorApiRef`](../reference/core-plugin-api.errorapiref.md)
+In this example, the [`errorApiRef`](../reference/core-plugin-api.errorapiref.md)
 is our API, which encapsulates the
 [`ErrorApi`](../reference/core-plugin-api.errorapi.md) type. The
 [`alertApiRef`](../reference/core-plugin-api.alertapiref.md) is our single
@@ -135,11 +132,11 @@ there is no step that needs to be taken to include these APIs in an app.
 ### Plugin APIs
 
 In addition to the core APIs, plugins can define and export their own APIs.
-While doing so they should usually also provide default implementations of their
-own APIs, for example, the `catalog` plugin exports `catalogApiRef`, and also
+While doing so, they should usually also provide default implementations of their
+own APIs; for example, the `catalog` plugin exports `catalogApiRef` and also
 supplies a default [`ApiFactory`](../reference/core-plugin-api.apifactory.md) of
 that API using the `CatalogClient`. There is one restriction to plugin-provided
-API Factories: plugins may not supply factories for core APIs, trying to do so
+API Factories: plugins may not supply factories for core APIs; trying to do so
 will cause the app to refuse to start.
 
 Plugins supply their APIs through the `apis` option of
@@ -165,16 +162,16 @@ export const techdocsPlugin = createPlugin({
 ### App APIs
 
 Lastly, the app itself is the final point where APIs can be added, and what has
-the final say in what APIs will be loaded at runtime. The app may override the
+the final say in what APIs will be loaded at runtime? The app may override the
 factories for any of the core or plugin APIs, with the exception of the config,
 app theme, and identity APIs. These are static APIs that are tied into the
-[`createApp`](../reference/app-defaults.createapp.md) implementation, and
+[`createApp`](../reference/app-defaults.createapp.md) implementation and
 therefore not possible to override.
 
 Overriding APIs is useful for apps that want to switch out behavior to tailor it
-to their environment. In some cases plugins may also export multiple
+to their environment. In some cases plugins, may also export multiple
 implementations of the same API, where they each have their own different
-requirements on for example backend storage and surrounding environment.
+requirements, for example, backend storage and the surrounding environment.
 
 Supplying APIs to the app works just like for plugins:
 
@@ -238,21 +235,14 @@ checked by the type embedded in the
 ## Defining custom Utility APIs
 
 Plugins are free to define their own Utility APIs. Simply define the TypeScript
-interface for the API, and create an
+interface for the API and create an
 [`ApiRef`](../reference/core-plugin-api.apiref.md) using
 [`createApiRef`](../reference/core-plugin-api.createapiref.md) exported from
-[`@backstage/core-plugin-api`](../reference/core-plugin-api.md). Also be sure to
-provide at least one implementation of the API, and to declare a default factory
+[`@backstage/core-plugin-api`](../reference/core-plugin-api.md). Also, be sure to
+provide at least one implementation of the API and to declare a default factory
 for the API in [`createPlugin`](../reference/core-plugin-api.createplugin.md).
 
-Custom Utility APIs can be either public or private, which is up to the plugin
-to choose. Private APIs do not expose an external API surface, and it's
-therefore possible to make breaking changes to the API without affecting other
-users of the plugin. If an API is made public however, it opens up for other
-plugins to make use of the API, and it also makes it possible for users for your
-plugin to override the API in the app. It is however important to maintain
-backwards compatibility of public APIs, as you may otherwise break apps that are
-using your plugin.
+Custom Utility APIs can be either public or private, which is up to the plugin to choose. Private APIs do not expose an external API surface, and it's therefore possible to make breaking changes to the API without affecting other users of the plugin. If an API is made public, however, it opens up for other plugins to make use of the API, and it also makes it possible for users for your plugin to override the API in the app. It is, however, important to maintain backward compatibility of public APIs, as you may otherwise break apps that are using your plugin.
 
 To make an API public, simply export the
 [`ApiRef`](../reference/core-plugin-api.apiref.md) of the API, and any associated

docs/auth/add-auth-provider.md

@@ -1,13 +1,12 @@
 ---
 id: add-auth-provider
-title: Contributing New Providers
+title: Contributing New Provider Modules
 description: Documentation on adding new authentication providers
 ---
 
 :::note Note
 
-The primary audience for this documentation are contributors to the main
-Backstage project that want to add support for new authentication providers.
+The primary audience for this documentation are contributors that want to add support for new authentication providers.
 While you can follow it to implement your own custom providers it is much
 more advanced than using our built-in providers.
 
@@ -122,191 +121,137 @@ due to its comprehensive set of supported authentication
 
 ### Quick guide
 
-[1.](#installing-the-dependencies) Install the passport-js based provider
-package.
+[1.](#create-new-auth-provider-module) Create a new auth provider module
 
-[2.](#create-implementation) Create a new folder structure for the provider.
+[3.](#adding-an-oauth-based-provider) or [adding a proxy auth based provider](#creating-proxy-auth-based-provider) depending on your needs.
 
-[3.](#adding-an-oauth-based-provider) Implement the provider, extending the
-suitable framework if needed.
+[4.](#add-the-provider-to-the-backend) Add the provider to the backend.
 
-[4.](#hook-it-up-to-the-backend) Add the provider to the backend.
+### Create new auth provider module
 
-### Installing the dependencies:
+In this example we will create auth module for a made up service named foobar.
+
+Create a new module using `yarn new`, pick `backend-module` and provide `auth-backend` as the plugin ID and `foobar-provider` as the module ID.
+
+Make sure that the module has the appropriate passport provider as a dependency.
 
 ```bash
-cd plugins/auth-backend
+cd plugins/auth-backend-backend-module-foobar-provider
 yarn add passport-provider-a
 yarn add @types/passport-provider-a
 ```
 
-### Create implementation
-
-Make a new folder with the name of the provider following the below file
-structure:
-
-```bash
-plugins/auth-backend/src/providers/providerA
-├── index.ts
-└── provider.ts
-```
-
-**`plugins/auth-backend/src/providers/providerA/provider.ts`** defines the
-provider class which implements a handler for the chosen framework.
-
 ### Adding an OAuth based provider
 
-If we're adding an `OAuth` based provider we would implement the
-`OAuthHandlers` interface. By implementing this
-interface we can use the `OAuthProvider` class provided by `lib/oauth`, meaning
-we don't need to implement the full
-`AuthProviderRouteHandlers` interface that providers
-otherwise need to implement.
+We're then creating a new module that can extend the Auth backend using the `authProvidersExtensionPoint`.
 
-The provider class takes the provider's options as a class parameter. It also
-imports the `Strategy` from the passport package.
+```ts title="plugins/auth-backend-foobar-provider/src/module.ts"
+import { createBackendModule } from '@backstage/backend-plugin-api';
+import {
+  authProvidersExtensionPoint,
+  commonSignInResolvers,
+  createOAuthProviderFactory,
+} from '@backstage/plugin-auth-node';
+import { providerAuthenticator } from './authenticator';
 
-```ts
-import { Strategy as ProviderAStrategy } from 'passport-provider-a';
-
-export type ProviderAProviderOptions = OAuthProviderOptions & {
-  // extra options here
-}
-
-export class ProviderAAuthProvider implements OAuthHandlers {
-  private readonly _strategy: ProviderAStrategy;
-
-  constructor(options: ProviderAProviderOptions) {
-    this._strategy = new ProviderAStrategy(
-      {
-        clientID: options.clientId,
-        clientSecret: options.clientSecret,
-        callbackURL: options.callbackUrl,
-        passReqToCallback: false,
-        response_type: 'code',
-        /// ... etc
-      }
-      verifyFunction, // See the "Verify Callback" section
-    );
-  }
-
-  async start() {}
-  async handler() {}
-}
-```
-
-### Adding an non-OAuth based provider
-
-An non-`OAuth` based provider could implement
-`AuthProviderRouteHandlers` instead.
-
-```ts
-type ProviderAOptions = {
-  // ...
-};
-
-export class ProviderAAuthProvider implements AuthProviderRouteHandlers {
-  private readonly _strategy: ProviderAStrategy;
-
-  constructor(options: ProviderAOptions) {
-    this._strategy = new ProviderAStrategy(
-      {
-        // ...
+/** @public */
+export const authModuleFoobarProvider = createBackendModule({
+  pluginId: 'auth',
+  moduleId: 'foobar',
+  register(reg) {
+    reg.registerInit({
+      deps: {
+        providers: authProvidersExtensionPoint,
       },
-      verifyFunction, // See the "Verify Callback" section
-    );
-  }
-
-  async start() {}
-  async frameHandler() {}
-  async logout() {}
-  async refresh() {} // If supported
-}
-```
-
-#### Integration Wrapper
-
-Each provider exports an object that provides a way to create new instances
-of the provider, along with related utilities like predefined sign-in resolvers.
-
-The object is created using `createAuthProviderIntegration`, with the most
-important part being the `create` method that acts as the factory function
-for our provider.
-
-The factory should return an implementation of `AuthProviderFactory`, which
-passes in a object with utilities for configuration, logging, token issuing,
-etc. The factory should return an implementation of
-`AuthProviderRouteHandlers`.
-
-The factory is what decides the mapping from
-[static configuration](../conf/index.md) to the creation of auth providers. For
-example, OAuth providers use `OAuthEnvironmentHandler` to allow for multiple
-different configurations, one for each environment, which looks like this;
-
-```ts
-export const okta = createAuthProviderIntegration({
-  create(options?: {
-    /**
-     * The profile transformation function used to verify and convert the auth response
-     * into the profile that will be presented to the user.
-     */
-    authHandler?: AuthHandler<OAuthResult>;
-
-    /**
-     * Configure sign-in for this provider, without it the provider can not be used to sign users in.
-     */
-    signIn?: {
-      /**
-       * Maps an auth result to a Backstage identity for the user.
-       */
-      resolver: SignInResolver<OAuthResult>;
-    };
-  }) {
-    return ({ providerId, globalConfig, config, resolverContext }) =>
-      OAuthEnvironmentHandler.mapConfig(config, envConfig => {
-        // read options from config
-        const clientId = envConfig.getString('clientId');
-        const clientSecret = envConfig.getString('clientSecret');
-
-        // Use provided auth handler, or create a default one
-        const authHandler: AuthHandler<OAuthResult> = options?.authHandler
-          ? options.authHandler
-          : async ({ fullProfile, params }) => ({
-              profile: makeProfileInfo(fullProfile, params.id_token),
-            });
-
-        // instantiate our OAuthHandlers implementation
-        const provider = new OktaAuthProvider({
-          audience,
-          clientId,
-          clientSecret,
-          callbackUrl,
-          authHandler,
-          signInResolver: options?.signIn?.resolver,
-          resolverContext,
+      async init({ providers }) {
+        providers.registerProvider({
+          providerId: 'foobar',
+          factory: createOAuthProviderFactory({
+            authenticator: providerAuthenticator,
+            signInResolverFactories: {
+              ...commonSignInResolvers,
+            },
+          }),
         });
-
-        // Wrap the OAuthHandlers with OAuthProvider, which implements AuthProviderRouteHandlers
-        return OAuthProvider.fromConfig(globalConfig, provider, {
-          providerId,
-          tokenIssuer,
-        });
-      });
-  },
-  resolvers: {
-    /**
-     * Looks up the user by matching their email local part to the entity name.
-     */
-    emailLocalPartMatchingUserEntityName: () => commonByEmailLocalPartResolver,
-
-    // ... additional predefined resolvers
+      },
+    });
   },
 });
 ```
 
-The purpose of the different environments is to allow for a single auth-backend
-to serve as the authentication service for multiple different frontend
-environments, such as local development, staging, and production.
+Now let's implement the actual authenticator for our provider using `Strategy` from a passport package.
+The authenticator is responsible for creating the passport strategy and handling the authentication flow using secrets from the config file.
+
+```ts title="plugins/auth-backend-foobar-provider/src/authenticator.ts"
+import { Strategy as ProviderStrategy } from 'passport-provider-a';
+import {
+  createOAuthAuthenticator,
+  PassportOAuthAuthenticatorHelper,
+  PassportOAuthDoneCallback,
+  PassportProfile,
+} from '@backstage/plugin-auth-node';
+
+/** @public */
+export const providerAuthenticator = createOAuthAuthenticator({
+  defaultProfileTransform:
+    PassportOAuthAuthenticatorHelper.defaultProfileTransform,
+  scopes: {
+    // Scopes required by the provider
+    required: ['openid', 'email', 'profile', 'offline_access'],
+  },
+  initialize({ callbackUrl, config }) {
+    const clientId = config.getString('clientId');
+    const clientSecret = config.getString('clientSecret');
+
+    return PassportOAuthAuthenticatorHelper.from(
+      new ProviderStrategy(
+        {
+          clientID: clientId,
+          clientSecret: clientSecret,
+          // ... other options
+        },
+        (
+          accessToken: string,
+          refreshToken: string,
+          params: any,
+          fullProfile: PassportProfile,
+          done: PassportOAuthDoneCallback,
+        ) => {
+          done(
+            undefined,
+            { fullProfile, params, accessToken },
+            { refreshToken },
+          );
+        },
+      ),
+    );
+  },
+
+  async start(input, helper) {
+    return helper.start(input);
+  },
+
+  async authenticate(input, helper) {
+    return helper.authenticate(input);
+  },
+
+  async refresh(input, helper) {
+    return helper.refresh(input);
+  },
+});
+```
+
+Here are some examples of authenticators that are already implemented in the codebase:
+
+- [Google](https://github.com/backstage/backstage/blob/master/plugins/auth-backend-module-google-provider/src/authenticator.ts)
+- [GitHub](https://github.com/backstage/backstage/blob/master/plugins/auth-backend-module-github-provider/src/authenticator.ts)
+- [Okta](https://github.com/backstage/backstage/blob/master/plugins/auth-backend-module-okta-provider/src/authenticator.ts)
+
+### Creating proxy auth based provider
+
+A proxy auth provider is a provider that uses another provider to authenticate for example Google IAP or AWS ALB, please note that those providers are already supported by Backstage.
+
+The implementation is similar to the OAuth provider, but the `authenticator` function is different. There are already some examples on how to implement a proxy provider in the codebase, for example [auth-backend-module-gcp-iap-provider](https://github.com/backstage/backstage/tree/master/plugins/auth-backend-module-gcp-iap-provider) and [auth-backend-module-aws-alb-provider](https://github.com/backstage/backstage/tree/master/plugins/auth-backend-module-aws-alb-provider)
 
 #### Verify Callback
 
@@ -323,27 +268,20 @@ environments, such as local development, staging, and production.
 >
 > http://www.passportjs.org/docs/configure/
 
-**`plugins/auth-backend/src/providers/providerA/index.ts`** is simply
-re-exporting the factory function to be used for hooking the provider up to the
-backend.
+### Add the provider to the backend
+
+The process for adding the new module is the same as for any other type of module or backend plugin.
+
+If this provider is internal to your installation the import path that you add to `packages/backend/src/index.ts` would be something like:
 
 ```ts
-export { createProviderAProvider } from './provider';
+backend.add(import('@internal/plugin-auth-backend-module-foobar-provider'));
 ```
 
-### Hook it up to the backend
-
-**`plugins/auth-backend/src/providers/factories.ts`** When the `auth-backend`
-starts it sets up routing for all the available providers by calling
-the factory function of each provider. You need to import the factory
-function from the provider and add it to the factory:
+But if this module is contributed directly to Backstage the module would be imported as
 
 ```ts
-import { createProviderAProvider } from './providerA';
-
-const factories: { [providerId: string]: AuthProviderFactory } = {
-  providerA: createProviderAProvider,
-};
+backend.add(import('@backstage/plugin-auth-backend-module-foobar-provider'));
 ```
 
 By doing this `auth-backend` automatically adds these endpoints: