fix(deps): update backstage core

[secustors-renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@backstage/backend-defaults (source)	0.17.0 → 0.17.5			dependencies	patch
@backstage/backend-openapi-utils (source)	^0.6.4 → ^0.7.0			dependencies	minor
@backstage/cli (source)	0.36.1 → 0.36.4			devDependencies	patch
@backstage/cli (source)	0.36.1 → 0.36.4			dependencies	patch
@backstage/cli-defaults (source)	0.1.1 → 0.1.4			devDependencies	patch
@backstage/config (source)	1.3.7 → 1.3.8			dependencies	patch
@backstage/core-compat-api (source)	0.5.10 → 0.5.13			dependencies	patch
@backstage/core-components (source)	0.18.9 → 0.18.12			dependencies	patch
@backstage/core-plugin-api (source)	1.12.5 → 1.12.8			dependencies	patch
@backstage/frontend-defaults (source)	0.5.1 → 0.5.4			dependencies	patch
@backstage/frontend-plugin-api (source)	^0.16.0 → ^0.17.0			dependencies	minor
@backstage/frontend-test-utils (source)	0.5.2 → 0.6.2			devDependencies	minor
@backstage/integration-react (source)	1.2.17 → 1.2.20			dependencies	patch
@backstage/plugin-app-backend (source)	0.5.13 → 0.5.16			dependencies	patch
@backstage/plugin-app-react (source)	0.2.2 → 0.2.5			dependencies	patch
@backstage/plugin-app-visualizer (source)	0.2.3 → 0.2.6			dependencies	patch
@backstage/plugin-auth-backend (source)	^0.28.0 → ^0.29.0			dependencies	minor
@backstage/plugin-auth-backend-module-github-provider (source)	0.5.2 → 0.5.5			dependencies	patch
@backstage/plugin-auth-backend-module-guest-provider (source)	0.2.18 → 0.2.21			dependencies	patch
@backstage/plugin-auth-node (source)	0.7.0 → 0.7.3			dependencies	patch
@backstage/plugin-catalog (source)	2.0.4 → 2.0.7			dependencies	patch
@backstage/plugin-catalog-backend (source)	3.6.1 → 3.8.1			dependencies	minor
@backstage/plugin-catalog-backend-module-logs (source)	0.1.21 → 0.1.24			dependencies	patch
@backstage/plugin-catalog-backend-module-scaffolder-entity-model (source)	0.2.19 → 0.2.22			dependencies	patch
@backstage/plugin-catalog-react (source)	^2.0.0 → ^3.0.0			dependencies	major
@backstage/plugin-kubernetes-backend (source)	0.21.3 → 0.21.6			dependencies	patch
@backstage/plugin-notifications (source)	0.5.16 → 0.5.19			dependencies	patch
@backstage/plugin-notifications-backend (source)	0.6.4 → 0.6.7			dependencies	patch
@backstage/plugin-org (source)	0.7.3 → 0.7.6			dependencies	patch
@backstage/plugin-permission-backend (source)	0.7.11 → 0.7.14			dependencies	patch
@backstage/plugin-permission-backend-module-allow-all-policy (source)	0.2.18 → 0.2.21			dependencies	patch
@backstage/plugin-permission-common (source)	0.9.8 → 0.9.9			dependencies	patch
@backstage/plugin-permission-node (source)	^0.10.7 → ^0.11.0			dependencies	minor
@backstage/plugin-scaffolder (source)	1.36.2 → 1.38.1			dependencies	minor
@backstage/plugin-search (source)	1.7.3 → 1.7.6			dependencies	patch
@backstage/plugin-search-backend (source)	2.1.1 → 2.1.4			dependencies	patch
@backstage/plugin-search-backend-module-catalog (source)	0.3.14 → 0.3.17			dependencies	patch
@backstage/plugin-search-backend-module-pg (source)	0.5.54 → 0.5.57			dependencies	patch
@backstage/plugin-search-backend-node (source)	1.4.3 → 1.4.6			dependencies	patch
@backstage/plugin-signals (source)	^0.0.30 → ^0.0.33			dependencies	patch
@backstage/plugin-signals-backend (source)	0.3.14 → 0.3.17			dependencies	patch
@backstage/plugin-user-settings (source)	0.9.2 → 0.9.5			dependencies	patch
@backstage/repo-tools (source)	^0.17.0 → ^0.18.0			devDependencies	minor
@backstage/ui (source)	^0.14.0 → ^0.17.0			dependencies	minor
backstage/backstage	1.50.4 → 1.53.0				minor

---

Release Notes

backstage/backstage (@​backstage/backend-defaults)

v0.17.5

Compare Source

Patch Changes

• aaa7d65: Improved readability of the AWS S3 URL parser by splitting the single monolithic regex into two separate patterns (standard S3 and VPC PrivateLink) with named capture groups. Also made the VPC endpoint region mandatory in the regex, fixing a potential mis-parse when the region segment was absent.
• d62c384: Fixed a bug where scheduled tasks that were initially registered with a manual trigger and later re-registered with a duration or cron cadence would never be scheduled to run.
• 8419f51: Added support for AWS PrivateLink for Amazon S3.
• a624fa3: The connection config option for the Redis cache store now accepts either a string URL or an object with additional connection options that are passed directly to the underlying client. The object form is only supported when backend.cache.store is redis; other stores require a plain string. This allows configuring options like pingInterval without needing dedicated config fields. For clustered Redis, the connection object properties are merged into cluster defaults. Fixes #​31813, #​31742.
• Updated dependencies
  • @​backstage/config-loader@​1.11.0
  • @​backstage/plugin-auth-node@​0.7.3
  • @​backstage/backend-app-api@​1.7.2
  • @​backstage/backend-plugin-api@​1.9.3
  • @​backstage/cli-node@​0.3.4
  • @​backstage/plugin-events-node@​0.4.24
  • @​backstage/plugin-permission-node@​0.11.2

v0.17.4

Compare Source

Patch Changes

• aaa7d65: Improved readability of the AWS S3 URL parser by splitting the single monolithic regex into two separate patterns (standard S3 and VPC PrivateLink) with named capture groups. Also made the VPC endpoint region mandatory in the regex, fixing a potential mis-parse when the region segment was absent.
• 8419f51: Added support for AWS PrivateLink for Amazon S3.
• Updated dependencies
  • @​backstage/config-loader@​1.11.0-next.0
  • @​backstage/plugin-auth-node@​0.7.3-next.0
  • @​backstage/backend-app-api@​1.7.2-next.0
  • @​backstage/plugin-permission-node@​0.11.2-next.0
  • @​backstage/backend-plugin-api@​1.9.3-next.0
  • @​backstage/plugin-events-node@​0.4.24-next.0

v0.17.3

Compare Source

Patch Changes

• 4f4bcf5: Upgraded infinispan from ^0.12.0 to ^0.13.0 to address known vulnerabilities.
• a07e6a3: Updated AzureBlobStorageUrlReader to reference the correctly-named AzureBlobStorageIntegration type from @backstage/integration. The previously-used AzureBlobStorageIntergation is now an alias for the new type and remains a valid argument to the constructor.
• b75158b: Adapted Azure-related tests for the Azure SDK upgrade to ESM-style exports. The AzureBlobStorageUrlReader now accepts an optional createContainerClient dependency for testability without needing to mock the @azure/storage-blob module.
• 89a95ca: Fixed the task worker retry loop to respect the abort signal. Previously, when a task worker encountered an unexpected error, the retry loop would continue indefinitely even after the worker was signaled to stop. The retry loop now checks the abort signal before retrying and passes it to the retry delay, allowing the worker to shut down gracefully.
• def82d4: Fixed the built-in rate limiter throwing a validation error and refusing to start when backend.rateLimit is enabled. Requests are now keyed using the address normalization helper from express-rate-limit, which is required by newer versions of that library and ensures IPv6 clients are grouped by their address block rather than by individual address.
• 0211390: Added a new v2 invoke endpoint (/.backstage/actions/v2/actions/:id/invoke) that accepts a wrapped body format { input, secrets } with secrets validation. The existing v1 invoke endpoint remains unchanged for backward compatibility. Updated DefaultActionsService to use the v2 endpoint. Updated DefaultActionsRegistryService to expose secrets schema in the actions list response and validate secrets on invocation.
• 34f21c3: Fix gitlabUrlReader issue with retrieving the repository archive tree
• Updated dependencies
  • @​backstage/cli-node@​0.3.3
  • @​backstage/backend-app-api@​1.7.1
  • @​backstage/integration@​2.0.3
  • @​backstage/backend-plugin-api@​1.9.2
  • @​backstage/config-loader@​1.10.12
  • @​backstage/plugin-auth-node@​0.7.2
  • @​backstage/plugin-events-node@​0.4.23
  • @​backstage/plugin-permission-node@​0.11.1

v0.17.2

Compare Source

Patch Changes

• a07e6a3: Updated AzureBlobStorageUrlReader to reference the correctly-named AzureBlobStorageIntegration type from @backstage/integration. The previously-used AzureBlobStorageIntergation is now an alias for the new type and remains a valid argument to the constructor.
• def82d4: Fixed the built-in rate limiter throwing a validation error and refusing to start when backend.rateLimit is enabled. Requests are now keyed using the address normalization helper from express-rate-limit, which is required by newer versions of that library and ensures IPv6 clients are grouped by their address block rather than by individual address.
• Updated dependencies
  • @​backstage/integration@​2.0.3-next.0
  • @​backstage/plugin-auth-node@​0.7.2-next.0
  • @​backstage/backend-app-api@​1.7.1-next.0
  • @​backstage/plugin-permission-node@​0.11.1-next.0
  • @​backstage/backend-plugin-api@​1.9.2-next.0
  • @​backstage/plugin-events-node@​0.4.23-next.0

v0.17.1

Compare Source

Patch Changes

• 90b572e: Adds an alpha TracingService to provide a unified interface for emitting trace spans across Backstage plugins.
• 97d3bd4: Fixed a race condition in CachedUserInfoService where a failed request could incorrectly evict a newer cache entry for the same token. The error handler now verifies the map entry is still the same promise before deleting it.
• 3595c97: Exported defaultServiceFactories to allow use with createSpecializedBackend for advanced configuration like extensionPointFactoryMiddleware.
• 89d3248: Fixed scheduler sleep firing immediately for durations longer than ~24.8 days, caused by Node.js setTimeout overflowing its 32-bit millisecond limit.
• d00a44b: Fixed Valkey cluster mode to use iovalkey's Cluster class instead of
  createCluster from @keyv/redis. The previous implementation passed a
  @redis/client RedisCluster instance to @keyv/valkey, which expects an
  iovalkey Cluster instance. This caused the cluster client to not be
  recognized correctly, as the two libraries have incompatible object models.
• 2f0519c: Added a new CachedUserInfoService decorator that wraps DefaultUserInfoService with a 5-second TTL cache and in-flight request coalescing. The decorator is wired in via userInfoServiceFactory using a shared root-level cache. Repeated getUserInfo() calls for the same user token within the TTL window return the cached result without making an HTTP call to the auth backend. Note that custom UserInfoService implementations registered via their own factory will not benefit from this cache automatically.
• 744fa1f: Removed duplicated entries that appeared in both dependencies and devDependencies.
• e9b78e9: Removed the uuid dependency and replaced usage with the built-in crypto.randomUUID().
• 6209065: Added context and propagation to the alpha TracingService. Plugins can bridge OpenTelemetry context across async boundaries via tracing.propagation.extract(tracing.context.active(), carrier) followed by tracing.context.with(ctx, fn), and read propagated baggage via tracing.propagation.getActiveBaggage() or tracing.propagation.getBaggage(ctx).
• Updated dependencies
  • @​backstage/errors@​1.3.1
  • @​backstage/integration-aws-node@​0.2.0
  • @​backstage/backend-plugin-api@​1.9.1
  • @​backstage/backend-app-api@​1.7.0
  • @​backstage/cli-node@​0.3.2
  • @​backstage/integration@​2.0.2
  • @​backstage/plugin-permission-node@​0.11.0
  • @​backstage/plugin-auth-node@​0.7.1
  • @​backstage/plugin-permission-common@​0.9.9
  • @​backstage/config@​1.3.8
  • @​backstage/config-loader@​1.10.11
  • @​backstage/plugin-events-node@​0.4.22

backstage/backstage (@​backstage/backend-openapi-utils)

v0.7.0

Compare Source

Minor Changes

• 84171b3: BREAKING: Removed wrapInOpenApiTestServer. This function redirected test traffic through the Optic capture proxy via the OPTIC_PROXY environment variable. Since the Optic dependency has been removed, this function no longer serves a purpose. Use wrapServer instead for OpenAPI spec validation in tests.

Patch Changes

• Updated dependencies
  • @​backstage/backend-plugin-api@​1.9.3

v0.6.10

Compare Source

Patch Changes

• Updated dependencies
  • @​backstage/backend-plugin-api@​1.9.2

v0.6.9

Compare Source

Patch Changes

• Updated dependencies
  • @​backstage/errors@​1.3.1
  • @​backstage/backend-plugin-api@​1.9.1

backstage/backstage (@​backstage/cli)

v0.36.4

Compare Source

Patch Changes

• 61d4881: The shared ESLint configuration now reports unused imports in config.d.ts configuration schema files. These declaration files are not covered by the TypeScript compiler's unused-variable checks, which previously allowed a stray import to slip through. Such an import can resolve during local development but break configuration schema loading for consumers of the published package, so it is now caught at lint time.
• Updated dependencies
  • @​backstage/cli-module-build@​0.1.5
  • @​backstage/cli-common@​0.3.0
  • @​backstage/cli-defaults@​0.1.4
  • @​backstage/cli-module-test-jest@​0.1.4
  • @​backstage/cli-node@​0.3.4

v0.36.3

Compare Source

Patch Changes

• b521571: Improved validation of conflicting CLI module commands, including conflicts between parent and nested command paths.
• Updated dependencies
  • @​backstage/cli-module-build@​0.1.4
  • @​backstage/cli-module-test-jest@​0.1.3
  • @​backstage/cli-node@​0.3.3
  • @​backstage/eslint-plugin@​0.3.1
  • @​backstage/cli-defaults@​0.1.3

v0.36.2

Compare Source

Patch Changes

• 744fa1f: Removed duplicated entries that appeared in both dependencies and devDependencies.
• Updated dependencies
  • @​backstage/eslint-plugin@​0.3.0
  • @​backstage/errors@​1.3.1
  • @​backstage/cli-module-build@​0.1.3
  • @​backstage/cli-node@​0.3.2
  • @​backstage/cli-common@​0.2.2
  • @​backstage/cli-defaults@​0.1.2
  • @​backstage/cli-module-test-jest@​0.1.2

backstage/backstage (@​backstage/cli-defaults)

v0.1.4

Compare Source

Patch Changes

• Updated dependencies
  • @​backstage/cli-module-build@​0.1.5
  • @​backstage/cli-module-migrate@​0.2.0
  • @​backstage/cli-module-new@​0.1.5
  • @​backstage/cli-module-actions@​0.1.3
  • @​backstage/cli-module-auth@​0.1.4
  • @​backstage/cli-module-config@​0.1.4
  • @​backstage/cli-module-github@​0.1.4
  • @​backstage/cli-module-info@​0.1.4
  • @​backstage/cli-module-lint@​0.1.4
  • @​backstage/cli-module-maintenance@​0.1.4
  • @​backstage/cli-module-test-jest@​0.1.4
  • @​backstage/cli-module-translations@​0.1.4

v0.1.3

Compare Source

Patch Changes

• Updated dependencies
  • @​backstage/cli-module-new@​0.1.4
  • @​backstage/cli-module-actions@​0.1.2
  • @​backstage/cli-module-auth@​0.1.3
  • @​backstage/cli-module-build@​0.1.4
  • @​backstage/cli-module-config@​0.1.3
  • @​backstage/cli-module-github@​0.1.3
  • @​backstage/cli-module-info@​0.1.3
  • @​backstage/cli-module-lint@​0.1.3
  • @​backstage/cli-module-maintenance@​0.1.3
  • @​backstage/cli-module-migrate@​0.1.3
  • @​backstage/cli-module-test-jest@​0.1.3
  • @​backstage/cli-module-translations@​0.1.3

v0.1.2

Compare Source

Patch Changes

• Updated dependencies
  • @​backstage/cli-module-build@​0.1.3
  • @​backstage/cli-module-new@​0.1.3
  • @​backstage/cli-module-actions@​0.1.1
  • @​backstage/cli-module-auth@​0.1.2
  • @​backstage/cli-module-config@​0.1.2
  • @​backstage/cli-module-github@​0.1.2
  • @​backstage/cli-module-info@​0.1.2
  • @​backstage/cli-module-lint@​0.1.2
  • @​backstage/cli-module-maintenance@​0.1.2
  • @​backstage/cli-module-migrate@​0.1.2
  • @​backstage/cli-module-test-jest@​0.1.2
  • @​backstage/cli-module-translations@​0.1.2

backstage/backstage (@​backstage/config)

v1.3.8

Compare Source

Patch Changes

• Updated dependencies
  • @​backstage/errors@​1.3.1

backstage/backstage (@​backstage/core-compat-api)

v0.5.13

Compare Source

Patch Changes

• Updated dependencies
  • @​backstage/frontend-plugin-api@​0.17.3
  • @​backstage/plugin-catalog-react@​3.2.0
  • @​backstage/filter-predicates@​0.1.4
  • @​backstage/core-plugin-api@​1.12.8
  • @​backstage/plugin-app-react@​0.2.5

v0.5.12

Compare Source

Patch Changes

• Updated dependencies
  • @​backstage/plugin-catalog-react@​3.1.0
  • @​backstage/frontend-plugin-api@​0.17.2
  • @​backstage/core-plugin-api@​1.12.7
  • @​backstage/plugin-app-react@​0.2.4

v0.5.11

Compare Source

Patch Changes

• 744fa1f: Removed duplicated entries that appeared in both dependencies and devDependencies.
• Updated dependencies
  • @​backstage/errors@​1.3.1
  • @​backstage/frontend-plugin-api@​0.17.0
  • @​backstage/core-plugin-api@​1.12.6
  • @​backstage/filter-predicates@​0.1.3
  • @​backstage/plugin-catalog-react@​3.0.0
  • @​backstage/plugin-app-react@​0.2.3

backstage/backstage (@​backstage/core-components)

v0.18.12

Compare Source

Patch Changes

• 120e7c3: chore(deps): bump js-yaml from 4.1.1 to 4.2.0
• 9efce7d: Fixed the table filters sidebar rendering a stray 0 when no filters are configured.
• 7ceeaad: Migrated CopyTextButton component from Material-UI to Backstage UI (BUI). Replaced MUI IconButton and Tooltip with BUI ButtonIcon and TooltipTrigger/Tooltip components. This is an internal refactoring that maintains backward compatibility - the component API remains unchanged.
• Updated dependencies
  • @​backstage/ui@​0.17.0
  • @​backstage/core-plugin-api@​1.12.8

v0.18.11

Compare Source

Patch Changes

• e0889a3: chore(deps): bump qs from 6.15.1 to 6.15.2
• a07e6a3: Added the correctly-spelled 'header' literal to the TableFiltersClassKey union type and deprecated the previous typoed 'heder' literal. The generated CSS class with the old key is preserved for backwards compatibility; switch to 'header' to avoid future removal.
• c161e1c: Lazy-load react-syntax-highlighter and @dagrejs/dagre so they are no longer pulled in eagerly through the barrel export. This reduces the upfront module cost of importing from @backstage/core-components by roughly 10 MB. The public API is unchanged.
• dbe93a7: Fix autologout not working correctly when closing all tabs
• 8add9b9: Fixed the proxy-based sign-in page failing to read the session token when the proxy issues a token whose payload is encoded using the URL-safe base64 alphabet. Such tokens are now decoded correctly so sign-in no longer breaks.
• f35372d: Fixed text clipping in SidebarSubmenuItem by correcting line-height from 1 to 1.5
• Updated dependencies
  • @​backstage/core-plugin-api@​1.12.7

v0.18.10

Compare Source

Patch Changes

• 3846774: Added missing dependencies that were previously only available transitively.
• 021b368: Added stable DOM markers to the legacy Page and Header so adjacent layout components can coordinate spacing without relying on generated class names.
• 0c5e41f: Removed unused dependencies that had no imports in source code.
• Updated dependencies
  • @​backstage/errors@​1.3.1
  • @​backstage/core-plugin-api@​1.12.6
  • @​backstage/config@​1.3.8

backstage/backstage (@​backstage/core-plugin-api)

v1.12.8

Compare Source

Patch Changes

• Updated dependencies
  • @​backstage/frontend-plugin-api@​0.17.3

v1.12.7

Compare Source

Patch Changes

• Updated dependencies
  • @​backstage/frontend-plugin-api@​0.17.2

[v1.12.6](ht

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.