Skip to content

feat: upgrade Backstage from 1.51.1 to 1.53.1 - #94

Closed
johnnyhuy wants to merge 4 commits into
mainfrom
chore/upgrade-backstage-1.53.1
Closed

feat: upgrade Backstage from 1.51.1 to 1.53.1#94
johnnyhuy wants to merge 4 commits into
mainfrom
chore/upgrade-backstage-1.53.1

Conversation

@johnnyhuy

Copy link
Copy Markdown
Contributor

Summary

  • Bumped backstage.json and the yarn backstage plugin spec from 1.51.1 to 1.53.1 (latest stable, released 2026-07-29)
  • Yarn install pulled in updated @backstage/* packages (e.g. cli 0.36.2 → 0.36.4, plugin-catalog 2.0.5 → 2.0.7, plugin-scaffolder 1.37.0 → 1.38.1, plugin-auth-backend 0.29.0 → 0.29.2, frontend-plugin-api 0.17.1 → 0.17.3, ui 0.15.0 → 0.17.0, backend-defaults 0.17.2 → 0.17.6, plugin-notifications 0.5.17 → 0.5.19, plugin-signals 0.0.31 → 0.0.33)

Consequences

None for this codebase. Notable v1.52 / v1.53 breaking changes were checked against current code and app-config.yaml:

  • discovery.endpoints object form — not configured
  • ComboboxProps / SelectProps union types — not extended
  • PolicyQueryUser.token / expiresInSeconds removal — module already uses info
  • catalog.stitchingStrategy.mode: 'immediate' removal — not configured
  • Default Kubernetes /kubernetes page removal — not used
  • MS Graph disabled user filtering — not used
  • MCP SSE transport removal — not used
  • bootstrapEnvProxyAgents removal — not used

The 1.53.1 legacy-app template additionally adds @backstage/plugin-user-settings-backend, which is optional (database-backed user settings — we use browser local storage via the frontend plugin-user-settings).

Testing

Local verification on macOS (mise-managed toolchain, Node 22.11.0, Yarn 4.3.1):

  • yarn lint:all — passes across all 5 packages
  • yarn test --watchAll=false — 9 tests pass, 1 skipped (pre-existing App.test.tsx)
  • yarn build:all — frontend (Rspack) and backend bundles build clean
  • yarn dev (full stack) — backend initialises all 10 plugins (app, auth, catalog, notifications, permission, proxy, scaffolder, search, signals, techdocs), guest auth issues tokens, catalog returns 73 entities across 7 kinds, frontend compiles and serves on :3000

CI will pick this up via the existing build.yml workflow.

- Add MISE_PYTHON_GITHUB_ATTESTATIONS=false to Dockerfile (both build
and run stages) to bypass mise Python 3.10.12 attestation failures
in mise 2026.5.16+
- Copy .yarn/plugins/ and backstage.json before yarn install in build
stage - the Backstage Yarn plugin requires these to resolve
backstage:^ version ranges
- Remove yarn tsc from Dockerfile - type checking is already covered
by backstage-cli repo lint in CI
- Copy .yarn/plugins/ and backstage.json before yarn workspaces focus
in run stage for the same reason
- Run mise install locally to rebuild native modules (better-sqlite3,
isolated-vm, cpu-features) for Node 22 ABI
- Fix GitHub Light/Dark themes missing text colors and component overrides
- Import styles.css into GitHub theme package
- Add MuiGrid, MuiTypography, MuiCard overrides to GitHub themes
- Remove negative marginBottom from catalog Grid items
- Add consistent spacing={2} to all catalog Grid containers
- Increase default theme MuiGrid padding from .5rem to 1rem
- Fix missing item prop on nested Grid in apiPage
- Remove MuiGrid overrides from both default and GitHub themes
The overrides broke MUI's spacing prop by zeroing out item padding
- Add global CSS fix for Backstage's v5-MuiGrid class name prefix
Backstage's UnifiedThemeProvider adds 'v5-' prefix to MUI classes,
but Grid's internal CSS still targets .MuiGrid-item selectors.
This mismatch caused all Grid items to have 0 padding, making
cards touch each other across all pages.
- Import grid-fix.css in index.tsx so it applies globally
- Bumped backstage version to 1.53.1 (latest stable as of 2026-07-29)
- Updated yarn backstage plugin checksum and spec to 1.53.1
- Yarn install pulled in updated @backstage/* packages (cli 0.36.4, core-plugin-api 1.12.8,
plugin-catalog 2.0.7, plugin-scaffolder 1.38.1, plugin-auth-backend 0.29.2,
frontend-plugin-api 0.17.3, ui 0.17.0, backend-defaults 0.17.6,
plugin-notifications 0.5.19, plugin-signals 0.0.33)
Verified locally:
- yarn lint:all passes (54 files across 5 packages)
- yarn test passes (9 tests, 1 skipped pre-existing)
- yarn build:all succeeds for app and backend
- yarn workspace backend start boots cleanly, all 10 plugins initialise,
catalog processes all 73 entities
- yarn workspace app start compiles with Rspack
No breaking changes required for this codebase. Notable v1.52 / v1.53
breaking changes (discovery.endpoints object form, ComboboxProps union,
PolicyQueryUser.token removal, immediate stitching removal, etc.)
were checked against the current code and app-config and are not in use.
@johnnyhuy
johnnyhuy enabled auto-merge (squash) August 18, 2026 13:06
@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

DiffPackageSupply Chain
Security
VulnerabilityQualityMaintenanceLicense
Updated@​backstage/​plugin-permission-backend-module-allow-all-policy@​0.2.19 ⏵ 0.2.211001006398100
Updated@​backstage/​plugin-catalog-backend-module-scaffolder-entity-model@​0.2.20 ⏵ 0.2.221001006598100
Updated@​backstage/​plugin-permission-react@​0.5.1 ⏵ 0.5.3991006798100
Updated@​backstage/​cli-defaults@​0.1.2 ⏵ 0.1.4681007298+1100
Updated@​backstage/​plugin-permission-backend@​0.7.12 ⏵ 0.7.14991006998100
Updated@​backstage/​plugin-scaffolder-backend-module-notifications@​0.1.22 ⏵ 0.1.24981006998100
Updated@​backstage/​plugin-techdocs-module-addons-contrib@​1.1.36 ⏵ 1.1.3899+110070+198100
Updated@​backstage/​plugin-signals-backend@​0.3.15 ⏵ 0.3.17991007098100
Updated@​backstage/​plugin-auth-backend-module-gitlab-provider@​0.4.3 ⏵ 0.4.597+110070+198100
Updated@​backstage/​plugin-auth-backend-module-github-provider@​0.5.3 ⏵ 0.5.5100+110070+198100
Updated@​backstage/​integration-react@​1.2.18 ⏵ 1.2.20991007198100
Updated@​backstage/​plugin-permission-node@​0.11.0 ⏵ 0.11.2991007198100
Updated@​backstage/​plugin-auth-node@​0.7.1 ⏵ 0.7.3991007398100
Updated@​backstage/​plugin-search-react@​1.11.4 ⏵ 1.11.6991007498100
Updated@​backstage/​plugin-techdocs-react@​1.3.11 ⏵ 1.3.1399+110074+198100
Updated@​backstage/​plugin-scaffolder-common@​2.2.0 ⏵ 2.2.1891007497-1100
Updated@​backstage/​plugin-search-backend@​2.1.2 ⏵ 2.1.4991007498100
Updated@​backstage/​plugin-scaffolder-backend-module-github@​0.9.9 ⏵ 0.9.119910075+198100
Updated@​backstage/​app-defaults@​1.7.8 ⏵ 1.7.1099+110075+198100
Updated@​backstage/​plugin-scaffolder-backend@​4.0.0 ⏵ 4.0.276+110010098100
Updated@​backstage/​plugin-notifications@​0.5.17 ⏵ 0.5.1997+11007698100
Updated@​backstage/​dev-utils@​1.1.23 ⏵ 1.1.25991007698100
Updated@​backstage/​frontend-plugin-api@​0.17.1 ⏵ 0.17.39910076+198100
Updated@​backstage/​plugin-signals@​0.0.31 ⏵ 0.0.33971007698100
Updated@​backstage/​core-plugin-api@​1.12.6 ⏵ 1.12.8991007798100
Updated@​backstage/​ui@​0.15.0 ⏵ 0.17.0961007798100
Updated@​backstage/​test-utils@​1.7.18 ⏵ 1.7.20991007798100
Updated@​backstage/​plugin-search-backend-module-techdocs@​0.4.14 ⏵ 0.4.1699+110078+198100
Updated@​backstage/​plugin-techdocs@​1.17.6 ⏵ 1.17.897+110078+198100
Updated@​backstage/​backend-plugin-api@​1.9.1 ⏵ 1.9.399+110078+198100
Updated@​backstage/​plugin-search-backend-node@​1.4.4 ⏵ 1.4.61001007898100
Updated@​backstage/​plugin-catalog-react@​3.0.0 ⏵ 3.2.09810079+198100
See 23 more rows in the dashboard

View full report

@socket-security

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

ActionSeverityAlert (click "▶" to expand/collapse)
WarnHigh
Obfuscated code: npm underscore is 90.0% likely obfuscated

Confidence: 0.90

Location:Package overview

From:?npm/@backstage/backend-defaults@0.17.6npm/underscore@1.13.8

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/underscore@1.13.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@johnnyhuy

Copy link
Copy Markdown
ContributorAuthor

Replaced by PR on chore/upgrade-backstage-1.53.1-clean — this branch was 11 commits behind main with redundant padding-fix commits that conflict on rebase. Opening a clean single-commit PR on top of main.

auto-merge was automatically disabled August 18, 2026 13:07

Pull request was closed

@johnnyhuy
johnnyhuy deleted the chore/upgrade-backstage-1.53.1 branch August 18, 2026 13:07
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@johnnyhuy