fix(deps): update backstage monorepo

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@backstage/app-defaults (source)	1.7.8 → 1.7.10
@backstage/backend-defaults (source)	0.17.2 → 0.17.5
@backstage/backend-plugin-api (source)	1.9.1 → 1.9.3
@backstage/cli (source)	0.36.2 → 0.36.4
@backstage/core-app-api (source)	1.20.1 → 1.20.3
@backstage/core-components (source)	0.18.10 → 0.18.12
@backstage/core-plugin-api (source)	1.12.6 → 1.12.8
@backstage/frontend-plugin-api (source)	0.17.1 → 0.17.3
@backstage/integration-react (source)	1.2.18 → 1.2.20
@backstage/plugin-api-docs (source)	0.14.1 → 0.14.3
@backstage/plugin-app-backend (source)	0.5.14 → 0.5.16
@backstage/plugin-auth-backend (source)	0.29.0 → 0.29.2
@backstage/plugin-auth-backend-module-github-provider (source)	0.5.3 → 0.5.5
@backstage/plugin-auth-backend-module-guest-provider (source)	0.2.19 → 0.2.21
@backstage/plugin-auth-backend-module-oidc-provider (source)	0.4.16 → 0.4.18
@backstage/plugin-auth-node (source)	0.7.1 → 0.7.3
@backstage/plugin-catalog (source)	2.0.5 → 2.0.7
@backstage/plugin-catalog-backend (source)	3.7.1 → 3.8.1
@backstage/plugin-catalog-backend-module-logs (source)	0.1.22 → 0.1.24
@backstage/plugin-catalog-backend-module-scaffolder-entity-model (source)	0.2.20 → 0.2.22
@backstage/plugin-catalog-graph (source)	0.6.4 → 0.6.6
@backstage/plugin-catalog-import (source)	0.13.13 → 0.13.15
@backstage/plugin-kubernetes (source)	0.12.19 → 0.12.21
@backstage/plugin-kubernetes-backend (source)	0.21.4 → 0.21.6
@backstage/plugin-notifications (source)	0.5.17 → 0.5.19
@backstage/plugin-notifications-backend (source)	0.6.5 → 0.6.7
@backstage/plugin-org (source)	0.7.4 → 0.7.6
@backstage/plugin-permission-backend (source)	0.7.12 → 0.7.14
@backstage/plugin-permission-backend-module-allow-all-policy (source)	0.2.19 → 0.2.21
@backstage/plugin-permission-node (source)	0.11.0 → 0.11.2
@backstage/plugin-permission-react (source)	0.5.1 → 0.5.3
@backstage/plugin-proxy-backend (source)	0.6.13 → 0.6.15
@backstage/plugin-scaffolder (source)	1.37.0 → 1.38.1
@backstage/plugin-scaffolder-backend-module-github (source)	0.9.9 → 0.9.11
@backstage/plugin-scaffolder-backend-module-notifications (source)	0.1.22 → 0.1.24
@backstage/plugin-scaffolder-node (source)	0.13.3 → 0.13.5
@backstage/plugin-search (source)	1.7.4 → 1.7.6
@backstage/plugin-search-backend (source)	2.1.2 → 2.1.4
@backstage/plugin-search-backend-module-catalog (source)	0.3.15 → 0.3.17
@backstage/plugin-search-backend-module-pg (source)	0.5.55 → 0.5.57
@backstage/plugin-search-backend-module-techdocs (source)	0.4.14 → 0.4.16
@backstage/plugin-search-backend-node (source)	1.4.4 → 1.4.6
@backstage/plugin-search-react (source)	1.11.4 → 1.11.6
@backstage/plugin-signals (source)	^0.0.31 → ^0.0.33
@backstage/plugin-signals-backend (source)	0.3.15 → 0.3.17
@backstage/plugin-techdocs (source)	1.17.6 → 1.17.8
@backstage/plugin-techdocs-backend (source)	2.2.0 → 2.2.2
@backstage/plugin-techdocs-module-addons-contrib (source)	1.1.36 → 1.1.38
@backstage/plugin-techdocs-react (source)	1.3.11 → 1.3.13
@backstage/plugin-user-settings (source)	0.9.3 → 0.9.5
@backstage/test-utils (source)	1.7.18 → 1.7.20
@backstage/ui (source)	^0.15.0 → ^0.17.0

---

Release Notes

backstage/backstage (@​backstage/app-defaults)

v1.7.10

Compare Source

Patch Changes

• Updated dependencies
  • @​backstage/frontend-plugin-api@​0.17.3
  • @​backstage/core-components@​0.18.12
  • @​backstage/core-app-api@​1.20.3
  • @​backstage/core-plugin-api@​1.12.8
  • @​backstage/plugin-permission-react@​0.5.3

v1.7.9

Compare Source

Patch Changes

• 74ed625: Provide toastApi for old frontend system

  Fixes 'No implementation available for apiRef{core.toast}' on old frontend system.

• Updated dependencies

  • @​backstage/core-components@​0.18.11
  • @​backstage/frontend-plugin-api@​0.17.2
  • @​backstage/core-app-api@​1.20.2
  • @​backstage/core-plugin-api@​1.12.7
  • @​backstage/plugin-permission-react@​0.5.2

backstage/backstage (@​backstage/backend-defaults)

v0.17.5

Compare Source

Patch Changes

• aaa7d65: Improved readability of the AWS S3 URL parser by splitting the single monolithic regex into two separate patterns (standard S3 and VPC PrivateLink) with named capture groups. Also made the VPC endpoint region mandatory in the regex, fixing a potential mis-parse when the region segment was absent.
• d62c384: Fixed a bug where scheduled tasks that were initially registered with a manual trigger and later re-registered with a duration or cron cadence would never be scheduled to run.
• 8419f51: Added support for AWS PrivateLink for Amazon S3.
• a624fa3: The connection config option for the Redis cache store now accepts either a string URL or an object with additional connection options that are passed directly to the underlying client. The object form is only supported when backend.cache.store is redis; other stores require a plain string. This allows configuring options like pingInterval without needing dedicated config fields. For clustered Redis, the connection object properties are merged into cluster defaults. Fixes #​31813, #​31742.
• Updated dependencies
  • @​backstage/config-loader@​1.11.0
  • @​backstage/plugin-auth-node@​0.7.3
  • @​backstage/backend-app-api@​1.7.2
  • @​backstage/backend-plugin-api@​1.9.3
  • @​backstage/cli-node@​0.3.4
  • @​backstage/plugin-events-node@​0.4.24
  • @​backstage/plugin-permission-node@​0.11.2

v0.17.4

Compare Source

Patch Changes

• aaa7d65: Improved readability of the AWS S3 URL parser by splitting the single monolithic regex into two separate patterns (standard S3 and VPC PrivateLink) with named capture groups. Also made the VPC endpoint region mandatory in the regex, fixing a potential mis-parse when the region segment was absent.
• 8419f51: Added support for AWS PrivateLink for Amazon S3.
• Updated dependencies
  • @​backstage/config-loader@​1.11.0-next.0
  • @​backstage/plugin-auth-node@​0.7.3-next.0
  • @​backstage/backend-app-api@​1.7.2-next.0
  • @​backstage/plugin-permission-node@​0.11.2-next.0
  • @​backstage/backend-plugin-api@​1.9.3-next.0
  • @​backstage/plugin-events-node@​0.4.24-next.0

v0.17.3

Compare Source

Patch Changes

• 4f4bcf5: Upgraded infinispan from ^0.12.0 to ^0.13.0 to address known vulnerabilities.
• a07e6a3: Updated AzureBlobStorageUrlReader to reference the correctly-named AzureBlobStorageIntegration type from @backstage/integration. The previously-used AzureBlobStorageIntergation is now an alias for the new type and remains a valid argument to the constructor.
• b75158b: Adapted Azure-related tests for the Azure SDK upgrade to ESM-style exports. The AzureBlobStorageUrlReader now accepts an optional createContainerClient dependency for testability without needing to mock the @azure/storage-blob module.
• 89a95ca: Fixed the task worker retry loop to respect the abort signal. Previously, when a task worker encountered an unexpected error, the retry loop would continue indefinitely even after the worker was signaled to stop. The retry loop now checks the abort signal before retrying and passes it to the retry delay, allowing the worker to shut down gracefully.
• def82d4: Fixed the built-in rate limiter throwing a validation error and refusing to start when backend.rateLimit is enabled. Requests are now keyed using the address normalization helper from express-rate-limit, which is required by newer versions of that library and ensures IPv6 clients are grouped by their address block rather than by individual address.
• 0211390: Added a new v2 invoke endpoint (/.backstage/actions/v2/actions/:id/invoke) that accepts a wrapped body format { input, secrets } with secrets validation. The existing v1 invoke endpoint remains unchanged for backward compatibility. Updated DefaultActionsService to use the v2 endpoint. Updated DefaultActionsRegistryService to expose secrets schema in the actions list response and validate secrets on invocation.
• 34f21c3: Fix gitlabUrlReader issue with retrieving the repository archive tree
• Updated dependencies
  • @​backstage/cli-node@​0.3.3
  • @​backstage/backend-app-api@​1.7.1
  • @​backstage/integration@​2.0.3
  • @​backstage/backend-plugin-api@​1.9.2
  • @​backstage/config-loader@​1.10.12
  • @​backstage/plugin-auth-node@​0.7.2
  • @​backstage/plugin-events-node@​0.4.23
  • @​backstage/plugin-permission-node@​0.11.1

backstage/backstage (@​backstage/backend-plugin-api)

v1.9.3

Compare Source

Patch Changes

• Updated dependencies
  • @​backstage/cli-common@​0.3.0
  • @​backstage/plugin-auth-node@​0.7.3
  • @​backstage/plugin-permission-node@​0.11.2

v1.9.2

Compare Source

Patch Changes

• 02c4e8a: Removed unused json-schema runtime dependency. The package was only used for TypeScript types from @types/json-schema; affected imports have been converted to import type to allow safe removal.
• 0211390: Added optional secrets schema support to ActionsRegistryActionOptions and ActionsRegistryActionContext. Actions can now declare a Zod secrets schema separate from the input schema, enabling surfaces to collect sensitive credentials independently from tool arguments. Added optional secrets field to ActionsServiceAction metadata and ActionsService.invoke() parameters.
• Updated dependencies
  • @​backstage/plugin-auth-node@​0.7.2
  • @​backstage/plugin-permission-node@​0.11.1

backstage/backstage (@​backstage/cli)

v0.36.4

Compare Source

Patch Changes

• 61d4881: The shared ESLint configuration now reports unused imports in config.d.ts configuration schema files. These declaration files are not covered by the TypeScript compiler's unused-variable checks, which previously allowed a stray import to slip through. Such an import can resolve during local development but break configuration schema loading for consumers of the published package, so it is now caught at lint time.
• Updated dependencies
  • @​backstage/cli-module-build@​0.1.5
  • @​backstage/cli-common@​0.3.0
  • @​backstage/cli-defaults@​0.1.4
  • @​backstage/cli-module-test-jest@​0.1.4
  • @​backstage/cli-node@​0.3.4

v0.36.3

Compare Source

Patch Changes

• b521571: Improved validation of conflicting CLI module commands, including conflicts between parent and nested command paths.
• Updated dependencies
  • @​backstage/cli-module-build@​0.1.4
  • @​backstage/cli-module-test-jest@​0.1.3
  • @​backstage/cli-node@​0.3.3
  • @​backstage/eslint-plugin@​0.3.1
  • @​backstage/cli-defaults@​0.1.3

backstage/backstage (@​backstage/core-app-api)

v1.20.3

Compare Source

Patch Changes

• 3ef5974: Added support for wildcard plugin entries in frontend discovery endpoints, matching the backend discovery behavior.
• 6172725: Fixed the default fetch API to support discovery endpoints that only define an internal target.
• Updated dependencies
  • @​backstage/ui@​0.17.0
  • @​backstage/core-plugin-api@​1.12.8

v1.20.2

Compare Source

Patch Changes

• Updated dependencies
  • @​backstage/ui@​0.16.0
  • @​backstage/core-plugin-api@​1.12.7

backstage/backstage (@​backstage/core-components)

v0.18.12

Compare Source

Patch Changes

• 120e7c3: chore(deps): bump js-yaml from 4.1.1 to 4.2.0
• 9efce7d: Fixed the table filters sidebar rendering a stray 0 when no filters are configured.
• 7ceeaad: Migrated CopyTextButton component from Material-UI to Backstage UI (BUI). Replaced MUI IconButton and Tooltip with BUI ButtonIcon and TooltipTrigger/Tooltip components. This is an internal refactoring that maintains backward compatibility - the component API remains unchanged.
• Updated dependencies
  • @​backstage/ui@​0.17.0
  • @​backstage/core-plugin-api@​1.12.8

v0.18.11

Compare Source

Patch Changes

• e0889a3: chore(deps): bump qs from 6.15.1 to 6.15.2
• a07e6a3: Added the correctly-spelled 'header' literal to the TableFiltersClassKey union type and deprecated the previous typoed 'heder' literal. The generated CSS class with the old key is preserved for backwards compatibility; switch to 'header' to avoid future removal.
• c161e1c: Lazy-load react-syntax-highlighter and @dagrejs/dagre so they are no longer pulled in eagerly through the barrel export. This reduces the upfront module cost of importing from @backstage/core-components by roughly 10 MB. The public API is unchanged.
• dbe93a7: Fix autologout not working correctly when closing all tabs
• 8add9b9: Fixed the proxy-based sign-in page failing to read the session token when the proxy issues a token whose payload is encoded using the URL-safe base64 alphabet. Such tokens are now decoded correctly so sign-in no longer breaks.
• f35372d: Fixed text clipping in SidebarSubmenuItem by correcting line-height from 1 to 1.5
• Updated dependencies
  • @​backstage/core-plugin-api@​1.12.7

backstage/backstage (@​backstage/core-plugin-api)

v1.12.8

Compare Source

Patch Changes

• Updated dependencies
  • @​backstage/frontend-plugin-api@​0.17.3

v1.12.7

Compare Source

Patch Changes

• Updated dependencies
  • @​backstage/frontend-plugin-api@​0.17.2

backstage/backstage (@​backstage/frontend-plugin-api)

v0.17.3

Compare Source

Patch Changes

• a5b2811: Adds useBreadcrumbEntries hook, BreadcrumbEntry component, and BreadcrumbsRegistryProvider for managing breadcrumb trails across the component tree for plugins using new frontend system. Completes wiring so that new frontend system plugin Pages and SubPages get automatic-population of PluginHeader breadcrumbs.

  • The app plugin's PageLayout registers a root breadcrumb for each plugin page and passes the breadcrumb trail to PluginHeader
  • PageBlueprint automatically wraps each sub-page route element with BreadcrumbEntry, so sub-pages contribute to the PluginHeader breadcrumb trail without extra wiring.
  • Plugin authors who need breadcrumbs for internal routes within a sub-page can wrap their route content with BreadcrumbEntry manually.
    • plugin-scaffolder internal routes have been wrapped as an example

• Updated dependencies

  • @​backstage/filter-predicates@​0.1.4

v0.17.2

Compare Source

Patch Changes

• 378784e: Moved dependencies that are re-exported in the public API from devDependencies to dependencies. These were incorrectly demoted in #​33936 because the source code only uses type imports, but the types still appear in the published API surface and need to be resolvable by consumers at build time.

backstage/backstage (@​backstage/integration-react)

v1.2.20

Compare Source

Patch Changes

• Updated dependencies
  • @​backstage/core-plugin-api@​1.12.8

v1.2.19

Compare Source

Patch Changes

• Updated dependencies
  • @​backstage/integration@​2.0.3
  • @​backstage/core-plugin-api@​1.12.7

backstage/backstage (@​backstage/plugin-api-docs)

v0.14.3

Compare Source

Patch Changes

• Updated dependencies
  • @​backstage/frontend-plugin-api@​0.17.3
  • @​backstage/ui@​0.17.0
  • @​backstage/plugin-catalog@​2.0.7
  • @​backstage/plugin-catalog-react@​3.2.0
  • @​backstage/core-components@​0.18.12
  • @​backstage/core-plugin-api@​1.12.8
  • @​backstage/plugin-permission-react@​0.5.3

v0.14.2

Compare Source

Patch Changes

• Updated dependencies
  • @​backstage/plugin-catalog@​2.0.6
  • @​backstage/plugin-catalog-react@​3.1.0
  • @​backstage/core-components@​0.18.11
  • @​backstage/frontend-plugin-api@​0.17.2
  • @​backstage/ui@​0.16.0
  • @​backstage/core-plugin-api@​1.12.7
  • @​backstage/plugin-permission-react@​0.5.2

backstage/backstage (@​backstage/plugin-app-backend)

v0.5.16

Compare Source

Patch Changes

• Updated dependencies
  • @​backstage/config-loader@​1.11.0
  • @​backstage/plugin-auth-node@​0.7.3
  • @​backstage/backend-plugin-api@​1.9.3
  • @​backstage/plugin-app-node@​0.1.47

v0.5.15

Compare Source

Patch Changes

• ca450be: Added a new app.disablePublicEntryPoint config option that allows you to opt out of the automatic public sign-in entry point. When set to true, the app backend will skip serving the public entry point to unauthenticated users, even if the app was bundled with an index-public-experimental entry point.
• Updated dependencies
  • @​backstage/backend-plugin-api@​1.9.2
  • @​backstage/config-loader@​1.10.12
  • @​backstage/plugin-app-node@​0.1.46
  • @​backstage/plugin-auth-node@​0.7.2

backstage/backstage (@​backstage/plugin-auth-backend)

v0.29.2

Compare Source

Patch Changes

• e2b3472: Promoted Client ID Metadata Documents (CIMD) to the stable auth.clientIdMetadataDocuments configuration. The previous auth.experimentalClientIdMetadataDocuments key remains supported as a deprecated alias. Dynamic Client Registration now logs a deprecation warning when enabled and users should migrate to CIMD.
• 2aeb246: Added token revocation support for clients using client ID metadata documents (CIMD). The /v1/revoke endpoint is now available whenever dynamic client registration or client ID metadata documents are enabled, and is advertised through revocation_endpoint in the OpenID provider configuration.
• Updated dependencies
  • @​backstage/plugin-auth-node@​0.7.3
  • @​backstage/backend-plugin-api@​1.9.3
  • @​backstage/plugin-catalog-node@​2.2.3

v0.29.1

Compare Source

Patch Changes

• Updated dependencies
  • @​backstage/backend-plugin-api@​1.9.2
  • @​backstage/plugin-auth-node@​0.7.2
  • @​backstage/plugin-catalog-node@​2.2.2

backstage/backstage (@​backstage/plugin-auth-backend-module-github-provider)

v0.5.5

Compare Source

Patch Changes

• Updated dependencies
  • @​backstage/plugin-auth-node@​0.7.3
  • [@​backstage/backend-plugin-api](https://redirect.git

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.