David TuiteNews
Backstage v1.48.0 Ships with Major New Frontend System Updates
Backstage v1.48.0 shipped February 17 after nearly a month of pre-release testing. The release brings significant changes to the New Frontend System, including graduated catalog extension points, experimental MCP authorization support, and breaking changes to API restrictions.
Key highlights:
- Catalog processing extension points graduated from alpha to stable (remove
/alphaimports). - API restrictions now enforced (plugins can only provide APIs to themselves, not other plugins). * New
createServiceMockandcreateApiMockutilities for testing. - Plugin titles and icons now supported, and module federation enabled by default without build-time overhead.
The release also introduces experimental catalogScmEventsServiceRef for instant catalog updates via webhooks, experimental Client ID Metadata Documents for MCP authorization (auth.experimentalClientIdMetadataDocuments.enabled), and experimental refresh token support to prevent hourly token expiration.
The breaking changes caught some teams off guard. Some users reported Soundcheck rendering issues tied to recently removed CSS variables in Backstage UI. Anyone running a custom theme should check that their files are referencing current CSS tokens before upgrading.
v1.48.1 Patch Fixes Type Compatibility and Documentation Issues
A patch release shipped February 18, fixing two regressions from v1.48.0:
- A missing sharing extensions sidebar item in the frontend system architecture docs
- A type compatibility issue for older plugins in the
FrontendFeaturetype.
If you upgraded to 1.48.0 and hit plugin type errors, update to 1.48.1.
Security Advisory: CVE-2025-69873 in ajv Dependency
Community members flagged CVE-2025-69873 (CVSS 8.2) affecting [email protected], a transitive dependency of @backstage/[email protected]. The vulnerability involves potential denial-of-service via uncontrolled schema input. Maintainer freben assessed impact as low since ajv only runs during build, not in production applications. Teams that tried resolving it by upgrading to [email protected] ran into breaking changes in the CLI's linting pipeline. The maintainers are still working through it.
Roadie Blog
Roadie published a new post this week on GitLab integration: Supercharge your GitLab setup with Roadie's Internal Developer Portal. It covers how teams using GitLab can eliminate repo sprawl, centralize ownership and governance, and visualize CI/CD pipelines through Roadie's managed Backstage platform. The post focuses on getting a production-ready IDP running in hours rather than months.
Community Discussions
Release Updates: Backstage v1.48.0 and v1.48.1
Backstage v1.48.0 shipped on February 17, followed quickly by a patch release v1.48.1 on February 18. The patch fixed two regressions introduced in 1.48.0: a missing sharing extensions sidebar item in the frontend system architecture docs, and a type compatibility issue for older plugins in the FrontendFeature type. Community members reported that some third-party plugins (notably Soundcheck) showed rendering issues after upgrading to 1.48.0, and a thread in #general noted that GabDug pointed to recently removed CSS variables in the latest Backstage UI update as a likely cause. Users encountering visual glitches after upgrading should check whether they need to update CSS variable references in custom theme files.
New Frontend System: "Is It Production-Ready?" Gets a Definitive Answer
One of the most active discussions of the week came from #support (25 replies), where Dinesh asked whether the New Frontend System is production-ready, what the alpha/experimental status means, and whether teams should migrate now or wait.
Maintainer Ahhhndre gave a clear and confident answer: the NFS has been announced as adoption-ready for several months and many organizations are already running it in production. The thread evolved into a practical migration walkthrough, with Sarabadu and Ahhhndre helping Dinesh navigate the transition from convertLegacyAppOptions to the new createApp API and clarifying plugin compatibility with signals.
Key clarifications from maintainers:
- There is no difference from a deployment standpoint between the legacy and new frontend systems.
convertLegacyAppOptionsis a transitional helper that will be removed once the full migration is complete.signalPluginis already NFS-compatible and should not be added to the legacy options during migration.
If you're looking for more information, check out these docs and migration guides
BUI Migration Pain Points: Theming and Missing Card Types
Teams migrating to Backstage UI (BUI) ran into several friction points this week. In #frontend-system , lgnd_seba reported being unable to apply a custom theme when migrating to BUI, finding that neither import '@backstage/ui/css/styles.css' nor the CSS variable approach using [data-theme-mode='dark'] caused the component to pick up the custom font; it fell back to the BUI default system-ui. In the same channel, adders flagged that EntityDependencyOfComponentsCard is missing an entity-card equivalent in the NFS, with no clear workaround for using existing cards. Brian Wink noted that type: summary was removed in 1.48.0 for Overview cards, raising questions about how to place two smaller cards side-by-side without it.
Security Advisory: CVE-2025-69873 in [email protected] (Backstage CLI Dependency)
A message thread in #security raised a Snyk alert for [email protected], which is a transitive dependency of @backstage/[email protected]. The vulnerability is CVE-2025-69873 (CVSS 8.2, SNYK-JS-AJV-15274295) and involves a potential denial-of-service via uncontrolled schema input. Maintainer freben assessed the impact as low for Backstage since ajv is used only in the build process (not in the running application).
Teams attempting to resolve the issue by upgrading to [email protected] reported that doing so breaks the CLI's linting pipeline with "NOT SUPPORTED: option missingRefs" errors. The thread was ongoing as of Feb 18, with the team investigating the correct version bump path.
Call for Help: SCM Webhook Event Handlers for the Catalog
In #catalog , maintainer freben shared an open call for community contributions. The Backstage catalog now has a generic interface for handling SCM events (things like file changes, repo renames/deletions, branch creation, and archiving), but only a GitHub adapter has been implemented so far. Teams using GitLab, Bitbucket, or other SCM providers that want instant reactive updates to catalog state are encouraged to contribute adapters. This was a required feature for the 1.48 release cycle.
Community Plugin: Excalidraw-Style Catalog Graph
Milan May'r shared a new community plugin in #visual-design and #plugins : backstage-plugin-roughjs-catalog-graph, which replaces the standard Relations Graph on entity pages with one rendered using rough.js (the same hand-drawn aesthetic popularized by Excalidraw). The plugin takes approximately five minutes to install. It received positive reactions in the community and is a fun way to give the dependency graph a more casual, whiteboard-style look.
Kubernetes-Ingestor Plugin: New Release with Cache Improvements
A 9-message thread in #plugins tracked a community request for a new release of the kubernetes-ingestor plugin. User prims47 had contributed a PR improving cache behavior when resolving owner from namespace, and Thomvaill's team was waiting on the release to plan their project schedule. Plugin maintainer Scott Rosenberg (vRabbi) confirmed on Feb 17 that a new release went out with the changes, and prims47 noted significantly improved performance on local testing.
Volvo Backstage Adoption Story Featured in Community Session
In #adoption , mihait announced that the upcoming Backstage Community Session (week of Feb 18) would feature Volvo showcasing their Backstage adoption journey. This continues the tradition of enterprise adoption stories in the monthly community calls and is a great resource for teams making the business case for Backstage internally.
TechDocs Content Rendering Randomly Blank in 1.44.x
A detailed bug report landed in #techdocs from user RP on Feb 17: TechDocs pages randomly show a blank content area while the sidebar renders correctly, with the issue appearing after 3–20 navigation clicks through docs pages.
The instance is running Backstage 1.44.1 with an external builder and GCS publisher. Network inspection showed all requests completing with 200/304 responses and no timeouts, making it tricky to diagnose. RP noted the issue is more common on pages with nested navigation and a custom plugin linking TechDocs for 150+ technologies. The thread was open for community input as of this writing.
Changelog
v1.48.0 (Feb 17, 2026) Major release with graduated catalog extension points, NFS enhancements, module federation enabled by default, experimental MCP authorization, and breaking changes to API restrictions. Full changelog at docs/releases/v1.48.0-changelog.md .
v1.48.1 (Feb 18, 2026) Patch release fixing missing sharing extensions sidebar item in frontend system docs and type compatibility for older plugins.
