Catalog Model Fragments RFC, OAuth Fix & Finland Meetup | Backstage Weekly

Core maintainer freben published a mini-RFC proposing Catalog Model Fragments, a new system for plugins to formally declare and extend the entity model. Backstage v1.49.4 shipped with an OAuth 2.0 fix affecting MCP and AI tool integrations. The community explored building Backstage MCP servers inspired by Spotify's AiKA, discussed Zod schema incompatibility blocking v1.49.x upgrades, and surfaced patterns for running multiple environments on shared PostgreSQL servers. A yarn tsc out-of-memory issue after Zod upgrades generated substantial discussion. The first Backstage Finland User Group meetup was announced for May 19 in Helsinki. April Fools brought a Windows 95-themed Backstage UI complete with Clippy assistant.

Backstage Finland User Group

Catalog Model Fragments RFC: Formalizing entity model extensions

Core maintainer freben announced in #catalog that he'd opened a mini-RFC on GitHub (issue #33770 ) calling for community input on a new alpha system for declaring, extending, and introspecting the catalog entity model. The proposal would let plugins register their own entity model fragments (custom fields, relationships, or metadata schemas) in a structured way that the catalog engine can reason about, rather than relying on ad hoc conventions.

The current model treats the catalog schema as implicit. Plugins add fields or relationships through convention, but there's no formal registration mechanism. This makes it difficult for tools to discover what fields are valid, for validation to catch schema drift, and for documentation to stay synchronized with actual usage. The RFC treats this as an API review opportunity ahead of implementation. Comment on the issue directly if you've ever wished plugins could formally advertise what they add to the catalog.

v1.49.4 ships with OAuth fix for MCP and AI integrations

Backstage v1.49.4 landed on April 7 with a focused set of fixes. It addresses a previous regression where the OAuth 2.0 Protected Resource Metadata endpoint was returning the wrong URL, affecting MCP and AI tool integrations. It also fixes an incorrect legacy-frontend-plugin template name and several other minor issues.

The OAuth fix solved an issue where Backstage actions worked fine with GitHub Copilot in VS Code but failed with Claude Code. The community had already flagged this in #backend-system , and PR #33092 resolves it by correcting the metadata endpoint response.

First Backstage Finland User Group meetup announced for May

The Backstage Finland User Group is hosting its inaugural meetup on Tuesday, May 19, 2026, the day before KubeCon Community Day in Helsinki. The event was announced in #meetups by drodil on April 8. The community-organized event includes knowledge sharing, live demos, and networking. Speakers are welcome to present. Contact drodil directly if you're interested.

Community Discussions

🤖 Community wants to build a Backstage MCP, inspired by Spotify's AiKA

A Spotify R&D video titled "Build like Vincenzo: AiKA | Spotify for Backstage" sparked an 8-message thread in #general , with community members asking about the MCP tooling used in the demo. SonilPro's team is trying to build a Backstage MCP server that can answer questions about their system, similar to how AiKA works internally at Spotify. freben joined in and suggested that Backstage's TechDocs search action would be a natural starting point for MCP tool definitions in documentation lookup use cases. Teams are actively exploring how to expose Backstage's catalog as context for AI coding agents, and this thread is a good snapshot of where that work stands.

🔐 Service account vs. user token: permissions in multi-tool Backstage

A thread in #auth surfaced a common architectural tension: when Backstage integrates with tools like Bitbucket, Jenkins, Kubernetes, and Jira via Keycloak, teams often use a shared service account token for backend-to-service communication, bypassing individual user permissions. This is particularly concerning when AI agents are granted Backstage access to open PRs. The thread explored whether Backstage should proxy user-scoped JWT tokens to downstream services and whether the permissions framework should support federated permission checks from external systems. No clear solution emerged, but teams building AI-augmented pipelines will increasingly run into this design problem.

🔑 Zod schema incompatibility blocking upgrades to v1.49.x

Jon Koops opened a 6-message thread in #general requesting a backport of PR #33536 to the v1.49.x line. The change, which refactors APIs to use TSchema extends ZodType instead of ZodSchema<Output, ZodType...> decomposition, is blocking downstream consumers who can't jump directly to v1.50. freben explained that the team generally doesn't backport breaking-change fixes to stable branches, and the pragmatic workaround is a Yarn resolution override. A related #support thread posted April 7 is also asking about Zod v4.x compatibility, and is still awaiting a maintainer response.

🏗️ Running multiple Backstage environments on one PostgreSQL server

A thread in #general explored how to isolate multiple Backstage environments (for example, idp_dev and idp_uat) on a single shared PostgreSQL server. Backstage creates one database per plugin (catalog, app, search), so running two full environments means managing TOTAL_PLUGINS × N_ENVIRONMENTS databases, which gets unwieldy fast. The thread covered schema-naming conventions and whether a shared server is actually worth the operational complexity compared to dedicated instances per environment.

💾 yarn tsc out of memory after Zod upgrade

A #support thread from April 1 hit on a widespread pain point: after updating to recent Backstage versions, yarn tsc crashes with a JS heap out-of-memory error. Dinesh confirmed that updating from Zod v3 to Zod v4 resolved the OOM, and freben added context: ensure everything is at least ^3.25.0, prefer import { z } over import z, and use from 'zod/v3' explicitly to avoid the v3/v4 ambiguity. A related thread in #general from the same week noted that migrating from the deprecated makeFieldSchemaFromZod to makeFieldSchema also stopped the OOM during type-checking.

😄 Entity provider with delta mutation: How does it actually work?

In a 13-message thread in #support , Enri Kapaj from Red Hat asked how delta-type entity providers know when to fire. Full-mutation providers run on a schedule you define, but delta providers are event-driven with no obvious wiring. freben clarified that some listen to PubSub messages, some run on a cadence, and some are triggered by API calls from a custom backend plugin. The catalog engine receives mutation commands without caring about the source. This thread is now a solid community reference for anyone building event-driven entity ingestion.

📝 app-config.yaml intellisense: The community wants it, it's just hard

Sarabadu kicked things off with a well-received meme ("I don't know if there is an easy way to get app-config intellisense, and at this point I'm too afraid to ask") that triggered an 8-message thread about IDE support for app-config.yaml. Partial intellisense exists for the core framework via config.d.ts schema files, but it doesn't extend to installed community plugins. freben noted that plugin schema discovery is non-trivial, but hinted that the output of backstage-cli config:schema could potentially feed into standard VS Code JSON schema tooling. freben replied on April 7, so it's worth watching.

😂 April Fools: Windows 95-themed Backstage UI with Clippy

The community marked April 1 in their own way. Ballpointcarrot shared a Windows 95-themed Backstage UI complete with a "Clippy"-style assistant with benji saying it was better than his own half-finished "Backstage premium subscription plugin" joke. The "Backstage is dead" LinkedIn post shared by drodil ( from Zohar Einy and Spotify for Backstage) prompted a 6-message thread including freben quipping "...you'd be poor 😂".

Changelog

v1.49.4

Released April 7, 2026

Highlights:

Fixed OAuth 2.0 Protected Resource Metadata endpoint returning wrong URL (affecting MCP and AI tool integrations)
Corrected legacy-frontend-plugin template name
Additional minor bug fixes

Full changelog: https://github.com/backstage/backstage/releases/tag/v1.49.4

v1.50.0-next.2