Skip to content

[opencode] feat: upgrade Backstage from 1.53.1 to 1.55.3 - #100

Merged
johnnyhuy merged 2 commits into
mainfrom
opencode/backstage-upgrade-1.55.3
Oct 3, 2026
Merged

johnnyhuy merged 2 commits into
mainfrom
opencode/backstage-upgrade-1.55.3

Conversation

@johnnyhuy

Copy link
Copy Markdown
Contributor

What

Upgrades the Backstage monorepo from 1.53.1 to 1.55.3, the current latest stable release, and unblocks yarn install along the way.

Why

The portal was pinned to Backstage 1.53.1 while 1.55.3 is the current stable line. Staying behind means missing framework fixes and features, and each release we skip makes the next upgrade diff larger. This is the routine sweep to keep the repo current.

The install blocker and its root cause

yarn backstage-cli versions:bump succeeded, but its follow-up yarn install failed during the resolution step:

Error: got@patch:got@npm%3A11.8.2#~/.yarn/patches/got-npm-11.8.2-c1eb105458.patch:
ENOENT: no such file or directory

Root cause: the 1.55.x line pulls in @backstage/cli-defaults -> @backstage/cli-module-package-manager-yarn -> @yarnpkg/core@^4.9.1. Yarn 4.9.2 published @yarnpkg/core with a got dependency using the patch: protocol, but the patch file itself only exists in the yarn berry monorepo and is not shipped in the npm tarball. Every consumer of that package hits an ENOENT unless they vendor the patch.

Fix: vendor the exact patch file from the public yarn berry repo into .yarn/patches/, so Yarn applies the upstream promise-settle fix to got as intended. No hand-written patch content, no unpatched got downgrade.

Changes

  • backstage.json 1.53.1 -> 1.55.3
  • Backstage yarn plugin and .yarnrc.yml spec refreshed to the 1.55.3 plugin
  • yarn.lock re-resolved for the 1.55.3 release line
  • .yarn/patches/got-npm-11.8.2-c1eb105458.patch added (from yarnpkg/berry)

Validation

Runs yarn backstage-cli versions:bump and refreshes the yarn plugin and
lockfile. Adds the got patch from the yarn berry repo that
@yarnpkg/core@4.9.2 (pulled in by @backstage/cli-module-package-manager-yarn)
references but does not ship in its npm tarball, fixing the ENOENT on
yarn install.

Co-authored-by: opencode-agent[bot] <219766164+opencode-agent[bot]@users.noreply.github.com>
@socket-security

socket-security Bot commented Oct 3, 2026 •

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatednpm/​@​backstage/​plugin-permission-backend-module-allow-all-policy@​0.2.21 ⏵ 0.2.231001006398100
Updatednpm/​@​backstage/​plugin-catalog-backend-module-scaffolder-entity-model@​0.2.22 ⏵ 0.2.24100 +11006598100
Updatednpm/​@​backstage/​plugin-permission-backend@​0.7.14 ⏵ 0.7.1699 +11006998100
Updatednpm/​@​backstage/​plugin-scaffolder-backend-module-notifications@​0.1.24 ⏵ 0.1.26100 +21006998100
Updatednpm/​@​backstage/​plugin-techdocs-module-addons-contrib@​1.1.38 ⏵ 1.1.409910070 +198100
Updatednpm/​@​backstage/​plugin-signals-backend@​0.3.17 ⏵ 0.3.1999 +11007098100
Updatednpm/​@​backstage/​plugin-auth-backend-module-gitlab-provider@​0.4.5 ⏵ 0.4.792 -41007098100
Updatednpm/​@​backstage/​plugin-auth-backend-module-github-provider@​0.5.5 ⏵ 0.5.710010071 +198100
Updatednpm/​@​backstage/​plugin-permission-common@​0.9.9 ⏵ 0.9.11991007198 +4100
Updatednpm/​@​backstage/​plugin-permission-node@​0.11.2 ⏵ 0.11.4100 +110072 +198100
Updatednpm/​@​backstage/​plugin-catalog-common@​1.1.10 ⏵ 1.2.0100 +110072 +198 +4100
Updatednpm/​@​backstage/​cli-defaults@​0.1.4 ⏵ 0.1.699 +3210073 +198 +1100
Updatednpm/​@​backstage/​plugin-auth-node@​0.7.3 ⏵ 0.7.699 +110073 +198100
Updatednpm/​@​backstage/​plugin-scaffolder-common@​2.2.1 ⏵ 2.3.089 +110074 +198 +2100
Updatednpm/​@​backstage/​plugin-search-backend@​2.1.4 ⏵ 2.1.799 +110074 +198100
Updatednpm/​@​backstage/​plugin-scaffolder-backend-module-github@​0.9.11 ⏵ 0.10.09910075 +198100
Updatednpm/​@​backstage/​config@​1.3.8 ⏵ 1.3.9100 +110075 +197 +3100
Updatednpm/​@​backstage/​plugin-notifications@​0.5.19 ⏵ 0.6.098 +11007698100
Updatednpm/​@​backstage/​dev-utils@​1.1.25 ⏵ 1.1.27981007698100
Updatednpm/​@​backstage/​plugin-signals@​0.0.33 ⏵ 0.0.3599 +21007698100
Updatednpm/​@​backstage/​core-plugin-api@​1.12.8 ⏵ 1.12.10991007798100
Updatednpm/​@​backstage/​test-utils@​1.7.20 ⏵ 1.7.2299 +11007798100
Addednpm/​react@​17.0.21001007797100
Updatednpm/​@​backstage/​plugin-search-backend-module-techdocs@​0.4.16 ⏵ 0.4.1899 +11007898100
Updatednpm/​@​backstage/​plugin-techdocs@​1.17.8 ⏵ 1.18.297 +110078 +198100
Updatednpm/​@​backstage/​backend-plugin-api@​1.9.3 ⏵ 1.10.199 +110078 +198100
Updatednpm/​@​backstage/​plugin-search-backend-node@​1.4.6 ⏵ 1.4.8100 +11007898100
Updatednpm/​@​backstage/​core-app-api@​1.20.3 ⏵ 1.20.59810079 +198100
Updatednpm/​@​backstage/​catalog-model@​1.9.0 ⏵ 1.10.1100 +110079 +197 +3100
Updatednpm/​@​backstage/​plugin-proxy-backend@​0.6.15 ⏵ 0.6.18100 +110079 +198100
Updatednpm/​@​backstage/​cli@​0.36.4 ⏵ 0.36.697 +11007998100
Updatednpm/​@​backstage/​core-components@​0.18.12 ⏵ 0.18.149710080 +198100
See 19 more rows in the dashboard

View full report

@johnnyhuy
johnnyhuy marked this pull request as ready for review October 3, 2026 00:02
The Docker build and run stages copy .yarn/plugins/ but not .yarn/patches/,
so yarn install failed in-container with ENOENT on the vendored got patch.

Co-authored-by: opencode-agent[bot] <219766164+opencode-agent[bot]@users.noreply.github.com>
@johnnyhuy
johnnyhuy merged commit 04e2ef5 into main Oct 3, 2026
5 checks passed
@johnnyhuy
johnnyhuy deleted the opencode/backstage-upgrade-1.55.3 branch October 3, 2026 00:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant