v2.3.0

What's Changed

• Update import to fix deployment with rhdh-1.8 by @abhikdps in #250
• Gate /sync/status endpoint with catalog read permission by @abhikdps in #252
• Fix job templates not appearing after sync without page refresh by @Jeevansuresh1 in #213
• feat: move secrets to .env with dotenv-cli and auto-generate backend keys by @ganeshrn in #237
• Revoke AAP OAuth token on logout by @audgirka in #176
• StepForm nested defaults and AAP picker overrides by @abhikdps in #254
• e2e UI testing for collections view by @Pavanjangle in #219
• feat(e2e): add Playwright git repositories catalog and detail-view tests by @Pavanjangle in #246
• chore(release): bump plugin versions to 2.2.0 by @NilashishC in #265
• fix(scm): refresh GitHub installation tokens on each request by @NilashishC in #267
• fix(self-service): harden Sync Now status and failure feedback by @NilashishC in #271
• fix: request only docs_blob and authors when fetching PAH collection details [AAP-72922] by @PyContriver in #273
• rhdh playwright migration by @Pavanjangle in #264
• [AAP-68922] Add permission-gated conditional menu items for Templates and History views by @ankitsharma589 in #211
• test(e2e): Add missing EE detail page test coverage by @Pavanjangle in #274
• fix: RunTask page button alignments by @abhikdps in #281
• feat(self-service): add per-source sync progress popover on Sync Now button by @NilashishC in #275
• Stop next button from triggering on error and make namespace and repo name mandatory by @abhikdps in #277
• Make source field mandatory in collections picker by @abhikdps in #278
• fix: also patch EE_DIR env var default in ee-build.yml workflow by @NilashishC in #288
• fix: pre-check addBuildSteps and specifyRequirements when importing saved EE templates by @NilashishC in #294
• fix: prevent EE build failure from empty additional build step commands by @NilashishC in #299
• [createEEDefinition] No internal detail related to deployment exposed in logs by @NilashishC in #300
• test(e2e): Add EE build process test coverage by @Pavanjangle in #303
• fix(self-service): log errors in useIsSuperuser and decouple Add Template permission by @tanwigeetika1618 in #286
• Fix wrong filter type in EE catalog page by @abhikdps in #305
• fix(ee-definition): align EE name validation between UI, schema, and action by @NilashishC in #307
• Change default crawl depth for AnsibleGitProvider by @abhikdps in #309
• fix(catalog): route manual sync triggers through scheduler to prevent race conditions with multiple pods by @NilashishC in #310
• fix(ee-definition): trim trailing whitespace from build image name by @NilashishC in #315
• fix: restore Red Hat fonts and dark mode text after Backstage version bump by @abhikdps in #318
• test(e2e): Add comprehensive pagination tests for EE and Collections pages by @Pavanjangle in #308
• Update configs doc URL for Empty Pages by @abhikdps in #324
• fix: restore all fields on chip click and preserve source format in saved templates by @abhikdps in #319
• update EE README and owner handling by @NilashishC in #317
• test(e2e): Add comprehensive sync toast notification tests by @Pavanjangle in #313
• fix: upgrade @backstage/plugin-catalog-backend to 3.6.1 (AAP-73301) by @audgirka in #330
• Update token scope in packages by @abhikdps in #333
• fix: increase sync completed timeout to 120s by @Pavanjangle in #340
• fix: remediate multiple CVEs via dependency resolutions by @shvenkat-rh in #338
• Update transitive dep @xmldom/xmldom to fix related CVEs by @abhikdps in #351
• fix: remove force:true to eliminate flaky test failures by @Pavanjangle in #350
• feat: add paginated caching for EE and Git Repos pages + update CI activity endpoint by @abhikdps in #356
• Replace docs links with short URLs by @abhikdps in #360
• fix: minor UI polish for details pages and pagination text by @abhikdps in #358
• fix: cache scaffolder collections autocomplete to prevent 504s under load by @abhikdps in #357
• fix portal- Add controller availability check to prevent 500 errors on Templates page by @ankitsharma589 in #249
• ci: update Node.js test matrix from 20 to 22 by @sshedmake in #375
• [AAP-73304] Skip instance groups fetch unless ask_instance_groups_on_launch is true by @abhikdps in #370
• fix: remediate CVE-2026-9277 via shell-quote resolution to 1.8.4 by @ankitsharma589 in #377
• [AAP-77602] feat: cache CI activity data across tab switches by @abhikdps in #359
• [AAP-77240] Make orgs_users_teams and job_templates endpoints asynchronous & replica-safe by @abhikdps in #372
• [AAP-77805] feat: server-side pagination for Execution Environments page by @abhikdps in #380
• fix: improve e2e test stability with better wait conditions by @Pavanjangle in #365
• fix: EE catalog starred filter not updating table on unstar by @abhikdps in #388
• [AAP-75663] Implement server-side pagination for Templates page by @abhikdps in #371
• [AAP-73727] fix: prevent task failures from OAuth token expiration during AAP job polling by @PyContriver in #373
• chore: update plugins version to 2.2.1 in package files by @abhikdps in #394
• feat: Bump Backstage to 1.49.4 & add node.js 24 support by @sshedmake in #392
• fix: CVE remediation - Update axios, undici, ws, and ip-address dependencies by @shvenkat-rh in #398
• [AAP-77606] feat: add support to build execution environments on gitlab by @abhikdps in #368
• [AAP-77607] feat: add gitlab pipeline trigger support for EE builds through modal by @abhikdps in #396
• chore: Remove Cypress artifacts after Playwright migration by @Pavanjangle in #404
• fix: CVE remediation - Update vm2 dependency by @ankitsharma589 in #406
• [AAP-79854] fix: resolve superuser permission denial from auth token race condition by @abhikdps in #402
• Update plugins version to 2.2.2 by @sshedmake in #414
• fix: local MUI v4 UnregisterEntityDialog to fix broken BUI dialog by @Pavanjangle in #412
• fix: backstage-rhaap plugin sonar issues by @abhikdps in #413
• [AAP-80929] fix(autocomplete): use service token for controller availability check by @audgirka in #420
• [AAP-79959] fix: cancel AAP job when scaffolder task is cancelled by @abhikdps in #416
• fix: self-service plugin sonar issues by @abhikdps in #407
• fix: add SonarCloud rule exclusions for false positives and framework patterns by @audgirka in #422
• fix: resolve SonarCloud code issues across backend plugins by @audgirka in #423
• fix: resolve remaining SonarCloud new code violations by @audgirka in #426
• fix: resolve SonarCloud quality gate — code fixes and exclusions by @audgirka in #427
• fix: resolve last 4 SonarCloud new code violations by @audgirka in #428
• fix: align gitlab pipeline trigger variable names with CI template by @abhikdps in #419
• update plugins version to 2.2.3 by @abhikdps in #431
• [AAP-80935] fix(self-service): show empty state and fix pagination for filtered templates by @audgirka in #421
• fix: add resolutions for handlebars, node-forge and fast-uri CVEs by @ankitsharma589 in #437
• [main] update plugins version to 2.2.4 by @sshedmake in #457
• feat(e2e): add GitLab EE build template execution and detail view tests by @abhikdps in #433
• fix(ci): add NODE_OPTIONS to prevent OOM during tsc and tests by @audgirka in #467
• fix(self-service): prefetch task data to avoid loading spinner on navigation by @audgirka in #409
• [AAP-80936] test: add non-admin user E2E tests across entire portal by @Pavanjangle in #424
• Add Node Option to tsc in root package.json by @abhikdps in #469
• fix: bump protobufjs to 7.6.3 to resolve multiple related CVEs by @ankitsharma589 in #471
• [AAP-83143] fix: restore @backstage/plugin-catalog-backend to ^3.6.1 by @sshedmake in #476
• fix(e2e): replace hardcoded wizard navigation with adaptive step detection by @Pavanjangle in #474
• fix: add resolutions for dompurify, multer, flatted, webpack-dev-server, launch-editor, linkify-it, markdown-it, typeorm, underscore, and react-router to fix vulnerabilites by @ankitsharma589 in #439
• fix: add resolutions for qs, @grpc/grpc-js, @babel/core, prismjs, lodash-es, @smithy/config-resolver, and @tootallnate/once to fix vulnerabilities by @ankitsharma589 in #455
• fix: add resolutions to fix e2e-tests related vulnerabilities by @ankitsharma589 in #464
• fix: add resolutions for tar, tmp, js-cookie, body-parser, cookie, tar-fs, file-type, http-proxy-middleware, form-data, jws, playwright, and picomatch. by @ankitsharma589 in #468
• fix(e2e): skip non-admin tests on RHDH 1.9 by @Pavanjangle in #480
• fix: fail task when AAP job template execution is not successful by @abhikdps in #497
• fix: remove decodeURIComponent from URL construction by @audgirka in #489
• chore(deps): update dependency protobufjs to v7.6.5 [security] by @renovate[bot] in #348
• [ANSTRAT-912] feat(catalog): add multi-org namespace scoping, logout sync, and hardening by @audgirka in #408
• fixing cve for grpc-js bumping version to 1.14.4 by @Abhishekism9450 in #504
• fix: cleanup stale form data when unchecking conditional checkboxes in EE scaffolder by @Abhishekism9450 in #510
• [ANSTRAT-912] feat: template taxonomy — automation-template type + source annotation by @audgirka in #503
• [main] update plugins version to 2.2.5 by @Jeevansuresh1 in #523
• test: increase self-service plugin unit test coverage by @Pavanjangle in #516
• [ANSTRAT-912] feat: disable sync trigger during active sync using Backstage Signals by @audgirka in #514
• refactor: use dynamic org discovery in multi-org E2E specs by @Pavanjangle in #515
• feat: replace bulk collection loading with server-side pagination by @Jeevansuresh1 in #527
• Fix sync button tooltip position and click area by @Pavanjangle in #532
• fix(catalog): add org group refs to memberOf and dedup system users by @audgirka in #545
• feat(auth): add PKCE support for AAP 2.7 OAuth compliance by @Jeevansuresh1 in #536
• fix(e2e): skip multi-org tests in single-org CI environments by @Jeevansuresh1 in #543
• fix: bump postcss resolution to ^8.5.19 to fix CVE-2026-45623 and CVE-2026-69153 by @Jeevansuresh1 in #541
• fix(cve): bump js-cookie resolution to ^3.0.8 for CVE-2026-46625 by @Jeevansuresh1 in #551
• fix: bump resolutions for brace-expansion, ip-address, tmp, and webpack-dev-server CVEs by @Abhishekism9450 in #542
• feat(self-service): add source type filter to templates page by @audgirka in #560
• fix: bump browserslist and nanoid for security advisories by @Abhishekism9450 in #558
• fix: Handle pagination in job templates autocomplete to display all templates by @Abhishekism9450 in #544
• [main] update plugins version to 2.2.6 by @Jeevansuresh1 in #564
• fix(self-service): add missing /catalog redirect to LocationListener by @abhikdps in #575
• refactor: align Templates page header with Collections view by @Pavanjangle in #549
• fix: Update multi-org e2e tests by @audgirka in #581
• fix(cve): bump tar resolution to ^7.5.21 for CVE-2026-73566 by @Jeevansuresh1 in #574
• fix(e2e): improve auth token handling and template visibility tests by @audgirka in #586
• chore: add CodeRabbit security review configuration by @NilashishC in #592
• Fix: Auth context, non-admin templates test by @audgirka in #588
• docs: add architecture and sequence diagrams by @NilashishC in #580
• fix: use theme text color on last-sync tooltip by @audgirka in #611
• fix(auth): replace in-memory PKCE verifier with cookie-bound storage by @Jeevansuresh1 in #556
• fix(auth): propagate AAP OAuth callback errors instead of generic messages by @Jeevansuresh1 in #618
• chore: Standard SECURITY.md by @gundalow in #612
• fix: bump @backstage/plugin-auth-backend to ^0.29.2 for CVE-2026-73563 by @Jeevansuresh1 in #587
• fix(cve): update nanoid to 5.1.6 for CVE-2026-67213 by @Jeevansuresh1 in #604
• fix: bump dompurify resolution to ^3.4.13 for CVE-2026-75838 by @Jeevansuresh1 in #624
• fix: bump fast-uri to 3.1.6 for SSRF and host-confusion CVEs by @Abhishekism9450 in #615
• fix startup crash error when orgs is missing by @audgirka in #650
• Fix org sync config when multi-org is set to false by @audgirka in #651
• Bump plugins version to 2.2.7 by @Jeevansuresh1 in #652
• fix: upgrade js-yaml to 4.3.2 to address CVE-2026-59869 by @Jeevansuresh1 in #630
• chore(deps): update dependency typeorm to v0.3.31 [security] by @renovate[bot] in #495
• fix: upgrade urllib to 4.9.1 for CVE-2026-55553 (AAP-89885) by @Jeevansuresh1 in #621
• chore(deps): update dependency shell-quote to v1.9.0 [security] by @renovate[bot] in #488
• chore(deps): update dependency undici to v6.28.0 [security] by @renovate[bot] in #535
• chore(deps): update dependency immutable to v4 [security] by @renovate[bot] in #493
• chore(deps): update dependency svgo to v2.8.3 [security] by @renovate[bot] in #492
• chore(deps): update dependency @xmldom/xmldom to v0.9.12 [security] by @renovate[bot] in #657
• chore(deps): update dependency vm2 to v3.11.6 [security] by @renovate[bot] in #658
• chore(deps): update dependency qs to v6.16.0 [security] by @renovate[bot] in #659
• chore(deps): update dependency react-router-dom to v6.30.5 [security] by @renovate[bot] in #500
• chore: configure Renovate to target release-* branches by @abhikdps in #660
• chore(deps): update dependency tar to v7.5.21 [security] (main) by @renovate[bot] in #661
• chore(deps): update dependency yaml to v2.8.3 [security] (main) by @renovate[bot] in #662
• fix: resolve SonarQube code smells and testing library issues by @abhikdps in #663
• fix: convert repeated tests to parameterized it.each() blocks by @abhikdps in #664
• fix: resolve Dependabot security vulnerabilities via yarn resolutions by @abhikdps in #674
• [PR #672/b66c48f0 backport][release-2.3] feat: Add server-side pagination for home job templates page & fix home templates sync progress tooltip accuracy by @patchback[bot] in #692
• [PR #673/31808443 backport][release-2.3] fix: team display name for RBAC by @patchback[bot] in #693
• [PR #691/524a8b85 backport][release-2.3] Log warning message when user's team is absent from org level teams by @patchback[bot] in #694
• [PR #676/8ac68a0f backport][release-2.3] Fix: Consolidate three incompatible AAP→Backstage name sanitizers by @patchback[bot] in #695
• [PR #690/edb3da9 backport][release-2.3] fix: bump compression to ^1.8.2 for CVE-2026-87776 by @sshedmake in #706
• [PR #718/a7d95533 backport][release-2.3] fix: show git provider source filters on Collections page by @patchback[bot] in #719
• [PR #711/ce7a52a7 backport][release-2.3] fix: replace existing EE catalog entity on recreate (AAP-85231) by @patchback[bot] in #745
• [PR #739/84c76749 backport][release-2.3] feat(catalog): multi-org ID-based entity names and auth by AAP user id by @patchback[bot] in #858
• [PR #743/ac1d3fc3 backport][release-2.3] fix(catalog): harden multi-org membership sync and dedupe catalog keys by @patchback[bot] in #859
• [PR #856/c724a3c0 backport][release-2.3] feat(self-service): soft-refresh Home templates catalog without remount by @patchback[bot] in #860
• [PR #599/95175532 backport][release-2.3] chore: align repo with agentic SDLC scaffolding practices by @patchback[bot] in #864
• chore: bump plugins version to 2.3.0 by @Pavanjangle in #865
• fix(self-service): show template owner display names without links by @audgirka in #912
• AAP-98562: fix(deps): pin yarn resolutions for portal CVE batch (release-2.3) by @sshedmake in #924

New Contributors

• @tanwigeetika1618 made their first contribution in #286
• @gundalow made their first contribution in #612

Full Changelog: v2.2.10...v2.3.0