Platform Changelog

feedbefore 2026-10-08all releases, patches included

2026-10-0625 days ago

Argo CDv3.5.4patchbreakingsecurity+~~******!!!!!!!!Argo CD v3.5.4 ships 19 changes, 11 of them security fixes, including several critical issues in the repo-server: Kustomize remote refs and Helm config home can run commands, and Jsonnet imports can read files. It also fixes an AppProject restriction bypass via PreDelete/PostDelete hooks and a high-severity command injection through repository proxy URLs on SSH Git repositories. Two changes are marked breaking: Kustomize builds rendering Helm charts no longer honor helmGlobals.configHome, and OCI manifests larger than 4 MiB are now rejected.platform teamsPlatform teams running Argo CD 3.5 should upgrade to pick up the repo-server and AppProject fixes. Teams using Kustomize with Helm plugins from a custom config home, or with OCI manifests above 4 MiB, need to check their builds before upgrading because those will fail.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Argo CDv3.4.10patchbreakingsecurity+~~****!!!!!!!!Argo CD v3.4.10 ships fixes for 11 security issues, including several rated critical: command execution via Kustomize remote refs and Helm config home in the repo-server, a Jsonnet import that reads repo-server files, and an AppProject restriction bypass through PreDelete/PostDelete hooks. It also includes two breaking changes: Kustomize no longer honors helmGlobals.configHome for Helm plugins registered from that directory, and OCI manifests larger than 4 MiB are rejected. The release also adds username logging on login attempts and four bug fixes.platform teamsPlatform teams running Argo CD 3.4 should upgrade to pick up the critical repo-server and AppProject fixes. Teams using Kustomize with Helm plugins from configHome or OCI manifests above 4 MiB need to check their builds before upgrading because those will now fail.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Argo CDv3.3.15patchbreakingsecurity~~*********!!!!!!!Argo CD v3.3.15 ships fixes for 12 security issues and 11 other fixes, with 2 changes marked breaking. Breaking changes: Kustomize builds that render Helm charts no longer honor helmGlobals.configHome, so builds relying on a Helm plugin registered from that directory will fail, and OCI manifests larger than 4 MiB are now rejected. Critical advisories cover command execution via Kustomize remote refs and Helm config home, Jsonnet file reads from the repo-server, and AppProject restriction bypass via PreDelete/PostDelete hooks.platform teamsPlatform teams running Argo CD 3.3 should plan to upgrade, and check any Kustomize-with-Helm pipelines that use a plugin from configHome or OCI manifests over 4 MiB before rolling out. Repo-server exposure from the listed critical issues makes the update a priority.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Migrating from NGINX Ingress to ALB: Handling oauth2-proxypostThe post describes two ways to keep OIDC authentication working when migrating from NGINX Ingress to the AWS Load Balancer Controller on Amazon EKS: running oauth2-proxy in reverse proxy mode behind an ALB, or using the ALB's native authenticate-oidc action. It notes that NGINX auth subrequest annotations are silently ignored by the ALB, and that the native option sends the token in x-amzn-oidc-accesstoken instead of Authorization: Bearer.platform teamsPlatform teams migrating off NGINX Ingress must choose between keeping oauth2-proxy with minimal changes or removing it and adapting backends to ALB headers and register the /oauth2/idpresponse callback with their identity provider. Without these changes, auth annotations are dropped and traffic reaches backends unauthenticated.AWS Containers Blog ↗Amazon EKSwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Jenkins2.585minor+++++****Jenkins 2.585 was released with 11 changes. Five are additions, including a new Manage Jenkins UI enabled by default and filtering on the experimental Job page. Four are fixes, including a sortable date column ordering fix and a missing New Item button in the new dashboard view. The minimum required Remoting version is raised to 3256.3258.v858f3c9a_f69d.platform teamsTeams running Jenkins controllers will see the new Manage Jenkins UI by default and must confirm agents meet the raised minimum Remoting version. The release notes describe no breaking changes beyond that requirement.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Kargov1.12.2patch

Dependency Firewall: Block risky packages before the buildpostGitLab announced Dependency Firewall, now in early access for GitLab.com and GitLab Self-Managed Premium and Ultimate customers. It blocks or warns on packages that match a policy covering malware status, vulnerability severity, license type, and minimum package age, before they are installed in a build. The source also cites five malicious PyPI packages GitLab researchers found in June 2026, four of them typosquats of Flask, Requests, and NumPy.platform teamsPlatform teams can set policy once at the top-level group, with project-level overrides where the strictest rule applies, and run warn mode before switching to block mode with logged bypasses. Teams using Sonatype Nexus or JFrog Artifactory can apply it at the registry, and the GitLab CLI can check a package before it is added.GitLab Blog ↗GitLabeditorCorrection 2026-10-20: this was listed as a GitLab release by mistake. It is GitLab Blog coverage, not release notes from the project.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

GitLab Transcend: Speed you can trust, all the way to productionannouncementGitLab announced more than a dozen features at its Transcend event, including goal-driven agent flows, custom flows, an MCP Server, Artifact Central in beta, Dependency Firewall in early access, and Secrets Manager set to reach GA this month. The vendor says GitLab Orbit context graph reduces agent retries by up to 45x and token use by up to 4.5x during its beta. Credit and usage controls add spend caps and alerts at the subscription, group, and user level.platform teamsPlatform teams evaluating GitLab can plan to govern agent actions and MCP access under existing policy, set AI spend caps, and route packages through Artifact Central and Dependency Firewall. Many capabilities are GA later or in beta or early access, so rollout timing matters.GitLab Blog ↗GitLab Jenkins GitHub Actionswritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Every artifact your teams ship, assembled right the first timeannouncementGitLab announced Artifact Central, an organization-level registry in beta that replaces project-level package and container registries. Retention rules, storage quotas and publish or pull access are set once at the organization level, with four artifact-specific roles (Admin, Manager, Contributor, Viewer). The beta supports Maven, npm, Docker and OCI, and is available on GitLab.com with Self-Managed availability planned, at no charge during the beta.platform teamsPlatform teams could set artifact storage, quota and access policy in one place instead of per project, and use one hosted, remote or virtual URL for internal and external packages. Existing registries can be added as remotes and converted to hosted repos gradually, so no bulk migration is required.GitLab Blog ↗GitLabwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

2026-10-0526 days ago

AWS Control Tower AFT now supports plan-only customization runsannouncementAWS Control Tower Account Factory for Terraform (AFT) now supports plan-only customization runs. Administrators can trigger a Terraform plan for global and account customizations without applying changes. The feature is available in all AWS Regions where AFT is supported, and the source says it works with open source Terraform, Terraform Cloud and Terraform Enterprise.platform teamsPlatform teams using AFT can preview Terraform changes across managed accounts before a broad rollout and wire plan output into CI/CD review steps. The source does not describe changes to AFT's apply behavior.What's New with AWS ↗written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Restart EC2 and on-premises fleets faster with AWS CodeDeploy RESTART deployment modepostAWS CodeDeploy added a RESTART deployment mode that reapplies a deployment group's last successful revision to EC2 and on-premises in-place deployments. The mode keeps deployment configurations, lifecycle hooks, CloudWatch alarm monitoring, rollback settings and deployment history. AWS reports up to 6.1x faster fleet restarts in its feature tests, which used m5.large instances and a 1 GB revision.platform teamsPlatform teams can run fleet restarts through CodeDeploy instead of custom scripts, keeping batch limits, health checks and alarm stops. Restarts do not run load balancer BlockTraffic and AllowTraffic steps, so request-serving fleets need draining logic in ApplicationStop and enough healthy capacity.AWS DevOps Blog ↗written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

2026-10-0229 days ago

Kargov1.12.1patch

Amazon ECS adds Amazon VPC Lattice support for blue/green, linear, and canary deploymentsannouncementAmazon ECS now offers built-in blue/green, linear, and canary deployment strategies for ECS services that use Amazon VPC Lattice for traffic routing. Teams can run test traffic before production shifts, attach lifecycle hooks such as Lambda and pause hooks, and use CloudWatch alarms and the ECS deployment circuit breaker to roll back automatically. The feature works for new and existing services in all Regions where VPC Lattice is available, and can be configured in the console, CLI, SDKs, or IaC tools.platform teamsPlatform teams running ECS with VPC Lattice can move progressive delivery into the ECS service configuration instead of building their own traffic shifting. Rollback depends on the CloudWatch alarms and circuit breaker that teams configure.What's New with AWS ↗written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Integrate AWS DevOps Agent with third-party tools using Amazon EventBridgepostAWS published a walkthrough that uses AWS CDK, Amazon EventBridge, AWS Lambda, and DynamoDB to send AWS DevOps Agent investigation events to Jira Cloud. The Lambda function creates a Jira issue on Investigation Created, stores the mapping from task_id to issue key, and appends comments for later state changes. Credentials are kept in AWS Secrets Manager, and the post says the same pattern applies to ServiceNow and PagerDuty.platform teamsA platform team that runs AWS DevOps Agent can follow investigations in its existing ticketing tool by adding an EventBridge rule and a Lambda target, without changing the agent. The destination-specific logic lives in the Lambda code, so swapping tools mainly means rewriting that function.AWS DevOps Blog ↗AWS DevOps Agent Amazon EKSwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Closed-loop incident response: connect AWS DevOps Agent to OpenSearchpostThe AWS DevOps Blog describes connecting AWS DevOps Agent to Amazon OpenSearch Service data through an MCP server, so that OpenSearch alerts trigger the agent to query logs and traces and correlate them with CloudTrail and CloudWatch. The post presents three hosting options: self-managed on ECS Fargate behind an NLB with VPC Lattice, Amazon Bedrock AgentCore, and the built-in MCP endpoint on OpenSearch 3.3+. The source text is cut off before the registration and verification steps are complete.platform teamsPlatform teams running OpenSearch alerting could route alerts to an agent that investigates automatically, but they would need to set up a hosted MCP server, a private network connection, and FGAC role mappings that control what the agent can read. The source describes this as a walkthrough and does not report measured results.AWS DevOps Blog ↗AWS DevOps Agent Amazon EKSwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

2026-10-011 month ago

Fluxv2.9.6patch+++++++~~~~~

Tektonv1.17.0minor+++******Pipeline release v1.17.0 "Egyptian Mau Robocop"Tekton Pipelines v1.17.0 was released with 60 changes in total. The release notes list 3 added items, including a new reconcile.write_intent span attribute, pod event surfacing, and a TaskRun ReconcileKind span tag on cancel or timeout. It also lists 6 fixes, covering Windows script placement, error messages on task resolution failure, variable-reference handling, and resolver request enqueueing.platform teamsPlatform teams running Tekton get better tracing on TaskRun cancellation and timeouts, plus clearer error messages when task resolution fails. No breaking change is listed in the condensed notes.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Actions Runner Controller0.15.0minor++++~----*********gha-runner-scale-set-0.15.0Actions Runner Controller released gha-runner-scale-set 0.15.0 with 79 changes, including removal of legacy e2e tests and several unused APIs and printer columns. New flags add default and per-controller max-concurrent-reconciles settings, and terminationGracePeriodSeconds is now configurable. The release also includes many fixes to listener pod patching, RBAC permissions, and scale-set drift detection.platform teamsPlatform teams running self-hosted GitHub Actions runners on Kubernetes should review the removed status-field printer columns and the new reconcile concurrency and termination grace period settings before upgrading. Runner status is now reported through metrics rather than status fields, so dashboards or scripts that read those fields will need updating.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

The Future of Platform Engineering reportreportOctopus Deploy published the 2026 Future of Platform Engineering report, based on primary survey data from 379 technical platform practitioners and a review of current literature. The report finds that automation and efficiency are the main reasons organizations adopt platforms, and that lack of clear strategy is a more common obstacle than technical complexity. It also reports that teams with mandatory adoption achieved most of their goals more often (62.2%) than teams with optional adoption (about 27.5%).platform teamsPlatform teams evaluating adoption models may weigh the reported link between mandatory adoption, leadership direction and goal delivery when deciding how to position a platform. The source gives no methodology detail beyond the sample size, so the figures are best treated as directional.Octopus Deploy Blog ↗Octopus Deploy State of Platform Engineering report DORA State of DevOps / AI-assisted development reportwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

2026-09-301 month ago

Kargov1.12.0minorbreaking++++++++++~~~~****Kargo v1.12.0 removes the Connect-based gRPC API, the createTargetBranch option on git-open-pr, and the author block on git-commit. It changes the git-push default integration policy to RebaseOrMerge and removes the legacy Secret namespace chart values, so upgrades that still set them will fail. The release also adds a tar step, an oci-push srcPath option, cross-account ECR pulls, and per-request actor attribution in API logs.platform teamsPlatform teams upgrading Kargo must check integrations for the removed gRPC API, remove deprecated step fields from promotion tasks, and confirm required Secrets exist in the system and shared resources namespaces before upgrading. Teams relying on rebase-only pushes should set pushIntegrationPolicy to AlwaysRebase in Helm values to keep the old behavior.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Jenkins2.580.1patch~Jenkins 2.580.1 was released on 2026-09-30. The release notes point to the changelog and upgrade guide for breaking changes and other update considerations, but the condensed source does not list specific changes.platform teamsPlatform teams running Jenkins should read the changelog and upgrade guide before updating. The source text does not name any concrete change.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Kargov1.11.6patch

Running production experiments with AWS AppConfig experimentationpostAWS describes AWS AppConfig experimentation, which adds A/B testing on top of AWS AppConfig feature flags so a change can be exposed to a controlled slice of production traffic. The AWS AppConfig Agent assigns each participant to a control or treatment, logs each assignment to stderr for shipping to CloudWatch Logs and Amazon S3, and leaves metric analysis to the customer's existing data warehouse. The post walks through a frontend Add to cart button experiment and a backend cache TTL experiment on Amazon ECS.platform teamsPlatform teams can run production A/B tests through existing AppConfig and Agent setups, but they must provision assignment logging, a warehouse for analysis, and CloudWatch alarms that stop runs. Entity IDs are logged verbatim, so PII must be hashed or pseudonymized.AWS DevOps Blog ↗Amazon EKSwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

What is the Agentic Development Lifecycle and do you need it?postThe author argues that the Agentic Development Lifecycle (ADLC) maps almost stage for stage onto the existing software development lifecycle (SDLC). He says Agentforce agents are deployed as metadata, so existing release and version control practices apply, and that metadata types have changed over the past year, such as Agent Planner bundles becoming Agent Script. He recommends limiting agents to analysis and building while deterministic CI/CD, testing, review and backups handle the rest.platform teamsPlatform teams running Salesforce should keep applying existing release governance, change failure rate and DORA measurement to AI-produced changes, and track Agentforce metadata format changes in release notes. Nothing new is shipped that changes tooling.Gearset Blog ↗Gearset Salesforce Platform Agentforce DORA State of DevOps / AI-assisted development reportwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

2026-09-291 month ago

Jenkins2.584minor+~****Jenkins 2.584 raises the minimum required Remoting version to 3256.3258.v858f3c9a_f69d. It also includes fixes to PackedMap equality and hash codes, workspaceDir and buildsDir persistence, a breadcrumbs-overflow TypeError when the logo item is missing, the wording of the -jnlpUrl deprecation warning, and ZIP creation for unreadable files.platform teamsTeams running Jenkins controllers and inbound agents need to check that their agents meet the new minimum Remoting version before upgrading. The other changes are bug fixes with no new capability to plan around.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Accelerating development workflows with Kiro CLI as a Pre-Commit and Git Hook AgentpostAWS DevOps Blog describes using Kiro CLI in non-interactive mode with a KIRO_API_KEY environment variable so it can run inside local Git hooks. The post gives example pre-commit, commit-msg and pre-push hook scripts that send staged diffs or commit messages to the Kiro API for analysis. The source notes that hooks send code diffs to an external API and that the hook is skipped when the key is unset.platform teamsPlatform teams can use this pattern to add AI review to local Git hooks before CI runs, but it sends source diffs to an external API, so data-handling policy review is needed first. The source text is cut off before the pre-push hook and post-merge hook are complete.AWS DevOps Blog ↗written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

GitLab and Claude Code: Fast, compliant AIannouncementGitLab describes running Anthropic's Claude Code as the coding interface inside GitLab Duo Agent Platform, so that generated changes pass through GitLab's merge request gate, scans, approvals and audit trail. The post says that as of August 2026, GitLab Dedicated for Government customers can deploy the AI Gateway in their own single-tenant environment and connect a model provider such as Amazon Bedrock. The post cites LinearB's 2026 benchmark for the finding that agentic AI merge requests take 5.3 times longer for a reviewer to pick up.platform teamsPlatform teams evaluating GitLab for agent-written code can use the merge request gate as a single review and audit point regardless of which coding tool wrote the change. Self-hosted and single-tenant AI Gateway options are the relevant deployment choices for data residency or air-gapped requirements, but the post gives no pricing, availability details beyond the stated date, or independent verification.GitLab Blog ↗GitLabwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

2026-09-281 month ago

What's new in Git 2.56.0?postGit 2.56.0 adds a drop subcommand to git-history that removes a commit and rebases its descendants onto its parent, and new --forked and --delete-merged options to git-branch for finding and deleting branches merged into an upstream. It also lets git-refs create, delete, update and rename refs, and adds a remote-object-info command to git-cat-file and a --drop-filtered option to git-repack for partial clones. The post also outlines a plan where Git 2.98 follows 2.56, with 2.99 and 3.0 shipping together in spring 2027 and 3.0 making SHA-256 the default object format, reftable the default ref storage, and Rust mandatory.platform teamsPlatform teams running Git-based pipelines get new commands for cleaning up merged branches and reclaiming disk space in partial clones, but nothing in this release changes existing CI behavior. The Git 3.0 plan (SHA-256 default, reftable default, Rust required) is a future breaking change that teams should check their forges, tooling and build toolchains against, and the 2.99 LTS release is aimed at platforms without a Rust toolchain.GitLab Blog ↗GitLabeditorCorrection 2026-10-20: this was listed as a GitLab 2.56.0 release by mistake. It is GitLab Blog coverage, not release notes from the project.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

How Property Finder automated incident management with AWS DevOps Agentcase studyProperty Finder describes a pipeline built on AWS DevOps Agent that takes a CloudWatch ECS CPU alarm through root cause analysis, Slack posting, Jira ticket creation, phone escalation via Grafana IRM, and a Draft GitHub PR with a Terraform fix. The post reports a 14-minute end-to-end time for one incident, with investigation taking about 10 minutes. The post is written by AWS and the figures come from a single incident and the company's own account.platform teamsPlatform teams running ECS and Terraform can see a pattern for wiring an AI investigation agent to alerting, ticketing and paging, with a remediation agent restricted to a GitHub MCP server and always opening Draft PRs for human review. The source gives no independent measurements beyond the one incident and a vendor-attributed quote.AWS DevOps Blog ↗AWS DevOps Agent Amazon EKS Terraform MCP Serverwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Audit trails for autonomous agents with AWS DevOps AgentpostAWS describes an audit pipeline for AWS DevOps Agent built on Amazon EventBridge, AWS Lambda, Amazon S3, Glue and Athena. The pipeline archives the agent's investigation journals, polls recommendations on a schedule, and correlates recommended fixes with resource changes recorded in AWS Config and CloudTrail. The post says the journal is immutable, and it points to sample code in a repository.platform teamsPlatform teams running DevOps Agent can capture per-investigation journals, recommendation versions, and lifecycle events into their own archive, and scope IAM access to that archive. Recommendations have no event, so they must be polled, and CloudTrail does not capture the agent's read queries.AWS DevOps Blog ↗AWS DevOps Agent Amazon EKSwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Fix pod distribution drift in Amazon EKS with the Kubernetes deschedulerpostThe AWS Containers Blog describes how pods spread across three Availability Zones with soft topology spread constraints can drift into two zones after a node-availability gap and stay skewed. In a measured run on Amazon EKS with a 1,000-pod fleet, the post reports the skew persisted for over 16 hours after capacity returned. It then shows the Kubernetes descheduler's RemovePodsViolatingTopologySpreadConstraint plugin, configured to act on ScheduleAnyway constraints, restoring balance in about 183 evictions with PDB limits applied.platform teamsPlatform teams running soft topology spread on EKS should expect silent zone drift after node disruptions and can use the descheduler with ScheduleAnyway enabled, topologyBalanceNodeFit, and PDBs to correct it. Teams needing strict zone balance should consider DoNotSchedule and alert on pending pods instead.AWS Containers Blog ↗Amazon EKSwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

older entries

daily email

statuslast 30 days for lines

tools tracked43releases in registry964released in the last 30 days106entries published336breaking change lines18security lines84

change typestwo-column gutter, like git status

+addedNew functionality.
~changedExisting behavior changed.
-deprecatedStill works, scheduled for removal.
-removedDecommissioned, gone in this version.
*fixedA defect corrected.
!securityA vulnerability closed or a dependency patched for one.
!breakingFlag in the first column; the change needs action before upgrading.

filter

categoryall idp & portals ai agents on platform ci/cd observability supply chain cost & governance reports & dx data enterprise app platforms

showmajor only releases case studies postmortems include patches

Platform Changelog: what shipped in platform engineering, developer experience and DevOps