Platform Changelog

feedbefore 2026-10-08patches hidden unless security or breaking

2026-10-0724 days ago

Cluster APIv1.14.3patchsecurity~~~~~~~~~~~~*****!Cluster API released v1.14.3. The release bumps grpc to 1.83.2 to address security advisories, along with several OpenTelemetry, golang.org/x/net and genproto dependencies. Fixes include setting the cluster-name label on Clusters without ClusterClass, a race in the KCP proxy DialContext, and handling of etcd member matching and not-found owner references.platform teamsPlatform teams running Cluster API should pick up the grpc dependency fix and the KCP and cluster labeling fixes. The release notes list no breaking changes, and the source does not describe any new capability.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Cluster APIv1.13.7patchsecurity~~~~~~~~~~~~~****!Cluster API v1.13.7 was released with 28 changes: one security item bumping grpc to 1.83.2 for security advisories, 14 dependency changes (including OpenTelemetry v1.45.0 and golang.org/x/net v0.58.0), and four fixes. The fixes cover cluster-name labels on Clusters without ClusterClass, KCP learner deletion after Node registration, a race in the KCP proxy DialContext, and a flaky test.platform teamsThe security fix is a dependency bump, not a vulnerability in Cluster API's own code, so platform teams should upgrade for the advisory fix and the KCP race fix. The release notes list supported management cluster versions as v1.32.x to v1.36.x and workload cluster versions as v1.30.x to v1.36.x.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Pulumiv3.268.0minor+++++*************Pulumi v3.268.0 adds an engine capability to negotiate OutputValues on Invoke, gated by a new accepts_outputs_in_invoke handshake capability. It adds version, whoami and install to the generated automation APIs for NodeJS, Python and Go, and sends the W3C traceparent header on Pulumi Cloud API calls when --otel-traces is set. The release also lists 14 fixes, including dynamic provider Read fallback, plugin checksum verification and parallel plugin shutdown.platform teamsTeams using the Pulumi Automation API get version, whoami and install methods in NodeJS, Python and Go, and dynamic provider authors need to check Read handling since the engine no longer duplicates inputs into state. Teams tracing Pulumi calls get trace propagation to Pulumi Cloud when --otel-traces is set.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

CNCF: Meshery becomes a CNCF Incubating projectannouncementThe CNCF TOC voted to accept Meshery as a CNCF incubating project. The announcement cites a 350% increase in code commits over the year to July 2026, about 7,000 contributors, and general availability of Meshery v1.0. A new Meshery MCP Server gives AI assistants read-only access to the Meshery Registry and cluster state.platform teamsPlatform teams evaluating Meshery gain a CNCF incubation signal and a read-only MCP server for agent access to cluster state. Terraform support for the single model is described as coming soon, so it is not yet available. The growth figures are self-reported by the project and the CNCF blog, not independently verified.CNCF Blog ↗Backstage Cortex OpenTofu Tekton Helmwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

2026-10-0625 days ago

Migrating from NGINX Ingress to ALB: Handling oauth2-proxypostThe post describes two ways to keep OIDC authentication working when migrating from NGINX Ingress to the AWS Load Balancer Controller on Amazon EKS: running oauth2-proxy in reverse proxy mode behind an ALB, or using the ALB's native authenticate-oidc action. It notes that NGINX auth subrequest annotations are silently ignored by the ALB, and that the native option sends the token in x-amzn-oidc-accesstoken instead of Authorization: Bearer.platform teamsPlatform teams migrating off NGINX Ingress must choose between keeping oauth2-proxy with minimal changes or removing it and adapting backends to ALB headers and register the /oauth2/idpresponse callback with their identity provider. Without these changes, auth annotations are dropped and traffic reaches backends unauthenticated.AWS Containers Blog ↗Amazon EKSwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

2026-10-011 month ago

OpenTofuv1.12.7patchsecurity!!OpenTofu v1.12.7 fixes a deadlock that could occur when remote-exec or file provisioners connect to an attacker-controlled SSH server, where the server could hang the connection by sending unexpected packet types. The release also addresses two upstream Go security advisories, CVE-2026-78662 and CVE-2026-56855.platform teamsPlatform teams running OpenTofu with provisioners that connect to external hosts should upgrade to pick up the connection-handling fix. The Go advisory fixes are toolchain dependency updates and do not change how platform workflows are run.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Pulumiv3.267.0minor**Pulumi v3.267.0 fixes a bug where concurrent pulumi new runs failed to clone the templates repository. It also fixes pulumi install for Python plugins and policy packs that use the uv toolchain and a [build-system] table.platform teamsTeams running parallel pulumi new commands in automation no longer hit clone failures from this bug. Teams that ship Python plugins or policy packs built with uv can install them with pulumi install again.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

The Future of Platform Engineering reportreportOctopus Deploy published the 2026 Future of Platform Engineering report, based on primary survey data from 379 technical platform practitioners and a review of current literature. The report finds that automation and efficiency are the main reasons organizations adopt platforms, and that lack of clear strategy is a more common obstacle than technical complexity. It also reports that teams with mandatory adoption achieved most of their goals more often (62.2%) than teams with optional adoption (about 27.5%).platform teamsPlatform teams evaluating adoption models may weigh the reported link between mandatory adoption, leadership direction and goal delivery when deciding how to position a platform. The source gives no methodology detail beyond the sample size, so the figures are best treated as directional.Octopus Deploy Blog ↗DORA State of DevOps / AI-assisted development report State of Platform Engineering report Octopus Deploywritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

2026-09-301 month ago

Pulumiv3.266.0minor++****

OpenTofuv1.13.0minorOpenTofu v1.13.0 was released. The release notes list six changes: base64gzip output is equivalent but no longer byte-for-byte identical to earlier versions because of a required Go upgrade, WinRM support for provisioners was removed, macOS 13 Ventura or later is now required, and v1.13 is the last series with official 32-bit CPU releases.platform teamsTeams using base64gzip should check whether any byte-level comparisons or stored outputs will change, and Windows teams relying on WinRM provisioners need an alternative before upgrading. Mac build hosts older than macOS 13 will need upgrading, and 32-bit targets will need a plan after v1.13.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

How athenahealth modernized healthcare workloads with Amazon EKS Hybrid Nodescase studyathenahealth moved its Clinicals Macro Service from AWS Outposts to Amazon EKS Hybrid Nodes, keeping on-premises worker nodes in one EKS cluster with a control plane in an AWS Region. The post reports about 50 percent lower HTTP response times, about 50 percent projected hardware cost savings, and CPU use below 10 percent across an eight-node fleet, and says the company passed a HITRUST audit. These figures are the authors' own account of the migration and were not independently verified.platform teamsA platform team that must keep latency-sensitive or data-resident workloads on premises can run them under the same EKS control plane, APIs and tooling as cloud nodes, instead of operating a second control plane. The team still owns the hardware, network, node OS and storage, and needs Direct Connect or VPN connectivity and a separate nodeadm upgrade path for hybrid nodes.AWS Containers Blog ↗Flux Crossplane Amazon EKS Karpenterwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

2026-09-291 month ago

Terraform Provider for SAP BTP1.27.0minor+****SAP released version 1.27.0 of the Terraform Provider for SAP BTP. The release notes list one added action, action_update_global_account, and four fixes covering function label extraction for legacy labels, failing early when an amount is set on non-quota entitlement plans, drift resolution for role collection assignments with custom IAS origins, and an auto_create_shadow_users option in the globalaccount trust configuration.platform teamsPlatform teams managing SAP BTP through Terraform get a new action for updating global accounts and fixes that reduce configuration drift for role collections and trust settings. Teams using entitlement plans should note that amount on non-quota plans now fails at plan time instead of being silently accepted.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

2026-09-251 month ago

Pulumiv3.265.0minor++****************Pulumi v3.265.0 adds a pulumi logout --all --delete-credentials-key option, Authenticode signing for Windows CLI and language host binaries, and a PCL error for literals that do not match a schema constant or enum. It also fixes 21 items, mostly in the PCL type checker and interpreter, code generation for Python, Node.js and Go SDKs, and engine handling of unknown outputs when a dependency fails during a --continue-on-error update.platform teamsTeams using Pulumi with --continue-on-error can now rely on Unknown=true being reported for skipped Read and Import steps, so SDK consumers no longer treat empty outputs as real values. Windows CLI binaries are now signed, which may matter for install policies.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

2026-09-231 month ago

Pulumiv3.264.0minor++++++************

2026-09-221 month ago

Crossplanev2.4.2patchsecurity+**!Crossplane v2.4.2 ships fixes for ServiceAccount ownership when package revisions become active, and a change so that a claim fails closed when it cannot list its XRD. The release also updates the OpenTelemetry OTLP trace exporter module to v1.45.0 to address a security issue in that dependency.platform teamsTeams running Crossplane 2.4 get corrected ServiceAccount ownership handover during package revision changes and stricter behavior when XRD listing fails. The security item is a dependency bump, not a fix in Crossplane's own code.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Implement per-pod image pull permissions with ECR repository policies on Amazon EKSpostAWS describes a walkthrough for scoping Amazon ECR image pull permissions to individual Kubernetes pods on Amazon EKS. The approach uses KEP 4412 per-pod credential support in kubelet, with the ecr-credential-provider assuming a team IAM role through a service account annotation and ECR repository policies enforcing access. The post states the feature needs Kubernetes 1.34 or later, with full support on EKS v1.35 or later.platform teamsPlatform teams on multi-tenant EKS can give each namespace its own ECR pull role instead of relying on the shared node role, but they must create a ClusterRole and ClusterRoleBinding for the sts.amazonaws.com audience before nodes join, and must update node credential provider configuration. Pods without the annotation fall back to the node role.AWS Containers Blog ↗Amazon EKSwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

2026-09-161 month ago

Pulumiv3.263.0minor+++++******

2026-09-151 month ago

Crossplane2.4.1patchsecurity+*!!!!Crossplane v2.4.1 updates the Go toolchain to 1.26.7, google.golang.org/grpc to v1.83.2, and golang.org/x/crypto to v0.56.0 to pick up upstream CVE fixes, including the gRPC advisory GHSA-2v4p-qf9q-27wj. It also bumps the Crossplane apis module to v2.4.0. The release changes how package revisions take control of established objects, so an incoming revision can take over CRDs from the revision it replaces.platform teamsPlatform teams upgrading to v2.4.1 get the dependency CVE fixes without changes to their own configuration. Package upgrades that previously could leave a new provider unhealthy with a cannot establish control of object error should now hand off automatically, without deleting the stale revision or editing CRD owner references by hand.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Crossplanev2.3.6patchsecurity+*!!!!Crossplane v2.3.6 updates the Go toolchain to 1.26.7 and bumps google.golang.org/grpc to v1.83.2 and golang.org/x/crypto to v0.56.0, which the release notes say pick up upstream CVE fixes, including a gRPC advisory. It also fixes a package revision hand-off bug where an outgoing revision could fail to release CRD control, leaving the incoming provider stuck with cannot establish control of object and no pod created.platform teamsPlatform teams running Crossplane packages should pick up this patch, since providers stuck on a replaced revision previously needed manual CRD owner-reference edits or deletion of the stale revision. The security content is dependency bumps only, not a vulnerability in Crossplane's own code.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Crossplanev2.2.6patchsecurity+*!!!!Crossplane v2.2.6 updates the Go toolchain to 1.26.7 and bumps google.golang.org/grpc to v1.83.2 and golang.org/x/crypto to v0.56.0, including a gRPC advisory fix. It also changes package revision handoff so a new revision takes control of CRDs from the revision it replaces, fixing a case where the incoming provider's pod was never created and needed manual cleanup.platform teamsPlatform teams upgrading to v2.2.6 get dependency CVE fixes, and provider package upgrades no longer stall with a cannot establish control of object error that previously required deleting the stale revision or editing CRD owner references by hand. The security content is dependency bumps only, not a vulnerability in Crossplane's own code.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Backstagev1.55.0minorsecurity++++++++++++++++!!Backstage v1.55.0 was released with 53 changes, seven of which are security fixes across several auth, catalog, proxy, scaffolder and TechDocs backend packages. The other changes are mostly fixes and additions, including new GitLab and GitHub scaffolder actions, a scaffolder task worker fix, and a default MCP server that is now always exposed at /api/mcp-actions/v1.platform teamsPlatform teams running Backstage should plan to upgrade to pick up the security fixes in the auth, proxy and scaffolder packages. Teams using the MCP actions endpoint or the GitLab scaffolder actions should check the changed behavior before upgrading.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Crossplanev1.20.13patchsecurity!!!Crossplane v1.20.13 was released with four changes, three of them security-related. The security content is dependency updates: the Go toolchain is bumped to 1.26.7, google.golang.org/grpc is updated to v1.83.2, and a set of vulnerable dependencies is updated, including the gRPC advisory GHSA-2v4p-qf9q-27wj.platform teamsPlatform teams running Crossplane 1.20 should plan to pick up this patch release, since it carries upstream CVE fixes. The changes are dependency and toolchain updates with no vulnerability in Crossplane's own code described in the source.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

older entries

daily email

statuslast 30 days for lines

tools tracked43releases in registry964released in the last 30 days106entries published335breaking change lines18security lines84