platformchangelog.dev
43 tools

Platform Changelog: what shipped in platform engineering, developer experience and DevOps

feedbefore 2026-10-08all releases, patches included
newest entries
Cluster APIv1.13.7patchsecurity~~~~~~~~~~~~~****!Cluster API v1.13.7 was released with 28 changes: one security item bumping grpc to 1.83.2 for security advisories, 14 dependency changes (including OpenTelemetry v1.45.0 and golang.org/x/net v0.58.0), and four fixes. The fixes cover cluster-name labels on Clusters without ClusterClass, KCP learner deletion after Node registration, a race in the KCP proxy DialContext, and a flaky test.platform teamsThe security fix is a dependency bump, not a vulnerability in Cluster API's own code, so platform teams should upgrade for the advisory fix and the KCP race fix. The release notes list supported management cluster versions as v1.32.x to v1.36.x and workload cluster versions as v1.30.x to v1.36.x.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Pulumiv3.268.0minor+++++*************Pulumi v3.268.0 adds an engine capability to negotiate OutputValues on Invoke, gated by a new accepts_outputs_in_invoke handshake capability. It adds version, whoami and install to the generated automation APIs for NodeJS, Python and Go, and sends the W3C traceparent header on Pulumi Cloud API calls when --otel-traces is set. The release also lists 14 fixes, including dynamic provider Read fallback, plugin checksum verification and parallel plugin shutdown.platform teamsTeams using the Pulumi Automation API get version, whoami and install methods in NodeJS, Python and Go, and dynamic provider authors need to check Read handling since the engine no longer duplicates inputs into state. Teams tracing Pulumi calls get trace propagation to Pulumi Cloud when --otel-traces is set.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
CNCF: Meshery becomes a CNCF Incubating projectannouncementThe CNCF TOC voted to accept Meshery as a CNCF incubating project. The announcement cites a 350% increase in code commits over the year to July 2026, about 7,000 contributors, and general availability of Meshery v1.0. A new Meshery MCP Server gives AI assistants read-only access to the Meshery Registry and cluster state.platform teamsPlatform teams evaluating Meshery gain a CNCF incubation signal and a read-only MCP server for agent access to cluster state. Terraform support for the single model is described as coming soon, so it is not yet available. The growth figures are self-reported by the project and the CNCF blog, not independently verified.CNCF Blog ↗BackstageCortexOpenTofuTektonHelmwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
2026-10-0625 days ago
Migrating from NGINX Ingress to ALB: Handling oauth2-proxypostThe post describes two ways to keep OIDC authentication working when migrating from NGINX Ingress to the AWS Load Balancer Controller on Amazon EKS: running oauth2-proxy in reverse proxy mode behind an ALB, or using the ALB's native authenticate-oidc action. It notes that NGINX auth subrequest annotations are silently ignored by the ALB, and that the native option sends the token in x-amzn-oidc-accesstoken instead of Authorization: Bearer.platform teamsPlatform teams migrating off NGINX Ingress must choose between keeping oauth2-proxy with minimal changes or removing it and adapting backends to ALB headers and register the /oauth2/idpresponse callback with their identity provider. Without these changes, auth annotations are dropped and traffic reaches backends unauthenticated.AWS Containers Blog ↗Amazon EKSwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
The Future of Platform Engineering reportreportOctopus Deploy published the 2026 Future of Platform Engineering report, based on primary survey data from 379 technical platform practitioners and a review of current literature. The report finds that automation and efficiency are the main reasons organizations adopt platforms, and that lack of clear strategy is a more common obstacle than technical complexity. It also reports that teams with mandatory adoption achieved most of their goals more often (62.2%) than teams with optional adoption (about 27.5%).platform teamsPlatform teams evaluating adoption models may weigh the reported link between mandatory adoption, leadership direction and goal delivery when deciding how to position a platform. The source gives no methodology detail beyond the sample size, so the figures are best treated as directional.Octopus Deploy Blog ↗DORA State of DevOps / AI-assisted development reportState of Platform Engineering reportOctopus Deploywritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
2026-09-301 month ago
Pulumiv3.266.0minor++****
How athenahealth modernized healthcare workloads with Amazon EKS Hybrid Nodescase studyathenahealth moved its Clinicals Macro Service from AWS Outposts to Amazon EKS Hybrid Nodes, keeping on-premises worker nodes in one EKS cluster with a control plane in an AWS Region. The post reports about 50 percent lower HTTP response times, about 50 percent projected hardware cost savings, and CPU use below 10 percent across an eight-node fleet, and says the company passed a HITRUST audit. These figures are the authors' own account of the migration and were not independently verified.platform teamsA platform team that must keep latency-sensitive or data-resident workloads on premises can run them under the same EKS control plane, APIs and tooling as cloud nodes, instead of operating a second control plane. The team still owns the hardware, network, node OS and storage, and needs Direct Connect or VPN connectivity and a separate nodeadm upgrade path for hybrid nodes.AWS Containers Blog ↗FluxCrossplaneAmazon EKSKarpenterwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
2026-09-291 month ago
Backstagev1.55.3patch*
Terraform Provider for SAP BTP1.27.0minor+****SAP released version 1.27.0 of the Terraform Provider for SAP BTP. The release notes list one added action, action_update_global_account, and four fixes covering function label extraction for legacy labels, failing early when an amount is set on non-quota entitlement plans, drift resolution for role collection assignments with custom IAS origins, and an auto_create_shadow_users option in the globalaccount trust configuration.platform teamsPlatform teams managing SAP BTP through Terraform get a new action for updating global accounts and fixes that reduce configuration drift for role collections and trust settings. Teams using entitlement plans should note that amount on non-quota plans now fails at plan time instead of being silently accepted.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
2026-09-251 month ago
Pulumiv3.265.0minor++****************Pulumi v3.265.0 adds a pulumi logout --all --delete-credentials-key option, Authenticode signing for Windows CLI and language host binaries, and a PCL error for literals that do not match a schema constant or enum. It also fixes 21 items, mostly in the PCL type checker and interpreter, code generation for Python, Node.js and Go SDKs, and engine handling of unknown outputs when a dependency fails during a --continue-on-error update.platform teamsTeams using Pulumi with --continue-on-error can now rely on Unknown=true being reported for skipped Read and Import steps, so SDK consumers no longer treat empty outputs as real values. Windows CLI binaries are now signed, which may matter for install policies.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Implement per-pod image pull permissions with ECR repository policies on Amazon EKSpostAWS describes a walkthrough for scoping Amazon ECR image pull permissions to individual Kubernetes pods on Amazon EKS. The approach uses KEP 4412 per-pod credential support in kubelet, with the ecr-credential-provider assuming a team IAM role through a service account annotation and ECR repository policies enforcing access. The post states the feature needs Kubernetes 1.34 or later, with full support on EKS v1.35 or later.platform teamsPlatform teams on multi-tenant EKS can give each namespace its own ECR pull role instead of relying on the shared node role, but they must create a ClusterRole and ClusterRoleBinding for the sts.amazonaws.com audience before nodes join, and must update node credential provider configuration. Pods without the annotation fall back to the node role.AWS Containers Blog ↗Amazon EKSwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
2026-09-211 month ago
Backstagev1.55.1patch**
2026-09-161 month ago
Pulumiv3.263.0minor+++++******
2026-09-151 month ago
Crossplane2.4.1patchsecurity+*!!!!Crossplane v2.4.1 updates the Go toolchain to 1.26.7, google.golang.org/grpc to v1.83.2, and golang.org/x/crypto to v0.56.0 to pick up upstream CVE fixes, including the gRPC advisory GHSA-2v4p-qf9q-27wj. It also bumps the Crossplane apis module to v2.4.0. The release changes how package revisions take control of established objects, so an incoming revision can take over CRDs from the revision it replaces.platform teamsPlatform teams upgrading to v2.4.1 get the dependency CVE fixes without changes to their own configuration. Package upgrades that previously could leave a new provider unhealthy with a cannot establish control of object error should now hand off automatically, without deleting the stale revision or editing CRD owner references by hand.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Crossplanev2.3.6patchsecurity+*!!!!Crossplane v2.3.6 updates the Go toolchain to 1.26.7 and bumps google.golang.org/grpc to v1.83.2 and golang.org/x/crypto to v0.56.0, which the release notes say pick up upstream CVE fixes, including a gRPC advisory. It also fixes a package revision hand-off bug where an outgoing revision could fail to release CRD control, leaving the incoming provider stuck with cannot establish control of object and no pod created.platform teamsPlatform teams running Crossplane packages should pick up this patch, since providers stuck on a replaced revision previously needed manual CRD owner-reference edits or deletion of the stale revision. The security content is dependency bumps only, not a vulnerability in Crossplane's own code.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Crossplanev2.2.6patchsecurity+*!!!!Crossplane v2.2.6 updates the Go toolchain to 1.26.7 and bumps google.golang.org/grpc to v1.83.2 and golang.org/x/crypto to v0.56.0, including a gRPC advisory fix. It also changes package revision handoff so a new revision takes control of CRDs from the revision it replaces, fixing a case where the incoming provider's pod was never created and needed manual cleanup.platform teamsPlatform teams upgrading to v2.2.6 get dependency CVE fixes, and provider package upgrades no longer stall with a cannot establish control of object error that previously required deleting the stale revision or editing CRD owner references by hand. The security content is dependency bumps only, not a vulnerability in Crossplane's own code.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
daily email

One short email each morning: what shipped, what breaks, and a link to each change. Unsubscribe in one click. Privacy.

statuslast 30 days for lines
tools tracked43releases in registry964released in the last 30 days106entries published336breaking change lines18security lines84
change typestwo-column gutter, like git status
  • +addedNew functionality.
  • ~changedExisting behavior changed.
  • -deprecatedStill works, scheduled for removal.
  • -removedDecommissioned, gone in this version.
  • *fixedA defect corrected.
  • !securityA vulnerability closed or a dependency patched for one.
  • !breakingFlag in the first column; the change needs action before upgrading.
filter
categoryallidp & portalsai agents on platformci/cdobservabilitysupply chaincost & governancereports & dx dataenterprise app platforms
showmajor onlyreleasescase studiespostmortemsinclude patches