platformchangelog.dev
43 tools

Platform Changelog: what shipped in platform engineering, developer experience and DevOps

feedbefore 2026-10-11patches hidden unless security or breaking
newest entries
2026-10-1021 days ago
Karpenterv1.15.0minor++++++++++********Karpenter v1.15.0 adds node repair as a voluntary disruption method, including reboot as a node action, terminate-first repair for capacity-constrained NodePools, and a --legacy-node-repair flag to run the previous controller. It also adds metrics such as karpenter_pods_disrupted_total and labels on disruption metrics, plus AWS feature gates and CEL expressions for kubelet settings. The release notes list 41 additions and 35 fixes, with 189 maintenance lines omitted.platform teamsPlatform teams running Karpenter on EKS should review repair and disruption behavior, since node repair now runs as a voluntary disruption and default repair policies changed, and the --legacy-node-repair flag offers a fallback. The new disruption and reboot metrics give more detail for monitoring node churn.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
InfoQ: Cloudflare Traces Turns the Proxy Layer into OpenTelemetry Spans, with New Volume-Based PricingpostCloudflare put Traces into open beta, extending its automatic tracing from Workers to security rules, transformations, cache, routing and origin handling, emitted as OpenTelemetry spans. Traces accept and forward W3C traceparent headers, and Trace Rules allow targeted sampling. Pricing moves to ingestion and retention volume starting December 1.platform teamsPlatform teams that use Cloudflare in front of services can get proxy-layer spans in their existing OpenTelemetry backends, with sampling controls to limit volume. Teams should estimate ingestion and retention costs before December 1, since billing changes from the current model to volume-based.InfoQ ↗written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Salesforce Deployments with OctopuspostThe Octopus Deploy blog describes a walkthrough for deploying a Salesforce sample application with Octopus Deploy and the Salesforce CLI (sf). It covers storing an SFDX auth URL as a sensitive variable, running a script step in a container built from a Dockerfile that installs the CLI, and running sf project deploy start against a target org.platform teamsA platform team that runs Salesforce deployments can use a pattern of a containerized execution step with the sf CLI and an auth URL secret in Octopus. The post is a tutorial on one approach and does not announce any change to Salesforce or Octopus tooling.Octopus Deploy Blog ↗Octopus DeploySalesforce CLISalesforce Platformwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
2026-10-0922 days ago
InfoQ: HashiCorp Relased Terraform Google Cloud Provider 8.0 in General AvailabilitypostHashiCorp has announced general availability of version 8.0 of the Terraform provider for Google Cloud. The major release changes the default load balancing for two Compute Engine resources and removes resources tied to retired Google Cloud services.platform teamsPlatform teams using this provider should review configurations for the two Compute Engine resources whose default load balancing changed, and remove or migrate any usage of resources for retired Google Cloud services before upgrading. The source does not name the specific resources or new defaults.InfoQ ↗written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
2026-10-0823 days ago
CNCF: Don’t give AI agents root. Make them propose the next system state.postThe author argues that autonomous agents should not be given root access to production machines, since agent behavior is nondeterministic and root access offers no reproducibility. He proposes that agents run in short-lived isolated workloads, observe immutable hosts, and submit pull requests for the next system image, which then passes review, build, signing and release before the host consumes it. He states that the agent identity should be able to propose changes without approving, merging, altering pipelines, or signing images. The post is written by a Kairos maintainer and describes a go-ukify alignment fix found by an agent during QA.platform teamsPlatform teams evaluating agents on infrastructure can treat agent write access as a separation-of-authority question: agents propose changes through the same review and build pipeline as humans, with no direct host mutation. The post describes an architectural pattern rather than a shipped product feature.CNCF Blog ↗written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
AWS Cost Explorer, Budgets, and Dashboards now support Amazon Bedrock product attributesannouncementAWS now lets users analyze Amazon Bedrock costs in Cost Explorer, AWS Budgets, and Cost Management Dashboards by new product attributes: model, model provider, inference type, and feature. Users can group and filter costs by these attributes in Cost Explorer and Dashboards, and filter budgets by them. The attribute dimension is available at no additional charge in all AWS Regions except GovCloud (US), China (Beijing), and China (Ningxia).platform teamsPlatform teams can attribute Bedrock spend to specific models and, combined with cost allocation tags or IAM principal tags, to applications, projects, workspaces, users or roles, and set alerts on spend for a single model. No change to Bedrock APIs or runtime behavior is described.What's New with AWS ↗written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Track organization-wide security risk in one dashboardpostGitLab 19.4 adds an organization-level security dashboard in beta for GitLab.com Ultimate users. It shows a risk score calculated from severity and age of open vulnerabilities, KEV status, and EPSS scores, with trend, age, severity and CWE charts across all top-level groups. Third-party scanners that output SARIF can also feed findings into the same view.platform teamsPlatform and security teams running GitLab across multiple top-level groups can get a single rolled-up vulnerability view without manual reporting, provided they have an Organization with Owner access and at least one scanner with a completed default-branch scan. The feature is beta and limited to GitLab.com.GitLab Blog ↗GitLabeditorCorrection 2026-10-20: this was listed as a GitLab 19.4 release by mistake. It is GitLab Blog coverage, not release notes from the project.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Cluster APIv1.13.7patchsecurity~~~~~~~~~~~~~****!Cluster API v1.13.7 was released with 28 changes: one security item bumping grpc to 1.83.2 for security advisories, 14 dependency changes (including OpenTelemetry v1.45.0 and golang.org/x/net v0.58.0), and four fixes. The fixes cover cluster-name labels on Clusters without ClusterClass, KCP learner deletion after Node registration, a race in the KCP proxy DialContext, and a flaky test.platform teamsThe security fix is a dependency bump, not a vulnerability in Cluster API's own code, so platform teams should upgrade for the advisory fix and the KCP race fix. The release notes list supported management cluster versions as v1.32.x to v1.36.x and workload cluster versions as v1.30.x to v1.36.x.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Pulumiv3.268.0minor+++++*************Pulumi v3.268.0 adds an engine capability to negotiate OutputValues on Invoke, gated by a new accepts_outputs_in_invoke handshake capability. It adds version, whoami and install to the generated automation APIs for NodeJS, Python and Go, and sends the W3C traceparent header on Pulumi Cloud API calls when --otel-traces is set. The release also lists 14 fixes, including dynamic provider Read fallback, plugin checksum verification and parallel plugin shutdown.platform teamsTeams using the Pulumi Automation API get version, whoami and install methods in NodeJS, Python and Go, and dynamic provider authors need to check Read handling since the engine no longer duplicates inputs into state. Teams tracing Pulumi calls get trace propagation to Pulumi Cloud when --otel-traces is set.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
CNCF: Meshery becomes a CNCF Incubating projectannouncementThe CNCF TOC voted to accept Meshery as a CNCF incubating project. The announcement cites a 350% increase in code commits over the year to July 2026, about 7,000 contributors, and general availability of Meshery v1.0. A new Meshery MCP Server gives AI assistants read-only access to the Meshery Registry and cluster state.platform teamsPlatform teams evaluating Meshery gain a CNCF incubation signal and a read-only MCP server for agent access to cluster state. Terraform support for the single model is described as coming soon, so it is not yet available. The growth figures are self-reported by the project and the CNCF blog, not independently verified.CNCF Blog ↗BackstageHelmTektonCortexOpenTofuwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
2026-10-0625 days ago
Argo CDv3.5.4patchbreakingsecurity+~~******!!!!!!!!Argo CD v3.5.4 ships 19 changes, 11 of them security fixes, including several critical issues in the repo-server: Kustomize remote refs and Helm config home can run commands, and Jsonnet imports can read files. It also fixes an AppProject restriction bypass via PreDelete/PostDelete hooks and a high-severity command injection through repository proxy URLs on SSH Git repositories. Two changes are marked breaking: Kustomize builds rendering Helm charts no longer honor helmGlobals.configHome, and OCI manifests larger than 4 MiB are now rejected.platform teamsPlatform teams running Argo CD 3.5 should upgrade to pick up the repo-server and AppProject fixes. Teams using Kustomize with Helm plugins from a custom config home, or with OCI manifests above 4 MiB, need to check their builds before upgrading because those will fail.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Argo CDv3.4.10patchbreakingsecurity+~~****!!!!!!!!Argo CD v3.4.10 ships fixes for 11 security issues, including several rated critical: command execution via Kustomize remote refs and Helm config home in the repo-server, a Jsonnet import that reads repo-server files, and an AppProject restriction bypass through PreDelete/PostDelete hooks. It also includes two breaking changes: Kustomize no longer honors helmGlobals.configHome for Helm plugins registered from that directory, and OCI manifests larger than 4 MiB are rejected. The release also adds username logging on login attempts and four bug fixes.platform teamsPlatform teams running Argo CD 3.4 should upgrade to pick up the critical repo-server and AppProject fixes. Teams using Kustomize with Helm plugins from configHome or OCI manifests above 4 MiB need to check their builds before upgrading because those will now fail.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Argo CDv3.3.15patchbreakingsecurity~~*********!!!!!!!Argo CD v3.3.15 ships fixes for 12 security issues and 11 other fixes, with 2 changes marked breaking. Breaking changes: Kustomize builds that render Helm charts no longer honor helmGlobals.configHome, so builds relying on a Helm plugin registered from that directory will fail, and OCI manifests larger than 4 MiB are now rejected. Critical advisories cover command execution via Kustomize remote refs and Helm config home, Jsonnet file reads from the repo-server, and AppProject restriction bypass via PreDelete/PostDelete hooks.platform teamsPlatform teams running Argo CD 3.3 should plan to upgrade, and check any Kustomize-with-Helm pipelines that use a plugin from configHome or OCI manifests over 4 MiB before rolling out. Repo-server exposure from the listed critical issues makes the update a priority.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Migrating from NGINX Ingress to ALB: Handling oauth2-proxypostThe post describes two ways to keep OIDC authentication working when migrating from NGINX Ingress to the AWS Load Balancer Controller on Amazon EKS: running oauth2-proxy in reverse proxy mode behind an ALB, or using the ALB's native authenticate-oidc action. It notes that NGINX auth subrequest annotations are silently ignored by the ALB, and that the native option sends the token in x-amzn-oidc-accesstoken instead of Authorization: Bearer.platform teamsPlatform teams migrating off NGINX Ingress must choose between keeping oauth2-proxy with minimal changes or removing it and adapting backends to ALB headers and register the /oauth2/idpresponse callback with their identity provider. Without these changes, auth annotations are dropped and traffic reaches backends unauthenticated.AWS Containers Blog ↗Amazon EKSwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
AWS Batch now publishes job metrics to Amazon CloudWatchannouncementAWS Batch now publishes job state transition and duration metrics to the AWS/Batch namespace in Amazon CloudWatch, with a JobQueueName dimension. The metrics cover job counts entering states such as submitted, running, succeeded, and failed, plus time spent between states. The metrics are available in all AWS Regions where AWS Batch runs.platform teamsPlatform teams running AWS Batch can track queue health, failure rates, and job durations in CloudWatch, the console, CLI, or SDKs. The source does not describe pricing, retention, or limits for these metrics.What's New with AWS ↗written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Every artifact your teams ship, assembled right the first timeannouncementGitLab announced Artifact Central, an organization-level registry in beta that replaces project-level package and container registries. Retention rules, storage quotas and publish or pull access are set once at the organization level, with four artifact-specific roles (Admin, Manager, Contributor, Viewer). The beta supports Maven, npm, Docker and OCI, and is available on GitLab.com with Self-Managed availability planned, at no charge during the beta.platform teamsPlatform teams could set artifact storage, quota and access policy in one place instead of per project, and use one hosted, remote or virtual URL for internal and external packages. Existing registries can be added as remotes and converted to hosted repos gradually, so no bulk migration is required.GitLab Blog ↗GitLabwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Dependency Firewall: Block risky packages before the buildpostGitLab announced Dependency Firewall, now in early access for GitLab.com and GitLab Self-Managed Premium and Ultimate customers. It blocks or warns on packages that match a policy covering malware status, vulnerability severity, license type, and minimum package age, before they are installed in a build. The source also cites five malicious PyPI packages GitLab researchers found in June 2026, four of them typosquats of Flask, Requests, and NumPy.platform teamsPlatform teams can set policy once at the top-level group, with project-level overrides where the strictest rule applies, and run warn mode before switching to block mode with logged bypasses. Teams using Sonatype Nexus or JFrog Artifactory can apply it at the registry, and the GitLab CLI can check a package before it is added.GitLab Blog ↗GitLabeditorCorrection 2026-10-20: this was listed as a GitLab release by mistake. It is GitLab Blog coverage, not release notes from the project.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
GitLab Transcend: Speed you can trust, all the way to productionannouncementGitLab announced more than a dozen features at its Transcend event, including goal-driven agent flows, custom flows, an MCP Server, Artifact Central in beta, Dependency Firewall in early access, and Secrets Manager set to reach GA this month. The vendor says GitLab Orbit context graph reduces agent retries by up to 45x and token use by up to 4.5x during its beta. Credit and usage controls add spend caps and alerts at the subscription, group, and user level.platform teamsPlatform teams evaluating GitLab can plan to govern agent actions and MCP access under existing policy, set AI spend caps, and route packages through Artifact Central and Dependency Firewall. Many capabilities are GA later or in beta or early access, so rollout timing matters.GitLab Blog ↗GitLabJenkinsGitHub Actionswritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
2026-10-0526 days ago
AWS Control Tower AFT now supports plan-only customization runsannouncementAWS Control Tower Account Factory for Terraform (AFT) now supports plan-only customization runs. Administrators can trigger a Terraform plan for global and account customizations without applying changes. The feature is available in all AWS Regions where AFT is supported, and the source says it works with open source Terraform, Terraform Cloud and Terraform Enterprise.platform teamsPlatform teams using AFT can preview Terraform changes across managed accounts before a broad rollout and wire plan output into CI/CD review steps. The source does not describe changes to AFT's apply behavior.What's New with AWS ↗written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Scaling Kubernetes Workloads with Node SwappostThe Kubernetes blog reports benchmarks of node swap backed by Local NVMe SSDs across a Linux kernel build, headless Chrome sandboxes under runc, gVisor and Kata, and Python sandboxes. Node swap reached General Availability in Kubernetes v1.34 and is configured through the kubelet with LimitedSwap. The post reports pod density gains of up to 3x in these tests, with the latency cost mainly attributed to CPU competition at peak density.platform teamsPlatform teams running memory-heavy CI or agent sandbox workloads can evaluate swap on Local SSD nodes to raise pod density, but must set workloads to Burstable QoS and size swap for burst rather than steady-state use. The results come from Google Cloud test nodes and the post does not give independent methodology beyond linked repositories.Kubernetes Blog ↗Amazon EKSwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Restart EC2 and on-premises fleets faster with AWS CodeDeploy RESTART deployment modepostAWS CodeDeploy added a RESTART deployment mode that reapplies a deployment group's last successful revision to EC2 and on-premises in-place deployments. The mode keeps deployment configurations, lifecycle hooks, CloudWatch alarm monitoring, rollback settings and deployment history. AWS reports up to 6.1x faster fleet restarts in its feature tests, which used m5.large instances and a 1 GB revision.platform teamsPlatform teams can run fleet restarts through CodeDeploy instead of custom scripts, keeping batch limits, health checks and alarm stops. Restarts do not run load balancer BlockTraffic and AllowTraffic steps, so request-serving fleets need draining logic in ApplicationStop and enough healthy capacity.AWS DevOps Blog ↗written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
AWS Batch now supports Amazon EKS access entry authenticationannouncementAWS Batch now supports Amazon EKS access entry authentication for compute environments. Users set accessEntry.desiredState to ENABLED through the CreateComputeEnvironment or UpdateComputeEnvironment APIs, and AWS Batch creates one access entry per cluster with the AWSBatchClusterPolicy attached. The feature is available in all AWS Regions where AWS Batch is offered.platform teamsPlatform teams running AWS Batch on EKS can manage Batch's cluster access through the API-driven access entry mechanism instead of editing the aws-auth ConfigMap. Access entry setup is per cluster, so teams should check that all Batch compute environments targeting a cluster are updated.What's New with AWS ↗Amazon EKSwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
daily email

One short email each morning: what shipped, what breaks, and a link to each change. Unsubscribe in one click. Privacy.

statuslast 30 days for lines
tools tracked43releases in registry964released in the last 30 days106entries published336breaking change lines18security lines84
change typestwo-column gutter, like git status
  • +addedNew functionality.
  • ~changedExisting behavior changed.
  • -deprecatedStill works, scheduled for removal.
  • -removedDecommissioned, gone in this version.
  • *fixedA defect corrected.
  • !securityA vulnerability closed or a dependency patched for one.
  • !breakingFlag in the first column; the change needs action before upgrading.
filter
categoryallidp & portalsai agents on platformci/cdobservabilitysupply chaincost & governancereports & dx dataenterprise app platforms
showmajor onlyreleasescase studiespostmortemsinclude patches