platformchangelog.dev
43 tools

Platform Changelog: what shipped in platform engineering, developer experience and DevOps

feedbefore 2026-10-20patches hidden unless security or breaking
newest entries
Amazon CloudWatch Omni is now available in additional AWS RegionsannouncementAWS says Amazon CloudWatch Omni, an AI-powered observability experience, is now available in eight more AWS Regions. The expansion adds Canada (Central), Asia Pacific (Mumbai, Singapore, Sydney, Tokyo), Europe (Frankfurt, London) and South America (São Paulo), on top of US East (N. Virginia), US West (Oregon) and Europe (Ireland). The source also describes spaces for cross-account telemetry, agent observability and an IDE extension, and says it works with Azure and GCP telemetry.platform teamsPlatform teams in the newly added Regions can now use Omni for cross-account and multi-cloud observability and AI-assisted root cause analysis. Teams should check pricing and data residency needs before adopting it, since the source only points to the pricing page.What's New with AWS ↗AWS DevOps Agentwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
CNCF: How AI workloads are reshaping Kubernetes autoscalingpostThe article describes how Kubernetes autoscaling is being reworked for AI workloads, where the scheduler and the cluster autoscaler often disagree about what a usable node is. It covers Dynamic Resource Allocation for topology and device sharing, and notes that DRA support in autoscalers still varies by implementation. It also says workload-aware scheduling is beta and disabled by default, and that the autoscaler does not yet take part in gang scheduling, with a SIG-Autoscaling proposal under discussion.platform teamsPlatform teams running GPU node pools should check whether their autoscaler supports DRA claims and provisioning requests, since without that a pending pod may trigger an incompatible node launch or wasted capacity. Gang scheduling for large jobs still depends on a bolt-on provisioning request path that is best effort and provider dependent.CNCF Blog ↗KarpenterAmazon EKSwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
InfoQ: Buildkite Adds Scoped Secrets and New Agentic CI ToolspostBuildkite has introduced pipeline-scoped secrets and new Model Context Protocol tools for validating pipelines, diagnosing failed builds and repairing webhooks. It also added Linux arm64 support to its GitHub Actions compatibility layer and expanded OpenTelemetry data in Buildkite Agent v4.1.0.platform teamsPlatform teams running Buildkite can scope secrets to individual pipelines and let MCP-connected agents validate pipelines and diagnose failures. Teams relying on the GitHub Actions compatibility layer on arm64 runners and on Buildkite Agent telemetry can now evaluate those changes.InfoQ ↗written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Amazon CloudWatch log centralization now available in AWS GovCloud and additional commercial RegionsannouncementAmazon CloudWatch log centralization is now available in AWS GovCloud (US) and 13 additional commercial Regions. The feature copies logs from multiple accounts and Regions into a single destination account, with rules scoped to an organization, organizational units, or selected accounts. Customers can centralize one copy of logs for free, and additional copies cost $0.05/GB.platform teamsPlatform teams running multi-account AWS estates in the newly covered Regions can aggregate logs into one account through AWS Organizations without building custom pipelines. Teams should check the per-GB charge for any second or further copy of logs.What's New with AWS ↗Amazon EKSwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Automating secure container registry management for air-gapped AWS workloadspostAWS describes an approach for migrating Helm charts and container images into private Amazon ECR repositories inside air-gapped VPCs. It uses ECR repository creation templates, applied through Terraform, to set customer-managed KMS encryption, immutable tags and lifecycle rules on repositories created on first push. A migration tool called ecr-artifact-manager, included in the sample repository, preserves multi-architecture manifests, rewrites Helm chart references, and pulls private source credentials from AWS Secrets Manager.platform teamsPlatform teams in regulated air-gapped AWS environments can define repository security settings once in Terraform and have new repositories inherit them, rather than configuring each repository by hand. Teams should note that the encryption configuration cannot be changed after repository creation, and that enhanced scanning is configured at the registry level, not in the template.AWS Containers Blog ↗HelmAmazon EKSTerraform MCP Serverwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
CNCF: Deploying, maintaining, and migrating production n8n on EKScase studyA team ran n8n in queue mode on Amazon EKS with separate workers and webhook processors, syncing secrets from AWS Secrets Manager via External Secrets Operator. They then moved from a community Helm chart to the official n8n Helm chart as a full cutover, keeping PostgreSQL, Redis, S3, IAM and secrets in place. The main pod's persistence was disabled because they found no state on that volume that needed to survive a restart.platform teamsPlatform teams running n8n on Kubernetes can see a concrete migration path from the community chart to the official chart, including the trade-off that main pods move to a Deployment with a shared PVC that gp3 RWO volumes cannot serve across nodes. The article's sample values repository shows queue mode, HPA and ingress configuration for external Postgres and Redis.CNCF Blog ↗HelmAmazon EKSwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
InfoQ: Chainguard Launches Secure Workspaces and Checks for AI Coding AgentsannouncementChainguard announced two beta products at its Assemble London event. Chainguard Workspaces provides remote development environments based on hardened microVMs. Chainguard Checks runs continuous integration inside the development loop, for code written by developers and AI agents.platform teamsPlatform teams evaluating hosted or agent-facing dev environments and in-loop CI can consider these betas, but the source gives no technical detail, pricing, or availability beyond beta status. Nothing here changes existing pipelines or platforms yet.InfoQ ↗written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Xcode 27 runner image generally availablepostGitHub has made the Xcode 27 runner image generally available for building and testing Apple applications in GitHub Actions. The image runs on macOS 27 and includes the Xcode 27 toolchain and Apple SDKs. It is available on Apple Silicon (arm64) runners only, selected with the xcode-27 and xcode-27-xlarge labels.platform teamsTeams building Apple apps on GitHub-hosted runners can target the xcode-27 or xcode-27-xlarge labels, and existing workflows using those labels need no change. Intel runners are not supported, so pipelines that depend on them will need a different runner.GitHub Changelog ↗GitHub Actionswritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Using Claude Code for Salesforce? Don’t miss these security and governance gapspostGearset's blog post lists governance and security gaps for teams using Claude Code, Cursor or Codex to build on Salesforce. The gaps include over-broad local permissions, prompt injection, changes that bypass testing and review, inconsistent team standards, and unplanned maintenance. The post recommends running agents in a container, using least-privilege integration users, restricting MCP toolsets, and routing all AI-generated changes through a CI/CD pipeline.platform teamsPlatform teams that let agents reach Salesforce orgs through MCP should scope credentials to least privilege, restrict enabled MCP toolsets, and require AI-generated changes to pass the same pipeline checks as human changes. The post's recommendations are general, and it promotes Gearset's own product as the solution.Gearset Blog ↗GearsetSalesforce PlatformSalesforce DX MCP ServerAgentforcewritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
GitLab19.5minorGitLab 19.5 was released on October 15, 2026. The GitLab MCP server and GitLab Secrets Manager are now generally available, and the MCP server gives external agents such as Claude Code and Cursor access to a wider set of GitLab tools. The release also adds beta support for connecting externally connected agents to AI Governance, plus non-default branch vulnerability tracking and several GitLab Duo CLI features.platform teamsPlatform teams can scope CI secrets per job by environment and branch and get audit logs for each secret operation, using existing GitLab permissions. Security teams can see sessions from agents running outside GitLab, with audit events sent to a SIEM, though this ECA capability is in beta.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
CNCF: Extending Kubernetes policy enforcement to runtime security for AI workloadspostNirmata published an open source project, Nirmata Runtime for Kyverno, that uses eBPF and Linux Security Modules to enforce policy on process execution, file access, network egress, and application protocol inside running pods. Policies use the same CEL-based syntax as Kyverno admission policies and start in monitor mode, with denials attributed to the responsible policy and reported as OpenReports objects. The post describes example policies for AI agent pods, such as limiting egress to an LLM gateway, restricting launchable binaries, and detecting agent CLIs in images.platform teamsPlatform teams running agent pods could use per-pod runtime policies to restrict egress, executables, and credential file access beyond what admission control checks. The post provides no benchmarks, adoption data, or independent validation, so the enforcement claims are unverified.CNCF Blog ↗Kyvernowritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Launch AWS DevOps Agent to review findings and test results from AWS Resilience HubannouncementAWS Resilience Hub now integrates with AWS DevOps Agent. Users can launch a DevOps Agent investigation when they run a resilience test, which returns a structured analysis of symptoms, root cause, impact and observed recovery actions such as ARC Region switch. Users can also start an on-demand DevOps Agent task from a failure mode assessment finding to ask questions and build a mitigation plan.platform teamsPlatform and SRE teams using Resilience Hub on AWS can get agent-driven root cause analysis for resilience tests and help turning failure mode findings into mitigation plans. The source gives no details on permissions, audit or cost of the agent.What's New with AWS ↗AWS DevOps AgentAmazon EKSwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Connect your agents to your software lifecycle with the GitLab MCP serverpostGitLab announced general availability of its MCP server with GitLab 19.5, letting MCP-compatible agents work with code, merge requests, work items and pipelines. The release adds tools for branches, file reads, semantic code search, pipeline inspection and artifact reads, and consolidates related tools into fewer calls. Agents can also start and follow GitLab Duo Agent Platform flows, with actions running under existing GitLab permissions.platform teamsPlatform teams evaluating agent access to GitLab can connect external agents with permissions inherited from GitLab, and can limit the tool surface with toolsets. The source gives no measured figures for the claimed reduction in calls or context.GitLab Blog ↗GitLabeditorCorrection 2026-10-20: this was listed as a GitHub Actions, GitLab 19.5 release by mistake. It is GitLab Blog coverage, not release notes from the project.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
GitLab Secrets Manager: Govern secrets like your codepostGitLab says Secrets Manager is now generally available in GitLab 19.5 for Premium and Ultimate on GitLab.com and Self-Managed, with GitLab Dedicated coming soon. It is built on OpenBao and stores build-time and runtime credentials under GitLab's project and group permissions and audit trail. Jobs receive only the secrets they declare and that match branch and environment scope conditions.platform teamsPlatform teams can replace raw CI/CD variables with scoped secret references and serve Kubernetes via External Secrets Operator, Terraform and OpenTofu data sources, and the Vault-compatible API from one store. Pricing is a paid add-on billed in GitLab Credits, and the source notes a CI/CD variable migration workflow is still in development.GitLab Blog ↗GitLabOpenTofueditorCorrection 2026-10-20: this was listed as a OpenTofu, Helm, GitLab 19.5 release by mistake. It is GitLab Blog coverage, not release notes from the project.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Get every merge request in front of the right reviewer, fasterpostGitLab 19.5 makes Recommend Reviewers Flow generally available on GitLab.com, Self-Managed and Dedicated. When a merge request is created, the flow suggests one reviewer based on workload, time zone, availability and expertise defined by approval rules and CODEOWNERS, and shows its reasoning. Authors can assign the suggested reviewer with one click. The vendor also states that Code Review Flow costs a flat 0.25 GitLab Credits per review and cuts per-review cost by 99% against a manual review estimate.platform teamsPlatform teams using GitLab can enable the flow as a project trigger and rely on CODEOWNERS and approval rules as the input for reviewer routing. The benefit to review load and time to first review is the vendor's claim and no independent data is given.GitLab Blog ↗GitLabeditorCorrection 2026-10-20: this was listed as a GitLab 19.5 release by mistake. It is GitLab Blog coverage, not release notes from the project.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Unblock agentic software delivery with governed code reviewannouncementGitLab says Code Review Flow, part of GitLab Duo Agent Platform, is now generally available and runs as a CI/CD job on GitLab-hosted or self-hosted runners. Teams can set custom review instructions at the project, group or instance level, and choose GitLab-managed or self-hosted models. The post lists roadmap items including extended analysis, approve or request-changes decisions, risk assessment and local review in Duo CLI.platform teamsPlatform teams can run automated agentic review inside existing merge request, pipeline and approval controls, and can select self-hosted models for air-gapped or regulated setups. The $0.25 per review price and 100x ROI figure are vendor claims, and the source gives no methodology for them.GitLab Blog ↗GitLabGitHub Actionswritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Pulumi3.269.0minor++++++++**********Pulumi v3.269.0 adds runtime functions to the Go, Node.js and Python SDKs that check whether a resource with a given ID exists without adopting it into the stack. It runs OPA policy packs through a pulumi-language-opa plugin that the CLI downloads on demand. The release also makes pulumi logs and pulumi watch error by default ahead of their removal, and includes 18 fixes across PCL, the CLI and the SDKs.platform teamsTeams running OPA policy packs will get the CLI-downloaded language plugin instead of the old analyzer fallback for runtimes without a language plugin. Scripts that call pulumi logs or pulumi watch will start failing by default and should be checked before the removal lands.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Amazon CloudWatch announces log routing and chained log parserspostAmazon CloudWatch pipelines now supports conditional log routing, which sends each event to a different CloudWatch log group based on conditions evaluated against processed fields. It also supports chained parsers, where later parser processors consume fields produced by earlier ones, such as parsing a JSON envelope and then applying a Grok parser. The capabilities are available in all commercial AWS Regions where CloudWatch pipelines is generally available and can be configured through the console, CLI, or SDKs.platform teamsPlatform teams can split mixed log streams into separate log groups and apply different retention and access controls per route within a single pipeline. Nested log formats can be parsed in sequence without a separate transformation stage.What's New with AWS ↗editorCorrection 2026-10-20: this was listed as a Amazon EKS release by mistake. It is What's New with AWS coverage, not release notes from the project.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Why Is My Kubernetes Job Still Pending? Tracing Kueue Admission with HeadlamppostThe Kubernetes Blog published a walkthrough of using the 0.1.0-alpha Kueue plugin for Headlamp to trace why a Job stays suspended. The article steps through the Workload, LocalQueue, ClusterQueue, ResourceFlavor and Cohort views, and separates Kueue admission from Pod scheduling. The alpha plugin provides read-only views for Kueue v1beta2 resources.platform teamsPlatform teams running Kueue for batch or quota-managed workloads can use the Headlamp views to read Workload conditions and queue capacity without switching to kubectl for each step. The alpha plugin does not add create, edit, stop, resume or delete workflows.Kubernetes Blog ↗written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
daily email

One short email each morning: what shipped, what breaks, and a link to each change. Unsubscribe in one click. Privacy.

statuslast 30 days for lines
tools tracked43releases in registry964released in the last 30 days106entries published335breaking change lines18security lines84
change typestwo-column gutter, like git status
  • +addedNew functionality.
  • ~changedExisting behavior changed.
  • -deprecatedStill works, scheduled for removal.
  • -removedDecommissioned, gone in this version.
  • *fixedA defect corrected.
  • !securityA vulnerability closed or a dependency patched for one.
  • !breakingFlag in the first column; the change needs action before upgrading.
filter
categoryallidp & portalsai agents on platformci/cdobservabilitysupply chaincost & governancereports & dx dataenterprise app platforms
showmajor onlyreleasescase studiespostmortemsinclude patches