Platform Changelog

feedbefore 2026-10-20patches hidden unless security or breaking

2026-10-1912 days ago

Open Policy Agent1.21.3patch~~OPA v1.21.3 makes a signing block with no entries under its top-level keys a startup configuration error. Bundle.NewVerificationConfig now requires signatures by default, and embedders can opt out. The release notes say the change covers bundle and discovery configurations that previously did not verify signatures, including those with an empty signing block or no keyid.platform teamsPlatform teams with bundle or discovery signing blocks that lack a keyid, or with empty signing blocks, will need to add a keyid or fix the configuration before OPA starts. Teams whose configs have no signing block, or that run with --skip-verify, are not affected by the new default.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

2026-10-1615 days ago

Pulumiv3.270.0minor**Pulumi v3.270.0 fixes a bug where pulumi env edit, env set, env rm and env provider could overwrite changes made after they read the environment. On a conflict, env edit now reopens the editor with the user's edits and the current definition, and the other commands fail. It also fixes pulumi stack drift status, which now reports an unknown drift status when drift detection has never run.platform teamsTeams using Pulumi ESC environments from the CLI no longer risk silent overwrites of concurrent edits, and conflicts now fail instead of clobbering changes. Scripts that read drift status should handle the unknown state for stacks where drift detection has not run.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

2026-10-1516 days ago

OpenFeaturev0.18.0minorbreaking+++++~~~flagd: v0.18.0

Helmv3.22.1patchsecurity~~~!Helm v3.22.1 was released with a security item that bumps dependencies to remove Go package vulnerabilities. Other changes update the k8s.io Go packages to v0.37.1 and the OpenTelemetry OTLP trace exporters to v1.45.0. The notes also state that the next patch releases for Helm 4.3.2 and 3.22.2 are scheduled for November 11, 2026, and that Helm 4.4.0 is scheduled for January 13, 2027.platform teamsPlatform teams running Helm 3 get dependency-level CVE fixes in this release, but the source does not name the affected packages or the tool's own code. The notes say there will be no further Helm 3 minor releases after this line, so teams should plan migration to Helm 4.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

OpenFeaturev0.17.1patchsecurity!flagd: v0.17.1

GitLab19.5minorGitLab 19.5 was released on October 15, 2026. The GitLab MCP server and GitLab Secrets Manager are now generally available, and the MCP server gives external agents such as Claude Code and Cursor access to a wider set of GitLab tools. The release also adds beta support for connecting externally connected agents to AI Governance, plus non-default branch vulnerability tracking and several GitLab Duo CLI features.platform teamsPlatform teams can scope CI secrets per job by environment and branch and get audit logs for each secret operation, using existing GitLab permissions. Security teams can see sessions from agents running outside GitLab, with audit events sent to a SIEM, though this ECA capability is in beta.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

2026-10-1417 days ago

OpenTofu1.12.8patchsecurity*!OpenTofu v1.12.8 fixes excessive CPU usage that could occur when tofu init installs dependencies from an attacker-controlled HTTP/2 server. It also fixes a crash in lifecycle destroy when the destroy expression contains references.platform teamsTeams running tofu init against untrusted or unverified module sources should upgrade to remove the CPU exhaustion risk. Pipelines that use lifecycle destroy with referenced expressions will no longer crash.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Pulumi3.269.0minor++++++++**********Pulumi v3.269.0 adds runtime functions to the Go, Node.js and Python SDKs that check whether a resource with a given ID exists without adopting it into the stack. It runs OPA policy packs through a pulumi-language-opa plugin that the CLI downloads on demand. The release also makes pulumi logs and pulumi watch error by default ahead of their removal, and includes 18 fixes across PCL, the CLI and the SDKs.platform teamsTeams running OPA policy packs will get the CLI-downloaded language plugin instead of the old analyzer fallback for runtimes without a language plugin. Scripts that call pulumi logs or pulumi watch will start failing by default and should be checked before the removal lands.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Salesforce CLI2.154.4minor+

2026-10-1318 days ago

ServiceNow SDK4.13.xminor++**SDK 4.13.x Patch NotesServiceNow released SDK 4.13.x patch changes. The release adds table support for db_object_id in bootstrap and for configuration_access, and adds a protectionPolicy option for sys_security_acl_role. It fixes an OAuth CSRF issue by restoring cookie replay and binding CSRF lookup to the exact session, and it also fixes a now-ux-globals Array.from polyfill requirement and a TypeScript error during UI type-checking.platform teamsPlatform teams that use the ServiceNow SDK should pick up the OAuth CSRF fix, which is a security fix in the SDK itself. Teams managing ACL rules can use the new protectionPolicy option on sys_security_acl_role, and telemetry events no longer have person profile processing applied.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Jenkins2.586minor+++++****Jenkins 2.586 was released with nine changes: five additions and four fixes. Added items include standardised shadows and focus rings for controls, removal of the Manage Jenkins breadcrumb menu, updated User settings pages, and a warning about unsafe authorization strategy. Fixes cover readOnlyMode propagation in dropdown fragments, locale handling in the search index, log recorder level updates, and dialog width limits.platform teamsPlatform teams running Jenkins controllers get UI changes and a warning when the authorization strategy is unsafe, which may prompt a review of their security configuration. The release notes list no breaking changes to pipelines or APIs.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

2026-10-1219 days ago

Argo Rolloutsv1.10.1patchbreaking**Argo Rollouts v1.10.1 ships two fixes cherry-picked to the 1.10 line. The Rollouts dashboard now binds only to the local interface by default, which is marked as a breaking change. The release also allows Bidirectional mountPropagation on privileged containers, fixing issue #3130.platform teamsTeams that reached the Rollouts dashboard over a non-local address will need to expose it explicitly or port-forward after upgrading. Teams running privileged workloads that need bidirectional mount propagation can now use that setting on this version.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Argo Rollouts1.9.2patchbreakingsecurity*!Argo Rollouts v1.9.2 changes the Rollouts dashboard to bind only to the local interface by default. The release notes mark this as a breaking change for users who expose the dashboard through a custom Helm chart or another method. The release also lists a security fix, but the notes do not describe its details.platform teamsTeams that reach the Rollouts dashboard through a custom Helm chart or ingress must now explicitly configure exposure, or the dashboard will be unreachable from outside the local interface. Teams should review their dashboard access setup before upgrading.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Argo Rolloutsv1.8.5patchbreaking**Argo Rollouts v1.8.5 ships two fixes. The Rollouts dashboard now binds only to the local interface by default, which is marked as a breaking change. A yarn.lock file was also updated with correct dependencies.platform teamsTeams that reach the Rollouts dashboard over the network by default will need to expose it explicitly or port-forward to it after upgrading. The yarn.lock fix is a build-level correction with no stated effect on runtime behavior.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Kargov1.12.4patchKargo released v1.12.4 on 2026-10-12. The release notes list five changes, one of which is a security item bumping the step-security/harden-runner GitHub Action from 2.21.1 to 2.22.0. The other four are maintenance changes such as dependency bumps, CI, tests and docs.platform teamsThe only security-related change is a CI action dependency bump, not a fix in Kargo's own code, so teams running Kargo see no concrete behavior change from the notes provided. Teams may still want to confirm the full changelog before upgrading.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Kargov1.11.8patchKargo v1.11.8 was released with 7 changes, including one security item bumping the step-security/harden-runner GitHub Action from 2.21.1 to 2.22.1. The other six changes are maintenance items such as dependency bumps, CI, tests and docs, which the source condenses and omits.platform teamsPlatform teams running Kargo in their delivery pipelines get a patch release with a CI hardening action bump; the source does not describe any change to runtime behavior, configuration, or APIs. The security change is to a build-pipeline action, not a vulnerability fix in Kargo's own code.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

2026-10-1021 days ago

Karpenterv1.15.0minor++++++++++********Karpenter v1.15.0 adds node repair as a voluntary disruption method, including reboot as a node action, terminate-first repair for capacity-constrained NodePools, and a --legacy-node-repair flag to run the previous controller. It also adds metrics such as karpenter_pods_disrupted_total and labels on disruption metrics, plus AWS feature gates and CEL expressions for kubelet settings. The release notes list 41 additions and 35 fixes, with 189 maintenance lines omitted.platform teamsPlatform teams running Karpenter on EKS should review repair and disruption behavior, since node repair now runs as a voluntary disruption and default repair policies changed, and the --legacy-node-repair flag offers a fallback. The new disruption and reboot metrics give more detail for monitoring node churn.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

2026-10-0922 days ago

Argo Workflowsv4.1.5patchsecurity**************!!Argo Workflows v4.1.5 was published with two changes, one added and one other, and one of them is marked as breaking. The release notes in the source are condensed and do not name the specific changes, pointing readers to the upgrading guide and the project's changelog.platform teamsPlatform teams running Argo Workflows should read the upgrading guide before rolling out v4.1.5, since a breaking change is flagged. The source text does not say what the breaking change is.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Argo Workflowsv4.0.13patchsecurity*******!Argo Workflows v4.0.13 was released with two changes, one marked as breaking and one added feature. The release notes in the source do not describe the specific changes and point to the upgrading guide and GitHub issues for details.platform teamsPlatform teams running Argo Workflows should read the upgrading guide for the breaking change before upgrading. The source text does not name the affected behavior.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

2026-10-0724 days ago

Cluster APIv1.14.3patchsecurity~~~~~~~~~~~~*****!Cluster API released v1.14.3. The release bumps grpc to 1.83.2 to address security advisories, along with several OpenTelemetry, golang.org/x/net and genproto dependencies. Fixes include setting the cluster-name label on Clusters without ClusterClass, a race in the KCP proxy DialContext, and handling of etcd member matching and not-found owner references.platform teamsPlatform teams running Cluster API should pick up the grpc dependency fix and the KCP and cluster labeling fixes. The release notes list no breaking changes, and the source does not describe any new capability.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Cluster APIv1.13.7patchsecurity~~~~~~~~~~~~~****!Cluster API v1.13.7 was released with 28 changes: one security item bumping grpc to 1.83.2 for security advisories, 14 dependency changes (including OpenTelemetry v1.45.0 and golang.org/x/net v0.58.0), and four fixes. The fixes cover cluster-name labels on Clusters without ClusterClass, KCP learner deletion after Node registration, a race in the KCP proxy DialContext, and a flaky test.platform teamsThe security fix is a dependency bump, not a vulnerability in Cluster API's own code, so platform teams should upgrade for the advisory fix and the KCP race fix. The release notes list supported management cluster versions as v1.32.x to v1.36.x and workload cluster versions as v1.30.x to v1.36.x.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Pulumiv3.268.0minor+++++*************Pulumi v3.268.0 adds an engine capability to negotiate OutputValues on Invoke, gated by a new accepts_outputs_in_invoke handshake capability. It adds version, whoami and install to the generated automation APIs for NodeJS, Python and Go, and sends the W3C traceparent header on Pulumi Cloud API calls when --otel-traces is set. The release also lists 14 fixes, including dynamic provider Read fallback, plugin checksum verification and parallel plugin shutdown.platform teamsTeams using the Pulumi Automation API get version, whoami and install methods in NodeJS, Python and Go, and dynamic provider authors need to check Read handling since the engine no longer duplicates inputs into state. Teams tracing Pulumi calls get trace propagation to Pulumi Cloud when --otel-traces is set.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Salesforce CLI2.153.5minor+~*Salesforce CLI 2.153.5 adds new sf apex trace commands for managing Apex debug log trace flags in an org. The release stops suggesting the SF_TEMP_SHOW_SECRETS environment variable for viewing redacted secrets and announces its removal on October 28, 2026. Commands such as org display user and org list users now point to the sf org auth show-* commands, and a Linux browser race condition in sf org login web is fixed.platform teamsTeams using SF_TEMP_SHOW_SECRETS in scripts should move to sf org auth show-* before October 28, 2026, when the workaround is removed. The new apex trace commands let pipelines manage trace flags from the CLI.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

2026-10-0625 days ago

Argo CDv3.5.4patchbreakingsecurity+~~******!!!!!!!!Argo CD v3.5.4 ships 19 changes, 11 of them security fixes, including several critical issues in the repo-server: Kustomize remote refs and Helm config home can run commands, and Jsonnet imports can read files. It also fixes an AppProject restriction bypass via PreDelete/PostDelete hooks and a high-severity command injection through repository proxy URLs on SSH Git repositories. Two changes are marked breaking: Kustomize builds rendering Helm charts no longer honor helmGlobals.configHome, and OCI manifests larger than 4 MiB are now rejected.platform teamsPlatform teams running Argo CD 3.5 should upgrade to pick up the repo-server and AppProject fixes. Teams using Kustomize with Helm plugins from a custom config home, or with OCI manifests above 4 MiB, need to check their builds before upgrading because those will fail.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Argo CDv3.4.10patchbreakingsecurity+~~****!!!!!!!!Argo CD v3.4.10 ships fixes for 11 security issues, including several rated critical: command execution via Kustomize remote refs and Helm config home in the repo-server, a Jsonnet import that reads repo-server files, and an AppProject restriction bypass through PreDelete/PostDelete hooks. It also includes two breaking changes: Kustomize no longer honors helmGlobals.configHome for Helm plugins registered from that directory, and OCI manifests larger than 4 MiB are rejected. The release also adds username logging on login attempts and four bug fixes.platform teamsPlatform teams running Argo CD 3.4 should upgrade to pick up the critical repo-server and AppProject fixes. Teams using Kustomize with Helm plugins from configHome or OCI manifests above 4 MiB need to check their builds before upgrading because those will now fail.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Argo CDv3.3.15patchbreakingsecurity~~*********!!!!!!!Argo CD v3.3.15 ships fixes for 12 security issues and 11 other fixes, with 2 changes marked breaking. Breaking changes: Kustomize builds that render Helm charts no longer honor helmGlobals.configHome, so builds relying on a Helm plugin registered from that directory will fail, and OCI manifests larger than 4 MiB are now rejected. Critical advisories cover command execution via Kustomize remote refs and Helm config home, Jsonnet file reads from the repo-server, and AppProject restriction bypass via PreDelete/PostDelete hooks.platform teamsPlatform teams running Argo CD 3.3 should plan to upgrade, and check any Kustomize-with-Helm pipelines that use a plugin from configHome or OCI manifests over 4 MiB before rolling out. Repo-server exposure from the listed critical issues makes the update a priority.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Jenkins2.585minor+++++****Jenkins 2.585 was released with 11 changes. Five are additions, including a new Manage Jenkins UI enabled by default and filtering on the experimental Job page. Four are fixes, including a sortable date column ordering fix and a missing New Item button in the new dashboard view. The minimum required Remoting version is raised to 3256.3258.v858f3c9a_f69d.platform teamsTeams running Jenkins controllers will see the new Manage Jenkins UI by default and must confirm agents meet the raised minimum Remoting version. The release notes describe no breaking changes beyond that requirement.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

2026-10-011 month ago

OpenTofuv1.12.7patchsecurity!!OpenTofu v1.12.7 fixes a deadlock that could occur when remote-exec or file provisioners connect to an attacker-controlled SSH server, where the server could hang the connection by sending unexpected packet types. The release also addresses two upstream Go security advisories, CVE-2026-78662 and CVE-2026-56855.platform teamsPlatform teams running OpenTofu with provisioners that connect to external hosts should upgrade to pick up the connection-handling fix. The Go advisory fixes are toolchain dependency updates and do not change how platform workflows are run.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Pulumiv3.267.0minor**Pulumi v3.267.0 fixes a bug where concurrent pulumi new runs failed to clone the templates repository. It also fixes pulumi install for Python plugins and policy packs that use the uv toolchain and a [build-system] table.platform teamsTeams running parallel pulumi new commands in automation no longer hit clone failures from this bug. Teams that ship Python plugins or policy packs built with uv can install them with pulumi install again.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Tektonv1.17.0minor+++******Pipeline release v1.17.0 "Egyptian Mau Robocop"Tekton Pipelines v1.17.0 was released with 60 changes in total. The release notes list 3 added items, including a new reconcile.write_intent span attribute, pod event surfacing, and a TaskRun ReconcileKind span tag on cancel or timeout. It also lists 6 fixes, covering Windows script placement, error messages on task resolution failure, variable-reference handling, and resolver request enqueueing.platform teamsPlatform teams running Tekton get better tracing on TaskRun cancellation and timeouts, plus clearer error messages when task resolution fails. No breaking change is listed in the condensed notes.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Actions Runner Controller0.15.0minor++++~----*********gha-runner-scale-set-0.15.0Actions Runner Controller released gha-runner-scale-set 0.15.0 with 79 changes, including removal of legacy e2e tests and several unused APIs and printer columns. New flags add default and per-controller max-concurrent-reconciles settings, and terminationGracePeriodSeconds is now configurable. The release also includes many fixes to listener pod patching, RBAC permissions, and scale-set drift detection.platform teamsPlatform teams running self-hosted GitHub Actions runners on Kubernetes should review the removed status-field printer columns and the new reconcile concurrency and termination grace period settings before upgrading. Runner status is now reported through metrics rather than status fields, so dashboards or scripts that read those fields will need updating.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

2026-09-301 month ago

Kargov1.12.0minorbreaking++++++++++~~~~****Kargo v1.12.0 removes the Connect-based gRPC API, the createTargetBranch option on git-open-pr, and the author block on git-commit. It changes the git-push default integration policy to RebaseOrMerge and removes the legacy Secret namespace chart values, so upgrades that still set them will fail. The release also adds a tar step, an oci-push srcPath option, cross-account ECR pulls, and per-request actor attribution in API logs.platform teamsPlatform teams upgrading Kargo must check integrations for the removed gRPC API, remove deprecated step fields from promotion tasks, and confirm required Secrets exist in the system and shared resources namespaces before upgrading. Teams relying on rebase-only pushes should set pushIntegrationPolicy to AlwaysRebase in Helm values to keep the old behavior.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Salesforce CLI2.152.14minorsecurity+~***!Salesforce CLI 2.152.14 adds --debug-level and --category-level flags to the apex run command for controlling anonymous Apex debug logs, and the two flags are mutually exclusive. It removes a Hyperforce/JWT gate that blocked sf org create user on Hyperforce orgs when the Dev Hub used JWT authentication. The release also fixes sf org open exiting before the browser launched, a broken sf-trust bin path in @salesforce/plugin-trust, and adds support for the ReferralIntakeConfiguration metadata type in DX projects. A security fix bumps the npm version pinned in npm-shrinkwrap.json to pull in a patched tar.platform teamsTeams running anonymous Apex from the CLI can set debug log levels per predefined level or per category. Teams that run user creation on Hyperforce orgs with JWT Dev Hubs can now use that command, and the npm install failure from the broken bin path is resolved.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Pulumiv3.266.0minor++****

Jenkins2.580.1patch~Jenkins 2.580.1 was released on 2026-09-30. The release notes point to the changelog and upgrade guide for breaking changes and other update considerations, but the condensed source does not list specific changes.platform teamsPlatform teams running Jenkins should read the changelog and upgrade guide before updating. The source text does not name any concrete change.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

OpenTofuv1.13.0minorOpenTofu v1.13.0 was released. The release notes list six changes: base64gzip output is equivalent but no longer byte-for-byte identical to earlier versions because of a required Go upgrade, WinRM support for provisioners was removed, macOS 13 Ventura or later is now required, and v1.13 is the last series with official 32-bit CPU releases.platform teamsTeams using base64gzip should check whether any byte-level comparisons or stored outputs will change, and Windows teams relying on WinRM provisioners need an alternative before upgrading. Mac build hosts older than macOS 13 will need upgrading, and 32-bit targets will need a plan after v1.13.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

2026-09-291 month ago

Jenkins2.584minor+~****Jenkins 2.584 raises the minimum required Remoting version to 3256.3258.v858f3c9a_f69d. It also includes fixes to PackedMap equality and hash codes, workspaceDir and buildsDir persistence, a breadcrumbs-overflow TypeError when the logo item is missing, the wording of the -jnlpUrl deprecation warning, and ZIP creation for unreadable files.platform teamsTeams running Jenkins controllers and inbound agents need to check that their agents meet the new minimum Remoting version before upgrading. The other changes are bug fixes with no new capability to plan around.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Terraform Provider for SAP BTP1.27.0minor+****SAP released version 1.27.0 of the Terraform Provider for SAP BTP. The release notes list one added action, action_update_global_account, and four fixes covering function label extraction for legacy labels, failing early when an amount is set on non-quota entitlement plans, drift resolution for role collection assignments with custom IAS origins, and an auto_create_shadow_users option in the globalaccount trust configuration.platform teamsPlatform teams managing SAP BTP through Terraform get a new action for updating global accounts and fixes that reduce configuration drift for role collections and trust settings. Teams using entitlement plans should note that amount on non-quota plans now fails at plan time instead of being silently accepted.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

older entries

daily email

statuslast 30 days for lines

tools tracked43releases in registry964released in the last 30 days106entries published335breaking change lines18security lines84

change typestwo-column gutter, like git status

+addedNew functionality.
~changedExisting behavior changed.
-deprecatedStill works, scheduled for removal.
-removedDecommissioned, gone in this version.
*fixedA defect corrected.
!securityA vulnerability closed or a dependency patched for one.
!breakingFlag in the first column; the change needs action before upgrading.

filter

categoryall idp & portals ai agents on platform ci/cd observability supply chain cost & governance reports & dx data enterprise app platforms

showmajor only releases case studies postmortems include patches

Platform Changelog: what shipped in platform engineering, developer experience and DevOps