Platform Changelog

feedbefore 2026-10-20all releases, patches included

2026-10-1912 days ago

Open Policy Agent1.21.3patch~~OPA v1.21.3 makes a signing block with no entries under its top-level keys a startup configuration error. Bundle.NewVerificationConfig now requires signatures by default, and embedders can opt out. The release notes say the change covers bundle and discovery configurations that previously did not verify signatures, including those with an empty signing block or no keyid.platform teamsPlatform teams with bundle or discovery signing blocks that lack a keyid, or with empty signing blocks, will need to add a keyid or fix the configuration before OPA starts. Teams whose configs have no signing block, or that run with --skip-verify, are not affected by the new default.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Karpenterv1.14.2patch*

2026-10-1615 days ago

Pulumiv3.270.0minor**Pulumi v3.270.0 fixes a bug where pulumi env edit, env set, env rm and env provider could overwrite changes made after they read the environment. On a conflict, env edit now reopens the editor with the user's edits and the current definition, and the other commands fail. It also fixes pulumi stack drift status, which now reports an unknown drift status when drift detection has never run.platform teamsTeams using Pulumi ESC environments from the CLI no longer risk silent overwrites of concurrent edits, and conflicts now fail instead of clobbering changes. Scripts that read drift status should handle the unknown state for stacks where drift detection has not run.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

2026-10-1516 days ago

OpenFeaturev0.18.0minorbreaking+++++~~~flagd: v0.18.0

Helmv3.22.1patchsecurity~~~!Helm v3.22.1 was released with a security item that bumps dependencies to remove Go package vulnerabilities. Other changes update the k8s.io Go packages to v0.37.1 and the OpenTelemetry OTLP trace exporters to v1.45.0. The notes also state that the next patch releases for Helm 4.3.2 and 3.22.2 are scheduled for November 11, 2026, and that Helm 4.4.0 is scheduled for January 13, 2027.platform teamsPlatform teams running Helm 3 get dependency-level CVE fixes in this release, but the source does not name the affected packages or the tool's own code. The notes say there will be no further Helm 3 minor releases after this line, so teams should plan migration to Helm 4.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

OpenFeaturev0.17.1patchsecurity!flagd: v0.17.1

GitLab19.5minorGitLab 19.5 was released on October 15, 2026. The GitLab MCP server and GitLab Secrets Manager are now generally available, and the MCP server gives external agents such as Claude Code and Cursor access to a wider set of GitLab tools. The release also adds beta support for connecting externally connected agents to AI Governance, plus non-default branch vulnerability tracking and several GitLab Duo CLI features.platform teamsPlatform teams can scope CI secrets per job by environment and branch and get audit logs for each secret operation, using existing GitLab permissions. Security teams can see sessions from agents running outside GitLab, with audit events sent to a SIEM, though this ECA capability is in beta.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Helmv4.3.1patch*****

2026-10-1417 days ago

OpenTofu1.12.8patchsecurity*!OpenTofu v1.12.8 fixes excessive CPU usage that could occur when tofu init installs dependencies from an attacker-controlled HTTP/2 server. It also fixes a crash in lifecycle destroy when the destroy expression contains references.platform teamsTeams running tofu init against untrusted or unverified module sources should upgrade to remove the CPU exhaustion risk. Pipelines that use lifecycle destroy with referenced expressions will no longer crash.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Pulumi3.269.0minor++++++++**********Pulumi v3.269.0 adds runtime functions to the Go, Node.js and Python SDKs that check whether a resource with a given ID exists without adopting it into the stack. It runs OPA policy packs through a pulumi-language-opa plugin that the CLI downloads on demand. The release also makes pulumi logs and pulumi watch error by default ahead of their removal, and includes 18 fixes across PCL, the CLI and the SDKs.platform teamsTeams running OPA policy packs will get the CLI-downloaded language plugin instead of the old analyzer fallback for runtimes without a language plugin. Scripts that call pulumi logs or pulumi watch will start failing by default and should be checked before the removal lands.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Salesforce CLI2.154.4minor+

2026-10-1318 days ago

ServiceNow SDK4.13.xminor++**SDK 4.13.x Patch NotesServiceNow released SDK 4.13.x patch changes. The release adds table support for db_object_id in bootstrap and for configuration_access, and adds a protectionPolicy option for sys_security_acl_role. It fixes an OAuth CSRF issue by restoring cookie replay and binding CSRF lookup to the exact session, and it also fixes a now-ux-globals Array.from polyfill requirement and a TypeScript error during UI type-checking.platform teamsPlatform teams that use the ServiceNow SDK should pick up the OAuth CSRF fix, which is a security fix in the SDK itself. Teams managing ACL rules can use the new protectionPolicy option on sys_security_acl_role, and telemetry events no longer have person profile processing applied.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Jenkins2.586minor+++++****Jenkins 2.586 was released with nine changes: five additions and four fixes. Added items include standardised shadows and focus rings for controls, removal of the Manage Jenkins breadcrumb menu, updated User settings pages, and a warning about unsafe authorization strategy. Fixes cover readOnlyMode propagation in dropdown fragments, locale handling in the search index, log recorder level updates, and dialog width limits.platform teamsPlatform teams running Jenkins controllers get UI changes and a warning when the authorization strategy is unsafe, which may prompt a review of their security configuration. The release notes list no breaking changes to pipelines or APIs.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

2026-10-1219 days ago

Argo Rolloutsv1.10.1patchbreaking**Argo Rollouts v1.10.1 ships two fixes cherry-picked to the 1.10 line. The Rollouts dashboard now binds only to the local interface by default, which is marked as a breaking change. The release also allows Bidirectional mountPropagation on privileged containers, fixing issue #3130.platform teamsTeams that reached the Rollouts dashboard over a non-local address will need to expose it explicitly or port-forward after upgrading. Teams running privileged workloads that need bidirectional mount propagation can now use that setting on this version.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Argo Rollouts1.9.2patchbreakingsecurity*!Argo Rollouts v1.9.2 changes the Rollouts dashboard to bind only to the local interface by default. The release notes mark this as a breaking change for users who expose the dashboard through a custom Helm chart or another method. The release also lists a security fix, but the notes do not describe its details.platform teamsTeams that reach the Rollouts dashboard through a custom Helm chart or ingress must now explicitly configure exposure, or the dashboard will be unreachable from outside the local interface. Teams should review their dashboard access setup before upgrading.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Argo Rolloutsv1.8.5patchbreaking**Argo Rollouts v1.8.5 ships two fixes. The Rollouts dashboard now binds only to the local interface by default, which is marked as a breaking change. A yarn.lock file was also updated with correct dependencies.platform teamsTeams that reach the Rollouts dashboard over the network by default will need to expose it explicitly or port-forward to it after upgrading. The yarn.lock fix is a build-level correction with no stated effect on runtime behavior.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Argo CDv3.5.5patch**********

Argo CDv3.4.11patch********

Argo CDv3.3.16patch****

Open Policy Agentv1.21.2patch

Kargov1.12.4patchKargo released v1.12.4 on 2026-10-12. The release notes list five changes, one of which is a security item bumping the step-security/harden-runner GitHub Action from 2.21.1 to 2.22.0. The other four are maintenance changes such as dependency bumps, CI, tests and docs.platform teamsThe only security-related change is a CI action dependency bump, not a fix in Kargo's own code, so teams running Kargo see no concrete behavior change from the notes provided. Teams may still want to confirm the full changelog before upgrading.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Kargov1.11.8patchKargo v1.11.8 was released with 7 changes, including one security item bumping the step-security/harden-runner GitHub Action from 2.21.1 to 2.22.1. The other six changes are maintenance items such as dependency bumps, CI, tests and docs, which the source condenses and omits.platform teamsPlatform teams running Kargo in their delivery pipelines get a patch release with a CI hardening action bump; the source does not describe any change to runtime behavior, configuration, or APIs. The security change is to a build-pipeline action, not a vulnerability fix in Kargo's own code.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Kargov1.10.15patch

Kargov1.9.15patch

Kargov1.8.19patch

2026-10-1021 days ago

Karpenterv1.15.0minor++++++++++********Karpenter v1.15.0 adds node repair as a voluntary disruption method, including reboot as a node action, terminate-first repair for capacity-constrained NodePools, and a --legacy-node-repair flag to run the previous controller. It also adds metrics such as karpenter_pods_disrupted_total and labels on disruption metrics, plus AWS feature gates and CEL expressions for kubelet settings. The release notes list 41 additions and 35 fixes, with 189 maintenance lines omitted.platform teamsPlatform teams running Karpenter on EKS should review repair and disruption behavior, since node repair now runs as a voluntary disruption and default repair policies changed, and the --legacy-node-repair flag offers a fallback. The new disruption and reboot metrics give more detail for monitoring node churn.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

2026-10-0922 days ago

Argo Workflowsv4.1.5patchsecurity**************!!Argo Workflows v4.1.5 was published with two changes, one added and one other, and one of them is marked as breaking. The release notes in the source are condensed and do not name the specific changes, pointing readers to the upgrading guide and the project's changelog.platform teamsPlatform teams running Argo Workflows should read the upgrading guide before rolling out v4.1.5, since a breaking change is flagged. The source text does not say what the breaking change is.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Argo Workflowsv4.0.13patchsecurity*******!Argo Workflows v4.0.13 was released with two changes, one marked as breaking and one added feature. The release notes in the source do not describe the specific changes and point to the upgrading guide and GitHub issues for details.platform teamsPlatform teams running Argo Workflows should read the upgrading guide for the breaking change before upgrading. The source text does not name the affected behavior.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Power Platform Build Tools2.0.158patch

K8sGPTv0.4.40patch+*****************

2026-10-0823 days ago

Power Platform Build Tools2.0.156patch

daily email

statuslast 30 days for lines

tools tracked43releases in registry964released in the last 30 days106entries published336breaking change lines18security lines84

change typestwo-column gutter, like git status

+addedNew functionality.
~changedExisting behavior changed.
-deprecatedStill works, scheduled for removal.
-removedDecommissioned, gone in this version.
*fixedA defect corrected.
!securityA vulnerability closed or a dependency patched for one.
!breakingFlag in the first column; the change needs action before upgrading.

filter

categoryall idp & portals ai agents on platform ci/cd observability supply chain cost & governance reports & dx data enterprise app platforms

showmajor only releases case studies postmortems include patches

Platform Changelog: what shipped in platform engineering, developer experience and DevOps