platformchangelog.dev
43 tools

Platform Changelog: what shipped in platform engineering, developer experience and DevOps

feedbefore 2026-10-23all releases, patches included
newest entries
ServiceNow SDK4.14.0minorsecurity~~***************!SDK 4.14.0ServiceNow SDK 4.14.0 changes how credentials are stored: they are now encrypted with AES-256-GCM in a local file under ~/.now-sdk/credentials.enc, with only a 32-byte key kept in the OS keychain. A new SN_SDK_CREDENTIALS_DIR variable sets the credentials directory. The release also lists one security fix that preserves Sys_dictionary security roles through transform and build, along with about 19 fixes to transform and build behavior.platform teamsTeams that run the SDK in CI or on shared machines should check where credentials.enc is written and whether SN_SDK_CREDENTIALS_DIR is needed for their runners. Pipelines that rely on the previous credential storage location may need updating.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Crossplanev2.4.3patchsecurity++++*!!!!!Crossplane v2.4.3 updates the Go toolchain to 1.26.10, which rejects certificates from compromised eMudhra intermediate CAs (CVE-2026-111943), and removes the AAA Certificate Services and emSign ECC Root CA - G3 roots from the image CA bundle. The release also bundles dependency security updates and fixes a bug where a failed, partial package download could be cached as a valid package. Users with crossplane-edit or crossplane-admin access can now kubectl scale XRs and claims whose XRD serves the scale subresource.platform teamsPlatform teams running Crossplane should upgrade to pick up the Go toolchain and dependency CVE fixes and the discarded-truncated-download fix, which could otherwise leave providers in a crash loop. Teams relying on the scale subresource need to note that edit and admin roles can now scale XRs and claims.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Crossplane2.3.7patchsecurity+++++**!!!!!!Crossplane v2.3.7 bumps the Go toolchain to 1.26.10 so that crypto/x509 rejects the compromised eMudhra intermediate certificates (CVE-2026-111943), and removes the AAA Certificate Services and emSign ECC Root CA - G3 roots from the image's CA bundle. The release also updates vulnerable dependencies, including otlptrace v1.45.0. Fixes include discarding truncated package downloads, failing claims closed when their XRD cannot be listed, and stopping repeated in-use label writes on Usage reconciles.platform teamsPlatform teams running Crossplane should upgrade to pick up the trust store change and the fix for truncated package downloads, which could leave a provider crash-looping. Claims that cannot list their XRD now report ReconcileError instead of honoring a compositionRef.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Crossplanev2.2.7patchsecurity++*!!!!!!Crossplane v2.2.7 ships a Go toolchain bump to 1.26.10, which makes crypto/x509 reject certificates from compromised eMudhra intermediate CAs (CVE-2026-111943), and removes the AAA Certificate Services and emSign ECC Root CA - G3 roots from the image's CA bundle. It also updates golang.org/x/net to v0.60.0, the OpenTelemetry OTLP trace exporter to v1.45.0, and crossplane-runtime to v2.2.5 to pick up upstream CVE fixes. Two fixes stop truncated package downloads from being cached and stop the in-use label from being rewritten on every Usage reconcile.platform teamsPlatform teams running Crossplane should upgrade to pick up the dependency CVE fixes and the fix that prevents truncated provider packages from being cached and crash-looping providers. The Usage change reduces needless API writes on every reconcile.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Crossplanev1.20.14patchsecurity!!!!!!!Crossplane v1.20.14 ships on the release-1.20 branch. The release updates the Go toolchain to 1.26.10 so crypto/x509 rejects certificates from the compromised eMudhra intermediate CAs, and removes the AAA Certificate Services and emSign ECC Root CA - G3 roots from the image CA bundle by moving to a newer distroless/static base image. It also bumps golang.org/x/net to v0.60.0, OpenTelemetry OTLP trace HTTP exporter to v1.45.0, and crossplane-runtime to v1.20.12 to pick up upstream CVE fixes.platform teamsPlatform teams running Crossplane 1.20 should upgrade to pick up the CA trust removal and dependency CVE fixes. The release notes do not describe a vulnerability in Crossplane's own code, so the security content is toolchain and dependency updates.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
PHP2Shell: GitLab helps find and remediate critical PHP flawspostPHP fixed two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), on October 21, 2026, in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The flaws are in the PHP engine, so framework or application changes do not mitigate them, and any web server running PHP is affected. GitLab says its own products are not affected and describes how to use container scanning and code search to find PHP runtimes in projects.platform teamsPlatform teams need to upgrade PHP runtimes in hosts and container images, rebuild images with docker build --pull, and check for PHP installed from source, which container scanning cannot detect. Runtime inventory is needed alongside repository scans to find PHP workloads outside GitLab projects.GitLab Blog ↗GitLabwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Pulumiv3.272.0minor+++++**Pulumi v3.272.0 collapses policy violations that an exception exempts into one line per policy, and adds a --show-policy-exceptions flag to up and preview to list them with their exceptions. It adds an AwaitError provider protocol error that lets a deployment continue with unknown outputs and exits the CLI with code 10. It also adds pulumi env change-request commands and an --organization/-o option for env setup commands. Two fixes cover a clearer error message for missing project files and keeping unknown outputs from remote components instead of resolving them as empty values.platform teamsPlatform teams using Pulumi policy packs get less noisy output for exempted violations, and CI jobs that check exit codes gain an ExitAwaitError code (10) to handle when a resource needs awaiting. Teams using Pulumi Cloud environments can manage change requests from the CLI.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Meta API endpoints updated for Actions blob storageannouncementGitHub added new blob storage endpoints for GitHub Actions on github.com to its meta API, as part of work to improve capacity and reliability. Organizations that restrict outbound traffic with a network allowlist are asked to permit two new host ranges: productionresultssa30 through productionresultssa49, and productionresultssa100 through productionresultssa199, under blob.core.windows.net. Wildcard allowlists for productionresultssa*.blob.core.windows.net need no change.platform teamsPlatform teams whose runners sit behind individual-host egress allowlists must add the new hosts or risk interruptions to job summaries and logs. The current endpoint list can be retrieved from the REST meta API.GitHub Changelog ↗GitHub Actionswritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
AWS CloudFormation now simplifies stack update rollback operationsannouncementAWS CloudFormation added a force rollback option to continue a stalled update rollback in a single operation. The option works across the AWS CLI, SDKs, AWS CDK and AI agents. Resources that still need attention, such as those changed outside CloudFormation, are recorded for review before the next deployment.platform teamsPlatform teams running CloudFormation can recover failed stack updates without listing and retrying each affected resource one by one. They should review drift-aware change sets and recorded resources before the next deployment, since force rollback does not resolve out-of-band changes.What's New with AWS ↗Amazon EKSwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Microsoft named a Leader in two evaluations of next-generation app development platformsannouncementMicrosoft says it was named a Leader in the 2026 Gartner Magic Quadrant for AI-Augmented Low-Code Application Platforms and in The Forrester Wave: AppGen and Low-Code Platforms, Q4 2026. The post also describes new Copilot Studio capabilities announced in October 2026, including agent accounts, business process memory, triggers, and Apps in Copilot Studio in public preview.platform teamsFor platform teams governing Power Platform, the post describes MCP-based exposure of app functions to agents, connector and MCP server policies in managed environments, and agent identity via Entra Agent ID, but gives no detail on how these are configured or enforced. The analyst claims and usage figures are vendor-supplied and not verifiable from the text.Microsoft Power Platform Blog ↗Microsoft Power PlatformSalesforce Platformwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
AgentCore Gateway now supports Bedrock InvokeModel APIs and model fallbackannouncementAmazon Bedrock AgentCore Gateway now accepts the Bedrock InvokeModel and InvokeModelWithResponseStream APIs on its inference endpoint. Existing Bedrock SDK clients can point at the gateway to reach any model provider through one endpoint. The gateway also adds model fallback routing, which sends a request to an ordered chain of alternative destinations when the primary is throttled, erroring, or timing out, and a circuit breaker skips destinations that are currently failing.platform teamsPlatform teams can centralize model access for agents behind one governed endpoint and move retry and failover logic out of each client. The source says the circuit breaker reduces latency for failed attempts, which is a vendor claim not measured in the text.What's New with AWS ↗written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
2026-10-2110 days ago
InfoQ: Cilium 1.20 Expands Gateway API and Opens eBPF Datapath for KubernetespostCilium 1.20 has been released with support for Kubernetes Gateway API 1.6, adding ExternalAuth, ListenerSets, CORS filtering, TCPRoute and UDPRoute. The release also adds a beta eBPF datapath plugin mechanism that runs as a separate process, a bpf.datapathMode=auto setting that selects netkit or veth per node, and further work on the ztunnel sidecarless mutual TLS proxy. The ztunnel release notes say the older Mutual Authentication feature is deprecated.platform teamsPlatform teams can let application teams add listeners through ListenerSets while keeping control of the shared Gateway, and can use ExternalAuth for HTTP authorisation at the gateway. Mixed-kernel fleets can use automatic netkit selection without splitting node pools, but operators should check the release notes for action needed on legacy Mutual Authentication, Kafka-aware policies, Envoy Go extensions and custom CNI configuration.InfoQ ↗written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
K8sGPTv0.4.41patchsecurity+++**********!!!K8sGPT v0.4.41 was released with three dependency security updates, including containerd v1.7.36, spdystream v0.5.1 and otel sdk v1.45.0. It adds Claude 4.5 and 5.x model support for Amazon Bedrock, the ability to source customHeaders from the config file, and a prompt to auto-pull missing Ollama models. The release also fixes ten analyzer and completion issues, covering StatefulSet claim templates, NetworkPolicy selectors, Gateway API namespace filters, HTTPRoute namespace selectors, node-problem-detector conditions, and Kyverno ClusterPolicyReports.platform teamsPlatform teams running K8sGPT get fewer false or missed findings for NetworkPolicy, Gateway API and Kyverno reports after upgrading. The security items are dependency bumps rather than fixes in K8sGPT's own code.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Pulumiv3.271.0minor++++++*********Pulumi v3.271.0 adds an id field to ReadResourceResponse so providers can return a resolved id that differs from the requested one, and adds state and env commands to the generated automation APIs for NodeJS, Python and Go. It also introduces version 2 of the --policy-pack-config format, which nests policy configs under policies and adds an exceptions field. Fixes include redacting secret values in invalid input diagnostics unless --show-secrets is passed, and resolving failed outputs as unknown under --continue-on-error.platform teamsTeams using policy packs need to migrate to the version 2 policy-pack-config format to use the new exceptions field. Teams relying on automation APIs gain state and env commands, and secret values in diagnostics are now redacted by default.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Observability patterns for AI agents on Amazon EKSpostAWS Containers Blog describes two observability patterns for AI agents on Amazon EKS: a decentralized pattern where each agent exports traces straight to Langfuse, and a centralized pattern where traces pass through a shared OpenTelemetry Collector first. Both use the Strands Agents SDK for instrumentation, Bifrost as an LLM gateway routing to Amazon Bedrock, and OpenTelemetry GenAI conventions, with trace context propagated via traceparent headers. The post is cut off before its full results were shown in the source text.platform teamsPlatform teams choosing between the two patterns trade per-agent configuration sprawl against a shared Collector that must be sized and monitored as critical infrastructure. Adding a new telemetry backend is a Collector config change in the centralized pattern, and a change to every agent in the decentralized one.AWS Containers Blog ↗Amazon EKSArgo CDOpenTofuwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Amazon S3 server access log delivery to Amazon CloudWatch Logs now available in five additional AWS RegionsannouncementAmazon S3 server access log delivery to Amazon CloudWatch Logs is now available in the AWS GovCloud (US) Regions, the AWS European Sovereign Cloud, and the AWS China Regions. The source states the feature is now available in all AWS Regions. Delivery to CloudWatch Logs complements the existing delivery of server access logs to S3 general purpose buckets.platform teamsPlatform teams can query S3 access logs as they arrive in CloudWatch Logs, set alarms on error rates and traffic patterns, and encrypt the logs with AWS KMS keys. Amazon CloudWatch Logs vended log charges apply.What's New with AWS ↗written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
CNCF: Before you evaluate an AI SRE, give your existing agent contextreportThe authors ran 50 Kubernetes faults from the SREGym benchmark on a live Amazon EKS cluster, comparing Claude Code with a shell and kubectl against Claude Code with read-only MCP tools from Radar, an open-source Kubernetes UI and MCP server the authors maintain. Both arms reached similar accuracy (46 vs 45 correct), but the context arm reached a correct diagnosis within two minutes on 86% of faults versus 60% with a shell, and used fewer tool calls on average (9.8 vs 16.3). The authors note that the context arm had different permissions from the shell arm, that each arm ran each fault once, and that they maintain the tool being tested.platform teamsPlatform teams evaluating AI SRE products can first measure whether their existing coding agent with read-only cluster context (current failures, change history, joined resources, filtered logs) diagnoses faults faster, using the published method and a read-only service account. Change history kept beyond Kubernetes event expiry and a read-only identity without Secrets or exec access are the concrete requirements the authors recommend checking.CNCF Blog ↗Kubernetes MCP ServerAmazon EKSK8sGPTwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
InfoQ: Presentation: AI is an Amplifier: Scale High Performance, Not DysfunctionreportDORA's Nathen Harvey presents findings from the 2025 DORA survey, which had nearly 5,000 respondents and ran June 13 to July 21, 2025. He reports that about 90% of respondents use AI at work and that the survey frames AI as an amplifier of existing organizational systems. The source text is cut off before the detailed relationship findings.platform teamsPlatform teams evaluating AI-assisted development should note that the talk argues gains in code generation do not reach production without work on the wider delivery system, such as review and release steps. The source gives no concrete tooling change.InfoQ ↗DORA State of DevOps / AI-assisted development reportwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
CNCF: Distributed tracing for CI pipelines without touching a single workflow filepostThe post describes using the OpenTelemetry Collector's githubreceiver, behind a single org-level GitHub webhook, to turn workflow_run and workflow_job events into OTLP traces. A workflow becomes a parent span, with jobs and steps as nested child spans, so no workflow files need changing. The receiver is a contrib component at alpha stability, and the author advises pinning the collector version.platform teamsA platform team can get org-wide CI traces by pointing one org webhook at a collector, and new repos are covered automatically. The team must provide a publicly reachable endpoint, restrict it to GitHub's webhook ranges, have org admin access, and pin an alpha-stage collector version.CNCF Blog ↗GitHub ActionsActions Runner Controllerwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
2026-10-2011 days ago
Backstagev1.56.0minorsecurity++++++++++++++++++!Backstage v1.56.0 ships 53 changes, including a new AppLifecycleApi for checking app finalization and subscribing to lifecycle changes, and a fix so useRouteRef resolves routes after finalization. Other changes cover catalog fixes, a Cloud SQL retry for transient connection failures, an AWS RDS IAM token expiry fix, a Bitbucket Cloud bearer token option, and a Gitea default-branch fix. The release also moves @backstage/catalog-model to zod version 4, which requires adding zod to packages that use it without declaring it.platform teamsTeams running Backstage should check custom packages that import zod without declaring it, since catalog-model now uses zod 4. Plugin authors gain AppLifecycleApi to gate rendering on app finalization.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Announcing Amazon ECS Gateway, a managed ingress solution for your ECS servicesannouncementAWS announced Amazon ECS Gateway, a resource that dynamically provisions and manages Application Load Balancers and supporting resources in the customer's account for ECS services. Platform teams define networking standards on a gateway and associate it with clusters, while application teams opt in by adding a gateway connector parameter. The source says it is available in all commercial AWS Regions for awsvpc network mode services at no additional charge, with customers paying only for underlying infrastructure.platform teamsPlatform teams running ECS can centralize ingress standards per cluster instead of managing ALBs per service, with up to 25 services sharing an ALB and per-service DNS hostnames. Teams should note that ECS creates and removes ALBs automatically, which affects cost and resource inspection planning.What's New with AWS ↗Amazon EKSwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Limit agent permissions and spend in AWS Transform custompostThe AWS DevOps Blog describes three configuration controls for running the AWS Transform custom agent on fleets of repositories: a trust settings file that auto-approves some tool calls and shell commands, an IAM execution identity scoped to approved transformations, and an agent-minute cap plus an AWS Budgets alert on spend. The post walks through a sample Java 8 to Java 17 upgrade run using AWS Transform CLI 3.10.0, reporting 43 tool calls and that the trust allowlist reduced approval prompts from 23 to zero on a clean clone.platform teamsPlatform teams running agent-driven upgrades from pipelines can manage tool trust, identity scope and spend as configuration rather than new infrastructure. The post's own measurements are from one sample repository and one CLI version, so counts will differ on other estates.AWS DevOps Blog ↗AWS DevOps Agentwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Bulk migrate branch protections to rulesets for a repositorypostGitHub now lets repository admins convert all classic branch protection rules in a repository to rulesets in one action, extending the earlier single-rule conversion. The Review import dialog previews the rulesets to be created, flags rules already covered by an existing ruleset, and shows where one rule expands into multiple rulesets. After creation, the user chooses whether to keep or delete the original branch protection rules.platform teamsPlatform teams that manage branch protection on many repositories can migrate in bulk instead of one rule at a time, choosing enforcement status (Active, Evaluate, or Disabled) before committing. Teams should review the generated rulesets before deleting the originals, since one classic rule can map to several rulesets.GitHub Changelog ↗GitHub Actionswritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
InfoQ: GitHub Actions Runner Controller 0.15.0 Targets Reliability at ScalepostGitHub released Actions Runner Controller 0.15.0, which the source describes as adding reliability, scalability and observability improvements for organisations running self-hosted GitHub Actions runners on Kubernetes. The source text is a short excerpt and does not list specific changes.platform teamsPlatform teams running self-hosted GitHub Actions runners on Kubernetes may get better reliability and visibility at scale, but the excerpt gives no specifics on what changed, so the changelog should be checked before upgrading.InfoQ ↗GitHub ActionseditorCorrection 2026-10-20: this was listed as a GitHub Actions 0.15.0 release by mistake. It is InfoQ coverage, not release notes from the project.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Amazon CloudWatch Alarms now supports tags in alarm actions payloadpostAmazon CloudWatch now lets customers include alarm tags in the payloads it sends to Amazon SNS, AWS Lambda, and Amazon EventBridge when an alarm changes state. The setting is off by default, can be configured per alarm, and supports all tags, selected tag keys, or all tags except selected keys. It applies to metric, composite, and log alarms and is unavailable in the Middle East (UAE) and Middle East (Bahrain) Regions.platform teamsPlatform teams routing many alarms through a shared notification pipeline can read owner, environment, or service tags directly from the event, removing per-event ListTagsForResource calls. Teams should check whether their Regions are covered and decide which tag keys to expose in messages.What's New with AWS ↗Amazon EKSwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
AI Governance: One view of agent activityannouncementGitLab has released the AI Governance Dashboard in beta, which shows activity from GitLab Duo Agent Platform agents and externally connected agents such as Claude Code, Cursor, and Codex in one view for a top-level group. Each agent action is recorded as an audit event with the prompt, model, tools, MCP servers, and project, and sessions can be downloaded as immutable evidence or streamed to a SIEM. Setup requires enabling AI audit event storage, which is off by default, and running glab govern setup on developer machines.platform teamsPlatform and security teams on GitLab Premium or Ultimate can get audit trails of agent tool calls and MCP server use, but must turn on AI audit event storage and hold the Owner role or a custom role with read_agent_artifacts. External agent capture depends on glab 1.122.0 or later on macOS or Linux.GitLab Blog ↗GitLabwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Redesign how your team ships software with AI agentsannouncementGitLab announced the AI-Native Engineering Playbook, a guide to redesigning software delivery so people and AI agents each handle the work they suit best. The playbook proposes a four-stage autonomy ladder in which each step up must be backed by evidence, and a layered verification approach for code review at agent volume. GitLab's AI Accountability Report, based on an April 2026 survey of 1,528 DevSecOps professionals, is cited, with 79% saying individual productivity improved but overall delivery did not accelerate at the same pace.platform teamsPlatform teams can use the playbook's layered checks as a model: move formatting, type and dependency policy checks closer to authoring, keep change sets small, and record agentic review decisions so they can be inspected later. The post does not describe any new platform feature or tooling change.GitLab Blog ↗GitLabwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Salesforce teams succeeding with AI have strong DevOps fundamentalsreportGearset's blog summarizes The State of Salesforce DevOps 2026 survey, which reports that 84% of surveyed teams use AI to build Salesforce changes but only 40% are confident in the accuracy and security of AI-generated code. The post says teams with every DevOps lifecycle stage covered report higher confidence and fewer production bugs than teams with gaps. The article then promotes Gearset's agent and pipeline product as a way to combine trusted AI changes with a DevOps pipeline.platform teamsPlatform teams running Salesforce delivery can use the survey's stage-by-stage findings to prioritize version control, automated validation, backups and post-release observability before expanding AI-generated changes or Agentforce agents. The survey methodology and sample size are not given in the source text, and the report is vendor-commissioned.Gearset Blog ↗GearsetSalesforce PlatformAgentforceGitHub Actionswritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
daily email

One short email each morning: what shipped, what breaks, and a link to each change. Unsubscribe in one click. Privacy.

statuslast 30 days for lines
tools tracked43releases in registry964released in the last 30 days106entries published336breaking change lines18security lines84
change typestwo-column gutter, like git status
  • +addedNew functionality.
  • ~changedExisting behavior changed.
  • -deprecatedStill works, scheduled for removal.
  • -removedDecommissioned, gone in this version.
  • *fixedA defect corrected.
  • !securityA vulnerability closed or a dependency patched for one.
  • !breakingFlag in the first column; the change needs action before upgrading.
filter
categoryallidp & portalsai agents on platformci/cdobservabilitysupply chaincost & governancereports & dx dataenterprise app platforms
showmajor onlyreleasescase studiespostmortemsinclude patches