platformchangelog.dev
43 tools

Platform Changelog: what shipped in platform engineering, developer experience and DevOps

feedbefore 2026-10-26all releases, patches included
newest entries
2026-10-247 days ago
The New Stack: Building an agentic software factory? Start with the sensor.postThe article argues that agentic software factories are limited by their verification step, which it calls the sensor, rather than by coding agents. It defines three sensor properties (latency, fidelity, bandwidth) and suggests tracking time to signal, escape rate and concurrent verification capacity. The article is written by a team that sells a product for per-change realistic environments and presents that approach as the solution.platform teamsPlatform teams evaluating agent-driven pipelines can use the proposed metrics to find which verification property is weakest before raising agent autonomy. The article does not describe a specific tool change, and its recommended per-change environment approach comes from the vendor's own view.The New Stack ↗written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
PHP2Shell: GitLab helps find and remediate critical PHP flawspostPHP fixed two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), on October 21, 2026, in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The flaws are in the PHP engine, so framework or application changes do not mitigate them, and any web server running PHP is affected. GitLab says its own products are not affected and describes how to use container scanning and code search to find PHP runtimes in projects.platform teamsPlatform teams need to upgrade PHP runtimes in hosts and container images, rebuild images with docker build --pull, and check for PHP installed from source, which container scanning cannot detect. Runtime inventory is needed alongside repository scans to find PHP workloads outside GitLab projects.GitLab Blog ↗GitLabwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Meta API endpoints updated for Actions blob storageannouncementGitHub added new blob storage endpoints for GitHub Actions on github.com to its meta API, as part of work to improve capacity and reliability. Organizations that restrict outbound traffic with a network allowlist are asked to permit two new host ranges: productionresultssa30 through productionresultssa49, and productionresultssa100 through productionresultssa199, under blob.core.windows.net. Wildcard allowlists for productionresultssa*.blob.core.windows.net need no change.platform teamsPlatform teams whose runners sit behind individual-host egress allowlists must add the new hosts or risk interruptions to job summaries and logs. The current endpoint list can be retrieved from the REST meta API.GitHub Changelog ↗GitHub Actionswritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
AWS CloudFormation now simplifies stack update rollback operationsannouncementAWS CloudFormation added a force rollback option to continue a stalled update rollback in a single operation. The option works across the AWS CLI, SDKs, AWS CDK and AI agents. Resources that still need attention, such as those changed outside CloudFormation, are recorded for review before the next deployment.platform teamsPlatform teams running CloudFormation can recover failed stack updates without listing and retrying each affected resource one by one. They should review drift-aware change sets and recorded resources before the next deployment, since force rollback does not resolve out-of-band changes.What's New with AWS ↗Amazon EKSwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
2026-10-2110 days ago
Argo CDv3.3.17patch*
CNCF: Distributed tracing for CI pipelines without touching a single workflow filepostThe post describes using the OpenTelemetry Collector's githubreceiver, behind a single org-level GitHub webhook, to turn workflow_run and workflow_job events into OTLP traces. A workflow becomes a parent span, with jobs and steps as nested child spans, so no workflow files need changing. The receiver is a contrib component at alpha stability, and the author advises pinning the collector version.platform teamsA platform team can get org-wide CI traces by pointing one org webhook at a collector, and new repos are covered automatically. The team must provide a publicly reachable endpoint, restrict it to GitHub's webhook ranges, have org admin access, and pin an alpha-stage collector version.CNCF Blog ↗GitHub ActionsActions Runner Controllerwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
2026-10-2011 days ago
Argo CDv3.5.6patch***
Limit agent permissions and spend in AWS Transform custompostThe AWS DevOps Blog describes three configuration controls for running the AWS Transform custom agent on fleets of repositories: a trust settings file that auto-approves some tool calls and shell commands, an IAM execution identity scoped to approved transformations, and an agent-minute cap plus an AWS Budgets alert on spend. The post walks through a sample Java 8 to Java 17 upgrade run using AWS Transform CLI 3.10.0, reporting 43 tool calls and that the trust allowlist reduced approval prompts from 23 to zero on a clean clone.platform teamsPlatform teams running agent-driven upgrades from pipelines can manage tool trust, identity scope and spend as configuration rather than new infrastructure. The post's own measurements are from one sample repository and one CLI version, so counts will differ on other estates.AWS DevOps Blog ↗AWS DevOps Agentwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Bulk migrate branch protections to rulesets for a repositorypostGitHub now lets repository admins convert all classic branch protection rules in a repository to rulesets in one action, extending the earlier single-rule conversion. The Review import dialog previews the rulesets to be created, flags rules already covered by an existing ruleset, and shows where one rule expands into multiple rulesets. After creation, the user chooses whether to keep or delete the original branch protection rules.platform teamsPlatform teams that manage branch protection on many repositories can migrate in bulk instead of one rule at a time, choosing enforcement status (Active, Evaluate, or Disabled) before committing. Teams should review the generated rulesets before deleting the originals, since one classic rule can map to several rulesets.GitHub Changelog ↗GitHub Actionswritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
InfoQ: GitHub Actions Runner Controller 0.15.0 Targets Reliability at ScalepostGitHub released Actions Runner Controller 0.15.0, which the source describes as adding reliability, scalability and observability improvements for organisations running self-hosted GitHub Actions runners on Kubernetes. The source text is a short excerpt and does not list specific changes.platform teamsPlatform teams running self-hosted GitHub Actions runners on Kubernetes may get better reliability and visibility at scale, but the excerpt gives no specifics on what changed, so the changelog should be checked before upgrading.InfoQ ↗GitHub ActionseditorCorrection 2026-10-20: this was listed as a GitHub Actions 0.15.0 release by mistake. It is InfoQ coverage, not release notes from the project.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Salesforce teams succeeding with AI have strong DevOps fundamentalsreportGearset's blog summarizes The State of Salesforce DevOps 2026 survey, which reports that 84% of surveyed teams use AI to build Salesforce changes but only 40% are confident in the accuracy and security of AI-generated code. The post says teams with every DevOps lifecycle stage covered report higher confidence and fewer production bugs than teams with gaps. The article then promotes Gearset's agent and pipeline product as a way to combine trusted AI changes with a DevOps pipeline.platform teamsPlatform teams running Salesforce delivery can use the survey's stage-by-stage findings to prioritize version control, automated validation, backups and post-release observability before expanding AI-generated changes or Agentforce agents. The survey methodology and sample size are not given in the source text, and the report is vendor-commissioned.Gearset Blog ↗GitHub ActionsSalesforce PlatformAgentforceGearsetwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
AI Governance: One view of agent activityannouncementGitLab has released the AI Governance Dashboard in beta, which shows activity from GitLab Duo Agent Platform agents and externally connected agents such as Claude Code, Cursor, and Codex in one view for a top-level group. Each agent action is recorded as an audit event with the prompt, model, tools, MCP servers, and project, and sessions can be downloaded as immutable evidence or streamed to a SIEM. Setup requires enabling AI audit event storage, which is off by default, and running glab govern setup on developer machines.platform teamsPlatform and security teams on GitLab Premium or Ultimate can get audit trails of agent tool calls and MCP server use, but must turn on AI audit event storage and hold the Owner role or a custom role with read_agent_artifacts. External agent capture depends on glab 1.122.0 or later on macOS or Linux.GitLab Blog ↗GitLabwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Redesign how your team ships software with AI agentsannouncementGitLab announced the AI-Native Engineering Playbook, a guide to redesigning software delivery so people and AI agents each handle the work they suit best. The playbook proposes a four-stage autonomy ladder in which each step up must be backed by evidence, and a layered verification approach for code review at agent volume. GitLab's AI Accountability Report, based on an April 2026 survey of 1,528 DevSecOps professionals, is cited, with 79% saying individual productivity improved but overall delivery did not accelerate at the same pace.platform teamsPlatform teams can use the playbook's layered checks as a model: move formatting, type and dependency policy checks closer to authoring, keep change sets small, and record agentic review decisions so they can be inspected later. The post does not describe any new platform feature or tooling change.GitLab Blog ↗GitLabwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
daily email

One short email each morning: what shipped, what breaks, and a link to each change. Unsubscribe in one click. Privacy.

statuslast 30 days for lines
tools tracked43releases in registry964released in the last 30 days106entries published336breaking change lines18security lines84
change typestwo-column gutter, like git status
  • +addedNew functionality.
  • ~changedExisting behavior changed.
  • -deprecatedStill works, scheduled for removal.
  • -removedDecommissioned, gone in this version.
  • *fixedA defect corrected.
  • !securityA vulnerability closed or a dependency patched for one.
  • !breakingFlag in the first column; the change needs action before upgrading.
filter
categoryallidp & portalsai agents on platformci/cdobservabilitysupply chaincost & governancereports & dx dataenterprise app platforms
showmajor onlyreleasescase studiespostmortemsinclude patches