platformchangelog.dev
43 tools

Platform Changelog: what shipped in platform engineering, developer experience and DevOps

feedsince 2026-10-08all releases, patches included
2026-10-292 days ago
The New Stack: Why Kubernetes platforms keep rebuilding a layer they could sharepostThe article argues that many Kubernetes tools rebuild the same composition layer for grouping resources, ordering them, and passing values between them. It describes kro's ResourceGraphDefinition, which expresses dependencies as CEL references that set order, and kro 0.10's Graph primitive, which runs composition without a custom API. The author suggests composition could be a shared primitive in Kubernetes.platform teamsPlatform teams that write glue controllers or ordering logic between Helm, Argo CD or Crossplane resources can consider expressing dependencies as references in one shared composition layer. Teams adopting it would take on ownership of every API they publish, since schema changes can break existing instances.The New Stack ↗kroHelmArgo CDCrossplanewritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
The New Stack: The 5 essential layers of AI agent sandboxing on KubernetespostThe article lays out five layers for isolating AI agent workloads on Kubernetes: the isolation runtime (runc, gVisor, or Kata Containers), node configuration, access controls on network, credentials and storage, RuntimeClass selection in the pod request, and the Agent Sandbox project for session management. It gives a RuntimeClass and Pod example and notes that runtime overhead should be measured rather than copied from examples. The piece is written from Oracle Cloud Infrastructure's perspective and describes community projects as the basis for its approach.platform teamsPlatform teams running agents on shared clusters need to choose a sandbox runtime, configure nodes for it, and add its measured overhead to RuntimeClass so scheduling and quotas account for it. Egress default-deny, short-lived task-scoped credentials, and separate authorization for MCP servers and APIs outside the sandbox also fall to the platform team.The New Stack ↗Kubernetes MCP Serverwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
2026-10-283 days ago
Salesforce CLI2.156.8minor~***
From one prompt to a governed Dataverse app: the Dataverse plugin lands in Copilot CoworkannouncementMicrosoft announced that the Dataverse plugin is now available in Copilot Cowork. The post demonstrates a workflow where a single prompt creates Dataverse tables, relationships, sample data and a published app, with each change shown to the user as an approval card before it happens. The app runs in Microsoft Copilot Managed Runtime (preview), and building in Cowork currently requires enrollment in the Frontier program.platform teamsPlatform teams that govern Power Platform get an agent path into Dataverse where the connection signs in as the user and is limited by Dataverse security roles, with changes requiring approval and resulting in ordinary solution-ready tables. The post does not describe new admin controls beyond existing Microsoft 365 admin center visibility.Microsoft Power Platform Blog ↗Microsoft Power PlatformAgentforcewritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
2026-10-274 days ago
The New Stack: One pod, one node: The architecture behind serverless Kubernetes on AWSpostThe article walks through how Amazon EKS Fargate places a pod: a mutating admission webhook assigns it to a Fargate scheduler before the default scheduler can claim it, the scheduler requests dedicated capacity, and a node runtime registers the pod's environment. It also describes three network namespaces, one ENI per pod, and EKS periodically replacing pods for security patching via the Eviction API. The piece is an architectural explainer and does not announce a new release.platform teamsPlatform teams using Fargate should plan for one ENI and private subnet capacity per pod, a pod-level patching cycle that respects PodDisruptionBudgets, and the lack of DaemonSets, host networking, EBS volumes and GPUs. Every pod must match a Fargate profile.The New Stack ↗Amazon EKSwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Extend GitLab Duo Agent Platform into your business systemspostGitLab published a tutorial showing how Salesforce can call a custom GitLab Duo Agent Platform flow through the Flows API when an Apex error occurs. The flow reads the repository, identifies a likely cause and suspect commit, and opens a GitLab issue with the analysis. The tutorial limits the agent to four read tools and one issue-creation tool, and uses a project access token and Named Credential.platform teamsPlatform teams that manage Salesforce metadata in GitLab could adapt this pattern to route runtime errors to agent triage with narrow privileges and an audit trail. Teams must still handle data stripping, token scoping, and privilege limits before production use, and the tutorial omits response checks, retries, and tests.GitLab Blog ↗GitLabSalesforce PlatformAgentforcewritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
2026-10-265 days ago
Custom APIs just landed in the Dataverse MCP Server, Agents just got smarterannouncementThe Dataverse MCP Server now exposes Custom APIs, so agents can invoke custom business operations hosted in Dataverse regardless of where the agent runs. A Custom API backed by a plug-in runs its steps inside a single Dataverse transaction and rolls back fully if any step fails. The post describes a search, describe, and invoke_api sequence the agent uses to discover and call these APIs from metadata, with a sample case-creation example. Custom Actions are not supported yet.platform teamsPlatform teams can expose multi-step business logic as one atomic, typed operation that agents discover automatically, rather than letting agents chain separate record writes. Teams should note that Custom Actions are not yet supported through the MCP server.Microsoft Power Platform Blog ↗Microsoft Power Platformwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
How to deliver your first change with Cam: a walkthroughpostGearset published a walkthrough of Cam, its AI agent, delivering a sample Salesforce change: a VAT number field with a placeholder validation, a finance Flow, and access across 23 profiles. The steps are assigning a Jira or Azure DevOps ticket, answering Cam's questions, approving a nine-step build plan on a feature branch, reviewing the diff, and raising a pull request that Cam fixes if validation fails. The post also describes using Gearset Observability to hand production Apex and Flow errors to Cam.platform teamsPlatform teams running Salesforce on Gearset pipelines could route backlog and production error fixes to an agent whose output passes the same tests, approvals and security checks as human-written changes. The post does not give measured results, so the reliability of this workflow is untested by the source.Gearset Blog ↗GearsetSalesforce Platformwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
2026-10-229 days ago
ServiceNow SDK4.14.0minorsecurity~~***************!SDK 4.14.0ServiceNow SDK 4.14.0 changes how credentials are stored: they are now encrypted with AES-256-GCM in a local file under ~/.now-sdk/credentials.enc, with only a 32-byte key kept in the OS keychain. A new SN_SDK_CREDENTIALS_DIR variable sets the credentials directory. The release also lists one security fix that preserves Sys_dictionary security roles through transform and build, along with about 19 fixes to transform and build behavior.platform teamsTeams that run the SDK in CI or on shared machines should check where credentials.enc is written and whether SN_SDK_CREDENTIALS_DIR is needed for their runners. Pipelines that rely on the previous credential storage location may need updating.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Microsoft named a Leader in two evaluations of next-generation app development platformsannouncementMicrosoft says it was named a Leader in the 2026 Gartner Magic Quadrant for AI-Augmented Low-Code Application Platforms and in The Forrester Wave: AppGen and Low-Code Platforms, Q4 2026. The post also describes new Copilot Studio capabilities announced in October 2026, including agent accounts, business process memory, triggers, and Apps in Copilot Studio in public preview.platform teamsFor platform teams governing Power Platform, the post describes MCP-based exposure of app functions to agents, connector and MCP server policies in managed environments, and agent identity via Entra Agent ID, but gives no detail on how these are configured or enforced. The analyst claims and usage figures are vendor-supplied and not verifiable from the text.Microsoft Power Platform Blog ↗Microsoft Power PlatformSalesforce Platformwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
2026-10-2110 days ago
InfoQ: Cilium 1.20 Expands Gateway API and Opens eBPF Datapath for KubernetespostCilium 1.20 has been released with support for Kubernetes Gateway API 1.6, adding ExternalAuth, ListenerSets, CORS filtering, TCPRoute and UDPRoute. The release also adds a beta eBPF datapath plugin mechanism that runs as a separate process, a bpf.datapathMode=auto setting that selects netkit or veth per node, and further work on the ztunnel sidecarless mutual TLS proxy. The ztunnel release notes say the older Mutual Authentication feature is deprecated.platform teamsPlatform teams can let application teams add listeners through ListenerSets while keeping control of the shared Gateway, and can use ExternalAuth for HTTP authorisation at the gateway. Mixed-kernel fleets can use automatic netkit selection without splitting node pools, but operators should check the release notes for action needed on legacy Mutual Authentication, Kafka-aware policies, Envoy Go extensions and custom CNI configuration.InfoQ ↗written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
2026-10-2011 days ago
Announcing Amazon ECS Gateway, a managed ingress solution for your ECS servicesannouncementAWS announced Amazon ECS Gateway, a resource that dynamically provisions and manages Application Load Balancers and supporting resources in the customer's account for ECS services. Platform teams define networking standards on a gateway and associate it with clusters, while application teams opt in by adding a gateway connector parameter. The source says it is available in all commercial AWS Regions for awsvpc network mode services at no additional charge, with customers paying only for underlying infrastructure.platform teamsPlatform teams running ECS can centralize ingress standards per cluster instead of managing ALBs per service, with up to 25 services sharing an ALB and per-service DNS hostnames. Teams should note that ECS creates and removes ALBs automatically, which affects cost and resource inspection planning.What's New with AWS ↗Amazon EKSwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Salesforce teams succeeding with AI have strong DevOps fundamentalsreportGearset's blog summarizes The State of Salesforce DevOps 2026 survey, which reports that 84% of surveyed teams use AI to build Salesforce changes but only 40% are confident in the accuracy and security of AI-generated code. The post says teams with every DevOps lifecycle stage covered report higher confidence and fewer production bugs than teams with gaps. The article then promotes Gearset's agent and pipeline product as a way to combine trusted AI changes with a DevOps pipeline.platform teamsPlatform teams running Salesforce delivery can use the survey's stage-by-stage findings to prioritize version control, automated validation, backups and post-release observability before expanding AI-generated changes or Agentforce agents. The survey methodology and sample size are not given in the source text, and the report is vendor-commissioned.Gearset Blog ↗GearsetSalesforce PlatformAgentforceGitHub Actionswritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
2026-10-1615 days ago
CNCF: Deploying, maintaining, and migrating production n8n on EKScase studyA team ran n8n in queue mode on Amazon EKS with separate workers and webhook processors, syncing secrets from AWS Secrets Manager via External Secrets Operator. They then moved from a community Helm chart to the official n8n Helm chart as a full cutover, keeping PostgreSQL, Redis, S3, IAM and secrets in place. The main pod's persistence was disabled because they found no state on that volume that needed to survive a restart.platform teamsPlatform teams running n8n on Kubernetes can see a concrete migration path from the community chart to the official chart, including the trade-off that main pods move to a Deployment with a shared PVC that gp3 RWO volumes cannot serve across nodes. The article's sample values repository shows queue mode, HPA and ingress configuration for external Postgres and Redis.CNCF Blog ↗HelmAmazon EKSwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Using Claude Code for Salesforce? Don’t miss these security and governance gapspostGearset's blog post lists governance and security gaps for teams using Claude Code, Cursor or Codex to build on Salesforce. The gaps include over-broad local permissions, prompt injection, changes that bypass testing and review, inconsistent team standards, and unplanned maintenance. The post recommends running agents in a container, using least-privilege integration users, restricting MCP toolsets, and routing all AI-generated changes through a CI/CD pipeline.platform teamsPlatform teams that let agents reach Salesforce orgs through MCP should scope credentials to least privilege, restrict enabled MCP toolsets, and require AI-generated changes to pass the same pipeline checks as human changes. The post's recommendations are general, and it promotes Gearset's own product as the solution.Gearset Blog ↗GearsetSalesforce PlatformSalesforce DX MCP ServerAgentforcewritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
2026-10-1417 days ago
Salesforce CLI2.154.4minor+
2026-10-1318 days ago
ServiceNow SDK4.13.xminor++**SDK 4.13.x Patch NotesServiceNow released SDK 4.13.x patch changes. The release adds table support for db_object_id in bootstrap and for configuration_access, and adds a protectionPolicy option for sys_security_acl_role. It fixes an OAuth CSRF issue by restoring cookie replay and binding CSRF lookup to the exact session, and it also fixes a now-ux-globals Array.from polyfill requirement and a TypeScript error during UI type-checking.platform teamsPlatform teams that use the ServiceNow SDK should pick up the OAuth CSRF fix, which is a security fix in the SDK itself. Teams managing ACL rules can use the new protectionPolicy option on sys_security_acl_role, and telemetry events no longer have person profile processing applied.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
2026-10-1021 days ago
Salesforce Deployments with OctopuspostThe Octopus Deploy blog describes a walkthrough for deploying a Salesforce sample application with Octopus Deploy and the Salesforce CLI (sf). It covers storing an SFDX auth URL as a sensitive variable, running a script step in a container built from a Dockerfile that installs the CLI, and running sf project deploy start against a target org.platform teamsA platform team that runs Salesforce deployments can use a pattern of a containerized execution step with the sf CLI and an auth URL secret in Octopus. The post is a tutorial on one approach and does not announce any change to Salesforce or Octopus tooling.Octopus Deploy Blog ↗Octopus DeploySalesforce CLISalesforce Platformwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
daily email

One short email each morning: what shipped, what breaks, and a link to each change. Unsubscribe in one click. Privacy.

statuslast 30 days for lines
tools tracked43releases in registry964released in the last 30 days106entries published335breaking change lines18security lines84
change typestwo-column gutter, like git status
  • +addedNew functionality.
  • ~changedExisting behavior changed.
  • -deprecatedStill works, scheduled for removal.
  • -removedDecommissioned, gone in this version.
  • *fixedA defect corrected.
  • !securityA vulnerability closed or a dependency patched for one.
  • !breakingFlag in the first column; the change needs action before upgrading.
filter
categoryallidp & portalsai agents on platformci/cdobservabilitysupply chaincost & governancereports & dx dataenterprise app platforms
showmajor onlyreleasescase studiespostmortemsinclude patches