platformchangelog.dev
43 tools

Platform Changelog: what shipped in platform engineering, developer experience and DevOps

feedsince 2026-10-08patches hidden unless security or breaking
2026-10-274 days ago
CNCF: OpenTelemetry-powered distributed tracing and Kubernetes events in OpenChoreopostOpenChoreo, a CNCF Sandbox internal developer platform, uses the OpenTelemetry Collector to add distributed tracing to its observability plane. A local Collector in each data plane receives OTLP spans, enriches them with Kubernetes metadata via k8sattributes, applies tail sampling, and exports to a central Collector or cloud backend. The article also describes a custom Collector distribution with a k8seventenrich processor that persists Kubernetes events with OpenChoreo labels beyond the API server's default retention of about an hour.platform teamsPlatform teams running OpenChoreo or a similar IDP get traces and persisted, labeled Kubernetes events in the portal and through the observability MCP server. Teams building their own pipeline can reuse the pattern of pod-association enrichment for spans and informer-cache enrichment for events, which needs a custom processor because events do not map to pods.CNCF Blog ↗Kubernetes MCP Serverwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Continuous Delivery Office Hours Ep.12: The platform adoption shockpostA Continuous Delivery Office Hours episode discusses mandatory versus optional platform adoption, citing Octopus Deploy's Future of Platform Engineering report. The source says platforms now have about six times as many features as before, that mandatory platforms outperform optional ones on goal attainment, and that platforms meeting more goals have more budget security. The hosts argue platform teams must show value in terms the organization understands.platform teamsPlatform teams evaluating adoption policy get a reasoned argument to pair optional adoption with mandatory standards and to track developer satisfaction and feedback. Teams should also expect to justify funding with metrics, since the source warns that platforms without demonstrated value risk being defunded.Octopus Deploy Blog ↗Octopus DeployState of Platform Engineering reportwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
2026-10-265 days ago
Measuring developer experience on an Amazon EKS developer platformpostThe AWS Containers Blog post explains the DORA metrics (deployment frequency, lead time for changes, change failure rate, and failed deployment recovery time) and how to collect them on an Amazon EKS developer platform. It walks through a demo setup that connects Argo Events, Argo Workflows, Argo CD, Argo Rollouts, Apache DevLake and Grafana. The post cites State of Platform Engineering Report Volume 4 and Enterprise Strategy Group figures on platform measurement and time to market.platform teamsPlatform teams on EKS can use the described Argo and DevLake pipeline to compute DORA metrics from existing deployment, rollout and pipeline events. The post's walkthrough is a demo, and the source text is cut off before the setup steps are complete.AWS Containers Blog ↗Amazon EKSArgo CDArgo RolloutsArgo WorkflowsDORA State of DevOps / AI-assisted development reportHelmwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
2026-10-238 days ago
CNCF: Multi-tenant GPU Kubernetes on simulated hardware with Kamaji and HAMicase studyThe author built a single-machine lab where Kamaji runs two tenant Kubernetes control planes inside one management cluster and HAMi shares simulated GPUs between pods using a mock device plugin. The post reports that three fractional-GPU pods were scheduled onto one simulated A100 card, that HAMi refused pods exceeding the remaining cores or memory, and that eight tests passed. The source text provided is cut off before the tenant isolation test results are shown.platform teamsPlatform teams evaluating per-team Kubernetes isolation with GPU sharing can see a reproducible pattern for putting control planes in a shared cluster while scheduling fractional GPUs through HAMi. Results come from simulated hardware, so they do not show real GPU performance or driver behavior.CNCF Blog ↗Amazon EKSwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
2026-10-229 days ago
Crossplanev2.4.3patchsecurity++++*!!!!!Crossplane v2.4.3 updates the Go toolchain to 1.26.10, which rejects certificates from compromised eMudhra intermediate CAs (CVE-2026-111943), and removes the AAA Certificate Services and emSign ECC Root CA - G3 roots from the image CA bundle. The release also bundles dependency security updates and fixes a bug where a failed, partial package download could be cached as a valid package. Users with crossplane-edit or crossplane-admin access can now kubectl scale XRs and claims whose XRD serves the scale subresource.platform teamsPlatform teams running Crossplane should upgrade to pick up the Go toolchain and dependency CVE fixes and the discarded-truncated-download fix, which could otherwise leave providers in a crash loop. Teams relying on the scale subresource need to note that edit and admin roles can now scale XRs and claims.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Crossplane2.3.7patchsecurity+++++**!!!!!!Crossplane v2.3.7 bumps the Go toolchain to 1.26.10 so that crypto/x509 rejects the compromised eMudhra intermediate certificates (CVE-2026-111943), and removes the AAA Certificate Services and emSign ECC Root CA - G3 roots from the image's CA bundle. The release also updates vulnerable dependencies, including otlptrace v1.45.0. Fixes include discarding truncated package downloads, failing claims closed when their XRD cannot be listed, and stopping repeated in-use label writes on Usage reconciles.platform teamsPlatform teams running Crossplane should upgrade to pick up the trust store change and the fix for truncated package downloads, which could leave a provider crash-looping. Claims that cannot list their XRD now report ReconcileError instead of honoring a compositionRef.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Crossplanev2.2.7patchsecurity++*!!!!!!Crossplane v2.2.7 ships a Go toolchain bump to 1.26.10, which makes crypto/x509 reject certificates from compromised eMudhra intermediate CAs (CVE-2026-111943), and removes the AAA Certificate Services and emSign ECC Root CA - G3 roots from the image's CA bundle. It also updates golang.org/x/net to v0.60.0, the OpenTelemetry OTLP trace exporter to v1.45.0, and crossplane-runtime to v2.2.5 to pick up upstream CVE fixes. Two fixes stop truncated package downloads from being cached and stop the in-use label from being rewritten on every Usage reconcile.platform teamsPlatform teams running Crossplane should upgrade to pick up the dependency CVE fixes and the fix that prevents truncated provider packages from being cached and crash-looping providers. The Usage change reduces needless API writes on every reconcile.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Crossplanev1.20.14patchsecurity!!!!!!!Crossplane v1.20.14 ships on the release-1.20 branch. The release updates the Go toolchain to 1.26.10 so crypto/x509 rejects certificates from the compromised eMudhra intermediate CAs, and removes the AAA Certificate Services and emSign ECC Root CA - G3 roots from the image CA bundle by moving to a newer distroless/static base image. It also bumps golang.org/x/net to v0.60.0, OpenTelemetry OTLP trace HTTP exporter to v1.45.0, and crossplane-runtime to v1.20.12 to pick up upstream CVE fixes.platform teamsPlatform teams running Crossplane 1.20 should upgrade to pick up the CA trust removal and dependency CVE fixes. The release notes do not describe a vulnerability in Crossplane's own code, so the security content is toolchain and dependency updates.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Pulumiv3.272.0minor+++++**Pulumi v3.272.0 collapses policy violations that an exception exempts into one line per policy, and adds a --show-policy-exceptions flag to up and preview to list them with their exceptions. It adds an AwaitError provider protocol error that lets a deployment continue with unknown outputs and exits the CLI with code 10. It also adds pulumi env change-request commands and an --organization/-o option for env setup commands. Two fixes cover a clearer error message for missing project files and keeping unknown outputs from remote components instead of resolving them as empty values.platform teamsPlatform teams using Pulumi policy packs get less noisy output for exempted violations, and CI jobs that check exit codes gain an ExitAwaitError code (10) to handle when a resource needs awaiting. Teams using Pulumi Cloud environments can manage change requests from the CLI.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Pulumiv3.271.0minor++++++*********Pulumi v3.271.0 adds an id field to ReadResourceResponse so providers can return a resolved id that differs from the requested one, and adds state and env commands to the generated automation APIs for NodeJS, Python and Go. It also introduces version 2 of the --policy-pack-config format, which nests policy configs under policies and adds an exceptions field. Fixes include redacting secret values in invalid input diagnostics unless --show-secrets is passed, and resolving failed outputs as unknown under --continue-on-error.platform teamsTeams using policy packs need to migrate to the version 2 policy-pack-config format to use the new exceptions field. Teams relying on automation APIs gain state and env commands, and secret values in diagnostics are now redacted by default.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
2026-10-2011 days ago
Backstagev1.56.0minorsecurity++++++++++++++++++!Backstage v1.56.0 ships 53 changes, including a new AppLifecycleApi for checking app finalization and subscribing to lifecycle changes, and a fix so useRouteRef resolves routes after finalization. Other changes cover catalog fixes, a Cloud SQL retry for transient connection failures, an AWS RDS IAM token expiry fix, a Bitbucket Cloud bearer token option, and a Gitea default-branch fix. The release also moves @backstage/catalog-model to zod version 4, which requires adding zod to packages that use it without declaring it.platform teamsTeams running Backstage should check custom packages that import zod without declaring it, since catalog-model now uses zod 4. Plugin authors gain AppLifecycleApi to gate rendering on app finalization.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Automating secure container registry management for air-gapped AWS workloadspostAWS describes an approach for migrating Helm charts and container images into private Amazon ECR repositories inside air-gapped VPCs. It uses ECR repository creation templates, applied through Terraform, to set customer-managed KMS encryption, immutable tags and lifecycle rules on repositories created on first push. A migration tool called ecr-artifact-manager, included in the sample repository, preserves multi-architecture manifests, rewrites Helm chart references, and pulls private source credentials from AWS Secrets Manager.platform teamsPlatform teams in regulated air-gapped AWS environments can define repository security settings once in Terraform and have new repositories inherit them, rather than configuring each repository by hand. Teams should note that the encryption configuration cannot be changed after repository creation, and that enhanced scanning is configured at the registry level, not in the template.AWS Containers Blog ↗HelmAmazon EKSTerraform MCP Serverwritten by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
InfoQ: Chainguard Launches Secure Workspaces and Checks for AI Coding AgentsannouncementChainguard announced two beta products at its Assemble London event. Chainguard Workspaces provides remote development environments based on hardened microVMs. Chainguard Checks runs continuous integration inside the development loop, for code written by developers and AI agents.platform teamsPlatform teams evaluating hosted or agent-facing dev environments and in-loop CI can consider these betas, but the source gives no technical detail, pricing, or availability beyond beta status. Nothing here changes existing pipelines or platforms yet.InfoQ ↗written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Pulumi3.269.0minor++++++++**********Pulumi v3.269.0 adds runtime functions to the Go, Node.js and Python SDKs that check whether a resource with a given ID exists without adopting it into the stack. It runs OPA policy packs through a pulumi-language-opa plugin that the CLI downloads on demand. The release also makes pulumi logs and pulumi watch error by default ahead of their removal, and includes 18 fixes across PCL, the CLI and the SDKs.platform teamsTeams running OPA policy packs will get the CLI-downloaded language plugin instead of the old analyzer fallback for runtimes without a language plugin. Scripts that call pulumi logs or pulumi watch will start failing by default and should be checked before the removal lands.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
2026-10-1318 days ago
InfoQ: Backstage 1.55 Adds Scaffolder Task Recovery and Removes Deprecated Catalog APIspostBackstage 1.55 adds opt-in recovery for Software Template tasks, allowing crashed or timed-out runs to resume from the last completed step. The release also includes breaking changes to the catalog, search and TechDocs. The source points readers to the current 1.55.3 patch.platform teamsPlatform teams running Backstage scaffolder templates can opt into resuming failed runs instead of restarting them. They should review catalog, search and TechDocs configuration before upgrading because of the breaking changes.InfoQ ↗BackstageeditorCorrection 2026-10-20: this was listed as a Backstage 1.55 release by mistake. It is InfoQ coverage, not release notes from the project.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
daily email

One short email each morning: what shipped, what breaks, and a link to each change. Unsubscribe in one click. Privacy.

statuslast 30 days for lines
tools tracked43releases in registry964released in the last 30 days108entries published335breaking change lines18security lines84
change typestwo-column gutter, like git status
  • +addedNew functionality.
  • ~changedExisting behavior changed.
  • -deprecatedStill works, scheduled for removal.
  • -removedDecommissioned, gone in this version.
  • *fixedA defect corrected.
  • !securityA vulnerability closed or a dependency patched for one.
  • !breakingFlag in the first column; the change needs action before upgrading.
filter
categoryallidp & portalsai agents on platformci/cdobservabilitysupply chaincost & governancereports & dx dataenterprise app platforms
showmajor onlyreleasescase studiespostmortemsinclude patches