platformchangelog.dev
43 tools

Platform Changelog: what shipped in platform engineering, developer experience and DevOps

feedsince 2026-09-14patches hidden unless security or breaking
2026-10-229 days ago
Crossplanev2.4.3patchsecurity++++*!!!!!Crossplane v2.4.3 updates the Go toolchain to 1.26.10, which rejects certificates from compromised eMudhra intermediate CAs (CVE-2026-111943), and removes the AAA Certificate Services and emSign ECC Root CA - G3 roots from the image CA bundle. The release also bundles dependency security updates and fixes a bug where a failed, partial package download could be cached as a valid package. Users with crossplane-edit or crossplane-admin access can now kubectl scale XRs and claims whose XRD serves the scale subresource.platform teamsPlatform teams running Crossplane should upgrade to pick up the Go toolchain and dependency CVE fixes and the discarded-truncated-download fix, which could otherwise leave providers in a crash loop. Teams relying on the scale subresource need to note that edit and admin roles can now scale XRs and claims.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Crossplane2.3.7patchsecurity+++++**!!!!!!Crossplane v2.3.7 bumps the Go toolchain to 1.26.10 so that crypto/x509 rejects the compromised eMudhra intermediate certificates (CVE-2026-111943), and removes the AAA Certificate Services and emSign ECC Root CA - G3 roots from the image's CA bundle. The release also updates vulnerable dependencies, including otlptrace v1.45.0. Fixes include discarding truncated package downloads, failing claims closed when their XRD cannot be listed, and stopping repeated in-use label writes on Usage reconciles.platform teamsPlatform teams running Crossplane should upgrade to pick up the trust store change and the fix for truncated package downloads, which could leave a provider crash-looping. Claims that cannot list their XRD now report ReconcileError instead of honoring a compositionRef.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Crossplanev2.2.7patchsecurity++*!!!!!!Crossplane v2.2.7 ships a Go toolchain bump to 1.26.10, which makes crypto/x509 reject certificates from compromised eMudhra intermediate CAs (CVE-2026-111943), and removes the AAA Certificate Services and emSign ECC Root CA - G3 roots from the image's CA bundle. It also updates golang.org/x/net to v0.60.0, the OpenTelemetry OTLP trace exporter to v1.45.0, and crossplane-runtime to v2.2.5 to pick up upstream CVE fixes. Two fixes stop truncated package downloads from being cached and stop the in-use label from being rewritten on every Usage reconcile.platform teamsPlatform teams running Crossplane should upgrade to pick up the dependency CVE fixes and the fix that prevents truncated provider packages from being cached and crash-looping providers. The Usage change reduces needless API writes on every reconcile.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Crossplanev1.20.14patchsecurity!!!!!!!Crossplane v1.20.14 ships on the release-1.20 branch. The release updates the Go toolchain to 1.26.10 so crypto/x509 rejects certificates from the compromised eMudhra intermediate CAs, and removes the AAA Certificate Services and emSign ECC Root CA - G3 roots from the image CA bundle by moving to a newer distroless/static base image. It also bumps golang.org/x/net to v0.60.0, OpenTelemetry OTLP trace HTTP exporter to v1.45.0, and crossplane-runtime to v1.20.12 to pick up upstream CVE fixes.platform teamsPlatform teams running Crossplane 1.20 should upgrade to pick up the CA trust removal and dependency CVE fixes. The release notes do not describe a vulnerability in Crossplane's own code, so the security content is toolchain and dependency updates.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Pulumiv3.272.0minor+++++**Pulumi v3.272.0 collapses policy violations that an exception exempts into one line per policy, and adds a --show-policy-exceptions flag to up and preview to list them with their exceptions. It adds an AwaitError provider protocol error that lets a deployment continue with unknown outputs and exits the CLI with code 10. It also adds pulumi env change-request commands and an --organization/-o option for env setup commands. Two fixes cover a clearer error message for missing project files and keeping unknown outputs from remote components instead of resolving them as empty values.platform teamsPlatform teams using Pulumi policy packs get less noisy output for exempted violations, and CI jobs that check exit codes gain an ExitAwaitError code (10) to handle when a resource needs awaiting. Teams using Pulumi Cloud environments can manage change requests from the CLI.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Pulumiv3.271.0minor++++++*********Pulumi v3.271.0 adds an id field to ReadResourceResponse so providers can return a resolved id that differs from the requested one, and adds state and env commands to the generated automation APIs for NodeJS, Python and Go. It also introduces version 2 of the --policy-pack-config format, which nests policy configs under policies and adds an exceptions field. Fixes include redacting secret values in invalid input diagnostics unless --show-secrets is passed, and resolving failed outputs as unknown under --continue-on-error.platform teamsTeams using policy packs need to migrate to the version 2 policy-pack-config format to use the new exceptions field. Teams relying on automation APIs gain state and env commands, and secret values in diagnostics are now redacted by default.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
2026-10-2011 days ago
Backstagev1.56.0minorsecurity++++++++++++++++++!Backstage v1.56.0 ships 53 changes, including a new AppLifecycleApi for checking app finalization and subscribing to lifecycle changes, and a fix so useRouteRef resolves routes after finalization. Other changes cover catalog fixes, a Cloud SQL retry for transient connection failures, an AWS RDS IAM token expiry fix, a Bitbucket Cloud bearer token option, and a Gitea default-branch fix. The release also moves @backstage/catalog-model to zod version 4, which requires adding zod to packages that use it without declaring it.platform teamsTeams running Backstage should check custom packages that import zod without declaring it, since catalog-model now uses zod 4. Plugin authors gain AppLifecycleApi to gate rendering on app finalization.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Pulumi3.269.0minor++++++++**********Pulumi v3.269.0 adds runtime functions to the Go, Node.js and Python SDKs that check whether a resource with a given ID exists without adopting it into the stack. It runs OPA policy packs through a pulumi-language-opa plugin that the CLI downloads on demand. The release also makes pulumi logs and pulumi watch error by default ahead of their removal, and includes 18 fixes across PCL, the CLI and the SDKs.platform teamsTeams running OPA policy packs will get the CLI-downloaded language plugin instead of the old analyzer fallback for runtimes without a language plugin. Scripts that call pulumi logs or pulumi watch will start failing by default and should be checked before the removal lands.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Cluster APIv1.13.7patchsecurity~~~~~~~~~~~~~****!Cluster API v1.13.7 was released with 28 changes: one security item bumping grpc to 1.83.2 for security advisories, 14 dependency changes (including OpenTelemetry v1.45.0 and golang.org/x/net v0.58.0), and four fixes. The fixes cover cluster-name labels on Clusters without ClusterClass, KCP learner deletion after Node registration, a race in the KCP proxy DialContext, and a flaky test.platform teamsThe security fix is a dependency bump, not a vulnerability in Cluster API's own code, so platform teams should upgrade for the advisory fix and the KCP race fix. The release notes list supported management cluster versions as v1.32.x to v1.36.x and workload cluster versions as v1.30.x to v1.36.x.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Pulumiv3.268.0minor+++++*************Pulumi v3.268.0 adds an engine capability to negotiate OutputValues on Invoke, gated by a new accepts_outputs_in_invoke handshake capability. It adds version, whoami and install to the generated automation APIs for NodeJS, Python and Go, and sends the W3C traceparent header on Pulumi Cloud API calls when --otel-traces is set. The release also lists 14 fixes, including dynamic provider Read fallback, plugin checksum verification and parallel plugin shutdown.platform teamsTeams using the Pulumi Automation API get version, whoami and install methods in NodeJS, Python and Go, and dynamic provider authors need to check Read handling since the engine no longer duplicates inputs into state. Teams tracing Pulumi calls get trace propagation to Pulumi Cloud when --otel-traces is set.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
2026-09-301 month ago
Pulumiv3.266.0minor++****
2026-09-291 month ago
Terraform Provider for SAP BTP1.27.0minor+****SAP released version 1.27.0 of the Terraform Provider for SAP BTP. The release notes list one added action, action_update_global_account, and four fixes covering function label extraction for legacy labels, failing early when an amount is set on non-quota entitlement plans, drift resolution for role collection assignments with custom IAS origins, and an auto_create_shadow_users option in the globalaccount trust configuration.platform teamsPlatform teams managing SAP BTP through Terraform get a new action for updating global accounts and fixes that reduce configuration drift for role collections and trust settings. Teams using entitlement plans should note that amount on non-quota plans now fails at plan time instead of being silently accepted.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
2026-09-251 month ago
Pulumiv3.265.0minor++****************Pulumi v3.265.0 adds a pulumi logout --all --delete-credentials-key option, Authenticode signing for Windows CLI and language host binaries, and a PCL error for literals that do not match a schema constant or enum. It also fixes 21 items, mostly in the PCL type checker and interpreter, code generation for Python, Node.js and Go SDKs, and engine handling of unknown outputs when a dependency fails during a --continue-on-error update.platform teamsTeams using Pulumi with --continue-on-error can now rely on Unknown=true being reported for skipped Read and Import steps, so SDK consumers no longer treat empty outputs as real values. Windows CLI binaries are now signed, which may matter for install policies.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
2026-09-161 month ago
Pulumiv3.263.0minor+++++******
2026-09-151 month ago
Crossplane2.4.1patchsecurity+*!!!!Crossplane v2.4.1 updates the Go toolchain to 1.26.7, google.golang.org/grpc to v1.83.2, and golang.org/x/crypto to v0.56.0 to pick up upstream CVE fixes, including the gRPC advisory GHSA-2v4p-qf9q-27wj. It also bumps the Crossplane apis module to v2.4.0. The release changes how package revisions take control of established objects, so an incoming revision can take over CRDs from the revision it replaces.platform teamsPlatform teams upgrading to v2.4.1 get the dependency CVE fixes without changes to their own configuration. Package upgrades that previously could leave a new provider unhealthy with a cannot establish control of object error should now hand off automatically, without deleting the stale revision or editing CRD owner references by hand.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Crossplanev2.3.6patchsecurity+*!!!!Crossplane v2.3.6 updates the Go toolchain to 1.26.7 and bumps google.golang.org/grpc to v1.83.2 and golang.org/x/crypto to v0.56.0, which the release notes say pick up upstream CVE fixes, including a gRPC advisory. It also fixes a package revision hand-off bug where an outgoing revision could fail to release CRD control, leaving the incoming provider stuck with cannot establish control of object and no pod created.platform teamsPlatform teams running Crossplane packages should pick up this patch, since providers stuck on a replaced revision previously needed manual CRD owner-reference edits or deletion of the stale revision. The security content is dependency bumps only, not a vulnerability in Crossplane's own code.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Crossplanev2.2.6patchsecurity+*!!!!Crossplane v2.2.6 updates the Go toolchain to 1.26.7 and bumps google.golang.org/grpc to v1.83.2 and golang.org/x/crypto to v0.56.0, including a gRPC advisory fix. It also changes package revision handoff so a new revision takes control of CRDs from the revision it replaces, fixing a case where the incoming provider's pod was never created and needed manual cleanup.platform teamsPlatform teams upgrading to v2.2.6 get dependency CVE fixes, and provider package upgrades no longer stall with a cannot establish control of object error that previously required deleting the stale revision or editing CRD owner references by hand. The security content is dependency bumps only, not a vulnerability in Crossplane's own code.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
daily email

One short email each morning: what shipped, what breaks, and a link to each change. Unsubscribe in one click. Privacy.

statuslast 30 days for lines
tools tracked43releases in registry964released in the last 30 days106entries published335breaking change lines18security lines84
change typestwo-column gutter, like git status
  • +addedNew functionality.
  • ~changedExisting behavior changed.
  • -deprecatedStill works, scheduled for removal.
  • -removedDecommissioned, gone in this version.
  • *fixedA defect corrected.
  • !securityA vulnerability closed or a dependency patched for one.
  • !breakingFlag in the first column; the change needs action before upgrading.
filter
categoryallidp & portalsai agents on platformci/cdobservabilitysupply chaincost & governancereports & dx dataenterprise app platforms
showmajor onlyreleasescase studiespostmortemsinclude patches