Platform Changelog

feedsince 2026-07-28all releases, patches included

2026-10-283 days ago

Jenkins2.588minorsecurity!Jenkins weekly release 2.588 shipped with three changes: one security item and two other changes. The release notes say multiple security fixes were made and point to a separate security advisory dated 2026-10-28 for details. The source text does not list the specific vulnerabilities or affected components.platform teamsPlatform teams running Jenkins should review the linked security advisory and plan to upgrade to 2.588 to pick up the fixes. The source does not say whether the flaws are in Jenkins core or in plugins.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

2026-10-229 days ago

Crossplanev2.4.3patchsecurity++++*!!!!!Crossplane v2.4.3 updates the Go toolchain to 1.26.10, which rejects certificates from compromised eMudhra intermediate CAs (CVE-2026-111943), and removes the AAA Certificate Services and emSign ECC Root CA - G3 roots from the image CA bundle. The release also bundles dependency security updates and fixes a bug where a failed, partial package download could be cached as a valid package. Users with crossplane-edit or crossplane-admin access can now kubectl scale XRs and claims whose XRD serves the scale subresource.platform teamsPlatform teams running Crossplane should upgrade to pick up the Go toolchain and dependency CVE fixes and the discarded-truncated-download fix, which could otherwise leave providers in a crash loop. Teams relying on the scale subresource need to note that edit and admin roles can now scale XRs and claims.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

2026-10-2110 days ago

OpenTofu1.12.9patchsecurity!OpenTofu v1.12.9 was published with one security change: it filters out compromised intermediate certificates. The release notes do not describe the affected code path or the certificate trust mechanism in further detail.platform teamsPlatform teams running OpenTofu should plan to upgrade to pick up the certificate filtering. The source does not say whether the fix affects provider downloads or state backends.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

2026-10-2011 days ago

Kyvernov1.19.2patchsecurity+~*********!!!!!!!

2026-10-1912 days ago

Open Policy Agent1.21.3patch~~OPA v1.21.3 makes a signing block with no entries under its top-level keys a startup configuration error. Bundle.NewVerificationConfig now requires signatures by default, and embedders can opt out. The release notes say the change covers bundle and discovery configurations that previously did not verify signatures, including those with an empty signing block or no keyid.platform teamsPlatform teams with bundle or discovery signing blocks that lack a keyid, or with empty signing blocks, will need to add a keyid or fix the configuration before OPA starts. Teams whose configs have no signing block, or that run with --skip-verify, are not affected by the new default.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

2026-10-1516 days ago

GitLab19.5minorGitLab 19.5 was released on October 15, 2026. The GitLab MCP server and GitLab Secrets Manager are now generally available, and the MCP server gives external agents such as Claude Code and Cursor access to a wider set of GitLab tools. The release also adds beta support for connecting externally connected agents to AI Governance, plus non-default branch vulnerability tracking and several GitLab Duo CLI features.platform teamsPlatform teams can scope CI secrets per job by environment and branch and get audit logs for each secret operation, using existing GitLab permissions. Security teams can see sessions from agents running outside GitLab, with audit events sent to a SIEM, though this ECA capability is in beta.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

2026-10-0625 days ago

Argo CDv3.4.10patchbreakingsecurity+~~****!!!!!!!!Argo CD v3.4.10 ships fixes for 11 security issues, including several rated critical: command execution via Kustomize remote refs and Helm config home in the repo-server, a Jsonnet import that reads repo-server files, and an AppProject restriction bypass through PreDelete/PostDelete hooks. It also includes two breaking changes: Kustomize no longer honors helmGlobals.configHome for Helm plugins registered from that directory, and OCI manifests larger than 4 MiB are rejected. The release also adds username logging on login attempts and four bug fixes.platform teamsPlatform teams running Argo CD 3.4 should upgrade to pick up the critical repo-server and AppProject fixes. Teams using Kustomize with Helm plugins from configHome or OCI manifests above 4 MiB need to check their builds before upgrading because those will now fail.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Argo CDv3.3.15patchbreakingsecurity~~*********!!!!!!!Argo CD v3.3.15 ships fixes for 12 security issues and 11 other fixes, with 2 changes marked breaking. Breaking changes: Kustomize builds that render Helm charts no longer honor helmGlobals.configHome, so builds relying on a Helm plugin registered from that directory will fail, and OCI manifests larger than 4 MiB are now rejected. Critical advisories cover command execution via Kustomize remote refs and Helm config home, Jsonnet file reads from the repo-server, and AppProject restriction bypass via PreDelete/PostDelete hooks.platform teamsPlatform teams running Argo CD 3.3 should plan to upgrade, and check any Kustomize-with-Helm pipelines that use a plugin from configHome or OCI manifests over 4 MiB before rolling out. Repo-server exposure from the listed critical issues makes the update a priority.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

2026-09-301 month ago

Kargov1.12.0minorbreaking++++++++++~~~~****Kargo v1.12.0 removes the Connect-based gRPC API, the createTargetBranch option on git-open-pr, and the author block on git-commit. It changes the git-push default integration policy to RebaseOrMerge and removes the legacy Secret namespace chart values, so upgrades that still set them will fail. The release also adds a tar step, an oci-push srcPath option, cross-account ECR pulls, and per-request actor attribution in API logs.platform teamsPlatform teams upgrading Kargo must check integrations for the removed gRPC API, remove deprecated step fields from promotion tasks, and confirm required Secrets exist in the system and shared resources namespaces before upgrading. Teams relying on rebase-only pushes should set pushIntegrationPolicy to AlwaysRebase in Helm values to keep the old behavior.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

2026-09-151 month ago

Crossplanev1.20.13patchsecurity!!!Crossplane v1.20.13 was released with four changes, three of them security-related. The security content is dependency updates: the Go toolchain is bumped to 1.26.7, google.golang.org/grpc is updated to v1.83.2, and a set of vulnerable dependencies is updated, including the gRPC advisory GHSA-2v4p-qf9q-27wj.platform teamsPlatform teams running Crossplane 1.20 should plan to pick up this patch release, since it carries upstream CVE fixes. The changes are dependency and toolchain updates with no vulnerability in Crossplane's own code described in the source.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

2026-09-101 month ago

Kyvernov1.19.1patchsecurity++**************!!

2026-08-202 months ago

Kyvernov1.19.0minorsecurity++++-*************!

older entries

daily email

statuslast 30 days for lines

tools tracked43releases in registry964released in the last 30 days106entries published336breaking change lines18security lines84

change typestwo-column gutter, like git status

+addedNew functionality.
~changedExisting behavior changed.
-deprecatedStill works, scheduled for removal.
-removedDecommissioned, gone in this version.
*fixedA defect corrected.
!securityA vulnerability closed or a dependency patched for one.
!breakingFlag in the first column; the change needs action before upgrading.

filter

categoryall idp & portals ai agents on platform ci/cd observability supply chain cost & governance reports & dx data enterprise app platforms

showmajor only releases case studies postmortems include patches

Platform Changelog: what shipped in platform engineering, developer experience and DevOps