Platform Changelog

feedsince 2026-10-20patches hidden unless security or breaking

2026-10-292 days ago

Open Policy Agent1.22.0minor++++++++~********

Tektonv1.18.0minor+****Pipeline release v1.18.0 "Ukrainian Levkoy Ultron LTS"Tekton Pipelines v1.18.0 was released. The release adds a continueAndFail option on step.onError. Fixes include making controller-managed labels immutable via a webhook, fixing truncation of large Tekton bundles resolved from OCI images, fixing early PVC cleanup for pipelines-in-pipelines child pipelines, and bumping the plumbing ko image to Go 1.27.3.platform teamsTeams running Tekton can use continueAndFail to let a pipeline keep going after a step error, which changes failure handling in existing pipelines. The label immutability webhook and PVC cleanup fix affect controller behavior, so teams should review those when upgrading.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Kubernetes MCP Serverv0.1.0minor++++++**Kubernetes MCP Server v0.1.0 added API-based filtering for Kiali, a multicluster evaluation suite for context tools, and tracking of in-flight MCP requests. It also added observability toolset tests, reading TOML config from stdin, and structured PipelineRun diagnosis. Fixes cover requiring Perses for show_timeseries and reporting metric LogQL queries instead of a JSON decode error.platform teamsPlatform teams running this MCP server get new Kiali filtering, PipelineRun diagnosis, and an in-flight request metric to watch. The stdin config option may simplify automated deployments.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

2026-10-283 days ago

Jenkins2.588minorsecurity!Jenkins weekly release 2.588 shipped with three changes: one security item and two other changes. The release notes say multiple security fixes were made and point to a separate security advisory dated 2026-10-28 for details. The source text does not list the specific vulnerabilities or affected components.platform teamsPlatform teams running Jenkins should review the linked security advisory and plan to upgrade to 2.588 to pick up the fixes. The source does not say whether the flaws are in Jenkins core or in plugins.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Pulumiv3.273.0minor+++++++***********

Salesforce CLI2.156.8minor~***

2026-10-274 days ago

Kargov1.9.16patch*Kargo v1.9.16 was released. The condensed notes list 16 changes, of which one is a fix: publishing best-releases.json on 1.9 releases. The remaining 15 are maintenance items such as dependency bumps, CI, tests and docs.platform teamsPlatform teams running Kargo 1.9 see a fix to release metadata publication, with no change to deployment behavior described in the notes. Nothing in the source indicates a breaking change.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

2026-10-265 days ago

Fluxv2.10.0minorbreaking++~~~~~~~~~~~~~~~*Flux v2.10.0 shipped with 94 changes: 10 added, 73 changed, 4 fixed, and 4 marked breaking. Breaking changes include object identity always on with a narrowed default RBAC (no create on serviceaccounts/token), notification Alert and Provider APIs promoted to v1 with dropped v1beta3 fields, the artifact storage backend becoming the default for ImageRepository tag database, and a change to kubeConfig audiences key. The release also adds SPIFFE mTLS between controllers, OCIRepository as a HelmRelease chart source, and Zoom, incident.io and Mastodon notification providers, and updates Kubernetes to 1.37 and Go to 1.27.platform teamsPlatform teams upgrading Flux must bind a ClusterRole with serviceaccounts/token create permission to the controller ServiceAccount if they rely on default RBAC, and migrate v1beta3 notification resources to v1. Expect a full ImageRepository rescan after upgrade unless FluxStorage=false is set.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

2026-10-238 days ago

Tektonv1.17.1patch*Pipeline release v1.17.1 "Egyptian Mau Robocop"Tekton Pipelines released v1.17.1. The release notes list one fix, which bumps the plumbing ko image to Go 1.27.3, and one other change updating examples to v1.17.1.platform teamsThe fix only changes the build toolchain image used for plumbing, so runtime behavior of Tekton Pipelines is not described as changed. Platform teams can treat this as a routine patch upgrade.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Tektonv1.15.5patch*Pipeline release v1.15.5 "Toyger Orisa" LTSTekton Pipelines v1.15.5, an LTS patch release, was published. The condensed notes list one fix that bumps the plumbing ko image to Go 1.27.3, plus an examples update, with 15 maintenance changes omitted.platform teamsThe only fix is a toolchain bump in build plumbing, not a change to pipeline runtime behavior, so platform teams on the v1.15 LTS line can take it as a routine patch. The source text does not describe any security content.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Tektonv1.12.3patch**Pipeline release v1.12.3 "Exotic Shorthair Elektrobots LTS"Tekton Pipelines v1.12.3 was released. The condensed notes list 53 changes, of which 50 are maintenance items such as dependency bumps, CI, tests and docs. The two fixes are a change to the release process that copies the vendor tarball into kodata instead of using a symlink, and a bump of the plumbing ko image to Go 1.27.3.platform teamsTeams running Tekton get a patch release with no new features or breaking changes listed in the notes. The Go toolchain bump is a build-time change to the plumbing image, and the release-process fix affects how the release artifacts are packaged.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Tektonv1.9.9patch**Pipeline release v1.9.9 "Devon Rex Dreadnought"Tekton Pipelines v1.9.9 was released. The condensed notes list two fixes: the release process now copies the vendor tarball into kodata instead of using a symlink, and the plumbing ko image was bumped to Go 1.27.3. The release also includes an Examples update, and 14 maintenance changes were omitted from the notes.platform teamsPlatform teams running Tekton can take this as a routine patch with no described change to pipeline behavior or APIs. The Go toolchain bump affects build tooling rather than the runtime features teams use.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Tektonv1.6.8patch**Pipeline release v1.6.8 "Sphynx Sentinels"Tekton Pipelines v1.6.8 shipped with two fixes on the release-v1.6.x branch. One change copies the vendor tarball into kodata instead of using a symlink, and the other bumps the plumbing ko image to Go 1.27.3. The release also includes an examples update and eleven maintenance changes such as dependency bumps, CI, tests and docs.platform teamsPlatform teams running Tekton v1.6.x get build-process fixes with no described change to pipeline behavior or APIs. The Go toolchain bump affects the build tooling only, so no action is indicated beyond routine upgrading.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Terraform MCP Serverv1.4.0minor

2026-10-229 days ago

Kubernetes MCP Serverv0.0.68patchbreaking++++++++++-********

ServiceNow SDK4.14.0minorsecurity~~***************!SDK 4.14.0ServiceNow SDK 4.14.0 changes how credentials are stored: they are now encrypted with AES-256-GCM in a local file under ~/.now-sdk/credentials.enc, with only a 32-byte key kept in the OS keychain. A new SN_SDK_CREDENTIALS_DIR variable sets the credentials directory. The release also lists one security fix that preserves Sys_dictionary security roles through transform and build, along with about 19 fixes to transform and build behavior.platform teamsTeams that run the SDK in CI or on shared machines should check where credentials.enc is written and whether SN_SDK_CREDENTIALS_DIR is needed for their runners. Pipelines that rely on the previous credential storage location may need updating.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Argo CDv3.3.18patchsecurity!Argo CD v3.3.18 was released with two changes listed: one security item and one maintenance change. The security item is titled as an Emudhra CA certificates compromise for release 3.3. The source text gives no further detail on what was affected or how it was fixed.platform teamsPlatform teams running Argo CD 3.3 should review the release notes and apply the patch release. The source does not say whether the fix is in Argo CD code or only in bundled certificate data.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Crossplanev2.4.3patchsecurity++++*!!!!!Crossplane v2.4.3 updates the Go toolchain to 1.26.10, which rejects certificates from compromised eMudhra intermediate CAs (CVE-2026-111943), and removes the AAA Certificate Services and emSign ECC Root CA - G3 roots from the image CA bundle. The release also bundles dependency security updates and fixes a bug where a failed, partial package download could be cached as a valid package. Users with crossplane-edit or crossplane-admin access can now kubectl scale XRs and claims whose XRD serves the scale subresource.platform teamsPlatform teams running Crossplane should upgrade to pick up the Go toolchain and dependency CVE fixes and the discarded-truncated-download fix, which could otherwise leave providers in a crash loop. Teams relying on the scale subresource need to note that edit and admin roles can now scale XRs and claims.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Crossplane2.3.7patchsecurity+++++**!!!!!!Crossplane v2.3.7 bumps the Go toolchain to 1.26.10 so that crypto/x509 rejects the compromised eMudhra intermediate certificates (CVE-2026-111943), and removes the AAA Certificate Services and emSign ECC Root CA - G3 roots from the image's CA bundle. The release also updates vulnerable dependencies, including otlptrace v1.45.0. Fixes include discarding truncated package downloads, failing claims closed when their XRD cannot be listed, and stopping repeated in-use label writes on Usage reconciles.platform teamsPlatform teams running Crossplane should upgrade to pick up the trust store change and the fix for truncated package downloads, which could leave a provider crash-looping. Claims that cannot list their XRD now report ReconcileError instead of honoring a compositionRef.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Crossplanev2.2.7patchsecurity++*!!!!!!Crossplane v2.2.7 ships a Go toolchain bump to 1.26.10, which makes crypto/x509 reject certificates from compromised eMudhra intermediate CAs (CVE-2026-111943), and removes the AAA Certificate Services and emSign ECC Root CA - G3 roots from the image's CA bundle. It also updates golang.org/x/net to v0.60.0, the OpenTelemetry OTLP trace exporter to v1.45.0, and crossplane-runtime to v2.2.5 to pick up upstream CVE fixes. Two fixes stop truncated package downloads from being cached and stop the in-use label from being rewritten on every Usage reconcile.platform teamsPlatform teams running Crossplane should upgrade to pick up the dependency CVE fixes and the fix that prevents truncated provider packages from being cached and crash-looping providers. The Usage change reduces needless API writes on every reconcile.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Crossplanev1.20.14patchsecurity!!!!!!!Crossplane v1.20.14 ships on the release-1.20 branch. The release updates the Go toolchain to 1.26.10 so crypto/x509 rejects certificates from the compromised eMudhra intermediate CAs, and removes the AAA Certificate Services and emSign ECC Root CA - G3 roots from the image CA bundle by moving to a newer distroless/static base image. It also bumps golang.org/x/net to v0.60.0, OpenTelemetry OTLP trace HTTP exporter to v1.45.0, and crossplane-runtime to v1.20.12 to pick up upstream CVE fixes.platform teamsPlatform teams running Crossplane 1.20 should upgrade to pick up the CA trust removal and dependency CVE fixes. The release notes do not describe a vulnerability in Crossplane's own code, so the security content is toolchain and dependency updates.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Pulumiv3.272.0minor+++++**Pulumi v3.272.0 collapses policy violations that an exception exempts into one line per policy, and adds a --show-policy-exceptions flag to up and preview to list them with their exceptions. It adds an AwaitError provider protocol error that lets a deployment continue with unknown outputs and exits the CLI with code 10. It also adds pulumi env change-request commands and an --organization/-o option for env setup commands. Two fixes cover a clearer error message for missing project files and keeping unknown outputs from remote components instead of resolving them as empty values.platform teamsPlatform teams using Pulumi policy packs get less noisy output for exempted violations, and CI jobs that check exit codes gain an ExitAwaitError code (10) to handle when a resource needs awaiting. Teams using Pulumi Cloud environments can manage change requests from the CLI.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

2026-10-2110 days ago

OpenTofuv1.13.2patchsecurity****!!OpenTofu v1.13.2 was released with six changes, two of them security-related. One fixes excessive CPU usage when tofu init connects to an attacker-controlled HTTP2 server during dependency installation. Another filters out compromised intermediate certificates, and four fixes cover lifecycle destroy crashes, workspace autocompletion, the -chdir and -version flag combination, and symbol libraries in plan files.platform teamsTeams running tofu init against untrusted or internal HTTP2 registries should upgrade to pick up the CPU exhaustion fix. Pipelines that apply saved plan files no longer fail when symbol libraries are present.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

OpenTofu1.12.9patchsecurity!OpenTofu v1.12.9 was published with one security change: it filters out compromised intermediate certificates. The release notes do not describe the affected code path or the certificate trust mechanism in further detail.platform teamsPlatform teams running OpenTofu should plan to upgrade to pick up the certificate filtering. The source does not say whether the fix affects provider downloads or state backends.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

K8sGPTv0.4.41patchsecurity+++**********!!!K8sGPT v0.4.41 was released with three dependency security updates, including containerd v1.7.36, spdystream v0.5.1 and otel sdk v1.45.0. It adds Claude 4.5 and 5.x model support for Amazon Bedrock, the ability to source customHeaders from the config file, and a prompt to auto-pull missing Ollama models. The release also fixes ten analyzer and completion issues, covering StatefulSet claim templates, NetworkPolicy selectors, Gateway API namespace filters, HTTPRoute namespace selectors, node-problem-detector conditions, and Kyverno ClusterPolicyReports.platform teamsPlatform teams running K8sGPT get fewer false or missed findings for NetworkPolicy, Gateway API and Kyverno reports after upgrading. The security items are dependency bumps rather than fixes in K8sGPT's own code.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Pulumiv3.271.0minor++++++*********Pulumi v3.271.0 adds an id field to ReadResourceResponse so providers can return a resolved id that differs from the requested one, and adds state and env commands to the generated automation APIs for NodeJS, Python and Go. It also introduces version 2 of the --policy-pack-config format, which nests policy configs under policies and adds an exceptions field. Fixes include redacting secret values in invalid input diagnostics unless --show-secrets is passed, and resolving failed outputs as unknown under --continue-on-error.platform teamsTeams using policy packs need to migrate to the version 2 policy-pack-config format to use the new exceptions field. Teams relying on automation APIs gain state and env commands, and secret values in diagnostics are now redacted by default.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Salesforce CLI2.155.7minor***

2026-10-2011 days ago

Backstagev1.56.0minorsecurity++++++++++++++++++!Backstage v1.56.0 ships 53 changes, including a new AppLifecycleApi for checking app finalization and subscribing to lifecycle changes, and a fix so useRouteRef resolves routes after finalization. Other changes cover catalog fixes, a Cloud SQL retry for transient connection failures, an AWS RDS IAM token expiry fix, a Bitbucket Cloud bearer token option, and a Gitea default-branch fix. The release also moves @backstage/catalog-model to zod version 4, which requires adding zod to packages that use it without declaring it.platform teamsTeams running Backstage should check custom packages that import zod without declaring it, since catalog-model now uses zod 4. Plugin authors gain AppLifecycleApi to gate rendering on app finalization.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

Kyvernov1.19.2patchsecurity+~*********!!!!!!!

Jenkins2.587minor*****Jenkins 2.587 was released with five bug fixes. The fixes cover help text for the quiet-down block, caching of label expressions for load statistics, concise error display on form validation failures during page load, job name matching in global search suggestions, and preservation of ANSI colours in the live console after output pauses.platform teamsTeams running Jenkins controllers get fixes to UI behaviour and console output, with no changes to pipeline APIs or configuration called out in the source. Label-related load statistics now share cached results, which may matter for teams with heavy label usage.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules

older entries

daily email

statuslast 30 days for lines

tools tracked43releases in registry964released in the last 30 days108entries published335breaking change lines18security lines84

change typestwo-column gutter, like git status

+addedNew functionality.
~changedExisting behavior changed.
-deprecatedStill works, scheduled for removal.
-removedDecommissioned, gone in this version.
*fixedA defect corrected.
!securityA vulnerability closed or a dependency patched for one.
!breakingFlag in the first column; the change needs action before upgrading.

filter

categoryall idp & portals ai agents on platform ci/cd observability supply chain cost & governance reports & dx data enterprise app platforms

showmajor only releases case studies postmortems include patches

Platform Changelog: what shipped in platform engineering, developer experience and DevOps