platformchangelog.dev
43 tools

Platform Changelog: what shipped in platform engineering, developer experience and DevOps

feedsince 2026-10-20all releases, patches included
2026-10-274 days ago
Kargov1.12.5patch
2026-10-265 days ago
Fluxv2.10.0minorbreaking++~~~~~~~~~~~~~~~*Flux v2.10.0 shipped with 94 changes: 10 added, 73 changed, 4 fixed, and 4 marked breaking. Breaking changes include object identity always on with a narrowed default RBAC (no create on serviceaccounts/token), notification Alert and Provider APIs promoted to v1 with dropped v1beta3 fields, the artifact storage backend becoming the default for ImageRepository tag database, and a change to kubeConfig audiences key. The release also adds SPIFFE mTLS between controllers, OCIRepository as a HelmRelease chart source, and Zoom, incident.io and Mastodon notification providers, and updates Kubernetes to 1.37 and Go to 1.27.platform teamsPlatform teams upgrading Flux must bind a ClusterRole with serviceaccounts/token create permission to the controller ServiceAccount if they rely on default RBAC, and migrate v1beta3 notification resources to v1. Expect a full ImageRepository rescan after upgrade unless FluxStorage=false is set.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
2026-10-238 days ago
Open Policy Agentv1.21.4patch
ServiceNow SDK4.14.0minorsecurity~~***************!SDK 4.14.0ServiceNow SDK 4.14.0 changes how credentials are stored: they are now encrypted with AES-256-GCM in a local file under ~/.now-sdk/credentials.enc, with only a 32-byte key kept in the OS keychain. A new SN_SDK_CREDENTIALS_DIR variable sets the credentials directory. The release also lists one security fix that preserves Sys_dictionary security roles through transform and build, along with about 19 fixes to transform and build behavior.platform teamsTeams that run the SDK in CI or on shared machines should check where credentials.enc is written and whether SN_SDK_CREDENTIALS_DIR is needed for their runners. Pipelines that rely on the previous credential storage location may need updating.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Crossplanev2.4.3patchsecurity++++*!!!!!Crossplane v2.4.3 updates the Go toolchain to 1.26.10, which rejects certificates from compromised eMudhra intermediate CAs (CVE-2026-111943), and removes the AAA Certificate Services and emSign ECC Root CA - G3 roots from the image CA bundle. The release also bundles dependency security updates and fixes a bug where a failed, partial package download could be cached as a valid package. Users with crossplane-edit or crossplane-admin access can now kubectl scale XRs and claims whose XRD serves the scale subresource.platform teamsPlatform teams running Crossplane should upgrade to pick up the Go toolchain and dependency CVE fixes and the discarded-truncated-download fix, which could otherwise leave providers in a crash loop. Teams relying on the scale subresource need to note that edit and admin roles can now scale XRs and claims.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Crossplane2.3.7patchsecurity+++++**!!!!!!Crossplane v2.3.7 bumps the Go toolchain to 1.26.10 so that crypto/x509 rejects the compromised eMudhra intermediate certificates (CVE-2026-111943), and removes the AAA Certificate Services and emSign ECC Root CA - G3 roots from the image's CA bundle. The release also updates vulnerable dependencies, including otlptrace v1.45.0. Fixes include discarding truncated package downloads, failing claims closed when their XRD cannot be listed, and stopping repeated in-use label writes on Usage reconciles.platform teamsPlatform teams running Crossplane should upgrade to pick up the trust store change and the fix for truncated package downloads, which could leave a provider crash-looping. Claims that cannot list their XRD now report ReconcileError instead of honoring a compositionRef.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Crossplanev2.2.7patchsecurity++*!!!!!!Crossplane v2.2.7 ships a Go toolchain bump to 1.26.10, which makes crypto/x509 reject certificates from compromised eMudhra intermediate CAs (CVE-2026-111943), and removes the AAA Certificate Services and emSign ECC Root CA - G3 roots from the image's CA bundle. It also updates golang.org/x/net to v0.60.0, the OpenTelemetry OTLP trace exporter to v1.45.0, and crossplane-runtime to v2.2.5 to pick up upstream CVE fixes. Two fixes stop truncated package downloads from being cached and stop the in-use label from being rewritten on every Usage reconcile.platform teamsPlatform teams running Crossplane should upgrade to pick up the dependency CVE fixes and the fix that prevents truncated provider packages from being cached and crash-looping providers. The Usage change reduces needless API writes on every reconcile.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Crossplanev1.20.14patchsecurity!!!!!!!Crossplane v1.20.14 ships on the release-1.20 branch. The release updates the Go toolchain to 1.26.10 so crypto/x509 rejects certificates from the compromised eMudhra intermediate CAs, and removes the AAA Certificate Services and emSign ECC Root CA - G3 roots from the image CA bundle by moving to a newer distroless/static base image. It also bumps golang.org/x/net to v0.60.0, OpenTelemetry OTLP trace HTTP exporter to v1.45.0, and crossplane-runtime to v1.20.12 to pick up upstream CVE fixes.platform teamsPlatform teams running Crossplane 1.20 should upgrade to pick up the CA trust removal and dependency CVE fixes. The release notes do not describe a vulnerability in Crossplane's own code, so the security content is toolchain and dependency updates.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Pulumiv3.272.0minor+++++**Pulumi v3.272.0 collapses policy violations that an exception exempts into one line per policy, and adds a --show-policy-exceptions flag to up and preview to list them with their exceptions. It adds an AwaitError provider protocol error that lets a deployment continue with unknown outputs and exits the CLI with code 10. It also adds pulumi env change-request commands and an --organization/-o option for env setup commands. Two fixes cover a clearer error message for missing project files and keeping unknown outputs from remote components instead of resolving them as empty values.platform teamsPlatform teams using Pulumi policy packs get less noisy output for exempted violations, and CI jobs that check exit codes gain an ExitAwaitError code (10) to handle when a resource needs awaiting. Teams using Pulumi Cloud environments can manage change requests from the CLI.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
K8sGPTv0.4.41patchsecurity+++**********!!!K8sGPT v0.4.41 was released with three dependency security updates, including containerd v1.7.36, spdystream v0.5.1 and otel sdk v1.45.0. It adds Claude 4.5 and 5.x model support for Amazon Bedrock, the ability to source customHeaders from the config file, and a prompt to auto-pull missing Ollama models. The release also fixes ten analyzer and completion issues, covering StatefulSet claim templates, NetworkPolicy selectors, Gateway API namespace filters, HTTPRoute namespace selectors, node-problem-detector conditions, and Kyverno ClusterPolicyReports.platform teamsPlatform teams running K8sGPT get fewer false or missed findings for NetworkPolicy, Gateway API and Kyverno reports after upgrading. The security items are dependency bumps rather than fixes in K8sGPT's own code.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Pulumiv3.271.0minor++++++*********Pulumi v3.271.0 adds an id field to ReadResourceResponse so providers can return a resolved id that differs from the requested one, and adds state and env commands to the generated automation APIs for NodeJS, Python and Go. It also introduces version 2 of the --policy-pack-config format, which nests policy configs under policies and adds an exceptions field. Fixes include redacting secret values in invalid input diagnostics unless --show-secrets is passed, and resolving failed outputs as unknown under --continue-on-error.platform teamsTeams using policy packs need to migrate to the version 2 policy-pack-config format to use the new exceptions field. Teams relying on automation APIs gain state and env commands, and secret values in diagnostics are now redacted by default.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
2026-10-2011 days ago
Backstagev1.56.0minorsecurity++++++++++++++++++!Backstage v1.56.0 ships 53 changes, including a new AppLifecycleApi for checking app finalization and subscribing to lifecycle changes, and a fix so useRouteRef resolves routes after finalization. Other changes cover catalog fixes, a Cloud SQL retry for transient connection failures, an AWS RDS IAM token expiry fix, a Bitbucket Cloud bearer token option, and a Gitea default-branch fix. The release also moves @backstage/catalog-model to zod version 4, which requires adding zod to packages that use it without declaring it.platform teamsTeams running Backstage should check custom packages that import zod without declaring it, since catalog-model now uses zod 4. Plugin authors gain AppLifecycleApi to gate rendering on app finalization.written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
daily email

One short email each morning: what shipped, what breaks, and a link to each change. Unsubscribe in one click. Privacy.

statuslast 30 days for lines
tools tracked43releases in registry964released in the last 30 days106entries published335breaking change lines18security lines84
change typestwo-column gutter, like git status
  • +addedNew functionality.
  • ~changedExisting behavior changed.
  • -deprecatedStill works, scheduled for removal.
  • -removedDecommissioned, gone in this version.
  • *fixedA defect corrected.
  • !securityA vulnerability closed or a dependency patched for one.
  • !breakingFlag in the first column; the change needs action before upgrading.
filter
categoryallidp & portalsai agents on platformci/cdobservabilitysupply chaincost & governancereports & dx dataenterprise app platforms
showmajor onlyreleasescase studiespostmortemsinclude patches