Deprecation and shutdown of GenAI Incident Summary (generative AI Insights)
The standalone GenAI Incident Summary (generative AI Insights) feature in Apigee Advanced API Security Abuse Detection, currently in Preview, is deprecated and shut down as of July 9, 2026. This feature used Google Cloud generative AI large language models (LLMs) to provide automated summaries and mitigation guidance for security incidents identified by the Abuse Detection clustering tool.
For more information, see GenAI Incident Summary deprecation.
The Cloud Deploy image now uses a Google-specific fork of Skaffold. The
Skaffold version that you see if you run gcloud deploy releases describe, or
if you view the release in the Google Cloud Console, is now cd-skaffold
instead of a version number.
Google Distributed Cloud (software only) for VMware 1.33.1000-gke.59 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud 1.33.1000-gke.59 runs on Kubernetes v1.33.11-gke.100.
If you use a third-party storage vendor, check the listing of our previously-qualified storage partners.
After a release, it takes approximately 7 to 14 days for the version to become available for use with GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.
The following patches were skipped:
The following issues were fixed in 1.33.1000-gke.59:
Google Distributed Cloud (software only) for bare metal 1.33.1000-gke.59 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.33.1000-gke.59 runs on Kubernetes v1.33.11-gke.100.
After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.
If you use a third-party storage vendor, check the listing of our previously-qualified storage partners.
The following issues were fixed in 1.33.1000-gke.59:
Include and exclude spoke filters for hybrid spokes are generally available.
You can use export filters to control which subnets or routes a spoke can send to the hub. Import filters control which subnets or routes can be accepted by a spoke from the hub.
]]>You can use the BigQuery Data Transfer Service to transfer metadata from the following data sources into Knowledge Catalog:
This feature is in Preview.
The Data Agent Kit extension is an extension for agent coding tools, such as VS Code, Antigravity, and Cursor, that lets you interact with BigQuery resources directly in your agent environment. You can use this extension to browse datasets, manage pipelines, run queries, and prompt your agent to perform other BigQuery tasks directly in your preferred IDE. This feature is in Preview.
Support for hybrid search (using the VECTOR_SEARCH function to combine a
semantic search with a lexical (keyword) search) has been temporarily disabled.
We are working to restore this feature as soon as possible.
You can use the Bigtable client library for Go to execute read jobs and queries using Data Boost.
Preview: Advanced Compute Images provide high-performance images to support your artificial intelligence (AI), machine learning (ML), and high-performance computing (HPC) workloads on Google Cloud.
Advanced Compute Images provide a single source of trusted, performance-tuned OS images that remove the need for manual image building for specialized workloads. Each image version is pre-installed with the necessary drivers, network fabrics, and Slurm agents to help you run your workloads.
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.6.143 | v24.0.9 | v1.7.31 | See List |
Upgraded app-admin/oslogin to v20260626.00.
Upgraded app-containers/docker-credential-helpers to v0.9.8.
Upgraded dev-db/sqlite to v3.53.3.
Upgraded dev-libs/expat to v2.8.2.
Upgraded sys-apps/acl to v2.4.0.
Fixed CVE-2026-53359 in the Linux kernel.
Fixed KCTF-d82ba05 in the Linux kernel.
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.12.94 | v27.5.1 | v2.1.7 | See List |
Added support for NVIDIA GRID driver version 580.159.03.
Fixed CVE-2026-40225 in sys-apps/systemd.
Fixed CVE-2026-53167 in the Linux kernel.
Fixed CVE-2026-53359 in the Linux kernel.
Fixed KCTF-d82ba05 in the Linux kernel.
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.12.94 | v27.5.1 | v2.2.3 | See List |
Added support for NVIDIA GRID driver version 580.159.03.
Fixed CVE-2026-53359 in the Linux kernel.
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.6.143 | v27.5.1 | v2.0.8 | See List |
Fixed CVE-2026-53359 in the Linux kernel.
Fixed KCTF-d82ba05 in the Linux kernel.
Gemini Enterprise: Enable skills feature management toggle is not available
The Enable skills feature management toggle is not available. This feature is generally available (GA) with an allowlist in Gemini Enterprise. After your organization is added to the allowlist, end users can create and use skills directly in the app. To access this feature, contact your Google account manager.
We will update the release notes when the Enable skills toggle for administrators is available.
Gemini Enterprise: AlphaEvolve algorithm optimization agent (GA)
The AlphaEvolve optimization service is generally available (GA) on the Gemini Enterprise agent. AlphaEvolve is a code optimization and discovery agent built on top of Gemini that helps solve the hardest algorithmic problems for your business and research. It combines creative, server-side LLM exploration with secure client-side code execution to autonomously discover new, optimized solutions that surpass human-designed baselines.
For more information, see AlphaEvolve documentation.
Retirement for preview models for 2.5 Flash, 2.5 Flash-Lite, and 3.1 Flash-Lite
The following preview model endpoints have been retired and are no longer accessible:
gemini-2.5-flash-lite-preview-09-2025gemini-2.5-flash-preview-05-2025gemini-3.1-flash-lite-previewSee Migrate to the latest Google models for information on how to migrate your project.
There are no version updates for 2026-R27.
There are no version updates for 2026-R27.
There are no version updates for 2026-R27.
There are no version updates for 2026-R27.
There are no version updates for 2026-R27.
There are no version updates for 2026-R27.
GKE cluster versions have been updated.
New versions available for upgrades and new clusters.
The following versions are now available for new GKE clusters, and for manual control plane upgrades and node upgrades for existing clusters. For more information about versioning and upgrades, see GKE versioning and support and About GKE cluster upgrades.
Knowledge Catalog connectors for importing metadata from SQL Server and PostgreSQL data sources are available in Preview.
Knowledge Catalog connectors automatically extract metadata (technical, operational, and business) from external data sources and import it into Knowledge Catalog entry groups. You can schedule metadata import runs on a set schedule.
For more information, see About database connectors and Manage connector jobs.
Looker 26.12 will roll out to Looker (original) instances on the following schedule:
Looker 26.12 is expected to include the following changes, features, and fixes.
An issue has been fixed where accessing a folder that contained scheduled content that was configured for disabled integrations could cause Looker to crash with a TypeError. This feature now performs as expected.
An issue has been fixed where users with only the Admin via IAM role on Looker (Google Cloud Core) instances would incorrectly lack access to connections when Advanced Control Governance (ACG) was enabled. This feature now performs as expected.
Layout spacing and column alignment issues have been fixed on the OIDC and SAML authentication Admin pages. These features now perform as expected.
An issue has been fixed where clicking Reset Styles in the table visualization formatting panel would unexpectedly reset the table theme, color palette, and custom borders. This feature now performs as expected.
An issue has been fixed where the Workflows page was not visible to users with the create_alerts permission. This feature now performs as expected.
An issue has been fixed where the comparison value in a KPI visualization could be incorrectly centered when the sparkline was disabled. This feature now performs as expected.
The KPI Visualization preview feature is now enabled by default.
The Increased Row Limit feature is now out of labs and generally available.
An issue has been fixed where the LookML validator used a stale cache for local project dependencies when the dependencies were updated in production. This feature now performs as expected.
An issue has been fixed where some custom visualizations could be cut off in PDF exports. This feature now performs as expected.
An issue has been fixed where, if a dashboard tile contained no results, the row_total table calculation function could return an error, which would prevent scheduled deliveries. This feature now performs as expected.
An issue has been fixed where the commit hash in the Deploy Manager displayed PENDING during compilation and didn't update upon refresh. This feature now performs as expected.
An issue has been fixed where drilling down on a value for which the custom value format contained the # character could cause the page to crash. This feature now performs as expected.
An issue has been fixed where inline button toggle filters on dashboards could be cut off or could overlap with adjacent filters. This feature now performs as expected.
An issue has been fixed where deleting a duplicated dashboard tab would incorrectly delete shared elements from other tabs. This feature now performs as expected.
An issue has been fixed where the column limit could fail to apply to an Explore that used pivots. This feature now performs as expected.
An issue has been fixed where added_params metadata in streaming JSON responses could be malformed or missing. This feature now performs as expected.
An issue has been fixed where OAuth connections would incorrectly fail connection tests on the Self-service Explores Admin page. This feature now performs as expected.
An issue has been fixed where the Run and Settings buttons were not correctly being displayed on embedded Explores with the _theme URL parameter. This feature now performs as expected.
An issue has been fixed where the Content Validator returned a generic error message instead of returning the specific models that were affected. This feature now performs as expected.
An issue has been fixed where drilling into a value while in Dev mode could return a 500 internal server error. This feature now performs as expected.
An issue has been fixed where API calls that were made by service account users without a configured last name failed with a 500 internal server error. This feature now performs as expected.
An issue has been fixed where view.field references in Liquid were not correctly rendered if the field name matched a built-in Liquid variable. This feature now performs as expected.
An issue has been fixed where autosizing table columns didn't work as expected in drill menus. This feature now performs as expected.
An issue has been fixed where drill modals could repeatedly render a visualization, which would present as constant flickering in the browser. This feature now performs as expected.
An issue has been fixed where invalid parameters in an embed URL could result in Looker displaying an unnecessarily verbose stack trace instead of a concise error. This feature now performs as expected.
An issue has been fixed where editing a workflow on the Workflow Management page could load indefinitely. This feature now performs as expected.
An issue has been fixed where clearing the Totals Labels option for the Totals Color setting in the color picker resulted in black text in the chart. This feature now performs as expected.
The OAuth interface now prohibits forward slashes in the OAuth Client ID field. Previously, the inclusion of one or more forward slashes would result in a 401 error. This feature now performs as expected.
Looker CI Run Alert emails now include the Run ID in the subject line to prevent email threading. The email body now includes the Git branch and commit details.
Looker (Google Cloud core) now supports FIPS 140-3 level 1 compliance. Existing FIPS 140-2 compliant instances will be automatically upgraded to the FIPS 140-3 standard when they're upgraded to Looker 26.12.
Now available in preview, the Table Row Grouping feature option for table charts lets users display table chart data hierarchically in groups and customize the appearance with new Grouping menu options. This feature is enabled by default.
You can modify the data residency and data encryption configuration on the Premium and Standard tiers after you activate Security Command Center for your organization. For more information, see Modify data residency or data encryption configuration.
]]>External search with AlloyDB now supports Apache Solr in Preview.
You can use the external_search_fdw extension to connect to a Solr cluster and query its data directly from your database.
An Improper Input Validation vulnerability in BigQuery DAO in Google Cloud Apigee versions prior to 2026-06-12 on Google Cloud Platform allowed an authenticated attacker to exfiltrate cross-tenant data.
This vulnerability was patched on 12 June 2026 on the Apigee Servers, and no customer action is needed. Apigee hybrid was not affected.
For more information, see CVE-2026-12879.
An updated version of the Simba ODBC driver for BigQuery is now available.
You can now perform multi-level aggregation in GoogleSQL, which lets you use an aggregate function as an argument to another aggregate function. This feature is in Preview.
Cloud Run sandboxes provide a fast and secure isolated environment to execute untrusted code, such as code generated by AI agents. For more information, see Configure sandboxes for services and Code execution in Cloud Run (Preview).
The base VM for your workstation includes the Content-Addressable Storage File System (CASFS) kernel module, which lets you run the Android Build File System (ABFS). For more information about the introduction of this module, see the Container-Optimized OS Milestone 129 LTS release notes.
The Data Agent Toolkit Extension is installed by default in Code OSS for Cloud Workstations.
Generally available: The network-optimized C4N machine series is generally available for Compute Engine and Google Kubernetes Engine (GKE) customers. Powered by 5th generation Intel Xeon Scalable processors (Emerald Rapids), C4N instances are purpose-built for network- and block storage-intensive workloads such as:
The C4N machine series delivers the highest I/O performance available in Compute Engine, supporting up to 400Â Gbps of network bandwidth and up to 95 million packets per second (Mpps) of sustained packet processing performance. C4N also offers leading block storage performance with Hyperdisk Extreme that scales up to 25Â GiB/s of bandwidth and 1M IOPS. C4N instances are available in predefined machine shapes with three different vCPU to memory ratios, ranging in size from 2 to 192 vCPUs and up to 1,488 GB of DDR5 memory.
For C4N machine types with attached Local SSD disks, you can Request preview access.
For more information, see C4N machine series.
Grok 4.1 models deprecation
The Grok 4.1 model family (including xai/grok-4.1-fast-reasoning and xai/grok-4.1-fast-non-reasoning) on the Gemini Enterprise Agent Platform is deprecated and will be shut down on August 20, 2026. After this date, Google Agent Platform Model as a Service (MaaS) will no longer serve these models. Specifically, API requests directed to the https://aiplatform.googleapis.com/v1/projects/<your-project>/locations/global/endpoints/openapi/chat/completions endpoint using the Grok 4.1 model IDs will fail and return a 400 error. To maintain service, migrate your applications to newer xAI models (such as Grok 4.2 or Grok 4.3) or choose an alternative model from the Google Cloud Model Garden.
Memory Bank support for Gemini Embedding 2
Memory Bank supports the gemini-embedding-2 model for similarity search configurations.
When you configure gemini-embedding-2 as the embedding model, you must use one of the global, us, or eu endpoints in the model's resource name (for example, projects/{project}/locations/us/publishers/google/models/gemini-embedding-2). Memory Bank does not support using regional locations (for example, us-central1) for gemini-embedding-2.
For details, see Similarity search configuration.
Memory Bank IngestEvents is generally available (GA)
The Memory Bank IngestEvents API is generally available. The IngestEvents API decouples event ingestion from memory generation, letting you continuously stream content to Memory Bank and configure when memory generation is triggered.
This GA release includes the following features:
overlap_event_count parameter to re-include already-processed events at the start of the next window to keep memories coherent.revision_labels, revision_ttl, or disable_memory_revisions to customize how generated revisions are managed.metadata and metadata_merge_strategy configuration parameters to store structured information alongside generated memories.For details, see Ingest events.
Cloud Armor preconfigured rules support ModSecurity Core Rule Set (CRS) 4.22 as a rule source. For more information, see Tuning Google Cloud Armor WAF rules. This feature is Generally Available.
Preview: You can configure disaster recovery for Google Cloud VMware Engine by using JetStream. Disaster recovery options include the following:
For more information, see Configure disaster recovery using JetStream.
Generally available: Google Cloud VMware Engine offers self-service management for customer-managed encryption keys (CMEK) using the Google Cloud console and the VMware Engine API. You can enable CMEK for your private clouds, using Cloud Key Management Service (Cloud KMS) to manage encryption keys for vSAN and vTPM. Key features and considerations include:
Limitations: This self-service functionality is unavailable for private clouds that use CMEK through service tickets.
The network-optimized C4N machine series is available with GKE clusters running 1.36.0-gke.3009002 or later. You can use C4N machine types in Standard or Autopilot mode.
FileUtilities: Version 27.0
Added support for extracting files from .7z archives in the following action:
Google Threat Intelligence: Version 17.0
Fixed widget rendering failures by escaping raw HTML script tags within
extended_response_body in the following action:
Google Chronicle: Version 87.0
Improved case and alert synchronization logic by fixing the verification handling of valid external ID values in the following job:
Connectivity Tests analyzes Proxy Network Load Balancers that are configured with Server Name Indication (SNI) routing for TLS traffic.
]]>To modernize image processing, migrate from the App Engine Images service to Cloud Run by routing calls to a Cloud Run image transformation service while your app continues to run on App Engine (Preview).
To modernize image processing, migrate from the App Engine Images service to Cloud Run by routing calls to a Cloud Run image transformation service while your app continues to run on App Engine (Preview).
You can bind existing tags to Bigtable instances when you create an instance and use policies to enforce mandatory tag assignments. This feature is generally available (GA). For more information, see Create an instance.
The Bigtable agent skill (bigtable-basics) is
generally available (GA)
in the public Google Agent Skills repository.
This skill lets you equip AI agents with capabilities for Bigtable tasks, such as
provisioning instances and tables, designing schemas, querying data using
GoogleSQL and key-value APIs, and diagnosing performance issues or hotspots.
You can use Organization Policy Service custom constraints to manage specific operations on continuous materialized views. This feature is generally available (GA). For more information, see Use custom organization policies.
The Cloud KMS overview dashboard Asymmetric PQC insights chart is generally available. You can use the Asymmetric PQC insights chart and details view to identify how many and which of your asymmetric keys are susceptible to attacks from future quantum computers. This information is an important input into your quantum computing modernization planning and process.
For more information about the Asymmetric PQC insights chart, see View asymmetric post-quantum cryptography (PQC) insights.
Gemini Enterprise: Managed organization policy constraints for data connectors (GA)
You can now use managed organization policy constraints to secure and control your data connectors in Gemini Enterprise.
With this release, the following constraints are generally available (GA):
For an overview of these policies and how they interact, see Overview of managed policy constraints.
Google Cloud CCaaS prerelease notes
Here are the pre-release notes for the next version of Google Cloud CCaaS. When we release this version, we expect the new capabilities to be as shown here.
Direct Access Points for chats
You can use a Direct Access Point (DAP) to route a chat conversation directly to a queue, based on the response from an API that you configure. This lets API-initiated chats bypass default routing and enter the intended queue immediately.
Fixed an issue where the inactive chat dismissal timer didn't reset after a chat was transferred from a virtual agent to a human agent.
Fixed an issue where voicemails disappeared from the queue immediately after being opened.
Fixed an issue where the reporting dashboard incorrectly displayed call and agent status during a cold transfer to another queue.
Improved rendering performance in the agent desktop mini chat adapter.
Fixed an issue where the storage path for screen recordings didn't align with the folder structure displayed in the user interface.
Fixed an issue where missing public files were incorrectly cached by the CDN for up to seven days.
Fixed an issue where agents were automatically redirected to the Closed inbox view after changing an interaction status to Closed.
Fixed an issue where the You cannot log out when in a chat notification was truncated in the chat adapter.
Fixed an issue with Salesforce integrations where rapid, concurrent data requests caused information to be lost.
Fixed an issue where duplicate call recording links were posted to Zendesk tickets for multi-segment calls.
Fixed an issue with Salesforce integrations where the UI retained settings from a previous Salesforce organization after switching to a new organization.
Fixed an issue where duplicate customer satisfaction surveys were submitted and recorded for a single live chat session.
Fixed an issue where the message field in the chat adapter was inactive when an agent accepted a new chat.
Fixed an issue where task virtual agents were incorrectly identified as Nobody when joining a conversation after a transfer from a human agent.
Fixed an issue that occurred when a chat entered a queue and the greeting message was sent before an agent was assigned. In these cases, the associated push notification crashed and logged an error, producing excessive noise in logs.
Fixed an issue where the agent's final message in a chat session appeared after This chat is ended in the chat adapter and the CRM transcript.
Fixed an issue where agents using instances without a CRM configuration received a No Account Detected warning when making outbound calls.
Fixed an issue where notification chimes played after an agent had connected to an active call.
Fixed an issue where the country code list didn't automatically update the
country flag when a phone number was entered without the + prefix.
Fixed an issue where calls to an agent's personal queue didn't break through if the agent was also assigned to an inbound queue with breakthrough disabled.
Fixed an issue where outbound calls that were transferred to a queue didn't adhere to the queue's deltacast configuration.
Fixed an issue where the agent desktop became unstable or didn't load.
Fixed an issue where wrap-up time was incorrectly reported when agents exceeded the configured wrap-up time.
Fixed an issue where the IVR queues dashboard didn't load for instances with a large volume of queues.
Fixed an issue where calls to the manager/api/v1/agent_activity_logs
endpoint timed out when sort_direction was turned off.
Managed Service for Apache Kafka now supports topic compression with zstd.
Custom organization policy constraints are generally available (GA) for Google Cloud VMware Engine. You can use custom constraints to enforce security policies and restrict configuration of your VMware Engine resources.
For more information, see Use custom organization policies.
In GKE version 1.34 and later, you can configure Google Cloud Managed Service for Prometheus to collect Pressure Stall Information (PSI) metrics from cAdvisor. You can use PSI metrics to monitor CPU, memory, and I/O congestion and stall times for your containers, Pods, and nodes. For more information, see Collect specific Prometheus metrics from Kubernetes.
In GKE version 1.35.3-gke.1389000 and later, you can run GPU workloads on Confidential GKE Nodes with certain G4 machine types and NVIDIA RTX PRO 6000 GPUs. This feature is available in Preview. For more information, see Encrypt GPU workload data in use with Confidential GKE Nodes.
In GKE version 1.36.0-gke.1601000 and later, you can enable the logging of VerticalPodAutoscaler decisions in Cloud Logging. You can use these logs to understand why specific vertical Pod autoscaling decisions were made. This feature is available in Preview. For more information, see Collect vertical Pod autoscaler event logs.
GKE Gateway now supports backend mutual TLS (mTLS). In addition to backend authenticated TLS, backend mTLS allows the GKE Gateway load balancer to authenticate its identity to backend Pods by presenting a client certificate. GKE Gateway configures backend mTLS using the standard Gateway API spec.tls.backend.clientCertificateRef field.
This feature is supported for the following GatewayClasses:
gke-l7-global-external-managedgke-l7-regional-external-managedgke-l7-rilbFor more information, see Configure backend mutual TLS (mTLS) for a Gateway.
For GKE Standard clusters, the maximum number of nodes that you can upgrade
simultaneously by using surge upgrades (maxSurge + maxUnavailable) is now
100. Each of these settings can be set as high as 100, but their sum can be no
higher than 100. For more information, see
Surge upgrades.
When you delete a Looker (Google Cloud core) instance, it is now moved to the trash for seven days before being permanently deleted. During this period, you can restore the instance to its previous state. After seven days, the instance is permanently deleted from the trash and cannot be recovered.
]]>On July 6, 2026, we released an updated version of the Apigee UI.
ParsePayload policy and payload operations matching in the Apigee UI
The Apigee UI now supports the new payload operations matching feature:
For more information, see Manage MCP tool access with API products.
Support for payload operations matching in API Products
Apigee now supports payload operations matching (payloadOperationGroup) in API
Products, powered by the new ParsePayload policy.
Payload operations matching allows you to define API Product operations that match fields within request payloads, such as JSON-RPC requests used by the Model Context Protocol (MCP). Apigee can then route, monetize, authorize, and apply distinct quota limits to traffic based on the derived payload operation.
This feature is available to all Apigee X customers in all supported regions with no additional charge. For more information, see Manage MCP tool access with API products and the ParsePayload policy reference.
For data transfers from Facebook Ads,
support for the AdInsightsMMM report has been temporarily disabled. Existing
data transfers from Facebook Ads that include the AdInsightsMMM report will
continue to run, but the transfer won't include data from the AdInsightsMMM
report.
This change is due to schema changes in the Facebook Ads API.
For more information, see July 06, 2026.
Bigtable supports direct connectivity, which bypasses the Google frontend and optimizes performance for application traffic that meets certain criteria. For more information, see Direct connectivity.
The Envoy Compressor Filter is now GA in the regular release channel.
The Envoy Lua Filter is now available as a preview feature in the regular release channel.
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.12.94 | v27.5.1 | v2.1.7 | See List |
Upgraded app-admin/oslogin to v20260626.00.
Upgraded app-containers/docker-credential-helpers to v0.9.8.
Upgraded dev-db/sqlite to v3.53.3.
Upgraded dev-libs/expat to v2.8.2.
Upgraded net-misc/socat to v1.8.1.3.
Fixed CVE-2026-35388 in net-misc/openssh.
Fixed CVE-2026-40226 in sys-apps/systemd.
Fixed CVE-2026-52921 in the Linux kernel.
Fixed CVE-2026-52927 in the Linux kernel.
Fixed CVE-2026-52930 in the Linux kernel.
Fixed CVE-2026-52942 in the Linux kernel.
Fixed CVE-2026-53033 in the Linux kernel.
Fixed CVE-2026-53122 in the Linux kernel.
Fixed CVE-2026-53131 in the Linux kernel.
Fixed CVE-2026-53134 in the Linux kernel.
Fixed CVE-2026-53154 in the Linux kernel.
Fixed CVE-2026-53156 in the Linux kernel.
Fixed CVE-2026-53168 in the Linux kernel.
Fixed CVE-2026-53180 in the Linux kernel.
Fixed CVE-2026-53181 in the Linux kernel.
Fixed CVE-2026-53184 in the Linux kernel.
Fixed CVE-2026-53185 in the Linux kernel.
Fixed CVE-2026-53189 in the Linux kernel.
Fixed CVE-2026-53191 in the Linux kernel.
Fixed CVE-2026-53199 in the Linux kernel.
Fixed CVE-2026-53207 in the Linux kernel.
Fixed CVE-2026-53212 in the Linux kernel.
Fixed CVE-2026-53214 in the Linux kernel.
Fixed CVE-2026-53218 in the Linux kernel.
Fixed CVE-2026-53219 in the Linux kernel.
Fixed CVE-2026-53220 in the Linux kernel.
Fixed CVE-2026-53223 in the Linux kernel.
Fixed CVE-2026-53229 in the Linux kernel.
Fixed CVE-2026-53230 in the Linux kernel.
Fixed CVE-2026-53232 in the Linux kernel.
Fixed CVE-2026-53233 in the Linux kernel.
Fixed CVE-2026-53236 in the Linux kernel.
Fixed CVE-2026-53239 in the Linux kernel.
Fixed CVE-2026-53249 in the Linux kernel.
Fixed CVE-2026-53264 in the Linux kernel.
Fixed CVE-2026-53265 in the Linux kernel.
Fixed CVE-2026-53266 in the Linux kernel.
Fixed CVE-2026-53267 in the Linux kernel.
Fixed CVE-2026-53268 in the Linux kernel.
Fixed CVE-2026-53269 in the Linux kernel.
Fixed CVE-2026-53270 in the Linux kernel.
Fixed CVE-2026-53275 in the Linux kernel.
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.12.94 | v27.5.1 | v2.2.3 | See List |
Updated the Linux kernel to v6.12.94. It resolves CVE-2026-52908,CVE-2026-52910, CVE-2026-52912,CVE-2026-52920, CVE-2026-52921,CVE-2026-52923, CVE-2026-52925,CVE-2026-52927,CVE-2026-52928,CVE-2026-52930, CVE-2026-52933,CVE-2026-52936, CVE-2026-52942,CVE-2026-52943, CVE-2026-52946,CVE-2026-52967, CVE-2026-52969,CVE-2026-52970, CVE-2026-52972,CVE-2026-52974, CVE-2026-52977,CVE-2026-52980, CVE-2026-52981,CVE-2026-52984, CVE-2026-52986,CVE-2026-52989, CVE-2026-52990,CVE-2026-52998, CVE-2026-52999,CVE-2026-53001, CVE-2026-53002,CVE-2026-53003, CVE-2026-53006,CVE-2026-53012, CVE-2026-53013,CVE-2026-53014, CVE-2026-53021,CVE-2026-53023, CVE-2026-53031,CVE-2026-53032, CVE-2026-53033,CVE-2026-53034, CVE-2026-53035,CVE-2026-53036, CVE-2026-53038,CVE-2026-53050, CVE-2026-53053,CVE-2026-53060, CVE-2026-53061,CVE-2026-53062, CVE-2026-53063,CVE-2026-53064, CVE-2026-53069,CVE-2026-53074, CVE-2026-53075,CVE-2026-53076, CVE-2026-53080,CVE-2026-53081, CVE-2026-53083,CVE-2026-53084, CVE-2026-53085,CVE-2026-53094, CVE-2026-53096,CVE-2026-53111, CVE-2026-53115,CVE-2026-53120, CVE-2026-53122,CVE-2026-53123, CVE-2026-53126,CVE-2026-53129, CVE-2026-53132.
Updated the Linux kernel to v6.12.94. It resolves CVE-2026-52908,CVE-2026-52910, CVE-2026-52912,CVE-2026-52920, CVE-2026-52921,CVE-2026-52923, CVE-2026-52925,CVE-2026-52927, CVE-2026-52928,CVE-2026-52930, CVE-2026-52933,CVE-2026-52936, CVE-2026-52942,CVE-2026-52943, CVE-2026-52945,CVE-2026-52946, CVE-2026-52967,CVE-2026-52969, CVE-2026-52970,CVE-2026-52972, CVE-2026-52974,CVE-2026-52977, CVE-2026-52980,CVE-2026-52981, CVE-2026-52984,CVE-2026-52986, CVE-2026-52989,CVE-2026-52990, CVE-2026-52998,CVE-2026-52999, CVE-2026-53001,CVE-2026-53002, CVE-2026-53003,CVE-2026-53006, CVE-2026-53012,CVE-2026-53013, CVE-2026-53014,CVE-2026-53021, CVE-2026-53023,CVE-2026-53031, CVE-2026-53032,CVE-2026-53033, CVE-2026-53034,CVE-2026-53035, CVE-2026-53036,CVE-2026-53038, CVE-2026-53050,CVE-2026-53053, CVE-2026-53060,CVE-2026-53061, CVE-2026-53062,CVE-2026-53063, CVE-2026-53064,CVE-2026-53069, CVE-2026-53074,CVE-2026-53075, CVE-2026-53076,CVE-2026-53080, CVE-2026-53081,CVE-2026-53083, CVE-2026-53084,CVE-2026-53085, CVE-2026-53094,CVE-2026-53096, CVE-2026-53111,CVE-2026-53115, CVE-2026-53120,CVE-2026-53122, CVE-2026-53123,CVE-2026-53126, CVE-2026-53129,CVE-2026-53132.
Upgraded app-admin/oslogin to v20260626.00.
Upgraded dev-db/sqlite to v3.53.3.
Upgraded dev-libs/expat to v2.8.2.
Upgraded net-misc/socat to v1.8.1.3.
Upgraded sys-apps/acl to v2.4.0.
Fixed CVE-2026-35388 in net-misc/openssh.
Fixed CVE-2026-40226 in sys-apps/systemd.
Fixed CVE-2026-53122 in the Linux kernel.
Fixed CVE-2026-53131 in the Linux kernel.
Fixed CVE-2026-53134 in the Linux kernel.
Fixed CVE-2026-53154 in the Linux kernel.
Fixed CVE-2026-53156 in the Linux kernel.
Fixed CVE-2026-53168 in the Linux kernel.
Fixed CVE-2026-53180 in the Linux kernel.
Fixed CVE-2026-53181 in the Linux kernel.
Fixed CVE-2026-53184 in the Linux kernel.
Fixed CVE-2026-53185 in the Linux kernel.
Fixed CVE-2026-53189 in the Linux kernel.
Fixed CVE-2026-53191 in the Linux kernel.
Fixed CVE-2026-53199 in the Linux kernel.
Fixed CVE-2026-53212 in the Linux kernel.
Fixed CVE-2026-53214 in the Linux kernel.
Fixed CVE-2026-53218 in the Linux kernel.
Fixed CVE-2026-53219 in the Linux kernel.
Fixed CVE-2026-53220 in the Linux kernel.
Fixed CVE-2026-53223 in the Linux kernel.
Fixed CVE-2026-53229 in the Linux kernel.
Fixed CVE-2026-53230 in the Linux kernel.
Fixed CVE-2026-53232 in the Linux kernel.
Fixed CVE-2026-53235 in the Linux kernel.
Fixed CVE-2026-53236 in the Linux kernel.
Fixed CVE-2026-53239 in the Linux kernel.
Fixed CVE-2026-53249 in the Linux kernel.
Fixed CVE-2026-53261 in the Linux kernel.
Fixed CVE-2026-53264 in the Linux kernel.
Fixed CVE-2026-53265 in the Linux kernel.
Fixed CVE-2026-53266 in the Linux kernel.
Fixed CVE-2026-53267 in the Linux kernel.
Fixed CVE-2026-53268 in the Linux kernel.
Fixed CVE-2026-53269 in the Linux kernel.
Fixed CVE-2026-53270 in the Linux kernel.
Fixed CVE-2026-53275 in the Linux kernel.
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.6.143 | v27.5.1 | v2.0.8 | See List |
Upgraded net-misc/rsync to v3.4.4.
Upgraded the Linux kernel to v6.6.143. Is resolves CVE-2026-52908,CVE-2026-52910, CVE-2026-52912,CVE-2026-52920, CVE-2026-52921,CVE-2026-52923, CVE-2026-52925,CVE-2026-52927, CVE-2026-52928,CVE-2026-52930, CVE-2026-52933,CVE-2026-52936, CVE-2026-52942,CVE-2026-52943, CVE-2026-52945,CVE-2026-52946, CVE-2026-52967,CVE-2026-52969, CVE-2026-52970,CVE-2026-52972, CVE-2026-52974,CVE-2026-52975, CVE-2026-52977,CVE-2026-52981, CVE-2026-52984,CVE-2026-52986, CVE-2026-52989,CVE-2026-52998, CVE-2026-52999,CVE-2026-53001, CVE-2026-53002,CVE-2026-53003, CVE-2026-53006,CVE-2026-53012, CVE-2026-53013,CVE-2026-53021, CVE-2026-53032,CVE-2026-53033, CVE-2026-53034,CVE-2026-53035, CVE-2026-53036,CVE-2026-53050, CVE-2026-53060,CVE-2026-53061, CVE-2026-53062,CVE-2026-53063, CVE-2026-53064,CVE-2026-53069, CVE-2026-53074,CVE-2026-53075, CVE-2026-53076,CVE-2026-53080, CVE-2026-53083,CVE-2026-53094, CVE-2026-53096,CVE-2026-53111, CVE-2026-53126.
Upgraded app-containers/docker-credential-helpers to v0.9.8.
Upgraded dev-db/sqlite to v3.53.3.
Upgraded dev-libs/expat to v2.8.2.
Upgraded net-libs/libtirpc to v1.3.7-r2.
Upgraded net-misc/socat to v1.8.1.3.
Upgraded sys-apps/acl to v2.4.0.
Fixed CVE-2026-31419 in the Linux kernel.
Fixed CVE-2026-35388 in net-misc/openssh.
Fixed CVE-2026-40226 in sys-apps/systemd.
Fixed CVE-2026-52936 in the Linux kernel.
Fixed CVE-2026-53033 in the Linux kernel.
Fixed CVE-2026-53131 in the Linux kernel.
Fixed CVE-2026-53134 in the Linux kernel.
Fixed CVE-2026-53154 in the Linux kernel.
Fixed CVE-2026-53168 in the Linux kernel.
Fixed CVE-2026-53181 in the Linux kernel.
Fixed CVE-2026-53184 in the Linux kernel.
Fixed CVE-2026-53185 in the Linux kernel.
Fixed CVE-2026-53189 in the Linux kernel.
Fixed CVE-2026-53199 in the Linux kernel.
Fixed CVE-2026-53212 in the Linux kernel.
Fixed CVE-2026-53218 in the Linux kernel.
Fixed CVE-2026-53219 in the Linux kernel.
Fixed CVE-2026-53223 in the Linux kernel.
Fixed CVE-2026-53230 in the Linux kernel.
Fixed CVE-2026-53232 in the Linux kernel.
Fixed CVE-2026-53236 in the Linux kernel.
Fixed CVE-2026-53239 in the Linux kernel.
Fixed CVE-2026-53249 in the Linux kernel.
Fixed CVE-2026-53264 in the Linux kernel.
Fixed CVE-2026-53266 in the Linux kernel.
Fixed CVE-2026-53267 in the Linux kernel.
Fixed CVE-2026-53268 in the Linux kernel.
Fixed CVE-2026-53269 in the Linux kernel.
Fixed CVE-2026-53270 in the Linux kernel.
Fixed CVE-2026-53275 in the Linux kernel.
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.6.143 | v24.0.9 | v1.7.31 | See List |
Upgraded net-misc/rsync to v3.4.4.
Upgraded the Linux kernel to v6.6.143. It resolves CVE-2026-52908,CVE-2026-52910, CVE-2026-52912,CVE-2026-52920, CVE-2026-52921,CVE-2026-52923, CVE-2026-52925,CVE-2026-52927, CVE-2026-52928,CVE-2026-52930, CVE-2026-52933,CVE-2026-52936, CVE-2026-52942,CVE-2026-52943, CVE-2026-52945,CVE-2026-52946, CVE-2026-52967,CVE-2026-52969, CVE-2026-52970,CVE-2026-52972, CVE-2026-52974,CVE-2026-52975, CVE-2026-52977,CVE-2026-52981, CVE-2026-52984,CVE-2026-52986, CVE-2026-52989,CVE-2026-52998, CVE-2026-52999,CVE-2026-53001, CVE-2026-53002,CVE-2026-53003, CVE-2026-53006,CVE-2026-53012, CVE-2026-53013,CVE-2026-53021, CVE-2026-53032,CVE-2026-53033, CVE-2026-53034,CVE-2026-53035, CVE-2026-53036,CVE-2026-53050, CVE-2026-53060,CVE-2026-53061, CVE-2026-53062,CVE-2026-53063, CVE-2026-53064,CVE-2026-53069, CVE-2026-53074,CVE-2026-53075, CVE-2026-53076,CVE-2026-53080, CVE-2026-53083,CVE-2026-53094, CVE-2026-53096,CVE-2026-53111, CVE-2026-53126.
Upgraded app-shells/dash to v0.5.13.4-r2.
Upgraded net-fs/cifs-utils to v7.6, Upgraded sys-libs/talloc to v2.4.4-r1.
Upgraded net-misc/socat to v1.8.1.3.
Fixed CVE-2026-35388 in net-misc/openssh.
Fixed CVE-2026-40226 in sys-apps/systemd.
Fixed CVE-2026-52930 in the Linux kernel.
Fixed CVE-2026-53033 in the Linux kernel.
Fixed CVE-2026-53131 in the Linux kernel.
Fixed CVE-2026-53134 in the Linux kernel.
Fixed CVE-2026-53154 in the Linux kernel.
Fixed CVE-2026-53168 in the Linux kernel.
Fixed CVE-2026-53181 in the Linux kernel.
Fixed CVE-2026-53184 in the Linux kernel.
Fixed CVE-2026-53185 in the Linux kernel.
Fixed CVE-2026-53189 in the Linux kernel.
Fixed CVE-2026-53199 in the Linux kernel.
Fixed CVE-2026-53212 in the Linux kernel.
Fixed CVE-2026-53218 in the Linux kernel.
Fixed CVE-2026-53219 in the Linux kernel.
Fixed CVE-2026-53223 in the Linux kernel.
Fixed CVE-2026-53230 in the Linux kernel.
Fixed CVE-2026-53232 in the Linux kernel.
Fixed CVE-2026-53236 in the Linux kernel.
Fixed CVE-2026-53249 in the Linux kernel.
Fixed CVE-2026-53264 in the Linux kernel.
Fixed CVE-2026-53265 in the Linux kernel.
Fixed CVE-2026-53266 in the Linux kernel.
Fixed CVE-2026-53267 in the Linux kernel.
Fixed CVE-2026-53268 in the Linux kernel.
Fixed CVE-2026-53269 in the Linux kernel.
Fixed CVE-2026-53270 in the Linux kernel.
Fixed CVE-2026-53275 in the Linux kernel.
Gemini Enterprise: Support for Japan and UK regions (GA with allowlist)
You can use the Gemini Enterprise app in the Japan (asia-northeast1) and
United Kingdom (europe-west2) regions with at-rest data residency (DRZ)
and machine learning processing (MLP) in region. You can also use the
latest Gemini 3.5 Flash model in these regions with in-region at-rest DRZ
and MLP.
These locations are available in GA with allowlist. To get access to these locations for use with Gemini Enterprise or NotebookLM Enterprise, contact your Google account team.
Certain limitations apply when using these regions. For more information, see Data residency for Gemini Enterprise Standard and Plus Editions.
AlphaGenome released for Gemini Enterprise Agent Platform
AlphaGenome, Google DeepMind's state-of-the-art genomics foundation model, is now available for deployment and use with Gemini Enterprise Agent Platform.
Designed to decipher the functional regulatory code of the human genome, AlphaGenome analyzes large-scale DNA sequences at single-base resolution to predict how genetic variations affect molecular and biological mechanisms like gene expression, chromatin accessibility, and RNA splicing. For information on how to use AlphaGenome in Agent Platform, see the documentation.
Data RBAC for first-party (1P) cases and alerts in public preview
Availability: This feature is available only in the following regions: europe-central2, asia-northeast1, asia-south1, australia-southeast1, northamerica-northeast2, europe-west3, europe-west6, southamerica-east1, asia-southeast1, me-central1, me-central2, me-west1, europe-west2, europe-west9, europe-west12, asia-southeast2, africa-south1, asia-east1, and asia-northeast3.
Google SecOps now supports data role-based access control (Data RBAC) for first-party (1P) cases and alerts in SOAR. This feature automatically applies SIEM data access scopes to alerts and cases ingested using the Chronicle connector, ensuring analysts only see data they are authorized to access.
Key highlights
Prerequisites and enablement
For more information, see Control access to 1P cases and alerts.
You can use Gemini in Spanner Studio to fix errors in your SQL queries. When you run a query that contains an error, you can click Fix to view a line-by-line comparison of your query and a recommended correction, along with an explanation of the change. This feature is available in Preview.
]]>Release 6.3.92 is being rolled out to the first phase of regions as listed here.
This release contains internal and customer bug fixes.
Publisher Agent Version 2.7.0
Publisher Agent Version 2.7.0 is being rolled out to the first phase of regions.
This release includes the following updates for the remote agent:
Release 6.3.91 is now available for all regions.
]]>On July 3, 2026 we released an updated version of the Apigee hybrid software, v1.15.5.
Various security and CVE fixes are included in this release.
Cloud CDN and external Application Load Balancers support self-service Private Bucket Access for Cloud Storage buckets. This feature allows you to securely serve content without making your storage buckets public. The access on the buckets is managed securely via IAM permissions on a Google-managed service account. This feature is Generally Available.
For more information, see Private bucket access.
]]>Audit Manager now supports built-in frameworks and custom frameworks that you define using Compliance Manager or Assured Workloads frameworks (preview).
MySQL version 9.7 support for MySQL homogeneous migrations is being rolled out across all regions. A new announcement will be published when MySQL version 9.7 for MySQL homogeneous migrations with Database Migration Service becomes available.
The Flex Unified service level supports the optional feature Block volume from deletion when clients are connected for both block and file volumes. This option is required for using NetApp Volumes with Google Cloud VMware Engine (GCVE) datastores. When this option is enabled, it prevents the deletion of a volume if the volume is mounted as a GCVE datastore.
The Flex Unified Default-mode service level supports the thick clone (thin clone split) feature in Preview. For more information, see Manage volume clones.
Oracle Database@Google Cloud supports Exascale Storage Vaults for Exadata on Dedicated Infrastructure and Exadata VM Clusters. For more information, see Create an Exascale Storage Vault for an Exadata Infrastructure, Configure Exascale Storage Vault for Exadata Infrastructure, and Create Exadata VM Clusters with Exascale Storage Vaults.
This feature is Generally Available (GA).
Secure Source Manager is now compliant with EU VPAT / WCAG 2.2.
]]>You can now use pre-trained TimesFM models in BigQuery ML
directly from
Connected Sheets.
These models let you create
forecasts and detect anomalies in your data by using the
AI.FORECAST
and
AI.DETECT_ANOMALIES
functions. This feature is
generally available
(GA).
Config Connector version 1.153.0 is now available.
New Beta Resources (Direct Reconciler):
OrgPolicyPolicy
New Alpha Resources (Direct Reconciler):
AIStreamsCluster
AutoMLDataset
CloudBatchResourceAllowance
BeyondCorpClientGateway
BigLakeDatabase
BigtableAuthorizedView
BigtableBackup
BillingAccount
CertificateManagerCertificateIssuanceConfig
CloudDeployDeployPolicy
FirestoreBackupSchedule
IAMDenyPolicy
NetworkSecurityMirroringDeployment
NetworkSecurityMirroringEndpointGroup
SecurityCenterBigQueryExport
SecurityCenterMuteConfig
VertexAIExampleStore
New Fields:
ContainerCluster
spec.confidentialNodes.confidentialInstanceType and spec.nodeConfig.confidentialNodes.confidentialInstanceType fields.ContainerNodePool
spec.nodeConfig.confidentialNodes.confidentialInstanceType field.spec.nodeConfig.windowsNodeConfig field.RedisCluster
spec.automatedBackupConfig field.spec.crossClusterReplicationConfig field.spec.kmsKeyRef field.spec.maintenancePolicy and status.observedState.maintenancePolicy fields.status.observedState.pscServiceAttachments field.MemorystoreInstance
spec.maintenancePolicy and status.observedState.maintenancePolicy fields.spec.kmsKeyRef field.status.observedState.encryptionInfo field.Reconciliation Improvements:
Added support for direct reconciliation to more resources, with opt-in behaviour. The API is unchanged. To use the direct reconciler, add the cnrm.cloud.google.com/reconciler: direct annotation to the corresponding Config Connector object. The following resources now have direct reconciliation support:
ArtifactRegistryRepositoryCertificateManagerCertificateDNSManagedZoneDNSPolicyLoggingLogBucketLoggingLogSinkLoggingLogViewPubSubSchemaPubSubTopicServiceDirectoryServiceBug Fixes:
ComposerEnvironment: Support resource reference resolution and fix drift on private environment config.ComputeBackendService: Prevent the automatic injection of subsetting: { policy: "NONE" } for regional backend services with INTERNAL_SELF_MANAGED load balancing scheme.DataprocCluster: userServiceAccountMapping field in DataprocCluster resources is now mutable.DNSPolicy: Fixes to DNSPolicy for real GCP integration.MemorystoreInstance: Fix crossInstanceReplicationConfig field, allowing replication roles to be synced and updated correctly.NetworkSecurity: Fix UpdateAuthorizationPolicy panic with empty updateMask.PrivilegedAccessManager: Fix mock drift in PrivilegedAccessManager by correcting Delete LRO and array element retention.RedisCluster: Fix permanent diff caused by automated backup configuration default value.Provisioned Throughput: Multiple pending new orders GA
The ability to submit multiple pending orders is generally available. you can submit up to seven Google model orders for the same model and region. See Multiple pending orders.
Google Cloud CCaaS 4.45
We've released version 4.45 of Google Cloud CCaaS.
The timing of the update to your instance depends on the deployment schedule that you have chosen. For more information, see Deployment schedules.
Do Not Call capability in HubSpot
You can configure your HubSpot integration to display This number is on the Do Not Call list in the call adapter when an agent initiates a call to a contact configured for Do Not Call (DNC). The agent can proceed with the DNC call if needed. If the agent proceeds with the call, the following comment is logged in the CRM: "The contact is in TPS, the agent chose to proceed with the call."
This capability is for non-campaign outbound calls. It doesn't affect outbound campaign calls.
Administrators: In the Settings > Developer Settings > Agent Platform > HubSpot > Account Lookup section, there's a new Do-Not-Call CRM Field section.
User experience update: The call adapter displays This number is on the Do Not Call list when an agent initiates a call to a contact configured for DNC.
For more information, see Do Not Call for HubSpot.
Return to queue after disconnection
You can configure CCAI Platform to offer a disconnected caller the option to return to their queue. If they accept, they're returned to the top of the queue. Virtual agents in the queue are skipped. This capability is for IVR calls only.
Administrators: We've made the following updates to the CCAI Platform portal:
In the Settings > Call > Call Details pane, there's a new Return to Queue After Disconnection section.
In the Settings > Queue > IVR (Interactive Voice Response) > Edit / View > MENU_NAME > Settings pane, there's a new Return to Queue after disconnection section.
In the Settings > Languages & Messages > Audible Messages pane, there's a new Return to Queue After Disconnection Messages section.
For more information, see Return to queue.
Fixed an issue where campaigns that didn't complete prevented subsequent campaigns from starting.
Fixed an issue where callers weren't correctly connected to voicemail during a warm transfer to an agent's direct number.
Fixed an issue where incoming calls were assigned to agents but didn't appear in the agent adapter, resulting in "ghost assignments" and abandoned calls.
Fixed an issue where cold-transferring a call from a queue while the transferring agent was in a wrap-up state caused the connection to become unresponsive and silent.
Fixed an issue where calls that disconnected before entering a queue were incorrectly displayed in the Queued Calls dashboard.
Fixed an issue in the agent desktop where the call disposition panel failed to load for queues with forced disposition enabled, leaving agents stuck and unable to proceed without logging out.
Fixed an issue where streaming conversations failed due to connection errors.
Fixed an issue where outbound calls initiated from a HubSpot company profile created duplicate anonymous contacts instead of matching existing records by phone number.
Fixed an issue where the Session Data report incorrectly calculated the after call work (ACW) duration for manual wrap-ups.
Fixed an issue where the Start Call button didn't display in the call adapter.
Fixed an issue where voicemails from cold transfers were lost or routed to the wrong queue.
Fixed an issue in the agent desktop where active calls appeared to be on hold while the agent was in a "wrap-up exceeded" state.
[Spotlight Feature] Security Tokens
Security Tokens are now available for metering agentic consumption within Google SecOps. Tokens are consumed by generally available security agents only. These agents are invoked automatically or manually using the web interface, CLI, chat, or Model Context Protocol (MCP). Assistive features, such as standard chat panels and automated summaries, along with preview agents, won't consume Security Tokens.
Security Tokens will start rolling out across all regions starting July 1. For more information, see Google SecOps Agentic SOC Security Tokens pricing and billing.
[Spotlight Feature] Enhanced security and compliance for the Advanced BigQuery Export feature
The Advanced BigQuery Export feature is in Preview and is available for Google SecOps Enterprise Plus customers only.
Here's what's new: We're excited to announce significant performance and coverage enhancements to Advanced BigQuery Export for Google SecOps Enterprise Plus customers.
entity_enum_value_to_name_mapping and udm_enum_value_to_name_mapping tables. These allow you to easily join against your events to translate numerical enum values into human-readable strings.Key reminders
Proofpoint Email Protection: Version 8.0
The following new actions have been added to support searching and programmatically managing quarantined emails:
Search Quarantined Emails
Delete Quarantined Email
Resubmit Quarantined Email
Move Quarantined Email
Proofpoint Email Protection: Version 8.0
Updated backend script implementation to support the new framework for the following actions:
Enrich Entities
Ping
[Spotlight Feature] Security Tokens
Security Tokens are now available for metering agentic consumption within Google SecOps. Tokens are consumed by generally available security agents only. These agents are invoked automatically or manually using the web interface, CLI, chat, or Model Context Protocol (MCP). Assistive features, such as standard chat panels and automated summaries, along with preview agents, won't consume Security Tokens.
Security Tokens will start rolling out across all regions starting July 1. For more information, see Google SecOps Agentic SOC Security Tokens pricing and billing.
The latest versions in the Looker (Google Cloud core) release channels are beginning deployment as follows:
Looker (Google Cloud core) has introduced release channels in preview, allowing users to choose between Rapid, Regular, and "No channel" options to manage the cadence of version updates. The Rapid channel provides early access to new capabilities but is excluded from the Service Level Agreement (SLA), while the Regular channel offers balanced stability with an optional Accelerated Security Patching flag.
]]>Python 3.12 base containers for Agent Platform Workbench custom containers
You can build custom containers for Agent Platform Workbench instances using Python 3.12 base containers, in addition to the default Python 3.10 base containers. The Python 3.12 standard and slim base containers are available at the following URIs:
us-docker.pkg.dev/workbench-images/gcr.io/workbench-container-2606:latestus-docker.pkg.dev/workbench-images/gcr.io/workbench-container-slim-2606:latestYou can specify an optional principal property on
BigQuery reservation assignments to
route queries to specific reservations based on the identity of the user,
service account, or third-party identity executing the job.
Preview: Cloud NAT gateways for Private NAT support IPv6 to IPv4 network address translation. For more information, see NAT64 in Private NAT.
You can now create and configure project-level resources for application layer inspection in Cloud NGFW, including project-level firewall endpoints, security profile groups, and security profiles. For more information, see Organization-level and project-level resources, Firewall endpoints overview, Security profile groups overview, and Security profiles overview. This feature is available in General Availability.
To restrict traffic to the managed Envoy proxies in a proxy-only subnet, you can configure global network firewall policies and regional network firewall policies to protect internal Application Load Balancers and internal proxy Network Load Balancers. For more information, see Use global network firewall policies to protect Envoy-based load balancers and Use regional network firewall policies to protect internal Application Load Balancers and internal proxy Network Load Balancers. This feature is available in General Availability.
Gemini Enterprise: Filters for Microsoft SharePoint data stores are generally available (GA)
Filters for Microsoft SharePoint federated data stores are now generally available (GA).
For more information, see Add filters to a Microsoft SharePoint data store.
Gemini Enterprise: Support for India and Singapore regions (GA with allowlist)
You can use the Gemini Enterprise app in the India (IN) and Singapore
(SG) regions with at-rest data
residency (DRZ) and machine learning processing (MLP) in region. You can
also use the latest Gemini 3.5 Flash model in these regions with
in-region at-rest DRZ and MLP.
These locations are available in GA with allowlist. To get access to these locations for use with Gemini Enterprise or NotebookLM Enterprise, contact your Google account team.
Certain limitations apply when using these regions. For more information, see Data residency for Gemini Enterprise Standard and Plus Editions.
Anthropic's Claude Sonnet 5
Claude Sonnet 5 is available in Model Garden.
In the Agent Desktop, the Knowledge Assist panel is being replaced with a new Agent Assist Hub panel
Who's affected?
Customers who use the Agent Desktop and the Knowledge Assist panel in a desktop layout are affected. If you don't use Agent Desktop and the Knowledge Assist panel, you can ignore this announcement.
What's changing?
We're replacing the Knowledge Assist panel in Agent Desktop with a new Agent Assist Hub panel. The Agent Assist Hub panel contains a Knowledge Assist module that is a 1:1 functional replacement of the Knowledge Assist panel.
How does this affect my contact center?
For any agents that are signed into your contact center at the moment we update it, the new Knowledge Assist module will stop working. To fix this problem, the agent needs to sign out of the contact center and sign in again. The Knowledge Assist module will begin working. Agents who sign into your contact center after we update it won't be affected by this issue.
What do I need to do?
When we roll out this change, your Google Cloud CCaaS instance will be updated automatically - you don't need to change any configurations. However, you should tell your agents to sign out of your contact center and sign in again if the Knowledge Assist module within the Agent Assist Hub panel isn't working for them. Your agents do not need to take action If your instance is configured as a Critical deployment and is updated outside of the contact center hours of operation.
When is this happening?
We expect to make this change in early Q3 of 2026, around mid to late July. We'll publish prerelease notes and release notes to keep you informed of this change.
Increased multiple event limits
Multiple event rule limits have been increased to 200 for Enterprise customers and 400 for Enterprise+ customers.
For more information, see Package comparison
[Spotlight Feature] Unified rules interface
The new rules interface is now available in public preview. The Google SecOps unified rules interface brings custom and curated rule management into a single, cohesive workflow. This optimizes detection engineering with a redesigned dashboard, an advanced rule editor, and expanded API capabilities to streamline rule deployment and troubleshooting.
You can still revert to the legacy experience. At the top right of the screen, click Switch to the legacy experience.
For more information about the Unified rules interface, see Manage unified rules.
Increased multiple event limits
Multiple event rule limits have been increased to 200 for Enterprise customers and 400 for Enterprise+ customers.
For more information, see Package comparison
Unified rules interface
The new rules interface is now available in public preview.
The Google SecOps unified rules interface brings custom and curated rule management into a single, cohesive workflow. This optimizes detection engineering with a redesigned dashboard, an advanced rule editor, and expanded API capabilities to streamline rule deployment and troubleshooting.
You can still revert to the legacy experience. At the top right of the screen, click Switch to the legacy experience.
For more information about the Unified rules interface, see Manage unified rules.
Key updates in these image versions include:
2.1.117 and 2.2.85 subminor image versions don't have preconfigured Conda channels, and are not mapped to default aliases (such as 2.1-debian11 and 2.2-debian12) until August 25, 2026.
2.1.117-debian11 or 2.2.85-debian12). Packages cannot be installed using Conda unless channels are manually configured during cluster initialization.2.1.116-debian11 or 2.2.84-debian12).2.1 and 2.2 will point to image versions without preconfigured Conda channels (the latest subminor versions). All workloads must transition to these new images after August 25, 2026 since the use of prior subminor versions with preconfigured Conda channels will be disallowed.You may need to delete and replace existing clusters After August 25, 2026, existing clusters created with images that have preconfigured Conda channels (even if cluster jobs don't use Conda to install packages) need to be deleted and replaced with new clusters created or recreated with images that don't have preconfigured Conda channels.
The broker mode for out-of-band Network Security Integration (also known as packet broker) is now available in General Availability (GA) with allowlist. Broker mode lets you mirror GENEVE-encapsulated network packets from a consumer network to multiple producer networks for analysis, and adds additional GENEVE metadata (such as timestamp and network stable ID). This feature is not available to all users. To access this feature, contact your Google account team.
For more information, see Out-of-band integration overview and Understand GENEVE format.
Project-level security profiles and security profile groups for Network Security Integration are now available in General Availability (GA).
For more information, see Security profiles overview and Security profile groups overview.
General Availability: If a consumer VPC network uses an RDMA network profile for Falcon VPC networks, a single Compute Engine instance can connect to it by using multiple virtual Private Service Connect interfaces.
For more information, see Create VMs with Private Service Connect interfaces.
]]>Support for deploying your existing apps in the flexible environment to Cloud Run using
the gcloud beta app migrate-to-run command is in Preview. For more information, see Deploy an App Engine app in the flexible environment to Cloud Run.
Support for deploying your existing apps in the flexible environment to Cloud Run using
the gcloud beta app migrate-to-run command is in Preview. For more information, see Deploy an App Engine app in the flexible environment to Cloud Run.
Support for deploying your existing apps in the flexible environment to Cloud Run using
the gcloud beta app migrate-to-run command is in Preview. For more information, see Deploy an App Engine app in the flexible environment to Cloud Run.
Support for deploying your existing apps in the flexible environment to Cloud Run using
the gcloud beta app migrate-to-run command is in Preview. For more information, see Deploy an App Engine app in the flexible environment to Cloud Run.
Support for deploying your existing apps in the flexible environment to Cloud Run using
the gcloud beta app migrate-to-run command is in Preview. For more information, see Deploy an App Engine app in the flexible environment to Cloud Run.
Support for deploying your existing apps in the flexible environment to Cloud Run using
the gcloud beta app migrate-to-run command is in Preview. For more information, see Deploy an App Engine app in the flexible environment to Cloud Run.
Support for deploying your existing apps in the flexible environment to Cloud Run using
the gcloud beta app migrate-to-run command is in Preview. For more information, see Deploy an App Engine app in the flexible environment to Cloud Run.
Support for deploying your existing apps in the flexible environment to Cloud Run using
the gcloud beta app migrate-to-run command is in Preview. For more information, see Deploy an App Engine app in the flexible environment to Cloud Run.
Effective March 9, 2026, new users are required to have a Cloud Billing account to use the BigQuery Migration Service. This change applies to users starting new projects using BigQuery Migration Service features, such as SQL translation and migration assessment.
After May 18, 2026, all users are required to have a Cloud Billing account to use the BigQuery Migration Service.
Pricing for the BigQuery Migration Service remains without charge.
You can now grant data preparations and pipelines access to additional services when running or scheduling them with user credentials for a Google Account. You can grant data preparations access to Google Drive, and grant pipelines access to Google Drive, Bigtable, and Knowledge Catalog. Extended access options are available in Preview.
Alerting policies based on PromQL queries can now operate over more than 25 hours of data. For more information, see Query over 2 years of metric data and Limits for alerting.
Deploy a highly available, multi-region Cloud Run service with automated failover and failback for internal and external traffic using Cloud Run service health in General Availability (GA).
Configure HTTP and gRPC readiness probes for your Cloud Run services is in General Availability (GA).
MySQL 8.0.45 is now the default minor version for Cloud SQL for MySQL 8.0.
For more information about minor version support in Cloud SQL for MySQL, see MySQL 8.0.
1.29.5-asm.5 is now available for in-cluster Cloud Service Mesh.
This patch release contains the fix for the security vulnerability listed in GCP-2026-045.
For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.29.5-asm.5 uses Envoy v1.37.5.
1.28.9-asm.4 is now available for in-cluster Cloud Service Mesh.
This patch release contains the fix for the security vulnerability listed in GCP-2026-045.
For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.9-asm.4 uses Envoy v1.36.9.
1.27.9-asm.9 is now available for in-cluster Cloud Service Mesh.
This patch release contains the fix for the security vulnerability listed in GCP-2026-045.
For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.9-asm.9 uses Envoy v1.35.13.
Proxy version csm_mesh_proxy.csm_mesh_proxy.20260624e_RC01 for Gateway API on GKE clusters is rolling out to all Managed Cloud Service Mesh release channels over the next week.
This patch release contains the fixes for the security vulnerabilities listed in GCP-2026-040.
Google Cloud Observability has expanded the supported locations for observability buckets, which store your trace data, to include the following:
For a list of supported locations, see Locations for observability buckets.
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.12.90 | v27.5.1 | v2.2.3 | See List |
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.18.36 | v29.4.3 | v2.2.3 | See List |
Updated cloud-provider-gcp to v35.0.8, docker-credential-gcr to v2.1.32, docker-credential-helpers to v0.9.7, nvidia-container-toolkit to v1.17.9, isa-l to v2.31.1, oauthlib to v3.0.2, apparmor-profiles to v3.1.7, apparmor to v3.1.7, ek-cpu-balloon to v1.2.3, libapparmor to v3.1.7.
Updated app-arch/gzip to v1.14_p20260502, app-arch/xz-utils to v5.4.7, app-arch/zstd to v1.5.7, app-crypt/mit-krb5 to v1.22.2, app-editors/vim and app-editors/vim-core to v9.1.2148, dev-libs/libaio to v0.3.113-r2, dev-libs/xxhash to v0.8.3, dev-python/PySocks to v1.6.8, dev-python/cryptography to v39.0.2, dev-python/markupsafe to v2.1.5, dev-python/pyrsistent to v0.14.11, dev-python/python-magic to v0.4.27, dev-python/pyyaml to v6.0.3, dev-python/rfc3339-validator to v0.1.4-r1, net-misc/rsync to v3.4.4, sys-apps/mawk to v1.3.4_p20260302, sys-libs/libxcrypt to v4.4.38, sys-libs/talloc to v2.4.4, sys-fs/lvm2 to v2.03.39, sys-libs/binutils-libs to v2.46.1.
Updated gzip to v1.14_p20260502, xz-utils to v5.4.7, zstd to v1.5.7, mit-krb5 to v1.22.2, vim to v9.1.2148, vim-core to v9.1.2148, python-exec-conf to v2.4.10, libaio to v0.3.113, xxhash to v0.8.3, PySocks to v1.6.8, cryptography to v39.0.2, markupsafe to v2.1.5, pyrsistent to v0.14.11, python-magic to v0.4.27, pyyaml to v6.0.3, rfc3339-validator to v0.1.4, iptables to v1.8.13, mawk to v1.3.4_p20260302, lvm2 to v2.03.39, binutils-libs to v2.46.1, libxcrypt to v4.4.38, talloc to v2.4.4.
Updated app-containers/cloud-provider-gcp to v35.0.8, app-containers/docker-credential-gcr to v2.1.32, app-containers/nvidia-container-toolkit to v1.17.9, dev-libs/isa-l to v2.31.1, dev-python/oauthlib to v3.0.2, net-fs/nfs-utils to v2.6.4, sec-policy/apparmor-profiles, sys-apps/apparmor, and sys-libs/libapparmor to v3.1.7.
Updated libtraceevent to v1.7.3, libtracefs to v1.6.4, conntrack-tools to v1.4.9, fuse to v2.9.9, fuse-common to v3.10.5.
Updated dev-libs/libtraceevent to v1.7.3, dev-libs/libtracefs to v1.6.4, net-firewall/conntrack-tools to v1.4.9, sys-fs/fuse to v2.9.9, sys-fs/fuse-common to v3.10.5.
Updated sys-apps/casfs to v0.1.14.
Updated sys-apps/casfs to v0.1.14.
Added cos-dkms support for vast client drivers v4.5.7.
Updated the Linux kernel to v6.18.36.
Support nvidia-fs for COS GPU installer
Added support for loading the ublk kernel module.
Upgraded app-admin/sosreport to v4.11.2.
Upgraded app-admin/sosreport to v4.11.2.
Upgraded app-containers/docker-credential-helpers to v0.9.8.
Upgraded app-shells/dash to v0.5.13.4-r2.
Upgraded app-emulation/cloud-init to v26.1.
Upgraded dev-libs/expat to v2.8.1.
Upgraded net-misc/curl to v8.20.0-r1.
Upgraded app-shells/dash to v0.5.13.4-r2.
Upgraded net-misc/rsync to v3.4.4.
Upgraded sys-apps/gentoo-functions to v1.7.7.
Upgraded chromeos-base/google-breakpad to v2026.06.22.165940-r278.
Fixed CVE-2026-11822, CVE-2026-11824 in dev-db/sqlite.
Upgraded net-misc/curl to v8.20.0-r1.
Fixed CVE-2026-43116 in the Linux kernel.
Fixed CVE-2026-40226 in sys-apps/systemd.
Fixed CVE-2026-45850 in the Linux kernel.
Fixed CVE-2026-5928 in sys-libs/glibc.
Fixed CVE-2026-52908 in the Linux kernel.
Fixed CVE-2026-6238 in sys-libs/glibc.
Fixed CVE-2026-52910 in the Linux kernel.
Fixed CVE-2026-7210 in dev-lang/python.
Fixed CVE-2026-52912 in the Linux kernel.
Upgraded dev-libs/openssl to v3.5.7 to fix CVE-2026-9076, CVE-2026-34183,CVE-2026-45445,CVE-2026-42764,CVE-2026-7383,CVE-2026-45447, CVE-2026-34182,CVE-2026-34181,CVE-2026-34180.
Fixed CVE-2026-52920 in the Linux kernel.
Runtime sysctl changes:
Fixed CVE-2026-52921 in the Linux kernel.
Fixed CVE-2026-52923 in the Linux kernel.
Fixed CVE-2026-52925 in the Linux kernel.
Fixed CVE-2026-52927 in the Linux kernel.
Fixed CVE-2026-52930 in the Linux kernel.
Fixed CVE-2026-52936 in the Linux kernel.
Fixed CVE-2026-52942 in the Linux kernel.
Fixed CVE-2026-52943 in the Linux kernel.
Fixed CVE-2026-52969 in the Linux kernel.
Fixed CVE-2026-52970 in the Linux kernel.
Fixed CVE-2026-52974 in the Linux kernel.
Fixed CVE-2026-52977 in the Linux kernel.
Fixed CVE-2026-52980 in the Linux kernel.
Fixed CVE-2026-52981 in the Linux kernel.
Fixed CVE-2026-52984 in the Linux kernel.
Fixed CVE-2026-52986 in the Linux kernel.
Fixed CVE-2026-52989 in the Linux kernel.
Fixed CVE-2026-52990 in the Linux kernel.
Fixed CVE-2026-52998 in the Linux kernel.
Fixed CVE-2026-52999 in the Linux kernel.
Fixed CVE-2026-53001 in the Linux kernel.
Fixed CVE-2026-53002 in the Linux kernel.
Fixed CVE-2026-53003 in the Linux kernel.
Fixed CVE-2026-53006 in the Linux kernel.
Fixed CVE-2026-53012 in the Linux kernel.
Fixed CVE-2026-53013 in the Linux kernel.
Fixed CVE-2026-53014 in the Linux kernel.
Fixed CVE-2026-53021 in the Linux kernel.
Fixed CVE-2026-53023 in the Linux kernel.
Fixed CVE-2026-53031 in the Linux kernel.
Fixed CVE-2026-53032 in the Linux kernel.
Fixed CVE-2026-53034 in the Linux kernel.
Fixed CVE-2026-53035 in the Linux kernel.
Fixed CVE-2026-53036 in the Linux kernel.
Fixed CVE-2026-53050 in the Linux kernel.
Fixed CVE-2026-53060 in the Linux kernel.
Fixed CVE-2026-53062 in the Linux kernel.
Fixed CVE-2026-53063 in the Linux kernel.
Fixed CVE-2026-53064 in the Linux kernel.
Fixed CVE-2026-53069 in the Linux kernel.
Fixed CVE-2026-53074 in the Linux kernel.
Fixed CVE-2026-53075 in the Linux kernel.
Fixed CVE-2026-53076 in the Linux kernel.
Fixed CVE-2026-53080 in the Linux kernel.
Fixed CVE-2026-53083 in the Linux kernel.
Fixed CVE-2026-53085 in the Linux kernel.
Fixed CVE-2026-53094 in the Linux kernel.
Fixed CVE-2026-53096 in the Linux kernel.
Fixed CVE-2026-53111 in the Linux kernel.
Fixed CVE-2026-53115 in the Linux kernel.
Fixed CVE-2026-53120 in the Linux kernel.
Fixed CVE-2026-53123 in the Linux kernel.
Fixed CVE-2026-53126 in the Linux kernel.
Fixed CVE-2026-53129 in the Linux kernel.
Fixed CVE-2026-7210 in dev-lang/python.
Upgraded dev-libs/openssl to v3.5.7 to fix CVE-2026-45447, CVE-2026-45445,CVE-2026-34183,CVE-2026-42764,CVE-2026-7383,CVE-2026-34180, CVE-2026-34182,CVE-2026-34181,CVE-2026-9076.
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.12.85 | v27.5.1 | v2.1.7 | See List |
Updated app-containers/docker-credential-gcr to v2.1.32, app-containers/docker-credential-helpers to v0.9.7, app-containers/nvidia-container-toolkit to v1.17.9, dev-libs/isa-l to v2.31.1, dev-python/oauthlib to v3.0.2, net-fs/nfs-utils to v2.6.4, sec-policy/apparmor-profiles to v3.1.7, sys-apps/apparmor to v3.1.7, sys-libs/libapparmor to v3.1.7.
Updated app-editors/vim to v9.1.2148, app-editors/vim-core to v9.1.2148, dev-libs/libtraceevent to v1.7.3, dev-libs/libtracefs to v1.6.4, net-firewall/conntrack-tools to v1.4.9, sys-fs/fuse to v2.9.9, sys-fs/fuse-common to v3.10.5.
Updated gzip to v1.14_p20260502, xz-utils to v5.4.7, zstd to v1.5.7, python-exec-conf to v2.4.10, expat to v2.8.1, json-c to v0.16.20220414, libaio to v0.3.113, xxhash to v0.8.3, PySocks to v1.6.8, cryptography to v39.0.2, markupsafe to v2.1.5, pyrsistent to v0.14.11, python-magic to v0.4.27, pyyaml to v6.0.3, rfc3339-validator to v0.1.4, urllib3 to v1.26.20, c-ares to v1.34.6, iptables to v1.8.13, gentoo-functions to v1.7.7, mawk to v1.3.4_p20260302, lvm2 to v2.03.39, binutils-libs to v2.46.1, libxcrypt to v4.4.38, talloc to v2.4.4.
Added cos-dkms support for vast client drivers v4.5.7.
Support nvidia-fs for COS GPU installer
Upgraded app-admin/logrotate to v3.22.0-r1.
Upgraded app-admin/sosreport to v4.11.2.
Upgraded app-shells/dash to v0.5.13.4-r2.
Upgraded dev-db/sqlite to v3.53.1.
Upgraded net-misc/curl to v8.20.0-r1.
Upgraded net-misc/rsync to v3.4.4.
Upgraded sys-apps/gentoo-functions to v1.7.6.
Upgraded sys-apps/less to v704.
Fixed CVE-2026-11822, CVE-2026-11824 in dev-db/sqlite.
Fixed CVE-2026-43116 in the Linux kernel.
Fixed CVE-2026-45850 in the Linux kernel.
Fixed CVE-2026-52908 in the Linux kernel.
Fixed CVE-2026-52910 in the Linux kernel.
Fixed CVE-2026-52912 in the Linux kernel.
Fixed CVE-2026-52920 in the Linux kernel.
Fixed CVE-2026-52923 in the Linux kernel.
Fixed CVE-2026-52925 in the Linux kernel.
Fixed CVE-2026-52928 in the Linux kernel.
Fixed CVE-2026-52933 in the Linux kernel.
Fixed CVE-2026-52936 in the Linux kernel.
Fixed CVE-2026-52943 in the Linux kernel.
Fixed CVE-2026-52969 in the Linux kernel.
Fixed CVE-2026-52970 in the Linux kernel.
Fixed CVE-2026-52974 in the Linux kernel.
Fixed CVE-2026-52977 in the Linux kernel.
Fixed CVE-2026-52980 in the Linux kernel.
Fixed CVE-2026-52981 in the Linux kernel.
Fixed CVE-2026-52984 in the Linux kernel.
Fixed CVE-2026-52986 in the Linux kernel.
Fixed CVE-2026-52989 in the Linux kernel.
Fixed CVE-2026-52990 in the Linux kernel.
Fixed CVE-2026-52998 in the Linux kernel.
Fixed CVE-2026-52999 in the Linux kernel.
Fixed CVE-2026-53001 in the Linux kernel.
Fixed CVE-2026-53002 in the Linux kernel.
Fixed CVE-2026-53003 in the Linux kernel.
Fixed CVE-2026-53006 in the Linux kernel.
Fixed CVE-2026-53012 in the Linux kernel.
Fixed CVE-2026-53013 in the Linux kernel.
Fixed CVE-2026-53014 in the Linux kernel.
Fixed CVE-2026-53021 in the Linux kernel.
Fixed CVE-2026-53023 in the Linux kernel.
Fixed CVE-2026-53031 in the Linux kernel.
Fixed CVE-2026-53032 in the Linux kernel.
Fixed CVE-2026-53034 in the Linux kernel.
Fixed CVE-2026-53035 in the Linux kernel.
Fixed CVE-2026-53036 in the Linux kernel.
Fixed CVE-2026-53050 in the Linux kernel.
Fixed CVE-2026-53060 in the Linux kernel.
Fixed CVE-2026-53062 in the Linux kernel.
Fixed CVE-2026-53063 in the Linux kernel.
Fixed CVE-2026-53064 in the Linux kernel.
Fixed CVE-2026-53069 in the Linux kernel.
Fixed CVE-2026-53074 in the Linux kernel.
Fixed CVE-2026-53075 in the Linux kernel.
Fixed CVE-2026-53076 in the Linux kernel.
Fixed CVE-2026-53080 in the Linux kernel.
Fixed CVE-2026-53083 in the Linux kernel.
Fixed CVE-2026-53085 in the Linux kernel.
Fixed CVE-2026-53094 in the Linux kernel.
Fixed CVE-2026-53096 in the Linux kernel.
Fixed CVE-2026-53111 in the Linux kernel.
Fixed CVE-2026-53115 in the Linux kernel.
Fixed CVE-2026-53120 in the Linux kernel.
Fixed CVE-2026-53123 in the Linux kernel.
Fixed CVE-2026-53126 in the Linux kernel.
Fixed CVE-2026-53129 in the Linux kernel.
Fixed CVE-2026-7210 in dev-lang/python.
Upgraded dev-libs/openssl to v3.5.7 to fix CVE-2026-45445, CVE-2026-34180,CVE-2026-9076,CVE-2026-34181,CVE-2026-42764,CVE-2026-34183, CVE-2026-34182,CVE-2026-45447,CVE-2026-7383.
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.6.137 | v27.5.1 | v2.0.8 | See List |
Updated app-containers/docker-credential-gcr to v2.1.32, app-containers/docker-credential-helpers to v0.9.7, app-containers/nvidia-container-toolkit to v1.17.9, dev-libs/isa-l to v2.31.1, dev-python/oauthlib to v3.0.2, net-fs/nfs-utils to v2.6.4, sec-policy/apparmor-profiles to v3.1.7, sys-apps/apparmor to v3.1.7, sys-libs/libapparmor to v3.1.7.
Updated app-editors/vim to v9.1.2148, app-editors/vim-core to v9.1.2148, dev-libs/libtraceevent to v1.7.3, dev-libs/libtracefs to v1.6.4, net-firewall/conntrack-tools to v1.4.9, sys-fs/fuse to v2.9.9, sys-fs/fuse-common to v3.10.5.
Updated gzip to v1.14_p20260502, xz-utils to v5.4.7, zstd to v1.5.7, python-exec-conf to v2.4.10, expat to v2.8.1, json-c to v0.16.20220414, libaio to v0.3.113, xxhash to v0.8.3, PySocks to v1.6.8, cryptography to v39.0.2, markupsafe to v2.1.5, pyrsistent to v0.14.11, python-magic to v0.4.27, pyyaml to v6.0.3, rfc3339-validator to v0.1.4, urllib3 to v1.26.20, c-ares to v1.34.6, iptables to v1.8.13, gentoo-functions to v1.7.7, mawk to v1.3.4_p20260302, lvm2 to v2.03.39, binutils-libs to v2.46.1, libxcrypt to v4.4.38, talloc to v2.4.4, procps to v4.0.6.
Upgraded app-admin/logrotate to v3.22.0-r1.
Upgraded app-admin/sosreport to v4.11.2.
Upgraded app-shells/dash to v0.5.13.4-r2.
Upgraded dev-db/sqlite to v3.53.1.
Upgraded net-misc/curl to v8.20.0-r1.
Upgraded sys-apps/less to v704.
Fixed CVE-2026-41567 in app-containers/docker.
Fixed CVE-2026-41568 in app-containers/docker.
Fixed CVE-2026-42306 in app-containers/docker.
Fixed CVE-2024-56647 in the Linux kernel.
Fixed CVE-2025-38584 in the Linux kernel.
Fixed CVE-2026-11822, CVE-2026-11824 in dev-db/sqlite.
Fixed CVE-2026-43088 in the Linux kernel.
Fixed CVE-2026-43116 in the Linux kernel.
Fixed CVE-2026-45850 in the Linux kernel.
Fixed CVE-2026-46321 in the Linux kernel.
Fixed CVE-2026-46322 in the Linux kernel.
Fixed CVE-2026-52908 in the Linux kernel.
Fixed CVE-2026-52910 in the Linux kernel.
Fixed CVE-2026-52912 in the Linux kernel.
Fixed CVE-2026-52920 in the Linux kernel.
Fixed CVE-2026-52921 in the Linux kernel.
Fixed CVE-2026-52923 in the Linux kernel.
Fixed CVE-2026-52925 in the Linux kernel.
Fixed CVE-2026-52927 in the Linux kernel.
Fixed CVE-2026-52928 in the Linux kernel.
Fixed CVE-2026-52930 in the Linux kernel.
Fixed CVE-2026-52933 in the Linux kernel.
Fixed CVE-2026-52942 in the Linux kernel.
Fixed CVE-2026-52943 in the Linux kernel.
Fixed CVE-2026-52969 in the Linux kernel.
Fixed CVE-2026-52970 in the Linux kernel.
Fixed CVE-2026-52974 in the Linux kernel.
Fixed CVE-2026-52977 in the Linux kernel.
Fixed CVE-2026-52984 in the Linux kernel.
Fixed CVE-2026-52986 in the Linux kernel.
Fixed CVE-2026-52989 in the Linux kernel.
Fixed CVE-2026-52998 in the Linux kernel.
Fixed CVE-2026-52999 in the Linux kernel.
Fixed CVE-2026-53001 in the Linux kernel.
Fixed CVE-2026-53002 in the Linux kernel.
Fixed CVE-2026-53003 in the Linux kernel.
Fixed CVE-2026-53006 in the Linux kernel.
Fixed CVE-2026-53012 in the Linux kernel.
Fixed CVE-2026-53013 in the Linux kernel.
Fixed CVE-2026-53021 in the Linux kernel.
Fixed CVE-2026-53032 in the Linux kernel.
Fixed CVE-2026-53034 in the Linux kernel.
Fixed CVE-2026-53035 in the Linux kernel.
Fixed CVE-2026-53036 in the Linux kernel.
Fixed CVE-2026-53050 in the Linux kernel.
Fixed CVE-2026-53060 in the Linux kernel.
Fixed CVE-2026-53062 in the Linux kernel.
Fixed CVE-2026-53063 in the Linux kernel.
Fixed CVE-2026-53064 in the Linux kernel.
Fixed CVE-2026-53069 in the Linux kernel.
Fixed CVE-2026-53074 in the Linux kernel.
Fixed CVE-2026-53075 in the Linux kernel.
Fixed CVE-2026-53076 in the Linux kernel.
Fixed CVE-2026-53080 in the Linux kernel.
Fixed CVE-2026-53083 in the Linux kernel.
Fixed CVE-2026-53094 in the Linux kernel.
Fixed CVE-2026-53126 in the Linux kernel.
Fixed CVE-2026-7210 in dev-lang/python.
Upgraded dev-libs/openssl to v3.0.21 to fix CVE-2026-9076, CVE-2026-45447,CVE-2026-34182,CVE-2026-34180,CVE-2026-45445,CVE-2026-7383.
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.6.137 | v24.0.9 | v1.7.31 | See List |
Updated app-admin/sosreport to v4.10.2, app-containers/docker-credential-gcr to v2.1.32, app-containers/docker-credential-helpers to v0.9.7, app-containers/nvidia-container-toolkit to v1.17.9, dev-libs/isa-l to v2.31.1, dev-python/oauthlib to v3.0.2, net-fs/nfs-utils to v2.6.4, sec-policy/apparmor-profiles to v3.1.7, sys-apps/apparmor to v3.1.7, sys-libs/libapparmor to v3.1.7.
Updated app-editors/vim to v9.1.2148, app-editors/vim-core to v9.1.2148, dev-libs/libtraceevent to v1.7.3, dev-libs/libtracefs to v1.6.4, net-firewall/conntrack-tools to v1.4.9, sys-fs/fuse to v2.9.9, sys-fs/fuse-common to v3.10.5.
Updated gzip to v1.14_p20260502, xz-utils to v5.4.7, zstd to v1.5.7, python-exec-conf to v2.4.10, expat to v2.8.1, json-c to v0.16.20220414, libaio to v0.3.113, xxhash to v0.8.3, PySocks to v1.6.8, cryptography to v39.0.2, markupsafe to v2.1.5, ptyprocess to v0.5.2, pyrsistent to v0.14.11, python-magic to v0.4.27, pyyaml to v6.0.3, rfc3339-validator to v0.1.4, rfc3987 to v1.3.8, urllib3 to v1.26.20, iptables to v1.8.13, mawk to v1.3.4_p20260302, lvm2 to v2.03.39, binutils-libs to v2.46.1, libxcrypt to v4.4.38.
Upgraded app-admin/logrotate to v3.22.0-r1.
Upgraded app-shells/dash to v0.5.13.4-r1.
Upgraded dev-db/sqlite to v3.53.1.
Upgraded net-misc/curl to v8.20.0-r1.
Upgraded sys-apps/gentoo-functions to v1.7.7.
Upgraded sys-apps/less to v704.
Fixed CVE-2026-11822, CVE-2026-11824 in dev-db/sqlite.
Fixed CVE-2026-43088 in the Linux kernel.
Fixed CVE-2026-43116 in the Linux kernel.
Fixed CVE-2026-43129 in the Linux kernel.
Fixed CVE-2026-45850 in the Linux kernel.
Fixed CVE-2026-46321 in the Linux kernel.
Fixed CVE-2026-46322 in the Linux kernel.
Fixed CVE-2026-52908 in the Linux kernel.
Fixed CVE-2026-52910 in the Linux kernel.
Fixed CVE-2026-52912 in the Linux kernel.
Fixed CVE-2026-52920 in the Linux kernel.
Fixed CVE-2026-52921 in the Linux kernel.
Fixed CVE-2026-52923 in the Linux kernel.
Fixed CVE-2026-52925 in the Linux kernel.
Fixed CVE-2026-52927 in the Linux kernel.
Fixed CVE-2026-52928 in the Linux kernel.
Fixed CVE-2026-52933 in the Linux kernel.
Fixed CVE-2026-52936 in the Linux kernel.
Fixed CVE-2026-52942 in the Linux kernel.
Fixed CVE-2026-52943 in the Linux kernel.
Fixed CVE-2026-52969 in the Linux kernel.
Fixed CVE-2026-52970 in the Linux kernel.
Fixed CVE-2026-52974 in the Linux kernel.
Fixed CVE-2026-52977 in the Linux kernel.
Fixed CVE-2026-52984 in the Linux kernel.
Fixed CVE-2026-52986 in the Linux kernel.
Fixed CVE-2026-52989 in the Linux kernel.
Fixed CVE-2026-52998 in the Linux kernel.
Fixed CVE-2026-52999 in the Linux kernel.
Fixed CVE-2026-53001 in the Linux kernel.
Fixed CVE-2026-53002 in the Linux kernel.
Fixed CVE-2026-53003 in the Linux kernel.
Fixed CVE-2026-53006 in the Linux kernel.
Fixed CVE-2026-53012 in the Linux kernel.
Fixed CVE-2026-53013 in the Linux kernel.
Fixed CVE-2026-53021 in the Linux kernel.
Fixed CVE-2026-53032 in the Linux kernel.
Fixed CVE-2026-53034 in the Linux kernel.
Fixed CVE-2026-53035 in the Linux kernel.
Fixed CVE-2026-53036 in the Linux kernel.
Fixed CVE-2026-53050 in the Linux kernel.
Fixed CVE-2026-53060 in the Linux kernel.
Fixed CVE-2026-53062 in the Linux kernel.
Fixed CVE-2026-53063 in the Linux kernel.
Fixed CVE-2026-53064 in the Linux kernel.
Fixed CVE-2026-53069 in the Linux kernel.
Fixed CVE-2026-53074 in the Linux kernel.
Fixed CVE-2026-53075 in the Linux kernel.
Fixed CVE-2026-53076 in the Linux kernel.
Fixed CVE-2026-53080 in the Linux kernel.
Fixed CVE-2026-53083 in the Linux kernel.
Fixed CVE-2026-53094 in the Linux kernel.
Fixed CVE-2026-53126 in the Linux kernel.
Fixed CVE-2026-7210 in dev-lang/python.
Upgraded dev-libs/openssl to v3.0.21 to fix CVE-2026-34180, CVE-2026-45447,CVE-2026-45445,CVE-2026-9076,CVE-2026-7383,CVE-2026-34182.
You can grant workflows access to Bigtable, Google Drive, and Knowledge Catalog when running or scheduling them with your Google Account user credentials. Extended access options are available in Preview.
Gemini Enterprise: Jira Data Center federated data store
The Jira Data Center federated data store is generally available (GA) in Gemini Enterprise.
For more information, see Jira Data Center.
Gemini Enterprise: Action-filtering support for Microsoft SharePoint and OneDrive data stores (Preview)
Filters configured on Microsoft SharePoint and Microsoft OneDrive federated data stores apply to both search queries and action execution. These filters let you specify which SharePoint sites and OneDrive paths are accessible to the Assistant; mutations or retrievals on out-of-scope data fail or return no results.
This feature is in Public Preview. For more information, see:
Gemini Enterprise: HubSpot federated data store
The HubSpot federated data store is generally available (GA) in Gemini Enterprise.
For more information, see Set up a HubSpot data store.
Gemini 3.5 Flash default model for Memory Bank
The default model used for Memory Bank generation is now Gemini 3.5 Flash instead of Gemini 2.5 Flash. For information, see Set up Memory Bank.
Semantic Governance Policies available in Public Preview
Semantic Governance Policies (SGP) and the SGP engine are now available in Preview. SGP provides an intelligent security and compliance layer that evaluates an AI agent's proposed tool calls against user intent and organizational business rules at runtime.
Key capabilities include:
For more information, see Semantic governance policies overview.
Provisioned Throughput: Email notifications GA
The ability to get email notifications for Provisioned Throughput events is generally available. See Get email notifications.
GKE cluster versions have been updated.
New versions available for upgrades and new clusters.
The following versions are now available for new GKE clusters, and for manual control plane upgrades and node upgrades for existing clusters. For more information about versioning and upgrades, see GKE versioning and support and About GKE cluster upgrades.
This release includes new GKE versions that use updated Container-Optimized OS images. These updated images are cumulative, incorporating security fixes from all Container-Optimized OS versions released since the previous GKE release.
To identify the specific vulnerabilities that were resolved in each updated Container-Optimized OS image, see the Security release notes for that image. The following table includes links to the release notes for each updated Container-Optimized OS image:
| GKE version | Container-Optimized OS version | Details |
|---|---|---|
| 1.30.14-gke.2746000 | cos-117-18613-613-61 | cos-117-18613-613-61 release notes |
| 1.31.14-gke.2157000 | cos-117-18613-613-61 | cos-117-18613-613-61 release notes |
| 1.32.13-gke.1829000 | cos-117-18613-613-61 | cos-117-18613-613-61 release notes |
| 1.33.12-gke.1270000 | cos-121-18867-381-183 | cos-121-18867-381-183 release notes |
| 1.34.9-gke.1065000 | cos-125-19216-395-109 | cos-125-19216-395-109 release notes |
| 1.35.6-gke.1049000 | cos-125-19216-395-109 | cos-125-19216-395-109 release notes |
| 1.36.0-gke.3712000 | cos-129-19506-224-49 | cos-129-19506-224-49 release notes |
A new Managed Service for Apache Airflow release has started on June 29, 2026. Get ready for upcoming changes and features as we roll out the new release to all regions. This release is in progress at the moment. Listed changes and features might not be available in some regions yet.
New Airflow builds are available in Managed Airflow (Gen 3):
New images are available in Managed Airflow (Gen 2):
Vertex AI Search for commerce, which has been previously known under the mame Retail Search, has been rebranded to AI Commerce Search in Gemini Enterprise for Customer Experience.
An intelligent AI search platform customized for ecommerce use cases, AI Commerce Search now belongs to the Gemini Enterprise for Customer Experience product suite.
For general product information, see AI Commerce Search on Gemini Enterprise for Customer Experience.
You can configure Sensitive Data Protection to detect specific file labels, which can represent Google Drive labels or Microsoft sensitivity labels. For more information, see Create a custom metadata label detector.
VPC Service Controls feature: Support for using the following identities in ingress and egress rules to allow access to resources protected by a service perimeter is generally available:
For more information, see Configure identity groups and third-party identities in ingress and egress rules and Supported identities for ingress and egress rules.
reCAPTCHA Mobile SDK v18.9.2 is available for Android. This version includes minor bug fixes.
]]>Google SecOps has updated the list of supported default parsers. Parsers are updated gradually, so it might take one to four days before you see the changes reflected in your region.
The following supported default parsers have been updated. Each parser is listed by product name and log_type value, where applicable. This list includes both released default parsers and pending parser updates.
AIX_SYSTEM)AWS_API_GATEWAY)APACHE)APPIAN_CLOUD)ARUBA_SWITCH)ATLASSIAN_BITBUCKET)AVAYA_AURA)AWS_CLOUDWATCH)GUARDDUTY)AWS_NETWORK_FIREWALL)AWS_RDS)AWS_SECURITY_HUB)AWS_VPC_FLOW)AWS_VPC_FLOW_CSV)AWS_WAF)AZURE_AD)BARRACUDA_WAF)BLUECOAT_WEBPROXY)CATO_NETWORKS)CHECKPOINT_HARMONY)CHROME_MANAGEMENT)CIRCLECI)CISCO_ACS)CISCO_ASA_FIREWALL)CISCO_EMAIL_SECURITY)CISCO_FIREPOWER_FIREWALL)CISCO_IRONPORT)CISCO_ISE)CISCO_MERAKI)CISCO_ROUTER)CISCO_SECURE_ACCESS)CISCO_SWITCH)CISCO_UMBRELLA_AUDIT)UMBRELLA_FIREWALL)UMBRELLA_WEBPROXY)CISCO_SDWAN)CISCO_WIRELESS)CITRIX_NETSCALER)CLAROTY_XDOME)CLOUDFLARE)CORELIGHT)CS_ALERTS)CS_EDR)CYBERARK_PTA)CYNET_360_AUTOXDR)DELL_SWITCH)ELASTIC_WINLOGBEAT)F5_ASM)F5_BIGIP_LTM)FIREEYE_ETP)FIREEYE_NX)FORCEPOINT_WEBPROXY)FORTINET_FIREWALL)FORTINET_FORTIMAIL)FORTINET_FORTIANALYZER)FORTINET_FORTIWEB)GITHUB)GCP_CLOUDAUDIT)GCP_DNS)HAPROXY)IBM_LTO)IMPERVA_CEF)IMPERVA_SECURESPHERE)INFOBLOX_DNS)ISLAND_BROWSER)JUMPCLOUD_DIRECTORY_INSIGHTS)KEMP_LOADBALANCER)KUBERNETES_NODE)ADAUDIT_PLUS)MICROSOFT_DEFENDER_ENDPOINT)MICROSOFT_DEFENDER_MAIL)MICROSOFT_GRAPH_ALERT)IIS)MICROSOFT_SQL)MISP_IOC)NETAPP_ONTAP)NETIQ_EDIRECTORY)NETSKOPE_ALERT_V2)NETSKOPE_WEBPROXY)NGINX)NONAME_API_SECURITY)OFFICE_365)OKTA)ORACLE_DB)OCI_FLOW)ORACLE_NETSUITE)PAN_FIREWALL)PAN_PANORAMA)PAN_CASB)PAN_PRISMA_CA)PING)PROOFPOINT_ON_DEMAND)RSA_AUTH_MANAGER)SALESFORCE)GCP_SECURITYCENTER_ERROR)GCP_SECURITYCENTER_MISCONFIGURATION)GCP_SECURITYCENTER_OBSERVATION)GCP_SECURITYCENTER_POSTURE_VIOLATION)GCP_SECURITYCENTER_THREAT)GCP_SECURITYCENTER_TOXIC_COMBINATION)GCP_SECURITYCENTER_UNSPECIFIED)GCP_SECURITYCENTER_VULNERABILITY)SENDMAIL)SENTINELONE_ACTIVITY)SERVICENOW_CMDB)SOPHOS_FIREWALL)SQUID_WEBPROXY)SYMANTEC_EDR)SEP)SYSDIG)THINKST_CANARY)TRELLIX_EDRF)TRENDMICRO_VISION_ONE_DETECTIONS)TRENDMICRO_VISION_ONE_WORKBENCH)NIX_SYSTEM)VARONIS)VEEAM)VMWARE_VCENTER)VMWARE_VSPHERE)WINDOWS_DNS)WINEVTLOG)WINEVTLOG_XML)WINDOWS_SYSMON)WIZ_IO)WORKDAY_USER_ACTIVITY)BRO_JSON)ZSCALER_WEBPROXY)ZSCALER_FIREWALL)The following log types were added without a default parser. Each parser is listed by product name and log_type value, where applicable.
CISCO_SECURE_ACCESS_ENROLLMENT)CISCO_SECURE_ACCESS_NETWORK)CYBERARK_CERTIFICATE_MANAGER_SAAS)GEMINI_ENTERPRISE_AGENT_PLATFORM)GEOSCADA_OT)MCPDEV)MCPMODIFY)MCPVIEW)NETAPP_RANSOMWARE_RESILIENCE)NETSKOPE_LOG_STREAMING)PYLON_LOGS)RECO_CSPM)SALT_SECURITY)SENTINELONE_APPLICATION)WIZ_VULNERABILITIES)Google SecOps has updated the list of supported default parsers. Parsers are updated gradually, so it might take one to four days before you see the changes reflected in your region.
The following supported default parsers have been updated. Each parser is listed by product name and log_type value, where applicable. This list includes both released default parsers and pending parser updates.
AIX_SYSTEM)AWS_API_GATEWAY)APACHE)APPIAN_CLOUD)ARUBA_SWITCH)ATLASSIAN_BITBUCKET)AVAYA_AURA)AWS_CLOUDWATCH)GUARDDUTY)AWS_NETWORK_FIREWALL)AWS_RDS)AWS_SECURITY_HUB)AWS_VPC_FLOW)AWS_VPC_FLOW_CSV)AWS_WAF)AZURE_AD)BARRACUDA_WAF)BLUECOAT_WEBPROXY)CATO_NETWORKS)CHECKPOINT_HARMONY)CHROME_MANAGEMENT)CIRCLECI)CISCO_ACS)CISCO_ASA_FIREWALL)CISCO_EMAIL_SECURITY)CISCO_FIREPOWER_FIREWALL)CISCO_IRONPORT)CISCO_ISE)CISCO_MERAKI)CISCO_ROUTER)CISCO_SECURE_ACCESS)CISCO_SWITCH)CISCO_UMBRELLA_AUDIT)UMBRELLA_FIREWALL)UMBRELLA_WEBPROXY)CISCO_SDWAN)CISCO_WIRELESS)CITRIX_NETSCALER)CLAROTY_XDOME)CLOUDFLARE)CORELIGHT)CS_ALERTS)CS_EDR)CYBERARK_PTA)CYNET_360_AUTOXDR)DELL_SWITCH)ELASTIC_WINLOGBEAT)F5_ASM)F5_BIGIP_LTM)FIREEYE_ETP)FIREEYE_NX)FORCEPOINT_WEBPROXY)FORTINET_FIREWALL)FORTINET_FORTIMAIL)FORTINET_FORTIANALYZER)FORTINET_FORTIWEB)GITHUB)GCP_CLOUDAUDIT)GCP_DNS)HAPROXY)IBM_LTO)IMPERVA_CEF)IMPERVA_SECURESPHERE)INFOBLOX_DNS)ISLAND_BROWSER)JUMPCLOUD_DIRECTORY_INSIGHTS)KEMP_LOADBALANCER)KUBERNETES_NODE)ADAUDIT_PLUS)MICROSOFT_DEFENDER_ENDPOINT)MICROSOFT_DEFENDER_MAIL)MICROSOFT_GRAPH_ALERT)IIS)MICROSOFT_SQL)MISP_IOC)NETAPP_ONTAP)NETIQ_EDIRECTORY)NETSKOPE_ALERT_V2)NETSKOPE_WEBPROXY)NGINX)NONAME_API_SECURITY)OFFICE_365)OKTA)ORACLE_DB)OCI_FLOW)ORACLE_NETSUITE)PAN_FIREWALL)PAN_PANORAMA)PAN_CASB)PAN_PRISMA_CA)PING)PROOFPOINT_ON_DEMAND)RSA_AUTH_MANAGER)SALESFORCE)GCP_SECURITYCENTER_ERROR)GCP_SECURITYCENTER_MISCONFIGURATION)GCP_SECURITYCENTER_OBSERVATION)GCP_SECURITYCENTER_POSTURE_VIOLATION)GCP_SECURITYCENTER_THREAT)GCP_SECURITYCENTER_TOXIC_COMBINATION)GCP_SECURITYCENTER_UNSPECIFIED)GCP_SECURITYCENTER_VULNERABILITY)SENDMAIL)SENTINELONE_ACTIVITY)SERVICENOW_CMDB)SOPHOS_FIREWALL)SQUID_WEBPROXY)SYMANTEC_EDR)SEP)SYSDIG)THINKST_CANARY)TRELLIX_EDRF)TRENDMICRO_VISION_ONE_DETECTIONS)TRENDMICRO_VISION_ONE_WORKBENCH)NIX_SYSTEM)VARONIS)VEEAM)VMWARE_VCENTER)VMWARE_VSPHERE)WINDOWS_DNS)WINEVTLOG)WINEVTLOG_XML)WINDOWS_SYSMON)WIZ_IO)WORKDAY_USER_ACTIVITY)BRO_JSON)ZSCALER_WEBPROXY)ZSCALER_FIREWALL)The following log types were added without a default parser. Each parser is listed by product name and log_type value, where applicable.
CISCO_SECURE_ACCESS_ENROLLMENT)CISCO_SECURE_ACCESS_NETWORK)CYBERARK_CERTIFICATE_MANAGER_SAAS)GEMINI_ENTERPRISE_AGENT_PLATFORM)GEOSCADA_OT)MCPDEV)MCPMODIFY)MCPVIEW)NETAPP_RANSOMWARE_RESILIENCE)NETSKOPE_LOG_STREAMING)PYLON_LOGS)RECO_CSPM)SALT_SECURITY)SENTINELONE_APPLICATION)WIZ_VULNERABILITIES)Release 6.3.91 is being rolled out to the first phase of regions as listed here.
This release contains internal and customer bug fixes.
Remote Agents Version 2.6.7
Remote Agents Version 2.6.7 is now available. This release contains minor bug fixes.
]]>Release 6.3.90 is now available for all regions.
]]>Generally available: You can cancel a future reservation request in calendar mode to prevent Compute Engine from provisioning your requested resources and incurring unnecessary charges. For more information, see Delete a future reservation request in calendar mode.
Generally available: In a managed instance group (MIG), you can use a health check to monitor your application health without triggering repairs for an unhealthy VM, if the application fails the health check. You can prevent the MIG from repairing an unhealthy VM by turning off autohealing. For more information, see Turn off repairs in a MIG.
Support for Intel TDX on
c3-standard-*-lssd machine types
is available in
Preview.
Gemini Enterprise: Confluence Data Center federated data store
The Confluence Data Center federated data store is generally available (GA) in Gemini Enterprise.
For more information, see Confluence Data Center.
New Provisioned Throughput features
The following Provisioned Throughput features are generally available:
There are no version updates for 2026-R24.
There are no version updates for 2026-R24.
There are no version updates for 2026-R24.
There are no version updates for 2026-R24.
There are no version updates for 2026-R24.
There are no version updates for 2026-R24.
GKE cluster versions have been updated.
New versions available for upgrades and new clusters.
The following versions are now available for new GKE clusters, and for manual control plane upgrades and node upgrades for existing clusters. For more information about versioning and upgrades, see GKE versioning and support and About GKE cluster upgrades.
This release includes new GKE versions that use updated Container-Optimized OS images. These updated images are cumulative, incorporating security fixes from all Container-Optimized OS versions released since the previous GKE release.
To identify the specific vulnerabilities that were resolved in each updated Container-Optimized OS image, see the Security release notes for that image. The following table includes links to the release notes for each updated Container-Optimized OS image:
| GKE version | Container-Optimized OS version | Details |
|---|---|---|
| 1.30.14-gke.2608000 | cos-117-18613-613-5 | cos-117-18613-613-5 release notes |
| 1.30.14-gke.2710000 | cos-117-18613-613-5 | cos-117-18613-613-5 release notes |
| 1.31.14-gke.1986000 | cos-117-18613-613-7 | cos-117-18613-613-7 release notes |
| 1.31.14-gke.2116000 | cos-117-18613-613-7 | cos-117-18613-613-7 release notes |
| 1.32.13-gke.1657000 | cos-117-18613-534-110 | cos-117-18613-534-110 release notes |
| 1.32.13-gke.1740000 | cos-117-18613-534-110 | cos-117-18613-534-110 release notes |
| 1.33.12-gke.1165000 | cos-121-18867-381-125 | cos-121-18867-381-125 release notes |
| 1.33.12-gke.1208000 | cos-121-18867-381-125 | cos-121-18867-381-125 release notes |
| 1.34.8-gke.1284000 | cos-125-19216-395-7 | cos-125-19216-395-7 release notes |
| 1.35.5-gke.1057002 | cos-125-19216-395-7 | cos-125-19216-395-7 release notes |
| 1.35.5-gke.1163012 | cos-125-19216-395-7 | cos-125-19216-395-7 release notes |
| 1.35.5-gke.1241004 | cos-125-19216-395-7 | cos-125-19216-395-7 release notes |
| 1.35.5-gke.1324000 | cos-125-19216-395-7 | cos-125-19216-395-7 release notes |
| 1.36.0-gke.3302001 | cos-129-19506-120-64 | cos-129-19506-120-64 release notes |
Improved documentation portal navigation
Finding help is now easier! We've updated the navigation of our documentation portal to be primarily user-centric. Sections have been reorganized and renamed to align with your workflows, providing a logical path through the documentation.
We've also added:
Improved documentation portal navigation
Finding help is now easier! We've updated the navigation of our documentation portal to be primarily user-centric. Sections have been reorganized and renamed to align with your workflows, providing a logical path through the documentation.
We've also added:
Improved documentation portal navigation
Finding help is now easier! We've updated the navigation of our documentation portal to be primarily user-centric. Sections have been reorganized and renamed to align with your workflows, providing a logical path through the documentation.
We've also added:
The apache-airflow-providers-google package was upgraded to version 22.1.0.
For more information about changes, see the
apache-airflow-providers-google changelog.
New Airflow builds are available in Managed Airflow (Gen 3):
New images are available in Managed Airflow (Gen 2):
The following Managed Airflow versions and builds have reached their end of support period: composer-3-airflow-2.9.3-build.25, composer-3-airflow-2.9.3-build.26, composer-3-airflow-2.9.3-build.27, composer-2.13.3-airflow-2.9.3, composer-2.13.4-airflow-2.9.3, composer-2.13.5-airflow-2.9.3, composer-2.13.3-airflow-2.10.5, composer-2.13.4-airflow-2.10.5, composer-2.13.5-airflow-2.10.5.
]]>Addressed multiple Common Vulnerabilities and Exposures (CVEs) by updating dependencies.
Upgraded the Open Telemetry image from 0.150.0 to 0.152.0 to pick up vulnerability fixes. To understand the changes in each release, review the full changelog for opentelemetry-collector-contrib.
Security bulletins page
See the new security bulletins page for Application Integration. Use it to stay informed about related security updates, vulnerabilities, and remediations. For more information, see Security bulletins.
The Assured Open Source Software free tier includes an updated list of curated binaries for the Go, Java, and Python languages.
For more information, see List of supported Java and Python packages for the Assured OSS free tier and List of supported Go packages for the Assured OSS free tier.
An updated version of the Simba ODBC driver for BigQuery is now available.
You can now use the VECTOR_SEARCH function
to combine a semantic search with a lexical (keyword) search. This is known as a
hybrid search. For tables with autonomous embedding generation enabled, you can
use HYBRID mode in the AI.SEARCH
function to simplify your search syntax.
You can also extend a vector index to include keyword information to improve the speed of the lexical search portion of a hybrid search.
This feature is in Preview.
Support for applying role-based access controls (RBAC) to Cloud Monitoring dashboards and alerting policies using Tags is generally available.
You can use Tags to protect Terraform-managed Cloud Monitoring resources and configure team-scoped access. For more information, see Use Tags to control access to resources.
You can now assess the upgrade readiness of your Cloud SQL for MySQL instances before a major version upgrade by running a precheck. This precheck analyzes your instance for version incompatibilities and lists any issues that need to be fixed prior to your upgrade. For more information, see Assess upgrade readiness for your instance.
This feature is in Preview.
Cluster Toolkit v1.95.0 is available. This release introduces Slurm
high availability controller support using managed instance groups (MIGs). This
version also implements Google Kubernetes Engine node auto-provisioning (NAP) and unified
compute consumption options for the gcluster job submit command. For details,
see the Release announcement on
GitHub.
tableSettings path resolution issue.Gemini Enterprise: Governance for agents and MCP servers
You can access Agent Registry from within Gemini Enterprise. Agent Registry provides a catalog of agents and custom Model Context Protocol (MCP) servers. From the catalog, you can select A2A agents or MCP servers to add to your Gemini Enterprise apps.
Furthermore, through egress policies managed by Agent Gateway, you can set allow and deny permissions on traffic going to these agents or these MCP servers.
This feature is generally available (GA). For more information, see:
Gemini Enterprise: New data store and support for new actions (Public Preview)
The Lovable data store is available in Public Preview in Gemini Enterprise. End users can search and read projects, and use natural language commands to perform actions, including adding connectors, remixing projects, and setting project knowledge and visibility. For more information, see Connect Lovable.
Additionally, support for new actions is available in Public Preview for the following data stores:
For more information, see Connect a third-party data source.
Gemini Enterprise: View agent identity
This feature is generally available (GA). As a Gemini Enterprise administrator, you can view an agent's identity on the Agent details page. This is typically the agent's SPIFFE ID.
If the SPIFFE ID is not published, the Agent Registry resource ID is displayed as a fallback. For more information, see Agent identity.
Administrative correction to Gemini Online Inference API on Gemini Enterprise Agent Platform SLA
We made an administrative correction to the Gemini Online Inference API on Gemini Enterprise Agent Platform Service Level Agreement (SLA), addressing a clerical issue.
Web SDK version 2 will be shut down on June 26, 2026
On June 26, 2025, we announced the launch of Web SDK version 3. Starting on June 26, 2026, the web SDK v2 will no longer be supported. Be sure to update your website to use the web SDK v3 to avoid disrupting your integration with the web SDK. We are no longer adding new features to the web SDK v2.
Palo Alto Cortex XDR: Version 30.0
The following new action has been added:
CyberArk PAM: Version 11.0
The following new action has been added:
Siemplify: Version 110.0
Updated results processing logic to cleanly escape backslashes in the following action:
Secret Manager: Version 2.0
Updated action description in the following action:
CrowdStrike Falcon: Version 77.0
Updated syncing logic to support multiple CrowdStrike alert IDs mapped to a single SecOps alert and improved error handling for alert ID context values in the following connector:
Azure Active Directory: Version 29.0
Updated error handling for sign-in activity retrieval in the following action:
Google Cloud Compute: Version 19.0
Refactored action code in the following actions:
Add IP To Firewall Rule
Remove external IP addresses
Execute VM Patch Job
Update Firewall Rule
VirusTotalV3: Version 41.0
Updated Predefined Widgets to fix cached fallback rendering in the following actions:
Enrich Hash
Enrich IOC
Enrich IP
Enrich URL
Get Domain Details
Google Threat Intelligence: Version 16.0
Updated Predefined Widgets to optimize loading performance and aligned layouts to prevent visual shifts in the following actions:
Enrich Entities
Enrich IOCs
EmailV2: Version 42.0
Updated default values for IMAP server address, port, username, and password for the following connector:
FireEye Helix: Version 20.0
FireEye ETP: Version 9.0
You can view the details of your GoldenGate deployments, connections, and related assignments through Google Cloud console. For more information, see Manage deployments, Manage connections, and Manage assignments.
This feature is Generally Available (GA).
The Assured Open Source Software premium tier includes an updated list of curated binaries for the Go, Java, and Python languages.
For more information, see List of supported Java and Python packages for the Assured OSS premium tier and List of supported Go packages for the Assured OSS premium tier.
]]>Apigee Emulator
On June 24, 2026, we released Apigee Emulator version 2.0.1.
This is a security-only hotfix release on top of v2.0.0 that addresses 10 security vulnerabilities in the Netty networking library and the embedded Cassandra Go standard library health-check binary. There are no functional, API, or configuration changes -- v2.0.1 is a drop-in replacement for v2.0.0.
The emulator image is available at Google Artifact Registry.
To upgrade, update the emulator version in your VS Code Cloud Code settings
to 2.0.1. See
Manage the Apigee Emulator
for details.
Apigee Emulator
4.1.135.Final (from 4.1.133.Final) and pinned all
transitive netty-* artifacts via netty-bom.1.25.11
(from 1.25.10) in the embedded health-check binary.netty-tcnative-boringssl-static classifier variants from
2.0.53.Final to 2.0.77.Final.Apigee Emulator
This release addresses 10 security vulnerabilities in the Netty networking
library and the embedded Go standard library. All Netty fixes come from
upgrading to 4.1.135.Final; all Go standard library fixes come from a
Cassandra base image rebuild against Go 1.25.11.
| CVE | Component |
|---|---|
| CVE-2026-50010 | Netty (netty-handler) |
| CVE-2026-50020 | Netty (netty-codec-http) |
| CVE-2026-50560 | Netty (netty-codec-http2) |
| CVE-2026-48043 | Netty (netty-codec-http2) |
| CVE-2026-44249 | Netty (netty-handler) |
| CVE-2026-45416 | Netty (netty-handler) |
| CVE-2026-47244 | Netty (netty-codec-http2) |
| CVE-2026-27145 | Go standard library |
| CVE-2026-42504 | Go standard library |
| CVE-2026-42507 | Go standard library |
You can create hot backups and modify all backups in Bigtable Studio. For more information, see Manage backups.
For GitLab Enterprise and Bitbucket Data Center connections, Cloud Build now checks permissions on the calling principal.
When you create or update repository connections, Cloud Build uses Secret Manager
secrets to authenticate to third-party Git providers. Previously, these
referenced secrets were retrieved by the Cloud Build service agent (P4SA) on your
behalf, checking permissions only against the P4SA's credentials rather than
those of the calling principal. To adhere to the security principle of least
privilege, Cloud Build now checks permissions on both the calling principal
(using end-user credentials) and the P4SA, to ensure both have the
secretmanager.versions.access IAM permission on the referenced
secrets.
This check only affects GitLab Enterprise (GLE) and Bitbucket Data Center (BBDC) connections.
For instructions and more details, see the Cloud Build security bulletin.
Cloud SQL now supports Private Service Connect outbound connectivity on the following additional types of instances:
Read replica instances.
Instances that use advanced disaster recovery features such as switchover and failover operations.
For more information about Private Service Connect outbound connectivity see About Private Service Connect.
Cloud SQL now supports Private Service Connect outbound connectivity on the following additional types of instances:
Read replica instances.
Instances that use advanced disaster recovery features such as switchover and failover operations.
For more information about Private Service Connect outbound connectivity see About Private Service Connect.
Cloud SQL now supports Private Service Connect outbound connectivity on the following additional types of instances:
Read replica instances.
Instances that use advanced disaster recovery features such as switchover and failover operations.
Primary instances that have replicas.
For more information about Private Service Connect outbound connectivity see About Private Service Connect.
Confidential Space image 260600 is available. This image provides support for graceful shutdown of container workloads on power button events.
Gemini Enterprise: Observability for agents (GA)
Observability for Gemini Enterprise is now generally available (GA). This includes:
For more information, see:
AI security findings in Agent Platform
Viewing AI security findings and posture management summaries in Gemini Enterprise Agent Platform is generally available.
With this release, the Security dashboard introduces the Top security findings widget.
Also, specific features within the AI security widgets are available in Preview, including the following:
For more information, see View security findings.
Model Armor for Agent Gateway in General Availability
You can enable Model Armor on an Agent Gateway resource to apply your organization's content security guardrails to prompts and responses that pass through the gateway. This feature is generally available (GA).
For more information, see Configure Model Armor on a gateway.
HCX upgrade to 4.11.4: The VMware Engine operations team is initiating updates of the HCX Manager Appliance to version 4.11.4. This upgrade resolves an issue with MON-enabled segments. You are responsible for upgrading the HCX On-Prem/Connectors and Service Mesh Appliances. For more details, see the Latest service announcements.
Google Distributed Cloud (software only) for bare metal 1.34.600-gke.53 is available. To upgrade, see Upgrade clusters. Runs on Kubernetes v1.34.7-gke.200.
After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.
If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.
The following issues were fixed in 1.34.600-gke.53:
Identity-Aware Proxy (IAP) supports securing agent-to-anywhere egress for Agent Gateway. The feature generally available GA. To learn more about IAP support for Agent Gateway, see IAP for agents overview.
General availability support for the following integration:
General Availability: You can cancel pending deletion requests for VPC Network Peering connections that are in consensus mode. For more information, see Cancel a deletion request.
]]>Preview: You can use Gemini in the Google Cloud console as an AI-powered interface to evaluate hardware options, estimate deployment costs, and view recommended configurations for your clusters. Prompting Gemini helps you reach an optimal configuration for your cluster before you create or modify the cluster. For more information, see Design and optimize your cluster with Gemini.
You can now configure application-consistent backups for Compute Engine instances directly through the Google Cloud Console. This enhancement allows you to enable Guest Flush or VSS options within Backup Plans, ensuring data integrity for applications running on Linux or Windows VMs during the backup process. The Back up Compute Engine instances documentation has been updated with instructions on how to create and modify backup plans to use this feature.
Announcing the general availability (GA) of cross-region backups for Backup and DR Service. Customers can now protect Compute Engine instances, Compute Engine disks, and Filestore instances against regional outages by storing backups in a distinct secondary region of their choice. This functionality enhances disaster recovery capabilities, provides a cost-effective way to ensure regional resilience, and helps maintain strict control over data residency. To learn more, see Backup vaults for immutable and indelible backups.
You can now configure your BigQuery pipelines to automatically trigger executions based on updates to specific BigQuery tables. For more information, see Trigger-based scheduling. This feature is in Preview.
Conversational analytics in BigQuery is now generally available (GA) and includes the following features:
Agents can use the following AI functions to answer your questions:
Conversational analytics supports US MREP and EU MREP locations that govern the storage of agent and conversation resources, and the location used for ML processing.
You can also create a conversation with a dataset. This feature is in preview.
Database Migration Service for MySQL homogeneous migrations now supports MySQL version 9.7. For more information, see Supported source and destination databases.
1.29.5-asm.3 is now available for in-cluster Cloud Service Mesh.
This patch release contains the fix for the security vulnerability listed in GCP-2026-040.
For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.29.5-asm.3 uses Envoy v1.37.5-dev.
This patch release also contain the fixes for the following CVEs:
| CVE | Proxy | Control Plane | Distroless | CNI | Severity |
|---|---|---|---|---|---|
| CVE-2026-34182 | Yes | Yes | No | Yes | Medium (9.1) |
| CVE-2026-45447 | Yes | Yes | No | Yes | High (8.8) |
| CVE-2026-7383 | Yes | Yes | No | Yes | Low (8.1) |
| CVE-2026-34180 | Yes | Yes | No | Yes | Low (7.5) |
| CVE-2026-45445 | Yes | Yes | No | Yes | Medium (7.5) |
| CVE-2026-9076 | Yes | Yes | No | Yes | Low (7.5) |
| CVE-2026-42766 | Yes | Yes | No | Yes | Low (5.9) |
| CVE-2026-42767 | Yes | Yes | No | Yes | Low (5.9) |
| CVE-2026-34743 | Yes | Yes | No | Yes | Low (5.3) |
| CVE-2026-45446 | Yes | Yes | No | Yes | Low (4.8) |
| CVE-2026-42770 | Yes | Yes | No | Yes | Low (3.7) |
| CVE-2026-40226 | Yes | Yes | No | Yes | Medium (0.0) |
1.28.9-asm.2 is now available for in-cluster Cloud Service Mesh.
This patch release contains the fix for the security vulnerability listed in GCP-2026-040.
For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.9-asm.2 uses Envoy v1.36.9-dev.
This patch release also contain the fixes for the following CVEs:
| CVE | Proxy | Control Plane | Distroless | CNI | Severity |
|---|---|---|---|---|---|
| CVE-2026-34182 | Yes | Yes | No | Yes | Medium (9.1) |
| CVE-2026-45447 | Yes | Yes | No | Yes | High (8.8) |
| CVE-2026-7383 | Yes | Yes | No | Yes | Low (8.1) |
| CVE-2026-34180 | Yes | Yes | No | Yes | Low (7.5) |
| CVE-2026-45445 | Yes | Yes | No | Yes | Medium (7.5) |
| CVE-2026-9076 | Yes | Yes | No | Yes | Low (7.5) |
| CVE-2026-42766 | Yes | Yes | No | Yes | Low (5.9) |
| CVE-2026-42767 | Yes | Yes | No | Yes | Low (5.9) |
| CVE-2026-34743 | Yes | Yes | No | Yes | Low (5.3) |
| CVE-2026-45446 | Yes | Yes | No | Yes | Low (4.8) |
| CVE-2026-42770 | Yes | Yes | No | Yes | Low (3.7) |
| CVE-2026-40226 | Yes | Yes | No | Yes | Medium (0.0) |
1.27.9-asm.8 is now available for in-cluster Cloud Service Mesh.
This patch release contains the fix for the security vulnerability listed in GCP-2026-040.
For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.9-asm.8 uses Envoy v1.35.13-dev.
This patch release also contain the fixes for the following CVEs:
| CVE | Proxy | Control Plane | Distroless | CNI | Severity |
|---|---|---|---|---|---|
| CVE-2026-34182 | Yes | Yes | No | Yes | Medium (9.1) |
| CVE-2026-45447 | Yes | Yes | No | Yes | High (8.8) |
| CVE-2026-7383 | Yes | Yes | No | Yes | Low (8.1) |
| CVE-2026-34180 | Yes | Yes | No | Yes | Low (7.5) |
| CVE-2026-45445 | Yes | Yes | No | Yes | Medium (7.5) |
| CVE-2026-9076 | Yes | Yes | No | Yes | Low (7.5) |
| CVE-2026-42766 | Yes | Yes | No | Yes | Low (5.9) |
| CVE-2026-42767 | Yes | Yes | No | Yes | Low (5.9) |
| CVE-2026-34743 | Yes | Yes | No | Yes | Low (5.3) |
| CVE-2026-45446 | Yes | Yes | No | Yes | Low (4.8) |
| CVE-2026-42770 | Yes | Yes | No | Yes | Low (3.7) |
| CVE-2026-40226 | Yes | Yes | No | Yes | Medium (0.0) |
The following images are now rolling out for managed Cloud Service Mesh:
These patch releases contain the fix for the vulnerability listed in GCP-2026-040.
These rollouts will preempt those previously announced on June 12, 2026.
Preview: You can use Gemini in the Google Cloud console as an AI-powered interface to evaluate hardware options, estimate deployment costs, and view recommended configurations for your Compute Engine instances. Prompting Gemini helps you reach an optimal configuration for your workload before you create or modify a compute instance. For more information, see Design your compute infrastructure with Gemini.
Config Connector version 1.152.0 is now available.
New Fields:
ComputeReservation
spec.shareSettings field.ComputeForwardingRule
status.target field.Reconciliation Improvements:
Added support for direct reconciliation to more resources, with opt-in behaviour. The API is unchanged. To use the direct reconciler, add the cnrm.cloud.google.com/reconciler: direct annotation to the corresponding Config Connector object. The following resources now have direct reconciliation support:
Bug Fixes:
SQLInstance: Fixed case sensitivity in availabilityType.Preview Tool: Fixed crash on typed resources and hang on defaulting in preview mode.ComputeForwardingRule: Fixed target field matching.ComputeFutureReservation: Fixed validation logic for future reservation times.Gemini Enterprise: Observability settings for Deep Research agents (Preview)
You can now configure observability settings for individual Deep Research agents, the same way as for Agent Designer employee-made agents. This allows you to monitor metrics in Metrics Explorer and view trace results in Trace Explorer for specific Deep Research agents.
Observability for Deep Research agents is enabled via the agent-level Observability toggle, not the app-level toggle used for the Core Assistant agent.
This feature is in Public Preview. For more information, see Manage observability settings.
For GKE cluster version 1.34.1-gke.3899001 (sidecar mounter image version 1.21.9) and later affected versions, Cloud Storage FUSE volumes might fail to mount if the GKE metadata service isn't ready when the Cloud Storage FUSE sidecar initiates.
When this issue occurs, you might see the following error:
MountVolume.SetUp failed for volume "volume-name" : rpc error: code = Internal desc = the sidecar container terminated due to Error, exit code: 255
Additionally, the gcsfuse-sidecar container displays the following error:
Failed to fetch identity pool and identity provider details required for bucket access check, got error Failed to set up metadata service: failed to get project: Get "http://X.X.X.X/computeMetadata/v1/project/project-id": dial tcp 169.254.169.254:80: connect: connection refused for identity pool PROJECT_ID.svc.id.goog and identity provider https://container.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/clusters/CLUSTER_NAME
Mitigation
To resolve this issue, perform one of the following mitigations:
Upgrade your cluster to one of the following fixed GKE versions:
1.34.8-gke.1218000 or later1.35.3-gke.2347000 or later1.36.0-gke.1266000 or later.Create an init container in your Pod that validates metadata service availability.
Manually inject the sidecar to ensure the sidecar is blocked by an init container.
For more information, see the Cloud Storage FUSE CSI driver troubleshooting guide.
In GKE version 1.35 and later, due to faster node startup, workloads that use Dataplane V2 and Workload Identity Federation for GKE to authenticate to Google Cloud APIs might experience transient connectivity timeouts or refused connections to the GKE metadata server immediately following node startup.
For recommendations and workarounds
if this impacts your workload (for example, if your workload doesn't retry
requests until they succeed), see Timeout errors at Pod
startup,
specifically by deploying an initContainer.
Alternatively, add any that selects no workloads, such as in a namespace with no workloads—to GKE Dataplane V2, network policy—including one which disables the faster node startup. Improvements are in progress and coming in a future GKE patch.
[Spotlight Feature] Ask Gemini Cloud Assist in Feed Management
Google SecOps now provides Gemini Cloud Assist (GCA) directly within the Feed Management interface. Use the new Ask Gemini Cloud Assist button to get help with feed creation, setup, and general troubleshooting questions.
Click Ask Gemini Cloud Assist to open the Gemini Cloud Assist panel and ask questions to get guidance on:
Note: Gemini Cloud Assist provides recommendations and answers to your questions, but does not perform configuration changes on your behalf. You must apply any recommended changes manually to your feeds.
For more information, see Feed management overview.
Ingestion metrics reporting correction
Google Security Operations has resolved an issue where certain ingestion metrics—which are displayed in both the dashboard and Cloud Monitoring—were under-reported.
Because of this correction, you might notice a one-time apparent spike in your ingestion metrics when the update is enabled for your region (between June 29 and July 10, 2026). The actual log volume ingested remains unchanged.
Historical metrics recorded before this update will not be modified or backfilled. This correction does not affect customer billing.
If you have questions or need assistance, contact Google Security Operations support.
Critical Notice: Upcoming reservation of siemAlertId field
Effective July 5, 2026, the siemAlertId field will be strictly reserved for
internal Chronicle SIEM alert IDs.
Starting July 5, the system will automatically overwrite any custom or
user-supplied data passed through this field. This change impacts all ingestion
methods, including the Ingestion API, webhooks, and both first-party and
third-party connectors. If you are currently utilizing a custom field named
siemAlertId in any of your data ingestion configurations, please migrate to a
different field name immediately to prevent data loss.
Ask Gemini Cloud Assist in Feed Management
Google SecOps now provides Gemini Cloud Assist (GCA) directly within the Feed Management interface to help you with feed creation, setup, and general troubleshooting questions.
A new Ask Gemini Cloud Assist button is now available in the Feed Management interface. You can click this button to open the Gemini Cloud Assist panel and ask questions to get guidance on:
Note: Gemini Cloud Assist provides recommendations and answers to your questions, but does not perform configuration changes on your behalf. You must apply any recommended changes manually to your feeds.
For more information, see Feed management overview.
Ingestion metrics reporting correction
Google Security Operations has resolved an issue where certain ingestion metrics—which are displayed in both the dashboard and Cloud Monitoring—were under-reported.
Because of this correction, you might notice a one-time apparent spike in your ingestion metrics when the update is enabled for your region (between June 29 and July 10, 2026). The actual log volume ingested remains unchanged.
Historical metrics recorded before this update will not be modified or backfilled. This correction does not affect customer billing.
If you have questions or need assistance, contact Google Security Operations support.
Critical Notice: Upcoming reservation of siemAlertId field
Effective July 5, 2026, the siemAlertId field will be strictly reserved for
internal Chronicle SIEM alert IDs.
Starting July 5, the system will automatically overwrite any custom or
user-supplied data passed through this field. This change impacts all ingestion
methods, including the Ingestion API, webhooks, and both first-party and
third-party connectors. If you are currently utilizing a custom field named
siemAlertId in any of your alert ingestion configurations, please
migrate to a different field name immediately to prevent data loss.
You can control data lineage ingestion for BigQuery and Managed Service for Apache Airflow at the organization, folder, or project level. This feature is available in preview.
For more information, see Control data ingestion.
ABAP SDK for Google Cloud version 1.14 (On-premises or any cloud edition)
Version 1.14 of the on-premises or any cloud edition of the ABAP SDK for Google Cloud is generally available (GA).
This version resolves an issue that occurred during signature verification for Cloud Storage content repository and removes an unreferenced node from the SPRO configuration menu.
For more information, see What's new with the ABAP SDK for Google Cloud.
BigQuery Connector for SAP version 2.15
Version 2.15 of the BigQuery Connector for SAP is generally available (GA). This version resolves issues related to column descriptions in standalone SLT system configurations and attribute consistency in Pub/Sub messages during Change Data Capture (CDC) replication.
For more information, see What's new with BigQuery Connector for SAP.
Image safety classification infoTypes are now supported in ExcludeByImageFindings and AdjustByImageFindings detection rules.
For information about configuring these rules, see Modifying infoType detectors to refine scan results.
Spanner supports direct connectivity. When enabled, your application traffic is routed directly to Spanner servers, bypassing the Google Front End (GFE) servers. This can reduce your overall latency. Direct connectivity is generally available (GA).
General Availability: Service consumers can authorize Private Service Connect interfaces to connect to network attachments by adding service class IDs to a network attachment's accept list.
For more information, see Authorization policies.
]]>Preview: RoCE VPC networks for VM instances support assigning alias IP
ranges to MRDMA vNICs. For more information about these features, see the
following:
On June 22nd, 2026, we released an updated version of Apigee (1-17-0-apigee-10).
| Bug ID | Description |
|---|---|
| 519996459 | Security fix for Apigee. Upgraded the Apigee ingress gateway to patch the following vulnerabilities:
|
| N/A | Security fix for Apigee infrastructure. |
| Bug ID | Description |
|---|---|
| 515788622 | Upgraded the default outbound TLS protocol from TLSv1.2 to TLSv1.3 on JVMs that support it. Per-proxy <SSLInfo><Protocols> settings continue to take precedence, and the new HTTPClient.outbound.tls.protocol override lets operators force a specific protocol. |
| 184266748 | Fixed an issue where ApigeeDatastore TLS certificate creation could fail in namespaces with longer names when the certificate common name exceeded the 64-byte limit. |
| 286069772 | Added a per-gateway proxyProtocol.mode property (strict, permissive, disable) on Apigee ingress gateway components to opt in to HAProxy PROXY-protocol parsing. The property defaults to disable. |
| N/A | Updates to infrastructure and libraries. |
You can use the BigQuery Data Transfer Service to transfer metadata from the following data sources into Knowledge Catalog:
This feature is in Preview.
Resource-based CUD recommendations available for Compute Engine GPUs, Local SSD disks, and OS licenses
Resource-based committed use discount (CUD) recommendations are generally available (GA) for GPUs, Local SSD disks, and premium operating system (OS) licenses.
CUD recommendations provide insight into any additional commitments that you can purchase to optimize the costs of the resources that you run. You can use these recommendations and purchase commitments for resource usage that isn't covered by commitments and is being charged at list prices. Google Cloud analyzes your compute instance spending trends with and without a commitment and generates CUD recommendations on a monthly basis.
For more information about how CUD recommendations are generated, what resource types are supported, and how to use recommendations to purchase commitments, see Get recommendations for committed use discounts (CUDs).
If the parent project for a Cloud Storage bucket changes, a log sink stops routing log entries to that bucket. For more information about error messages and recovery options, see Errors routing to Cloud Storage.
Metrics Explorer can automatically break down a chart into a series of tiles, with each displaying time-series data for a specific label key. This view helps you identify spikes, dips, or trends that the aggregation settings might otherwise hide.
To learn more, see Break down a chart by labels.
Customer-managed encryption key (CMEK) support for Cloud SQL enhanced backups is generally available. You can protect your CMEK-enabled Cloud SQL instances using Google Cloud Backup and DR Service.
For more information, see Choose your backup option.
Customer-managed encryption key (CMEK) support for Cloud SQL enhanced backups is generally available. You can protect your CMEK-enabled Cloud SQL instances using Google Cloud Backup and DR Service.
For more information, see Choose your backup option.
The Envoy Lua Filter is now available as a preview feature in the rapid release channel.
Generally available: You can create instances all at once in a regional managed instance group (MIG) by using resize requests. For more information, see About resize requests in a MIG.
Generally available: Resource-based committed use discount (CUD) recommendations are available for GPUs, Local SSD disks, and premium operating system (OS) licenses.
CUD recommendations provide insight into any additional commitments that you can purchase to optimize the costs of the resources that you run. You can use these recommendations and purchase commitments for resource usage that isn't covered by commitments and is being charged at list prices. Google Cloud analyzes your compute instance spending trends with and without a commitment and generates CUD recommendations on a monthly basis.
For more information about how CUD recommendations are generated, what resource types are supported, and how to use recommendations to purchase commitments, see Get recommendations for committed use discounts (CUDs).
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.12.90 | v27.5.1 | v2.2.3 | See List |
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.18.35 | v29.4.3 | v2.2.3 | See List |
Minor changes.
Upgraded app-admin/logrotate to v3.22.0-r1.
Upgraded app-admin/oslogin to v20260605.00.
Upgraded chromeos-base/google-breakpad to v2026.06.03.194714-r275.
Upgraded cos-gpu-installer to v2.7.4.
Upgraded dev-db/sqlite to v3.53.2-r1.
Upgraded sys-apps/less to v704.
Fixed CVE-2026-50195, CVE-2026-53488, CVE-2026-53492, CVE-2026-53489, and CVE-2026-47262 in app-containers/containerd.
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.12.85 | v27.5.1 | v2.1.7 | See List |
Minor changes.
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.6.137 | v27.5.1 | v2.0.8 | See List |
Fixed CVE-2026-5928 in sys-libs/glibc.
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.6.137 | v24.0.9 | v1.7.31 | See List |
Minor changes.
You can now use Hyperdisk Balanced
disks for Dataflow worker VMs. With Hyperdisk Balanced disks, you can provision
IOPS and throughput independently of disk size by using the diskProvisionedIOPS
and diskProvisionedThroughput pipeline options (Java SDK) or
disk_provisioned_iops and disk_provisioned_throughput_mibps pipeline options
(Python and Go SDKs). For more information, see
Disk type and
Provision IOPS and throughput.
Supervised fine-tuning available for Gemini 3.1 Flash Lite and Gemini 3.5 Flash in Public Preview
Supervised fine-tuning is now available for the gemini-3.1-flash-lite and
gemini-3.5-flash models in
Preview. Model tuning
for Gemini 3.1 Flash Lite and Gemini 3.5 Flash is restricted to us-central1
and europe-west4 and tuned model serving is restricted to the us and eu
multi-region endpoints.
See About supervised fine-tuning for more information.
Provisioned Throughput support for supervised fine-tuned Gemini 3 model inference.
Provisioned Throughput can be used to assure supervised fine-tuned inference using the same quota. Supervised fine-tuned inference for Gemini 3 models incurs a higher burndown rate compared to base model inference. Learn more here.
Google Cloud CCaaS 4.43
We've released version 4.43 of Google Cloud CCaaS.
The timing of the update to your instance depends on the deployment schedule that you have chosen. For more information, see Deployment schedules.
Calls to direct numbers display language selection in the call adapter
When an agent receives a direct call, the call adapter now displays the language that the caller chose during language selection.
For more information, see Direct phone numbers.
HubSpot: Control the display of CRM account fields and record fields in the agent adapter
You can now control how CRM account fields (contact and company) and record fields (ticket and deal) appear in the agent adapter for HubSpot integrations. This gives agents immediate access to important context such as VIP status, account ownership, and ticket priority during live interactions.
Administrators: In the Settings > Developer Settings > CRM > Agent Platform > HubSpot > Account Lookup section, there are two new CRM Account Display Fields sections and a new CRM Record Display Fields section.
For more information, see HubSpot lookups.
The chat API supports CSAT surveys
You can now conduct customer satisfaction (CSAT) surveys using the chat API. You can configure CSAT surveys at the global level and at the queue level.
Administrators: On the Settings > Chat page, there's a new Chat API section.
For more information, see CSAT in the chat API.
This release addresses the following issues:
Fixed an issue where uploading a PDF document to a chat made the conversation history unavailable during a session transfer or page refresh.
Fixed an issue where direct SMS chats didn't send termination notifications at the end of the chat.
Fixed an issue where the after-hours voicemail greeting didn't play during agent-to-agent call deflections.
Fixed an issue where SIP and IVR calls intermittently failed if the caller disconnected before a virtual agent was assigned.
Fixed an issue where calls deflected to voicemail during after-hours were incorrectly reported as errors in the All Call History report.
Fixed an issue where direct inbound calls were incorrectly deflected to voicemail during an agent's available hours when agent deflections were enabled.
Fixed an issue where inbound voice calls failed with an application error during the initial lookup phase.
Fixed a Kustomer issue where Agent Assist transcripts were delivered to the CRM as file attachments instead of timeline notes.
Fixed an issue where the In Progress banner and the Cancel button didn't appear immediately after a virtual task assistant request was initiated.
Fixed an issue where campaigns stayed in a paused state instead of transitioning to a completed state after finishing.
Fixed a Deltacast issue where chats weren't routed correctly to available agents when the company-wide concurrency setting was disabled but individual agent limits were active.
Fixed an issue where supervisor monitoring and whisper features caused system errors during call recording.
Fixed an issue where agents couldn't dismiss forwarded voicemails if the source queue had been deleted.
Fixed an issue where Telnyx calls that ended normally didn't generate a disconnect event, resulting in missing recordings, missing transcripts, and calls appearing to still be active in the CCAI Platform portal.
Fixed an issue where consecutive IVR queue deletions caused performance delays and timeout errors.
Fixed an issue where queue-level automatic wrap-up settings were disabled without an end-user action.
Fixed an issue where the queue settings page displayed inconsistent whisper announcement statuses and didn't play queue names during calls.
Fixed an issue where the Queues page displayed incorrect overcapacity deflection settings when end-users navigated quickly between different queues.
Fixed an issue where virtual agents attempted to fail over to a human agent during outages even when no human agent was configured.
Fixed a Salesforce issue where initiating an outbound call from an active case linked to a separate case assigned to a different user, incorrectly overriding ownership of the second case.
Fixed a Kustomer issue where duplicate conversation records were created in the CRM during calls.
Fixed a Kustomer issue where SMS chat sessions didn't create tickets in the CRM.
Fixed an issue where underscores in an email address in a shortcut were converted to double backslashes when an agent sent the email address to an end-user.
Fixed an issue where deleting Twilio records caused unnecessary errors.
Fixed an issue where disabling the global CSAT setting prevented IVR surveys from being offered to callers, even when the surveys were enabled for specific queues.
Knowledge Catalog connectors for importing metadata from Oracle and MySQL data sources are available in Preview.
Knowledge Catalog connectors automatically extract metadata (technical, operational, and business) from external data sources and import it into Knowledge Catalog entry groups. You can schedule metadata import runs on a set schedule.
For more information, see About database connectors and Manage connector jobs.
Starting June 22, 2026, the following features will begin rolling out as part of Looker 26.10.
The Gemini Expression Assistant preview feature has been updated to increase performance.
Note: This item was updated on June 26, 2026 to indicate support for Looker (original) only.
New in Looker 26.10, Looker project deployments have transitioned from a synchronous to an asynchronous process to improve reliability and efficiency. Deployments now run as background processes. Instead of waiting for a deployment to finish, the system immediately returns a deployment ID, allowing you to continue your work without being blocked. In addition, the Looker IDE's Deploy tab is visible for all LookML projects, not just for projects where advanced deploy mode is enabled. For projects where advanced deploy mode is disabled, when a LookML developer deploys to production, the Looker IDE displays a confirmation that the deployment was submitted. The confirmation dialog has a Go to Deployment Manager button, which you can click to open the Deploy tab in the IDE and see the status of your recent deployments.
Note: This item was added on June 23, 2026.
The Self-service Explores feature has the following updates:
Now available in preview, model localization is supported for imported projects. By default, Looker uses the locale definitions from the importing project only, if the importing project has locale definitions. However, if you want to merge the locale definitions from an imported project with the locale definitions of the importing project, you can add the import_locale_defs: yes
Dashboard editors can now enable the Preserve desktop layout setting to preserve the layout of a dashboard when users view the dashboard in a smaller browser or on a mobile screen. Users can navigate the dashboard with a zoom slider that enlarges tiles, and they can switch between desktop and mobile view.
When you publish an in-database analytic model as a stable model on your database, you can now view its stable name in the Stable Name field of the PDT Details modal on the Persistent Derived Tables admin page. You can then use the stable name to query the published analytic model. See the derived_analytic_model parameter page for more information.
Note: This item was added on June 26, 2026.
Continuous Integration (CI) suites can now be configured to automatically run on a recurring schedule.
The character limit for descriptions on dashboards and Looks has been increased to 2,000 characters, giving content creators the ability to add comprehensive descriptions, operational definitions, and notes to their dashboards and Looks to ensure that viewers fully understand the data context.
This feature is available to any user with standard content editing rights (Edit content access level or save_dashboards or save_looks permissions).
The Enhanced search feature is now generally available.
Note: The general availability of Enhanced Search preview feature has been temporarily delayed. This release note was updated on July 1, 2026.
Looker admins can now programmatically change the owner of dashboards, boards, and agents with the Looker API by updating the associated user ID. This simplifies offboarding and content reassignment when users change roles or leave the organization.
When the owner of a dashboard, a board, or an agent is changed, new owners are automatically granted Manage/Edit access to transferred agents. Any existing certification badges on transferred dashboards remain intact.
The API initiator must have save_content and manage_spaces access to the folder where the asset resides.
Transferring ownership of dashboards and boards doesn't automatically grant the new owner access to parent folders, models, or underlying Looks.
Now available in preview, the Filters as tiles and tile-level filter context feature lets you convert dashboard filters into draggable tiles on the dashboard canvas. A dashboard editor can then drag and arrange filter tiles on the dashboard canvas in the same way as other dashboard tiles. To enable this feature, a Looker admin must turn on the Filters as tiles and tile-level filter context setting on the Previews admin page.
In addition, viewers can now check which filters are applied to a specific visualization tile.
Now available in preview, the Google Maps enhancements feature adds the following features:
The Visualization Assistant is now available in the new Explore experience.
Now available in preview, the KPI Visualization feature replaces the Single Value chart option with the KPI (Single Value) chart option. The new KPI (Single Value) chart option lets users access the following enhanced styling options for single value visualizations:
Looker dashboard agents are now included in the embedded Looker experience. Embed users with the appropriate permissions can see dashboard agents on all the embedded dashboards that they have access to.
Learn more about how to configure an embedded dashboard for embed user visibility.
The Granular Dashboard Sizing preview feature is now enabled by default.
Conversational Analytics data agents that are published to Gemini Enterprise now support visualizations in their conversations. Note: This feature is not yet available. This item was updated on July 9, 2026.
The dashboard summary feature can now be enabled separately from dashboard data agents. This feature is disabled by default. When this feature is enabled, a dashboard summary is generated automatically at the top of the dashboard data agent conversation. To enable this feature, a Looker admin must turn on the Enable Dashboard Summary feature on the Gemini in Looker admin page.
Note: This feature is not yet available. This item was updated on July 6, 2026.
When you update the Gemini Enterprise instance that is connected to Looker, any data agents that you published to the previous Gemini Enterprise instance will be unpublished. You can still access these data agents in Looker, but you must re-publish them to the new Gemini Enterprise instance before you can chat with those agents in Gemini Enterprise.
Now available in preview, enhanced observability metrics, including engagement and token usage data, are available for Conversational Analytics on the Conversational Analytics System Activity dashboard. To enable this feature, a Looker admin must turn on the Conversational Analytics Observability setting on the Previews admin page.
Note: The Conversational Analytics Observability preview feature is temporarily unavailable. You can still monitor Conversational Analytics engagement on the Conversational Analytics System Activity dashboard, but metrics on token usage are not available. This item was updated on June 29, 2026.
Managed Service for Apache Spark (formerly Dataproc on Compute Engine):
The following new subminor image versions, 1.3.96, 1.4.81, 1.5.92, 2.0.161, and 2.3.32,
don't have preconfigured Conda channels, and are not mapped to default aliases
(such as 2.3-debian12 and 2.3-ubuntu22) until August 25, 2026.
The new 2.1 and 2.2 subminor images continue to have preconfigured Conda channels,
but note the following Default change schedule:, which will impact all supported
image versions.
2.3.32-debian12). Packages cannot be installed using Conda unless channels are manually configured during cluster initialization.1.3.96, 1.4.81, 1.5.92, and 2.0.161 will become default after August 25, 2026.
Additionally, newer subminor versions for 2.1, 2.2, and 2.3 released after August 25, 2026 will not have preconfigured Conda channels and will be mapped to default aliases.
All workloads must use new images after August 25, 2026
since the use of prior subminor versions with preconfigured Conda
channels will be disallowed.You may need to delete and replace existing clusters After August 25, 2026, existing clusters created with images that have preconfigured Conda channels (even if cluster jobs don't use Conda to install packages) need to be deleted and replaced with new clusters created or recreated with images that don't have preconfigured Conda channels.
Managed Service for Apache Spark (formerly Dataproc on Compute Engine): Key updates in these image versions include:
ICEBERG optional component. Users can opt-in to Iceberg 1.10 by setting the dataproc:dataproc.iceberg.version cluster property to 1.10 during cluster creation.spark.scheduler.listenerbus.exitTimeout to 30s for Compute Engine deployments.Image scanning is available in the following cloud regions:
asia-southeast1us-east4us-west1For more information, see Locations that support image scanning.
Between July 2025 and June 2026, some table data
profiles saved to BigQuery contained an incorrect
1970-01-01 timestamp instead of NULL in expiration_time
for tables that don't expire. This issue has been fixed. New exports of table
data profiles show the correct expiration timestamps.
Preview: RoCE VPC networks for VM instances support assigning alias IP
ranges to MRDMA vNICs. For more information about these features, see the
following:
Scheduled Maintenance
CloudSQL will undergo a scheduled minor upgrade this Sunday, June 21, 2026.
Release 6.3.90 is being rolled out to the first phase of regions as listed here.
This release contains internal and customer bug fixes.
Scheduled Maintenance
CloudSQL will undergo a scheduled minor upgrade.
]]>Cloud Shell no longer includes the Terraform CLI by default. Users can customize their environment to install the CLI on environment startup, or install the binary to their home directory to persist the install between sessions.
Release 6.3.89 is now available for all regions.
]]>On June 19, 2026 we released an updated version of the Apigee hybrid software, v1.16.6.
HAProxy PROXY-protocol support on Apigee ingress gateway
In this release, you can opt into HAProxy PROXY-protocol parsing by setting the ingressGateways[].proxyProtocol.mode property (with options strict, permissive, or disable) in your overrides configuration file. The property defaults to disable.
Various security and CVE fixes are included in this release.
Bare Metal Solution supports using Privileged Access Manager to provide temporary elevated access to a user to perform the critical evict operation that permanently deletes a storage resource. For more information, see Evict a LUN or storage volume.
You can use the Bigtable Studio explorer to search for all resources except for authorized views and column families. For more information, see Manage your data using Bigtable Studio.
When you migrate from Percona XtraBackup physical file to Cloud SQL for MySQL,
you can now specify multiple data files in the innodb_data_file_path
parameter of your external server configuration. Also, you are no longer
required to use the default name for your data files.
Cloud SQL for MySQL now supports multiple system tablespace files, allowing system tablespace size to grow larger than 16TB.
Various bug fixes and minor product enhancements.
Secret Manager supports multi-region storage. You can choose between a single region or a multi-region location when you create a regional secret in the Google Cloud console.
For more information, see Create a regional secret.
]]>Update to the API Gateway runtime architecture
The API Gateway runtime architecture is being updated to improve its integration with Google Cloud Platform and its services.
This update does not affect existing API Gateway features. However, be aware of the following differences:
Status code changes for gRPC API Gateways
| Error | New status code | Previous status code |
|---|---|---|
| Quota exceeded | ResourceExhausted |
Unavailable
|
| Invalid API key | InvalidArgument |
InternalError |
For 4xx client-side quota failures, API Gateway will now reject requests (fail closed). This applies to both gRPC and OpenAPI API Gateways.
If you experience any other differences in behavior due to this update, contact Google Cloud Customer Care.
Note: Rollouts of this release to production instances might take up to 4 weeks to complete across all Google Cloud zones. Your instances might not be updated until the rollout is complete.
Agent Registry is generally available (GA).
The following are features available in Agent Registry for the GA launch stage:
v1 version of the Agent Registry API is available. Cloud client libraries are available in C#, Go, Java, Node.js, PHP, Python, and Ruby.1.0, letting you explicitly declare transport endpoints and bindings inside the supportedInterfaces array, in addition to the existing 0.3 schema support.Known limitations:
On June 18th, 2026, we began maintenance updates of Apigee instances configured for maintenance windows.
If you set a preferred window for maintenance for your instance, and your instance version is below 1-17-0-apigee-9, your instance will be updated to 1-17-0-apigee-9 within the next seven to 21 days. A notification containing the expected date of upgrade will be sent within the next two business days.
For more information on participating in scheduled maintenance windows, see Maintenance overview and Manage Apigee instance maintenance windows.
Backup vault support for Cloud SQL instances encrypted with customer-managed encryption keys (CMEK) is generally available (GA), providing immutable and indelible storage with enforced retention. For more information, see Back up Cloud SQL instances to a backup vault.
The Cloud Logging API adds support for the ca regional endpoint. For a
complete list of regional endpoints, see the
REST reference pages.
Cloud SQL for MySQL now supports minor version 8.0.46. To upgrade your existing instance to the new minor version, see Upgrade the database minor version.
Cloud SQL is integrated with Google AI Studio to help you build full-stack applications that use a Cloud SQL for PostgreSQL developer edition instance as the database. You can enter natural language prompts in the Google AI Studio to build applications backed by Cloud SQL and add features such as authentication, search, and persistent data storage.
For more information, see Build vibe-coded applications using Google AI Studio and Cloud SQL.
This feature is generally available (GA).
The rollout of the following Cloud SQL for PostgreSQL minor version and extension upgrades is complete:
Minor versions
The new maintenance version is [PostgreSQL version].R20260319.07_04.
To apply the new maintenance version, see
Perform self-service maintenance.
You can collect, view, and analyze multimodal prompts and responses from your agentic applications that use the LangGraph or Agent Development Kit (ADK) frameworks. This feature is generally available (GA).
Cluster Toolkit v1.94.0 is available. This release provides reservation
subblock support in the nodeset module for Slurm. This version also adds
network_policy as a variable in the gke-cluster module and loosens strict
Terraform version constraints across core and community modules. By moving to a
minimum version requirement, you can use newer versions of Terraform while
maintaining compatibility. For details, see the Release announcement on
GitHub.
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.12.90 | v27.5.1 | v2.2.3 | See List |
Updated oslogin to v20260605.00.
Upgraded app-admin/logrotate to v3.22.0-r1.
Upgraded sys-apps/less to v704.
Fix CVE-2026-41567 in app-containers/docker.
Fix CVE-2026-41568 in app-containers/docker.
Fix CVE-2026-42306 in app-containers/docker.
Fixed CVE-2026-46160 in the Linux kernel.
Fixed CVE-2026-46315 in the Linux kernel.
Fixed CVE-2026-46321 in the Linux kernel.
Fixed CVE-2026-46322 in the Linux kernel.
Fixed CVE-2026-46323 in the Linux kernel.
Fixed CVE-2026-50195, CVE-2026-53488, CVE-2026-53492, CVE-2026-53489, and CVE-2026-47262 in app-containers/containerd.
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.12.85 | v27.5.1 | v2.1.7 | See List |
Updated oslogin to v20260605.00.
Fix CVE-2026-41568 in app-containers/docker.
Fix CVE-2026-415687 in app-containers/docker.
Fix CVE-2026-42306 in app-containers/docker.
Fixed CVE-2026-46315 in the Linux kernel.
Fixed CVE-2026-46321 in the Linux kernel.
Fixed CVE-2026-46322 in the Linux kernel.
Fixed CVE-2026-46323 in the Linux kernel.
Fixed CVE-2026-50195, CVE-2026-53488, CVE-2026-53492, CVE-2026-53489, and CVE-2026-47262 in app-containers/containerd.
Runtime sysctl changes:
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.6.137 | v24.0.9 | v1.7.31 | See List |
Updated oslogin to v20260605.00.
Fix CVE-2026-41567 in app-containers/docker.
Fix CVE-2026-41568 in app-containers/docker.
Fix CVE-2026-42306 in app-containers/docker.
Fixed CVE-2025-13462 in dev-lang/python.
Fixed CVE-2026-46323 in the Linux kernel.
Fixed CVE-2026-50195, CVE-2026-53488, CVE-2026-53492, CVE-2026-53489, and CVE-2026-47262 in app-containers/containerd.
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.6.137 | v27.5.1 | v2.0.8 | See List |
Updated oslogin to v20260605.00.
Fixed CVE-2026-46323 in the Linux kernel.
Fixed CVE-2026-50195, CVE-2026-53488, CVE-2026-53492, CVE-2026-53489, and CVE-2026-47262 in app-containers/containerd.
Viewer data refresh
Report editors can now allow report viewers to manually refresh report data. When editors enable the new Viewer data refresh option in report settings, viewers can refresh data for a component by right clicking the component, or refresh data for a report by selecting the option in the three-dot menu.
Various bug fixes and minor product enhancements.
Gemini Enterprise: Workflow agents (GA with allowlist)
You can create, import, update, and use workflow agents in the Gemini Enterprise web app. These agents are designed to execute a sequence of steps or actions, which can include a mix of AI automation and human intervention, based on a configured trigger.
This feature is available as a GA with allowlist. To access this feature, contact your Google account manager. After your Google Cloud project is added to the allowlist, a Gemini Enterprise administrator must turn on the Enable agent designer toggle in the web app feature management settings to let users use it.
For more information, see:
Workflow agents (You need to be on the allowlist to access the page.)
Agent Gateway in General Availability
Agent Gateway is the networking component of the Gemini Enterprise Agent Platform ecosystem. It secures and governs connectivity for all agentic interactions, whether they occur between users and agents, agents and tools, or among agents themselves.
For details, see Agent Gateway overview.
Agent Observability is generally available (GA)
This release provides visibility into the performance, behavior, and health of deployed agents and Model Context Protocol (MCP) servers directly within the agent management workflow.
Key updates in this release include:
For more information, see the following:
Agent Registry is generally available (GA)
Agent Registry is generally available (GA). Agent Registry is a centralized catalog for discovering and registering agents and Model Context Protocol (MCP) servers.
The following features are available in Agent Registry for the GA launch stage:
v1 version of the Agent Registry API is available. Cloud client libraries are available in C#, Go, Java, Node.js, PHP, Python, and Ruby.1.0, letting you explicitly declare transport endpoints and bindings inside the supportedInterfaces array, in addition to the existing 0.3 schema support.Known limitations:
For more information, see the Agent Registry overview.
The Agent Identity API (agentidentity.googleapis.com) is
available in Preview.
This new API replaces the legacy IAM Connectors API
(iamconnectors.googleapis.com) for managing auth providers and agent
identities.
During the preview migration period, both APIs operate side-by-side. Existing
auth providers are automatically mirrored to the new V2 resource hierarchy
(authProviders/), allowing you to migrate your IAM policies, agent code, and
client applications without downtime.
The Agent Identity API (agentidentity.googleapis.com) is
available in Preview.
This new API replaces the legacy IAM Connectors API
(iamconnectors.googleapis.com) for managing auth providers and agent
identities.
During the preview migration period, both APIs operate side-by-side. Existing
auth providers are automatically mirrored to the new V2 resource hierarchy
(authProviders/), allowing you to migrate your IAM policies,
agent code, and client applications without downtime.
For Exadata Database Service on Exascale infrastructure and Base Database Service, Oracle Database@Google Cloud adds region asia-northeast2 (Osaka, Japan).
For a list of supported locations, see Supported regions and zones.
Secret Manager is available in the following multi-regions:
us)eu)ca)in)For more information, see Secret Manager locations.
Security Command Center External Exposure is available in Preview for the Security Command Center Premium tier. The service helps you manage and reduce your external attack surface through automated asset discovery, Google Cloud network exposure path validation, and active exploitability testing.
For more information, see Detect exposed resources.
]]>Agent Assist offers the following UI module integrations with Agent Assist for Salesforce:
You can enable autonomous embedding
generation on new or existing
tables that you make with the CREATE
TABLE
or ALTER
TABLE
statements. When you do this, BigQuery maintains a column of embeddings on the
table based on a source column. When you add or modify data in the source
column, BigQuery automatically generates or updates the embedding column for
that data.
This feature is generally available (GA).
CUD dashboard redesign available (preview)
The redesigned CUD dashboard is available in the Billing section of the Google Cloud console. It provides a consolidated view of all your resource-based and spend-based CUDs in a single place. The new design improves usability and scalability, helping you find information faster.
For more information, see View your commitments.
When you create composite objects, you can delete the temporary source objects as part of the composition process.
Gemini Enterprise: Create and manage skills (GA with allowlist)
You can create, import, update, and use skills in the Gemini Enterprise web app. Skills are reusable custom instructions that help the assistant perform specific tasks.
This feature is available as a GA with allowlist. To access this feature, contact your Google account manager. After your Google Cloud project is added to the allowlist, a Gemini Enterprise administrator must turn on the Enable skills toggle in the web app feature management settings to let users use it.
For more information, see:
Create and manage skills (You need to be on the allowlist to access the page.)
Gemini Enterprise: Gemini Enterprise app for Slack
Gemini Enterprise administrators can integrate Gemini Enterprise with Slack to deliver AI-powered answers and search directly to users in their Slack workspace. Once integrated, users can interact with Gemini Enterprise through direct messages and slash commands to receive answers that incorporate data from all connected data stores.
This feature is generally available (GA). For more information, see Configure the Gemini Enterprise app for Slack.
Memory Bank and Sessions global and multi-regional endpoints GA
Memory Bank and Sessions support for multi-regional and global endpoints is now in General Availability (GA). For more information, see Supported locations for agents. Note that Customer-Managed Encryption Keys (CMEK) cannot be used if your Memory Bank or Sessions instance is configured to use the global endpoint.
We are experiencing a delay preventing patch releases for GDC software only for VMware. We are working diligently to resolve this issue. We will post updates here with more information as it becomes available.
Auto-collapse setting for the query editor
You can now configure the query editor to automatically collapse after you run a search, maximizing the screen space available for viewing your search results. By default, the query editor remains expanded.
For more information, see Configure query editor behavior.
Secret Manager: Version 1.0
Source code is now publicly available on GitHub for the following integrations:
AlienVault USM Appliance: Version 29.0
AlienVaultTI: Version 15.0
Arcsight: Version 46.0
Axonius: Version 8.0
BMC Helix Remedyforce: Version 18.0
Cisco AMP: Version 24.0
EasyVista: Version 8.0
Mandiant: Version 10.0
Office 365 Management API: Version 11.0
SCCM: Version 22.0
SonicWall-Beta: Version 9.0
Stellar Cyber Starlight: Version 19.0
Symantec Email Security.Cloud: Version 6.0
Twilio: Version 16.0
XForce: Version 20.0
Zabbix: Version 17.0
Google Chronicle: Version 86.0
Fixed an issue where the connector would idle or hang on heartbeats instead of
breaking early when nextPageToken or nextPageStartTime is received, and
updated ontology mapping in the following connector:
Palo Alto Cortex XDR: Version 29.0
Updated host name extraction logic in the raw payload in the following connector:
Auto-collapse setting for the query editor
You can now configure the query editor to automatically collapse after you run a search, maximizing the screen space available for viewing your search results. By default, the query editor remains expanded.
For more information, see Configure query editor behavior.
Memorystore for Redis supports the General Availability of the following health issues:
Support for the ext_authz Envoy gRPC API
protocol
is now generally available
(GA) for regional
external Application Load Balancers and regional internal
Application Load Balancers.
AlloyDB integration with Knowledge Catalog is now generally available (GA).
This integration provides a unified metadata view to simplify data governance and analysis. It includes near real-time synchronization and expanded metadata details, like primary and foreign keys.
For more information, see Integrate AlloyDB with Knowledge Catalog.
On June 16, 2026 we released an updated version of the Apigee hybrid software, v1.14.6.
Various security and CVE fixes are included in this release.
Table Explorer behavior is moving to the Reference panel. This transition will occur in July 2026 or later. For more information, see Table Explorer.
QueryData adds support for parameterized secure views (PSVs) to help secure applications that use natural language queries. For more information, see Secure and control access to application data.
This feature is in Preview.
For resource-based committed use discounts (CUDs), the default value of CUD scope for most Cloud Billing accounts has changed from Project to Billing account. If the CUD scope is set to Billing account, then resource-based CUDs from a commitment are shared across all projects in that account. If the CUD scope is set to Project, then resource-based CUDs from a commitment are available to only the project in which you purchased that commitment.
Depending on the Cloud Billing account's creation date and the active commitments in that account, this change applies in the following way:
For more information, see Share resource-based CUDs across projects.
Support for the accelerator-optimized g4-standard-48 machine type for securely running AI and ML workloads is available in Preview, with the following specifications:
Dataflow now supports NVIDIA RTX Pro 6000 GPUs. You can use this
GPU model to run your Apache Beam pipelines on Dataflow. RTX
Pro 6000 GPUs are recommended for large, medium, and small model inference
workloads. To configure your workers with this GPU model, set the accelerator
type to nvidia-rtx-pro-6000. For more information, see Dataflow
support for GPUs.
Gemini Enterprise: ServiceNow data store actions and federation
The ServiceNow data store supports federation and assistant actions in Gemini Enterprise.
You can connect a ServiceNow site to search and read incidents, change requests, tasks, and knowledge base articles using natural language. You can also perform actions, such as creating and updating incidents, directly from the Gemini Enterprise app.
This feature is generally available (GA). For more information, see Connect ServiceNow.
Google Distributed Cloud (software only) for bare metal 1.35.200-gke.66 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.35.200-gke.66 runs on Kubernetes v1.35.3-gke.400.
After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.
If you use a third-party storage vendor, check the Google Distributed Cloud-ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.
The following issues were fixed in 1.35.200-gke.66:
etcd-events pod read the stale data directory when it started
and attempted to reuse the old member ID to rejoin the cluster instead of the
new one. Trying to use the old member ID to rejoin the cluster resulted in an
infinite retry loop and caused the cluster to reject the connection. The fix
ensures the /var/lib/etcd-events directory is
cleared upon failure, and adds retry logic to kubeadm-reset to improve resiliency against transient API errors.
New Documentation changelogs
Google SecOps is now releasing a monthly changelog to capture major documentation updates.
For more information, refer to Documentation changelog.
New Documentation changelogs
Google SecOps is now releasing a monthly changelog to capture major documentation updates.
For more information, refer to Documentation changelog.
New Documentation changelogs
Google SecOps is now releasing a monthly changelog to capture major documentation updates.
For more information, refer to Documentation changelog.
Managed Service for Apache Spark (formerly Dataproc on Compute Engine): Rollout of the new sub-minor versions without pre-configured channels will begin on June 22, 2026, delayed from the previously planned date of June 15, 2026 ETA.
You can now use authorization policies to perform identity-based and content-based access control checks when processing outbound traffic requests through Secure Web Proxy.
By configuring authorization policies, you can set rules for your workloads to access external destinations. You can also use these authorization policies to delegate complex authorization decisions to identity and content-scanning services like Service Extensions. This feature is supported in Preview.
You can integrate frontend mutual TLS (mTLS) with Secure Web Proxy to boost the security of your applications and workloads.
With this integration, you can use validated client identities in Secure Web Proxy authorization policies to enforce granular access control for outbound traffic. This feature is supported in Preview.
]]>Preview: Before you create Spot VMs, you can view the real-time availability, estimated uptime, historical preemption rate, and pricing for a specific machine type and location. This information helps you maximize the chances of successfully creating Spot VMs and choose the configuration that best fits your workload needs and budget. For more information, see Use Spot.
The Database Insights remote Model Context Protocol (MCP) server now supports the following advanced query insights tools for AlloyDB for PostgreSQL:
get_advanced_aggregated_query_statsget_advanced_aggregated_wait_event_statsget_advanced_time_series_query_statsget_advanced_time_series_wait_event_statsget_index_recommendationsFor more information, see Database Insights remote MCP server.
You can publish an AlloyDB for PostgreSQL conversational analytics agent in Gemini Enterprise. This feature is in Preview.
New minor engine versions released for the commercial line of business within the v004.009 and v004.010 version lines. These versions extend support for the major engine version and include no significant changes compared to the previous minor versions.
Use Gemini Cloud Assist to analyze your SQL queries and receive recommendations to optimize query performance in BigQuery. This feature is available to customers who use BigQuery editions. This feature is in Preview.
Support for configuring daily token quotas for BigQuery generative AI functions has been temporarily disabled. We are working to restore this feature as soon as possible.
You can resize the width of table columns in BigQuery Studio for BigQuery listings such as datasets, repositories, job history, and connections. To resize a column, hover over the column divider and drag it to your preferred width.
You can use Gemini Code Assist directly within the BigQuery Jobs explorer, Job details, Job history, and Capacity management pages to help you troubleshoot and analyze performance issues. For more information, see Troubleshoot job performance. This feature is in Preview.
Limited support for Blockchain Node Engine
Starting June 15, 2026, Blockchain Node Engine will enter a period of limited support.
New node creation in Blockchain Node Engine and provisioning of new Blockchain RPC endpoints will be disabled.
Existing nodes and endpoints will continue to function and receive critical updates until the final shutdown date.
We recommend migrating your workloads to our partner, Quicknode, to avoid service disruption.
For more information, see the migration guide.
New filters and group-by options available in Cloud Billing Reports
Cloud Billing has added two filters to the Billing Reports page to help you analyze and understand your costs:
Products: Google Cloud Products consist of a group of SKUs (potentially from more than one Google Cloud Service) that work together and are sold as a single service, sometimes referred to as a logical product family or a subscription service. Examples include Gemini Enterprise and Firebase App Hosting.
Originating services: An Originating service is a Google Cloud service that causes usage in another service. For example, Google Kubernetes Engine (GKE) can cause usage in Compute Engine. In this use case, when you are viewing the Compute Engine usage and costs, GKE is an originating service when it causes usage in Compute Engine.
You can also Group by the new filters, to summarize your costs by the dimension you select.
Learn more about analyzing billing data and cost trends with Reports.
Learn how to view Gemini Enterprise costs in Cloud Billing reports.
The Cloud Deploy image now uses Kubectl Kustomize.
By default, Cloud Deploy now uses the Kustomize built into kubectl. Previously, the default version of Kustomize was the version embedded in the Cloud Deploy image. Now it's the version used by kubectl.
You can still use kustomize directly (not through kubectl) by specifying the kustomize version when you create a release.
The Envoy Compressor Filter is now GA in the rapid release channel.
To ensure your EnvoyFilter compressor configuration is fully supported, see
Modernize EnvoyFilter compressor configurations.
Preview: Before you create Spot VMs, you can view the following information for a specific machine type and location:
You can view the real-time obtainability and estimated uptime. This information helps you maximize your chances of successfully creating Spot VMs, as well as help ensure that your workload starts and runs efficiently.
You can view historical and current preemption rate and pricing. This information helps you compare and choose the configuration that best fits your workload needs and budget.
For more information, see View the availability of Spot VMs and View the preemption rate and pricing for Spot VMs.
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.12.90 | v27.5.1 | v2.2.3 | See List |
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.18.35 | v29.4.3 | v2.2.3 | See List |
Upgraded app-admin/fluent-bit to v4.2.5.
Upgraded cos-gpu-installer to v2.7.3.
Allow overriding IMA policy from oem partition.
Upgraded sys-apps/less to v702.
On cchost boards, autoload IMA policy on boot.
Fixed CVE-2025-71289 in the Linux kernel.
Set static UUID for the stateful partition.
Fixed CVE-2026-43245 in the Linux kernel.
Update sys-process/audit to v3.0.9.
Fixed CVE-2026-43503 in the Linux kernel.
Fixed CVE-2026-45838 in the Linux kernel.
Updated glib to v2.86.5.
Fixed CVE-2026-45839 in the Linux kernel.
Updated sys-libs/pam to v1.5.3.
Fixed CVE-2026-45841 in the Linux kernel.
Updated the Linux kernel to v6.18.35.
Fixed CVE-2026-45842 in the Linux kernel.
Upgraded net-misc/openssh to v10.0_p2.
Fixed CVE-2026-45843 in the Linux kernel.
Upgraded sys-apps/ek-cpu-balloon to v1.2.3.
Fixed CVE-2026-45844 in the Linux kernel.
Added support for NVIDIA driver v580.159.04.
Fixed CVE-2026-46243 in the Linux kernel.
Fixed a crash that occurs when using the configfile or
source GRUB2 commands when Secure Boot is enabled.
Fixed CVE-2026-46244 in the Linux kernel.
Upgraded app-containers/docker to v29.4.3, Upgraded app-containers/docker-test to v29.4.3, Upgraded app-containers/docker-cli to v29.4.3.
Fixed CVE-2026-46274 in the Linux kernel.
Upgraded app-containers/docker-credential-helpers to v0.9.7.
Fixed CVE-2026-46300 in the Linux kernel.
Upgraded cos-gpu-installer to v2.7.2.
Fixed CVE-2026-46316 in the Linux kernel.
Upgraded sys-apps/gentoo-functions to v1.7.7.
Fixed KCTF-def602e in the Linux kernel.
Upgraded sys-apps/less to v702.
Fixed KCTF-e5b31d9 in the Linux kernel.
Upgraded sys-libs/libcap-ng to v0.9.3.
Updated dev-python/pyjwt to v2.13.0. This fixes CVE-2026-48522, CVE-2026-48524, CVE-2026-48525, CVE-2026-485256.
Fixed CVE-2026-44431 in dev-python/urllib3.
Fixed CVE-2026-6732 in dev-libs/libxml2.
Updated dev-lang/go to 1.25.10. This fixes CVE-2026-33814,CVE-2026-39819,CVE-2026-39823,CVE-2026-39825,CVE-2026-42499,CVE-2026-39817,CVE-2026-39820,CVE-2026-39826,CVE-2026-39836.
Updated dev-python/pyjwt to v2.13.0. This fixes CVE-2026-48522, CVE-2026-48524, CVE-2026-48525, CVE-2026-485256.
Updated net-misc/curl to v8.20. This fixes CVE-2026-5545,CVE-2026-4873,CVE-2026-6429,CVE-2026-7168,CVE-2026-6253,CVE-2026-6276,CVE-2026-7009,CVE-2026-5773.
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.6.137 | v24.0.9 | v1.7.31 | See List |
Fixed a race condition triggered by ext4 online resize that rarely causes machines to fail to boot.
Upgraded cos-gpu-installer to v2.7.4.
Upgraded dev-libs/libusb to v1.0.30.
Upgraded sys-apps/less to v702.
Fixed CVE-2024-56647 in the Linux kernel.
Fixed CVE-2025-38584 in the Linux kernel.
Fixed CVE-2026-23272 in the Linux kernel.
Fixed CVE-2026-23394 in the Linux kernel.
Fixed CVE-2026-31527 in the Linux kernel.
Fixed CVE-2026-43492 in the Linux kernel.
Fixed CVE-2026-43496 in the Linux kernel.
Fixed CVE-2026-43503 in the Linux kernel.
Fixed CVE-2026-46243 in the Linux kernel.
Fixed CVE-2026-46244 in the Linux kernel.
Fixed CVE-2026-46274 in the Linux kernel.
Fixed CVE-2026-46289 in the Linux kernel.
Fixed CVE-2026-46294 in the Linux kernel.
Fixed CVE-2026-46303 in the Linux kernel.
Fixed CVE-2026-46304 in the Linux kernel.
Fixed CVE-2026-46306 in the Linux kernel.
Updated dev-python/pyjwt to v2.13.0. This fixes CVE-2026-48522, CVE-2026-48524, CVE-2026-48525, CVE-2026-485256.
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.12.85 | v27.5.1 | v2.1.7 | See List |
Fixed a race condition triggered by ext4 online resize that rarely causes machines to fail to boot.
Upgraded cos-gpu-installer to v2.7.4.
Upgraded sys-apps/less to v702.
Uprev sys-kernel/lakitu-kernel-6_12 to v6.12.92
Fixed CVE-2025-71289 in the Linux kernel.
Fixed CVE-2026-23394 in the Linux kernel.
Fixed CVE-2026-43245 in the Linux kernel.
Fixed CVE-2026-46160 in the Linux kernel.
Fixed CVE-2026-46244 in the Linux kernel.
Fixed CVE-2026-46274 in the Linux kernel.
Fixed CVE-2026-46283 in the Linux kernel.
Fixed CVE-2026-46289 in the Linux kernel.
Fixed CVE-2026-46294 in the Linux kernel.
Fixed CVE-2026-46303 in the Linux kernel.
Fixed CVE-2026-46304 in the Linux kernel.
Fixed CVE-2026-46306 in the Linux kernel.
Fixed CVE-2026-46316 in the Linux kernel.
Fixed KCTF-def602e in the Linux kernel.
Updated dev-python/pyjwt to v2.13.0. This fixes CVE-2026-48522, CVE-2026-48524, CVE-2026-48525, CVE-2026-485256.
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.6.137 | v27.5.1 | v2.0.8 | See List |
Fixed a race condition triggered by ext4 online resize that rarely causes machines to fail to boot.
Upgraded cos-gpu-installer to v2.7.4.
Upgraded sys-apps/less to v702.
Fixed CVE-2026-23394 in the Linux kernel.
Fixed CVE-2026-31527 in the Linux kernel.
Fixed CVE-2026-43492 in the Linux kernel.
Fixed CVE-2026-43496 in the Linux kernel.
Fixed CVE-2026-46243 in the Linux kernel.
Fixed CVE-2026-46244 in the Linux kernel.
Fixed CVE-2026-46274 in the Linux kernel.
Fixed CVE-2026-46289 in the Linux kernel.
Fixed CVE-2026-46294 in the Linux kernel.
Fixed CVE-2026-46303 in the Linux kernel.
Fixed CVE-2026-46304 in the Linux kernel.
Fixed CVE-2026-46306 in the Linux kernel.
Fixed KCTF-def602e in the Linux kernel.
Updated dev-python/pyjwt to v2.13.0. This fixes CVE-2026-48522, CVE-2026-48524, CVE-2026-48525, CVE-2026-485256.
Dataflow has updated and expanded its pipeline update features for streaming jobs:
update_strategy_parallel_job_update) and a standard
in-place update (update_strategy_in_place_update) while keeping all other
configuration the same.create_or_update_job experiment to enable automatic create-or-update
(upsert) behavior. If an active job with the specified name already exists,
it is updated. Otherwise, a new job is created.For more information, see Automated stop and replace, Automated parallel pipeline updates, and Automatic create or update (upsert) for templates.
Gemini Enterprise: New data stores and support for new actions (Public Preview)
The following data stores are available in Public Preview:
Additionally, support for new actions is available for the following data stores:
For more information, see Connect a third-party data source.
Gemini Enterprise: Observability settings for individual agents (Preview)
You can now configure observability settings for individual agents in Agent Designer employee-made agents. This allows you to monitor metrics in Metrics Explorer and view trace results in Trace Explorer for specific agents.
Observability settings for individual agents are configured inside the agent-level settings. Previously, observability was only available at the application level, which applies to the Core Assistant agent.
This feature is in Public Preview. For more information, see Manage observability settings.
Reinforcement Learning fine-tuning is available for Gemini 3.5 Flash in Public Preview
Reinforcement Learning fine-tuning is now available for the gemini-3.5-flash models in
Preview. Model tuning
for Gemini 3.5 Flash is restricted to us-central1 and europe-west4, and tuned
model serving is restricted to the us and eu multi-region endpoints.
See About reinforcement learning fine-tuning for more information.
Advanced reporting dashboards 4.36
We've released version 4.36 of the advanced reporting dashboards.
New child queues filter option
Dashboards that have the Queue Name filter now also have a Child Queues checkbox. Select Yes if you want to include all child queues of the specified queue. There's also a new Child Queues (Yes / No) filter available in Explores that have the Queue Name filter.
The Agent & Queue Status (Live) Explore contains new real-time agent and queue metrics
The Agent & Queue Status (Live) Explore contains the following new metrics:
In Call: the number of agents currently on a call
Available / Waiting: the number of agents available and waiting for the next contact
Contacts in Queue: the number of calls currently waiting in the queue
Link directly to CSAT scores in your CRM from the CSAT dashboards
In the CSAT Interactions table of the CSAT - Calls and CSAT - Chats dashboards, next to the Session ID numbers, links to the associated CSAT scores in your CRM are now available. You can go directly to the CSAT scores without needing to search for them in your CRM.
For more information, see CSAT dashboards.
Updates to the Real-time Queue Monitoring - Calls dashboard
The Real-time Queue Monitoring - Calls dashboard now includes the following metrics tiles:
Total Rolled Over Pending Callbacks
Total Rolled Over Completed Callbacks
Avg CSAT Calls
For more information, see Queue monitoring dashboards.
Updates to the Queue Performance dashboards
The Queue Performance - Calls and Queue Performance - Chats dashboards now include the following:
A new Interaction Type filter
A new Interaction Type column in the Queue Detailed Table
The Queue Performance - Calls dashboard now includes the following metrics tiles:
Total Rolled Over Completed Callbacks
Total Rolled Over Pending Callbacks
Repeat contact data in the Queue Performance dashboards
The Queue Summary Table of the Queue Performance - Calls and Queue Performance - Chats dashboards now includes the following columns:
Total Repeat Contacts
Repeat Contact %
For more information, see Queue Performance dashboards.
The following issues were addressed in this release:
Fixed an issue where Repeat Contact % values in the Queue Summary Table of the Queue Performance - Calls dashboard exceeded 100%.
Fixed an issue where the Date filter in Explores returned no results when is on or after was set for an absolute date.
Removed the Total Logged in Time metrics tile from the Agent Availability dashboard.
Fixed an issue where language labels were missing from the advanced reporting dashboards.
Fixed an issue that occurred when filtering by chat ID in the All Interactions - Chats dashboard. The wrong chat ID appeared in the Virtual Agent Chats table.
Fixed an issue where disposition codes were missing or blank for outbound calls in the Call Agent Metrics (Historical) dashboard.
Starting with Distributed Cloud software only for VMware version
1.33.0-gke.799, you must add us.gcr.io to your firewall allowlist to
create or upgrade advanced clusters.
You can use the error ID provided in permission error messages to help troubleshoot access. Error IDs provide context for the error, including the principal, resource, permission, and supported IAM conditions. This feature is available in Preview.
For more information, see Permission error messages.
You can publish a Spanner conversational analytics agent in Gemini Enterprise. This feature is in Preview.
]]>Release 6.3.89 is being rolled out to the first phase of regions as listed here.
This release contains internal and customer bug fixes.
]]>Non-prioritized IoC Matching rules Category
Google SecOps has introduced a new detection category, Non-prioritized IoC Matching rules, as part of the Curated Detections feature. These rule sets integrate with Google's Indicators of Compromise (IoC) feeds and build on curated threat intelligence to identify malicious activities within Google SecOps environments, specifically focusing on threats identifiable through high-fidelity indicators like IPs, domains, and file hashes.
This rules category provides comprehensive coverage for threats often missed by standard managed content, including cryptomining, Command and Control (C2) communications, and the use of malicious anonymization services.
For more information, refer to Non-prioritized IoC Matching rules category overview.
Non-prioritized IoC Matching rules Category
Google SecOps has introduced a new detection category, Non-prioritized IoC Matching rules, as part of the Curated Detections feature. These rule sets integrate with Google's Indicators of Compromise (IoC) feeds and build on curated threat intelligence to identify malicious activities within Google SecOps environments, specifically focusing on threats identifiable through high-fidelity indicators like IPs, domains, and file hashes.
This rules category provides comprehensive coverage for threats often missed by standard managed content, including cryptomining, Command and Control (C2) communications, and the use of malicious anonymization services.
For more information, refer to Non-prioritized IoC Matching rules category overview.
Release 6.3.88 is now available for all regions.
]]>BigQuery AI functions can use
ObjectRef values directly as input,
without calling the OBJ.GET_ACCESS_URL function.
This feature is
generally available
(GA).
All agent.googleapis.com/processes metrics are retained for 24 months. For
more information, see Data retention.
You can now create and query parameterized secure views in Cloud SQL for PostgreSQL.
Parameterized secure views let you use PostgreSQL views with more granular
access control over your data. While you can issue a GRANT statement to control
whether a user can query a PostgreSQL view, a GRANT statement doesn't let you
control the data that the view returns based on the user who is making the
query.
To gain this level of control, use parameterized secure views. You can define parameters such as a user ID or region within the view. When your application queries the view, a user can provide values for these parameters, which customizes the query results. Using parameterized secure views lets you enforce "least privilege" access to help ensure that your users interact only with the data that is relevant and authorized to them.
This feature is in Preview.
The following images are now rolling out for managed Cloud Service Mesh:
These rollouts will preempt those previously announced on June 3, 2026.
These patch releases contain the fix for the vulnerability listed in GCP-2026-035
Proxy version csm_mesh_proxy.20260423_RC03 for Gateway API on GKE clusters is rolling out to all Managed Cloud Service Mesh release channels over the next week.
Gemini Enterprise mobile app: General availability (GA) for Google Identity users
The Gemini Enterprise mobile app is generally available (GA) for organizations using Google Identity as their identity provider. Users can access their agents, search enterprise data, utilize voice features, and perform interactive actions from iOS and Android devices.
With this release, administrators can display a configuration QR code on the web app homepage to enable user access by scanning the QR code. For organizations using Microsoft Entra ID, access to the mobile app is in GA with allowlist.
To learn more, see Configure the mobile app and Use the mobile app.
Google Cloud CCaaS 4.40
We've released version 4.40 of Google Cloud CCaaS.
The timing of the update to your instance depends on the deployment schedule that you have chosen. For more information, see Deployment schedules.
This release addresses the following issues:
Fixed an issue with Salesforce where virtual agent responses appeared out of order in transcripts.
Fixed an issue where the advanced reporting dashboards didn't load.
Fixed an issue where PDF and audio attachments weren't visible to agents after a chat transfer.
Fixed an issue where end-users were incorrectly placed on hold following a cold transfer to a queue.
Fixed an issue where MP3 audio files for agent call deflections couldn't be uploaded.
Fixed an issue where agents were automatically logged out due to inactivity while still engaged in active calls or chats.
Fixed an issue where a bulk user upload with blank phone number columns caused existing direct inbound phone numbers to become unassigned from agent profiles.
GKE cluster versions have been updated.
New versions available for upgrades and new clusters.
The following versions are now available for new GKE clusters, and for manual control plane upgrades and node upgrades for existing clusters. For more information about versioning and upgrades, see GKE versioning and support and About GKE cluster upgrades.
This release includes new GKE versions that use updated Container-Optimized OS images. These updated images are cumulative, incorporating security fixes from all Container-Optimized OS versions released since the previous GKE release.
To identify the specific vulnerabilities that were resolved in each updated Container-Optimized OS image, see the Security release notes for that image. The following table includes links to the release notes for each updated Container-Optimized OS image:
| GKE version | Container-Optimized OS version | Details |
|---|---|---|
| 1.30.14-gke.2681000 | cos-117-18613-613-40 | cos-117-18613-613-40 release notes |
| 1.31.14-gke.2074000 | cos-117-18613-613-40 | cos-117-18613-613-40 release notes |
| 1.33.12-gke.1166000 | cos-121-18867-381-161 | cos-121-18867-381-161 release notes |
| 1.35.5-gke.1241000 | cos-125-19216-395-55 | cos-125-19216-395-55 release notes |
| 1.36.0-gke.2459000 | cos-129-19506-120-64 | cos-129-19506-120-64 release notes |
[Spotlight Feature] Search for cases using SIEM Search
Google SecOps SIEM Search now provides robust capabilities for analyzing cases and case history alongside existing Unified Data Model (UDM) events and entities. This update allows security analysts to seamlessly correlate case details with other security telemetry within a single interface, streamlining workflows and accelerating incident response.
Key Highlights:
Unified Search Experience: Conduct searches across UDM events, entities, cases, and case history from a single SIEM Search interface.
Correlate SIEM and SOAR Data: Effortlessly link case details and historical activities with security data, reducing context switching and improving investigation efficiency.
For more information, see Search cases and case history.
[Spotlight Feature] Investigate detections in Google SecOps Search
Google SecOps Search now supports querying, filtering, and analyzing system-generated detections. When searching on events or entities, matching detections will now appear in the Alerts and Detections tab, providing a more holistic workflow for threat investigation.
For more details, see Investigate detections in Search.
Asynchronous Search APIs for large datasets
Google SecOps now supports asynchronous Search APIs that let you perform long-running queries without blocking your applications. This is ideal for searches that return a large volume of results.
For more information, see Asynchronous Search APIs and Result limits for data sources.
[Spotlight Feature] Investigate detections in Google SecOps Search
Google SecOps Search now supports querying, filtering, and analyzing system-generated detections. When searching on events or entities, matching detections will now appear in the Alerts and Detections tab, providing a more holistic workflow for threat investigation.
For more details, see Investigate detections in Search.
Asynchronous Search APIs for large datasets
Google SecOps now supports asynchronous Search APIs that let you perform long-running queries without blocking your applications. This is ideal for searches that return a large volume of results.
For more information, see Asynchronous Search APIs and Result limits for data sources.
New Managed Airflow (Gen 2) environments created while the Restrict Endpoint Usage organization policy is active now use regional endpoints for services like Cloud Storage, Cloud Logging, Pub/Sub, and Data Lineage. For more information, see Configure environments with Restrict Endpoint Usage policy.
The maximum cacheable object size for Media CDN can be increased up to 1 TiB. To request a limit increase for your project, contact your Google support representative. This feature is Generally Available.
For more information, see Quotas and limits.
Media CDN lets you identify the country codes of the edge caches serving client requests. This feature is Generally Available.
For more information, see Custom headers.
The ability to remediate access issues with Policy Troubleshooter is generally available.
Added support for inspecting and de-identifying batched content. You can now include a BatchContentItem in your ContentItem requests.
You can monitor performance, analyze capacity, and optimize costs with Gemini Cloud Assist in BigQuery. This feature is in Preview.
Support for the
AI.KEY_DRIVERS function
is restored. You can use the
AI.KEY_DRIVERS function to identify segments of data that cause statistically significant changes to a summable metric.
This feature is in Preview.
Cluster Toolkit v1.93.0 is available. This release introduces example blueprints for GKE H4D deployments that use the flex-start provisioning model, a compact placement policy and integrated Google Cloud ML Diagnostics. This version also adds a Slurm high availability controller script and upgrades Slurm images from Rocky Linux 8 to Rocky Linux 9. For details, see the Release announcement on GitHub.
In an autoscaled managed instance group (MIG), you can configure the stabilization period to manage how quickly the autoscaler deletes instances after a decrease in the load. This configuration can help optimize costs or maintain extra capacity based on your workload requirements. For more information, see Configure stabilization period.
Pro feature: Security and compliance enhancements
The following features are now available to help you meet your organization's security and compliance needs. These features are only available for Data Studio Pro.
Various bug fixes and minor product enhancements.
The VMware Engine ve2 node type is now available in the following
additional region:
northamerica-south1)Siemplify: Version 109.0
Refactored the code in the following action:
Knowledge Catalog now supports data profile scans for unstructured data (such as PDFs in Cloud Storage) on existing BigQuery object tables. This feature uses Vertex AI Gemini models to extract semantic insights, including entities and relationships, from unstructured content.
For more information, see About unstructured data insights and Use data profile for unstructured data.
]]>