The following release notes cover the most recent changes over the last 60 days. For a comprehensive list of product-specific release notes, see the [individual product release note pages](https://docs.cloud.google.com/release-notes/all.md.txt). You can also see and filter all release notes in the [Google Cloud console](https://console.cloud.google.com/release-notes) or you can programmatically access release notes in [BigQuery](https://console.cloud.google.com/bigquery?p=bigquery-public-data&d=google_cloud_release_notes&t=release_notes&page=table). To get the latest product updates delivered to you, add the URL of this page to your [feed reader](https://wikipedia.org/wiki/Comparison_of_feed_aggregators), or add the [feed URL](https://docs.cloud.google.com/feeds/gcp-release-notes.xml) directly. ## November 12, 2026 **Cloud Service Mesh** Announcement **1.31.3-asm.9 is now available for in-cluster Cloud Service Mesh.** For details on upgrading Cloud Service Mesh, see [Upgrade Cloud Service Mesh](https://docs.cloud.google.com/service-mesh/docs/upgrade/upgrade.md.txt). Cloud Service Mesh 1.31.3-asm.9 uses Envoy v1.39.5-dev. This release resolves the security vulnerabilities listed in Security Bulletin [GCP-2026-080](https://cloud.google.com/service-mesh/docs/security-bulletins#gcp-2026-080) ([ISTIO-SECURITY-2026-009](https://istio.io/latest/news/security/istio-security-2026-009/)). Announcement **1.30.7-asm.9 is now available for in-cluster Cloud Service Mesh.** For details on upgrading Cloud Service Mesh, see [Upgrade Cloud Service Mesh](https://docs.cloud.google.com/service-mesh/v1.30/docs/upgrade/upgrade.md.txt). Cloud Service Mesh 1.30.7-asm.9 uses Envoy v1.38.10-dev. This release resolves the security vulnerabilities listed in Security Bulletin [GCP-2026-080](https://cloud.google.com/service-mesh/docs/security-bulletins#gcp-2026-080) ([ISTIO-SECURITY-2026-009](https://istio.io/latest/news/security/istio-security-2026-009/)). Announcement **1.29.10-asm.4 is now available for in-cluster Cloud Service Mesh.** For details on upgrading Cloud Service Mesh, see [Upgrade Cloud Service Mesh](https://docs.cloud.google.com/service-mesh/v1.29/docs/upgrade/upgrade.md.txt). Cloud Service Mesh 1.29.10-asm.4 uses Envoy v1.37.10-dev. This release resolves the security vulnerabilities listed in Security Bulletin [GCP-2026-080](https://cloud.google.com/service-mesh/docs/security-bulletins#gcp-2026-080) ([ISTIO-SECURITY-2026-009](https://istio.io/latest/news/security/istio-security-2026-009/)). Fixed Patch 1.29.10-asm.4 contains the fix for the following platform CVEs: | CVE | Proxy | Control Plane | Distroless | CNI | Severity | |---|---|---|---|---|---| | [CVE-2026-89161](https://nvd.nist.gov/vuln/detail/CVE-2026-89161) | Yes | Yes | No | Yes | Medium (7.8) | | [CVE-2026-89157](https://nvd.nist.gov/vuln/detail/CVE-2026-89157) | Yes | Yes | No | Yes | Medium (7.4) | | [CVE-2026-89158](https://nvd.nist.gov/vuln/detail/CVE-2026-89158) | Yes | Yes | No | Yes | Medium (6.5) | | [CVE-2026-89160](https://nvd.nist.gov/vuln/detail/CVE-2026-89160) | Yes | Yes | No | Yes | Medium (6.5) | | [CVE-2026-89156](https://nvd.nist.gov/vuln/detail/CVE-2026-89156) | Yes | Yes | No | Yes | Medium (5.9) | | [CVE-2026-103111](https://nvd.nist.gov/vuln/detail/CVE-2026-103111) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-109518](https://nvd.nist.gov/vuln/detail/CVE-2026-109518) | Yes | Yes | No | Yes | High (0.0) | | [CVE-2026-86145](https://nvd.nist.gov/vuln/detail/CVE-2026-86145) | Yes | Yes | No | Yes | Medium (0.0) | **Model Armor** Feature Filter version `v4` under the `Latest` alias includes an updated [prompt injection and jailbreak detection](https://docs.cloud.google.com/model-armor/overview#ma-prompt-injection) filter with the following improvements: - Higher recall for indirect prompt injection (IPI) and tool calls. - Higher recall for conversational inputs at a lower false positive rate. - Higher recall for jailbreak attacks. For more information, see [Filter version history](https://docs.cloud.google.com/model-armor/version-history.md.txt#release-history). ## November 11, 2026 **Apigee Edge for Public Cloud** Announcement On November 11, 2026, we began releasing Edge UI updates for Apigee Edge for Public Cloud. Fixed | Bug ID | Component | Description | |---|---|---| | **392653797, 399185014** | Edge UI | Fixed an issue where navigating to the App Details or New App pages in organizations with a large number of API products experienced slowness or UI freezing during the initial page load. The Edge UI now fetches API products on demand when you open the **Add Product** dialog, improving initial page load performance. | | **576859695** | Edge UI | Fixed an issue in the Analytics Error Code Analysis dashboard where `504 Gateway Timeout` responses caused by target timeouts were excluded from the **Proxy errors** charts. Target timeout `504` responses are now counted under **Proxy errors**. | | **188163219** | Edge UI | Fixed a UI formatting issue in the Analytics Custom Reports list view so that dimensions display without overlapping. | **App Engine flexible environment .NET** Feature The App Engine Migration hub lets you check compatibility and migrate services in the App Engine flexible environment to Cloud Run. For more information, see [Deploy an App Engine app in the flexible environment to Cloud Run](https://docs.cloud.google.com/appengine/migration-center/run/migrate-app-engine-flexible-to-run.md.txt) ([Preview](https://cloud.google.com/products#product-launch-stages)). **App Engine flexible environment Go** Feature The App Engine Migration hub lets you check compatibility and migrate services in the App Engine flexible environment to Cloud Run. For more information, see [Deploy an App Engine app in the flexible environment to Cloud Run](https://docs.cloud.google.com/appengine/migration-center/run/migrate-app-engine-flexible-to-run.md.txt) ([Preview](https://cloud.google.com/products#product-launch-stages)). **App Engine flexible environment Java** Feature The App Engine Migration hub lets you check compatibility and migrate services in the App Engine flexible environment to Cloud Run. For more information, see [Deploy an App Engine app in the flexible environment to Cloud Run](https://docs.cloud.google.com/appengine/migration-center/run/migrate-app-engine-flexible-to-run.md.txt) ([Preview](https://cloud.google.com/products#product-launch-stages)). **App Engine flexible environment Node.js** Feature The App Engine Migration hub lets you check compatibility and migrate services in the App Engine flexible environment to Cloud Run. For more information, see [Deploy an App Engine app in the flexible environment to Cloud Run](https://docs.cloud.google.com/appengine/migration-center/run/migrate-app-engine-flexible-to-run.md.txt) ([Preview](https://cloud.google.com/products#product-launch-stages)). **App Engine flexible environment PHP** Feature The App Engine Migration hub lets you check compatibility and migrate services in the App Engine flexible environment to Cloud Run. For more information, see [Deploy an App Engine app in the flexible environment to Cloud Run](https://docs.cloud.google.com/appengine/migration-center/run/migrate-app-engine-flexible-to-run.md.txt) ([Preview](https://cloud.google.com/products#product-launch-stages)). **App Engine flexible environment Python** Feature The App Engine Migration hub lets you check compatibility and migrate services in the App Engine flexible environment to Cloud Run. For more information, see [Deploy an App Engine app in the flexible environment to Cloud Run](https://docs.cloud.google.com/appengine/migration-center/run/migrate-app-engine-flexible-to-run.md.txt) ([Preview](https://cloud.google.com/products#product-launch-stages)). **App Engine flexible environment Ruby** Feature The App Engine Migration hub lets you check compatibility and migrate services in the App Engine flexible environment to Cloud Run. For more information, see [Deploy an App Engine app in the flexible environment to Cloud Run](https://docs.cloud.google.com/appengine/migration-center/run/migrate-app-engine-flexible-to-run.md.txt) ([Preview](https://cloud.google.com/products#product-launch-stages)). **App Engine flexible environment custom runtimes** Feature The App Engine Migration hub lets you check compatibility and migrate services in the App Engine flexible environment to Cloud Run. For more information, see [Deploy an App Engine app in the flexible environment to Cloud Run](https://docs.cloud.google.com/appengine/migration-center/run/migrate-app-engine-flexible-to-run.md.txt) ([Preview](https://cloud.google.com/products#product-launch-stages)). **BigQuery** Feature [Project caps (also known as scheduling policies)](https://docs.cloud.google.com/bigquery/docs/reservations-workload-management.md.txt#scheduling-policies) let you limit maximum slots and concurrency per project within a BigQuery reservation. This feature is only supported in the [BigQuery Enterprise and Enterprise Plus editions](https://docs.cloud.google.com/bigquery/docs/editions-intro.md.txt) and is [generally available](https://cloud.google.com/products#product-launch-stages) (GA). Feature You can specify an optional `principal` property on [BigQuery reservation assignments](https://docs.cloud.google.com/bigquery/docs/reservations-assignments.md.txt) to route queries to specific reservations based on the identity of the user, service account, or third-party identity executing the job. This feature is only supported in the [BigQuery Enterprise and Enterprise Plus editions](https://docs.cloud.google.com/bigquery/docs/editions-intro.md.txt) and is [generally available](https://cloud.google.com/products#product-launch-stages) (GA). Feature You can use the [`JSON_FLATTEN` function](https://docs.cloud.google.com/bigquery/docs/reference/standard-sql/json_functions.md.txt#json_flatten) to extract all non-array values that are either directly in the input `JSON` value or children of one or more consecutively nested arrays in the input `JSON` value. This function is [generally available](https://cloud.google.com/products#product-launch-stages). (GA). **Cloud Build** Change When storing build logs in Cloud Storage, a [user-owned, regional bucket](https://docs.cloud.google.com/build/docs/securing-builds/store-manage-build-logs.md.txt#store_build_logs_in_a_user-owned_and_regionalized_bucket) is now used by default. **Container Optimized OS** Change ### cos-dev-138-20309-0-0 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.18.60](https://cos.googlesource.com/third_party/kernel/+/2e51c2b69f224ad0c59ce7b3a5bb0b8272de0488) | v29.4.3 | v2.4.1 | [See List](https://storage.googleapis.com/cos-tools/20309.0.0/lakitu/gpu_driver_versions.textproto) | Change Added 64k page size support for iRDMA. Change Enabled kernel configs CONFIG_I2C_TEGRA=m, CONFIG_IOMMU_DEFAULT_DMA_LAZY=y and CONFIG_RTC_DRV_NCT3018Y=m. Change Updated app-admin/google-guest-configs to v20261025.00. Change Updated the Linux kernel to v6.18.60. Feature Added RTC support in A4X-Max images. Feature Added support for net-fs/lustre-client-driver v2.16.0_p60. Feature Enabled PCI peer to peer direct memory access for 64k kernels. Feature The ext4 journal of the stateful partition is now resized appropriately with the rest of the stateful partition. Fixed Added support for NVIDIA driver v580.196.07. Fixed Added support for NVIDIA driver v595.112.07. Fixed Enabled periodic fstrim.timer to reclaim unused disk blocks on thin-provisioned storage. Fixed Updated cos-gpu-installer to v2.7.12. It installs ucodes firmwares for r615 and newer GPU driver versions. Fixed Upgraded app-admin/oslogin to v20261021.00. Fixed Upgraded app-arch/bzip2 to v1.0.8-r5. Fixed Upgraded app-arch/gzip to v1.15. Fixed Upgraded app-containers/docker-credential-helpers to v0.9.12. Fixed Upgraded app-editors/nano to v9.2. Fixed Upgraded app-editors/vim to v9.2.1229, Upgraded app-editors/vim-core to v9.2.1229. Fixed Upgraded app-misc/ca-certificates to v20260816.3.131.1. Fixed Upgraded app-misc/jq to v1.8.2. Fixed Upgraded chromeos-base/google-breakpad to v2026.10.15.232609-r285. Fixed Upgraded chromeos-base/minijail to v18-r200. Fixed Upgraded dev-db/sqlite to v3.54.1. Fixed Upgraded dev-libs/json-c to v0.19-r3. Fixed Upgraded dev-libs/libffi to v3.1-r9. Fixed Upgraded dev-libs/libltdl to v2.6.2. Fixed Upgraded dev-libs/nspr to v4.40. Fixed Upgraded dev-libs/nss to v3.132. Fixed Upgraded dev-libs/re2 to v0.2024.07.02-r1. Fixed Upgraded net-dns/c-ares to v1.34.9. Fixed Upgraded net-fs/cifs-utils to v7.8, Upgraded sys-libs/talloc to v2.5.0. Fixed Upgraded net-libs/gnutls to v3.8.13. Fixed Upgraded net-misc/openssh to v10.6_p1. Fixed Upgraded net-misc/rsync to v3.5.1. Fixed Upgraded sys-apps/less to v710. Fixed Upgraded sys-apps/rootdev to v0.0.1-r52. Fixed Upgraded sys-fs/e2fsprogs to v1.47.4. Fixed Upgraded sys-fs/mdadm to v4.6-r1. Fixed Upgraded sys-libs/libcap-ng to v0.9.6. Fixed Upgraded sys-libs/libxcrypt to v4.5.2. Fixed Upgraded virtual/pkgconfig to v3. Security Fixed CVE-2024-25621, CVE-2026-53488 in google-osconfig-agent. Security Fixed CVE-2024-41110 in cri-tools. Security Fixed CVE-2025-52565 in nvidia-container-toolkit. Security Fixed CVE-2025-9230 in dev-libs/openssl. Security Fixed CVE-2026-103111 in dev-libs/libpcre. Security Fixed CVE-2026-116587 in containerd. Security Fixed CVE-2026-116587 in cos-extensions. Security Fixed CVE-2026-14456 in dev-libs/openssl. Security Fixed CVE-2026-29181 in guest-agent. Security Fixed CVE-2026-33186 in cni-plugins. Security Fixed CVE-2026-33186 in google-osconfig-agent. Security Fixed CVE-2026-34986 in guest-agent. Security Fixed CVE-2026-35469 in cri-tools. Security Fixed CVE-2026-39833, CVE-2026-39832, CVE-2026-39834, CVE-2026-39830, CVE-2026-42508 in google-osconfig-agent. Security Fixed CVE-2026-41567 in cri-tools. Security Fixed CVE-2026-4438 in sys-libs/glibc. Security Fixed CVE-2026-53489 in docker. Security Fixed CVE-2026-63209 in google-osconfig-agent. Security Fixed CVE-2026-63209 in node-problem-detector. Security Fixed CVE-2026-6368 in sys-libs/glibc. Security Fixed CVE-2026-77214 in dev-libs/expat. Security Fixed CVE-2026-84304 in cni-plugins. Security Fixed CVE-2026-84304 in containerd. Security Fixed CVE-2026-84304, CVE-2026-29181 in node-problem-detector. Security Fixed CVE-2026-84304, CVE-2026-32285 in cri-tools. Security Fixed CVE-2026-84304, CVE-2026-34986 in google-guest-agent. Security Fixed CVE-2026-84304, CVE-2026-45022, CVE-2026-84445 in google-osconfig-agent. Security Fixed CVE-2026-84445 in cni-plugins. Security Fixed CVE-2026-84445 in containerd. Security Fixed CVE-2026-84445 in kubernetes. Security Updated app-arch/brotli to 1.0.10. This resolves CVE-2026-111497. Security Updated curl to v8.22.0. This resolves CVE-2026-18924, CVE-2026-13608, CVE-2026-80229, CVE-2026-80255 and CVE-2026-19931. Change ### cos-121-18867-652-49 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.6.159](https://cos.googlesource.com/third_party/kernel/+/c87b8de2956ad6b99b07834c48be0a022d71d1d4) | v27.5.1 | v2.0.10 | [See List](https://storage.googleapis.com/cos-tools/18867.652.49/lakitu/gpu_driver_versions.textproto) | Feature Added suppport for lustre-client-driver 2.16 in new lustre package lustre-client-drivers-2_16. Security Fixed CVE-2024-25621 in cri-tools. Security Fixed CVE-2025-31133 in cri-tools. Security Fixed CVE-2025-52565 in nvidia-container-toolkit. Security Fixed CVE-2026-103111 in dev-libs/libpcre. Security Fixed CVE-2026-116587 in guest-agent. Security Fixed CVE-2026-32285 in cri-tools. Security Fixed CVE-2026-33747 and CVE-2026-33748 in docker. Security Fixed CVE-2026-35189 in dev-libs/openssl. Security Fixed CVE-2026-39883 in docker. Security Fixed CVE-2026-53488 in google-osconfig-agent. Security Fixed CVE-2026-84304, CVE-2026-29181 in node-problem-detector. Security Fixed CVE-2026-84445 in google-guest-agent. Security Fixed CVE-2026-92392 in net-misc/curl. Security Fixed CVE-2026-97032, CVE-2026-78663 in dev-lang/go. Security Updated curl to v8.22.0. This resolves CVE-2026-18924, CVE-2026-13608, CVE-2026-80229, CVE-2026-80255 and CVE-2026-19931. Security Updated libpcre2 to v10.49. This resolves CVE-2026-86145 and CVE-2026-103111. Security Updated pyjwt to v2.14.0. This resolves CVE-2026-102266, CVE-2026-102267, CVE-2026-102268 and CVE-2026-102271. Security Upgraded dev-libs/expat to v2.8.5. This fixes CVE-2026-93990. Security Upgraded dev-libs/openssl to v3.0.22. This fixes CVE-2026-63076, CVE-2026-75803. Security Upgraded net-libs/libpcap to v1.10.7. This fixes CVE-2026-0799. Change ### cos-125-19216-801-29 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.12.114](https://cos.googlesource.com/third_party/kernel/+/1dcdbc3f0dcd16137863cab1347dee8c604b87c0) | v27.5.1 | v2.2.7 | [See List](https://storage.googleapis.com/cos-tools/19216.801.29/lakitu/gpu_driver_versions.textproto) | Feature Added suppport for lustre-client-driver 2.16 in new lustre package lustre-client-drivers-2_16. Security Fixed CVE-2024-25621 in cri-tools. Security Fixed CVE-2025-52565 in nvidia-container-toolkit. Security Fixed CVE-2026-103111 in dev-libs/libpcre. Security Fixed CVE-2026-106583 in net-misc/openssh. Security Fixed CVE-2026-119196 in dev-python/pyasn1. Security Fixed CVE-2026-15146 in net-misc/wget. Security Fixed CVE-2026-30922 in dev-python/pyasn1. Security Fixed CVE-2026-33747 in docker. Security Fixed CVE-2026-44973 in google-osconfig-agent. Security Fixed CVE-2026-78663, CVE-2026-97031 in dev-lang/go. Security Fixed CVE-2026-84304 in cos-extensions. Change ### cos-129-19506-625-25 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.12.114](https://cos.googlesource.com/third_party/kernel/+/1bac64d736f17f5ed23cbcb8ec3f6edf39ccab9a) | v27.5.1 | v2.2.7 | [See List](https://storage.googleapis.com/cos-tools/19506.625.25/lakitu/gpu_driver_versions.textproto) | Feature Added suppport for lustre-client-driver 2.16 in new lustre package lustre-client-drivers-2_16. Security Fixed CVE-2025-45582 in app-arch/tar. Security Fixed CVE-2025-52565 in nvidia-container-toolkit. Security Fixed CVE-2026-103111 in dev-libs/libpcre. Security Fixed CVE-2026-118669 in dev-python/oauthlib. Security Fixed CVE-2026-30922 in dev-python/pyasn1. Security Fixed CVE-2026-41567 in cri-tools. Security Fixed CVE-2026-63209 in docker. Change ### cos-133-19999-44-197 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.18.55](https://cos.googlesource.com/third_party/kernel/+/e794243e77b51f9bdf8954da0cb3ce2c79661328) | v29.4.3 | v2.4.1 | [See List](https://storage.googleapis.com/cos-tools/19999.44.197/lakitu/gpu_driver_versions.textproto) | Security Fixed CVE-2026-32285, CVE-2026-84304 in cni-plugins. Security Fixed CVE-2026-84304, CVE-2026-29181 in node-problem-detector. Security Fixed CVE-2026-84445 in google-guest-agent. Security Updated pyjwt to v2.14.0. This resolves CVE-2026-102266, CVE-2026-102267, CVE-2026-102268 and CVE-2026-102271. **Gemini Enterprise Agent Platform** Feature **End-user safety identifier labels for abuse monitoring** End-user `safety_identifier` request labels are available in [General Availability (GA)](https://cloud.google.com/products#product-launch-stages) for Gemini (`generateContent` and `streamGenerateContent`) and Veo (`predictLongRunning`) API calls. API resellers and multi-tenant apps can pass an anonymized per-user ID in `labels` to attribute policy violations to individual end users. Targeted attribution helps prevent enforcement actions across an entire Google Cloud project. For formatting requirements and code samples, see [Pass an end-user safety identifier in API calls](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/abuse-monitoring.md.txt#pass-safety-identifier). Fixed **CodeMender updates (v0.21.0)** This release introduces updates to CodeMender: - **Sandboxed build commands and patch refresh** : When sandboxing is enabled, `cm build` and `cm fix` build validation now run `build.command` inside the sandbox, and `cm fix` refreshes stored patch diffs after build validation finishes. - **Read-only host toolchains and isolated caches** : Sandboxed `cm build`, `cm fix`, and `cm verify` runs now mount host toolchain and package-manager directories read-only and redirect supported compiler and package caches to session-scoped temporary directories. - **Command environment isolation** : Disabled repository Git hooks, isolated host Git configuration, and ignored repository Python bytecode caches (`__pycache__`) during command and build runs. - **Bug fixes** : - Added a 30-minute timeout for silent active turns so stalled sessions cancel and recover cleanly. - Preserved proof-of-concept execution output when reproducer errors occur, retaining stdout and stderr to help diagnose build failures, timeouts, and setup issues. - Fixed an issue where patch generation failed on mid-run sandbox failures by automatically retrying with a fresh sandbox environment. For more information, see the [CodeMender documentation](https://docs.cloud.google.com/gemini-enterprise-agent-platform/agents/codemender.md.txt). Feature **Gemini 4 Carbon in CodeMender (Preview)** CodeMender now supports Gemini 4 Carbon. To use it, pass `--model gemini-4-carbon` to `cm find`, `cm verify`, or `cm fix`. Gemini 3.8 Flash remains the default model. For more information, see [Specifying the model](https://docs.cloud.google.com/gemini-enterprise-agent-platform/agents/codemender.md.txt#specifying-the-model). Feature **Govern agents on any CNCF-conformant Kubernetes cluster with Agent Gateway for cross-cloud (Limited Preview)** [Agent Gateway for cross-cloud](https://docs.cloud.google.com/gemini-enterprise-agent-platform/agents/governance/agent-gateway-cross-cloud/overview.md.txt) is available in [Limited Preview](https://cloud.google.com/products#product-launch-stages). It extends Agent Platform governance to agents that run on Cloud Native Computing Foundation (CNCF)-conformant Kubernetes clusters outside of Google Cloud, such as Amazon Elastic Kubernetes Service (Amazon EKS), Azure Kubernetes Service (AKS), Red Hat OpenShift, and bare-metal clusters. Your agents keep running where they are, but you govern them from one place: give each agent a verifiable identity, register agents and MCP servers in Agent Registry, and route their LLM, MCP, and A2A traffic through local Agent Gateway proxies by using your existing service mesh or network stack. Those proxies enforce access and Model Armor safety policies, and send access logs and agent traces to Cloud Logging and Cloud Trace. Agent Gateway for cross-cloud is available at no charge during Limited Preview. Other products that you configure with it, such as Model Armor, Cloud Logging, and Cloud Trace, are billed at their standard rates. To request access, complete the [access request form](https://docs.google.com/forms/d/e/1FAIpQLSeUpnNRtYQjLRblii-KoUbJJ7DjEV6fvQAfO21IAXgVSqFjpw/viewform). For more information, see [Set up Agent Gateway for cross-cloud](https://docs.cloud.google.com/gemini-enterprise-agent-platform/agents/governance/agent-gateway-cross-cloud/setup.md.txt). **Google Distributed Cloud (software only) for VMware** Announcement Google Distributed Cloud (software only) for VMware 1.34.1100-gke.125 is now available for download. To upgrade, see [Upgrade clusters](https://docs.cloud.google.com/kubernetes-engine/distributed-cloud/vmware/docs/how-to/upgrading.md.txt). Google Distributed Cloud 1.34.1100-gke.125 runs on Kubernetes v1.34.12-gke.500. If you use a third-party storage vendor, check the listing of our previously-qualified [storage partners](https://docs.cloud.google.com/kubernetes-engine/enterprise/docs/resources/partner-storage.md.txt). After a release, it takes approximately 7 to 14 days for the version to become available for use with GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform. Feature The following changes were added in 1.34.1100-gke.125: - Updated system components and container base images to remove the distrusted eMudhra (emSign) and AAA Certificate Services root CAs and reject compromised eMudhra intermediate CAs. - Upgraded Container-Optimized OS (COS) to milestone 121 (`cos-121-18867-652-7`), which removes the distrusted eMudhra (emSign) and AAA Certificate Services root CAs. - Updated the Ubuntu 22.04 node and admin workstation base image to `ubuntu-gke-op-2204-1-33-v20261024` to remove the distrusted eMudhra (emSign) root CAs (USN-8944-1). Fixed The following issues were fixed in 1.34.1100-gke.125: - Fixed vulnerabilities listed in [Vulnerability fixes](https://docs.cloud.google.com/kubernetes-engine/distributed-cloud/vmware/docs/vulnerabilities.md.txt). - Fixed an issue where deleting a user cluster left an orphaned `k8s-health-check-reader-binding-` `ClusterRoleBinding` on the admin cluster. Health check permissions now use a namespaced `RoleBinding`, and legacy `ClusterRoleBinding` objects are automatically cleaned up. - Fixed an issue where adding IP addresses to an existing MetalLB address pool of an advanced user cluster left the cluster stuck in the `UPDATING` state. The update is now rejected during validation; to add IP addresses, add a new address pool instead. - Fixed an issue where preflight checks erroneously required the control plane VIP (`loadBalancer.vips.controlPlaneVIP`) to be in the control plane node subnet when the control plane load balancer mode is set to `manual`. - Fixed an issue where `audit-proxy` retried audit log exports indefinitely on permanent errors, generating excessive audit logging traffic. - Fixed an issue where the Kubernetes preflight health check scanned all namespaces in the admin cluster instead of the target cluster's namespace, causing cluster upgrades to fail if an unrelated cluster had stale reconciling resources. **Google Distributed Cloud (software only) for bare metal** Announcement Google Distributed Cloud (software only) for bare metal 1.34.1100-gke.125 is now available for download. To upgrade, see [Upgrade clusters](https://docs.cloud.google.com/release-notes/how-to/upgrade). Google Distributed Cloud for bare metal 1.34.1100-gke.125 runs on Kubernetes v1.34.12-gke.500. After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform. If you use a third-party storage vendor, check the listing of our previously-qualified [storage partners](https://docs.cloud.google.com/kubernetes-engine/enterprise/docs/resources/partner-storage.md.txt). Feature The following changes were added in 1.34.1100-gke.125: - Updated system components and container base images to remove the distrusted eMudhra (emSign) and AAA Certificate Services root CAs and reject compromised eMudhra intermediate CAs. Fixed The following issues were fixed in 1.34.1100-gke.125: - Fixed vulnerabilities listed in [Vulnerability fixes](https://docs.cloud.google.com/kubernetes-engine/distributed-cloud/bare-metal/docs/vulnerabilities.md.txt). - Fixed an issue where deleting a user cluster left an orphaned `k8s-health-check-reader-binding-` `ClusterRoleBinding` on the admin cluster. Health check permissions now use a namespaced `RoleBinding`, and legacy `ClusterRoleBinding` objects are automatically cleaned up. - Fixed a race condition where `bmctl check cluster --snapshot` could fail with a `panic: send on closed channel` error when taking Node Agent snapshots. - Fixed an issue where removing a node from a cluster left behind its local `PersistentVolume` resources instead of garbage collecting them. This fix applies to Google Distributed Cloud for bare metal local `PersistentVolume` resources created after upgrading to 1.34.1100-gke.125; existing orphaned `PersistentVolume` resources must be deleted manually. - Improved `containerd` resilience against state corruption if a node reboots while unpacking container images. - Fixed an issue where resetting or removing a control plane node could remove the wrong `etcd` or `etcd-events` member if another control plane node's IP address shared the same prefix (for example, `10.201.0.2` and `10.201.0.26`), causing the affected node to become `NotReady` and stalling cluster upgrades. - Fixed an issue where the periodic configuration drift health check failed with a `version not supported` error while a cluster upgrade or rollback was in progress. - Fixed an issue where `audit-proxy` retried audit log exports indefinitely on permanent errors, generating excessive audit logging traffic. - Fixed an issue where the Kubernetes preflight health check scanned all namespaces in the admin cluster instead of the target cluster's namespace, causing cluster upgrades to fail if an unrelated cluster had stale reconciling resources. **Google Kubernetes Engine** Issue On nodes that have Linux syscall auditing enabled, such as Container-Optimized OS nodes where you [enabled Linux auditd logging](https://docs.cloud.google.com/kubernetes-engine/docs/how-to/linux-auditd-logging.md.txt), mounting Cloud Storage FUSE CSI driver volumes can hang indefinitely. Pods that use these volumes don't start and remain in a status such as `Init:0/1` or `ContainerCreating`. Pods that are being deleted remain in the `Terminating` state, and node drains, including drains during node pool upgrades, might not complete. Pod events show errors similar to the following: MountVolume.SetUp failed for volume "VOLUME_NAME" : rpc error: code = DeadlineExceeded desc = context deadline exceeded MountVolume.SetUp failed for volume "VOLUME_NAME" : rpc error: code = Aborted desc = An operation with the given volume key TARGET_PATH already exists The following GKE versions are affected: - 1.31.14-gke.2963000 and later - 1.32.13-gke.2714000 and later - 1.33.13-gke.1973000 and later - 1.34.12-gke.1209000 and later - 1.35.8-gke.2014000 and later - 1.36.5-gke.1817000 and later - 1.37.1-gke.1777000 and later In these versions, the Cloud Storage FUSE CSI driver uses a Debian 13 base image whose `mount` utility uses the newer Linux mount API. When syscall auditing is active, the mount operation can hang in the kernel before the FUSE file system is initialized. Restarting the `gcsfusecsi-node` Pod doesn't resolve the issue. Nodes that don't have syscall audit rules loaded aren't affected. Workaround: [Disable Linux auditd logging](https://docs.cloud.google.com/kubernetes-engine/docs/how-to/linux-auditd-logging.md.txt#cleanup) in clusters that use the Cloud Storage FUSE CSI driver, and then re-create the affected nodes to clear the audit rules that are loaded on them. If you must keep auditd logging enabled, contact [Cloud Customer Care](https://docs.cloud.google.com/kubernetes-engine/docs/getting-support.md.txt). A fix is in progress. Feature Capacity buffers, including active and standby capacity buffers, are generally available for GKE Standard and Autopilot clusters running version 1.37.1-gke.3020000 or later. Capacity buffers let you pre-provision and optionally suspend standby compute capacity using the CapacityBuffer custom resource (autoscaling.x-k8s.io/v1beta1) to accelerate workload scaling and mitigate capacity constraints. To get started, see [About capacity buffers](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/capacity-buffer.md.txt). **Oracle Database@Google Cloud** Feature For Exadata VM Clusters and Exascale VM Clusters, you can now choose to create a cluster without an Identity Connector, and enable or disable the Identity Connector after the cluster is created by using the Google Cloud console, the gcloud CLI, or the API. For more information, see [Enable and disable Identity Connector](https://docs.cloud.google.com/oracle/database/docs/enable-disable-identity-connector.md.txt). This feature is [generally available (GA)](https://cloud.google.com/products#product-launch-stages). ## November 10, 2026 **API Gateway** Feature **TLS 1.3 for connections to backends** TLS 1.3 is now enabled on connections from API Gateway gateways to backend services. When a backend supports TLS 1.3, the gateway uses TLS 1.3. **Agent Platform Workbench** Feature **Antigravity CLI in Agent Platform Workbench instances** [Preview](https://cloud.google.com/products#product-launch-stages): The Antigravity CLI is available in Agent Platform Workbench instances that use a Debian 12 (`workbench-instances-2603`) or later image. The Antigravity CLI is the terminal surface of Google Antigravity, an AI agent that works in a terminal. New instances have it turned on by default. You can use the Antigravity CLI to do tasks like the following: - Create, explain, edit, check, and run notebooks. - Create a Jupyter kernel with the packages that you need. - Run shell commands and Google Cloud commands, such as `gcloud` and `bq`. - Write the code for a notebook cell from a description, with the `%%agy` cell magic. The Antigravity CLI asks for your approval before it edits a file or runs a command. To turn it off for an instance, set the `enable-antigravity` metadata key to `false`. To get started, see [Use the Antigravity CLI](https://docs.cloud.google.com/gemini-enterprise-agent-platform/notebooks/workbench/instances/antigravity-cli). **BigQuery** Feature You can use [graph measures](https://docs.cloud.google.com/bigquery/docs/graph-measures.md.txt) to lock an aggregation to a key in order to perform complex aggregations without overcounting. [Measure expressions](https://docs.cloud.google.com/bigquery/docs/reference/standard-sql/data-types.md.txt#measure_type) can include the following: - Aggregate function calls - Expressions within aggregate functions - Conditional logic within aggregate functions - Conditional distinct counting - Scalar operations and expressions outside of aggregate functions - Combinations of measures wrapped in the `AGG` function To query measures, you transform your graph into a flattened table by using the [`GRAPH_EXPAND` TVF](https://docs.cloud.google.com/bigquery/docs/reference/standard-sql/graph-sql-queries.md.txt#graph_expand), and then query measures in that table with the [`AGG` function](https://docs.cloud.google.com/bigquery/docs/reference/standard-sql/aggregate_functions.md.txt#agg). The `GRAPH_EXPAND` function now supports multiple fact tables. To view the output schema of the `GRAPH_EXPAND` function, use the [`BQ.SHOW_GRAPH_EXPAND_SCHEMA` system procedure](https://docs.cloud.google.com/bigquery/docs/reference/system-procedures.md.txt#bqshow_graph_expand_schema). You can define [extensions](https://docs.cloud.google.com/bigquery/docs/graph-schema-overview.md.txt#specify_options) in the `OPTIONS` clause of the labels and properties in your graphs, which are string pairs that represent custom metadata for natural language querying. Measures and graphs are supported in Data Studio through the [BigQuery connector](https://docs.cloud.google.com/data-studio/connect-to-google-bigquery.md.txt). Measures and graphs are also automatically cataloged in Knowledge Catalog, which makes them searchable by natural language or domain synonyms. These features are [generally available](https://cloud.google.com/products#product-launch-stages) (GA). Feature BigQuery [generative AI functions](https://docs.cloud.google.com/bigquery/docs/generative-ai-overview.md.txt#locations) now support the `gemini-4-carbon` model. This model is [generally available](https://cloud.google.com/products#product-launch-stages). **Cloud Asset Inventory** Feature The following resource type is publicly available through the [ExportAssets](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/exportAssets.md.txt), [ListAssets](https://docs.cloud.google.com/asset-inventory/docs/listing-assets), [BatchGetAssetsHistory](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/batchGetAssetsHistory.md.txt), [QueryAssets](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/queryAssets.md.txt), and [Feed](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/feeds.md.txt) APIs. - Cloud Key Management Service - `cloudkms.googleapis.com/KajPolicyConfig` **Cloud Billing** Feature **Estimate costs for AI agents using the new cost estimator agent (Preview)** Cloud Billing is introducing cost estimation directly inside the Billing section of the Google Cloud console, starting with **cost estimation for AI agents** now available in [Preview](https://cloud.google.com/products#product-launch-stages). Using the new [Cost estimator agent](https://docs.cloud.google.com/billing/docs/how-to/estimate-costs.md.txt#cost-estimator-agent), you can generate high-level estimates based on reference architectures for agents built with Gemini Enterprise Agent Platform, helping you understand the potential cost of your agent before you build it. To get cost estimates for your planned Google Cloud workloads and other cloud infrastructure, you can also use the [Google Cloud pricing calculator](https://docs.cloud.google.com/billing/docs/how-to/estimate-costs.md.txt#pricing-calculator). With the pricing calculator, you can estimate costs for a wide range of Google Cloud services and products. Cost estimates help you set spend caps, create Cloud Billing budgets and alerts, allocate project quotas, and get financial sign-off for a launch. For more information about the cost estimator tools, see the following: - [Cost estimator agent](https://docs.cloud.google.com/billing/docs/how-to/estimate-costs.md.txt#cost-estimator-agent) - [Pricing calculator](https://docs.cloud.google.com/billing/docs/how-to/estimate-costs.md.txt#pricing-calculator) **Cloud Logging** Feature VM Extension Manager extension policies for the Ops Agent are now available at the folder and organization levels in [Preview](https://docs.cloud.google.com/products#product-launch-stages). Extension policies provide zonal and global Ops Agent installation, version upgrades, and configuration management. For more information, see [VM Extension Manager policies for the Ops Agent](https://docs.cloud.google.com/logging/docs/agent/ops-agent/agent-vmem-policies). In addition, new read-only APIs are available in [Preview](https://docs.cloud.google.com/products#product-launch-stages) for querying the details and status of installed VM extensions. For more information, see [View extension details and status](https://docs.cloud.google.com/logging/docs/agent/ops-agent/view-agent-vmem-extension-state.md.txt). **Cloud Monitoring** Feature VM Extension Manager extension policies for the Ops Agent are now available at the folder and organization levels in [Preview](https://docs.cloud.google.com/products#product-launch-stages). Extension policies provide zonal and global Ops Agent installation, version upgrades, and configuration management. For more information, see [VM Extension Manager policies for the Ops Agent](https://docs.cloud.google.com/monitoring/agent/ops-agent/agent-vmem-policies). In addition, new read-only APIs are available in [Preview](https://docs.cloud.google.com/products#product-launch-stages) for querying the details and status of installed VM extensions. For more information, see [View extension details and status](https://docs.cloud.google.com/monitoring/agent/ops-agent/view-agent-vmem-extension-state.md.txt). **Cloud SDK** Breaking ## 593.0.0 (2026-11-10) ### Breaking Changes - **(App Lifecycle Manager)** Updated `--evaluation-spec` flag of `gcloud beta app-lifecycle-manager flags create` and `gcloud beta app-lifecycle-manager flags update` to use `defaultVariant`, `defaultAllocation`, `variantId`, and `allocationId` instead of deprecated `defaultTarget` and `target`. ### Google Cloud CLI - Made bundled Python a required component on Windows (x86 and x86_64). `gcloud components update` and `gcloud components install` now install it if it is missing. ### Agent Identity - Promoted `gcloud agent-identity auth-providers authorizations get-iam-policy`, `gcloud agent-identity auth-providers authorizations set-iam-policy`, `gcloud agent-identity auth-providers authorizations add-iam-policy-binding`, `gcloud agent-identity auth-providers authorizations remove-iam-policy-binding`, and `gcloud agent-identity auth-providers authorizations test-iam-permissions` to GA. - Added `--xaa-auth-provider-id-token-input-jag`, `--xaa-auth-provider-id-token-input-jag-additional-claims`, `--xaa-auth-provider-client-secret-id`, `--xaa-auth-provider-client-secret`, `--xaa-auth-provider-client-assertion-jwt-id`, `--xaa-auth-provider-custom-issuer-token-url`, `--xaa-auth-provider-custom-issuer`, `--xaa-auth-provider-additional-parameters`, `--connector-reference-auth-provider`, and `--connector-reference-auth-provider-authorization-details` flags to `gcloud agent-identity auth-providers create` and `gcloud agent-identity auth-providers update` to configure Cross-App Access and Connector Reference auth providers. ### AlloyDB - Added `--[no-]enable-psc-auto-dns` and `--[no-]enable-psc-auto-connection-policy` flags to `gcloud alloydb instances create`, `gcloud alloydb instances create-secondary`, and `gcloud alloydb instances update` to control automatic creation of DNS records and service connection policies for Private Service Connect (PSC) auto connections. ### App Lifecycle Manager - Added `--application-template-component`, `--application-template-component-revision`, `--composite-ref-application-template`, and `--composite-ref-revision` flags to `gcloud beta app-lifecycle-manager unit-kinds create` and `update`. - Added `--clear-application-template-component` to `gcloud beta app-lifecycle-manager unit-kinds update`. - Promoted `gcloud app-lifecycle-manager` command group to GA. ### Audit Manager - Added `--parameter-overrides` flag to `gcloud audit-manager audit-reports generate`, `gcloud audit-manager audit-scopes generate`, and `gcloud audit-manager audit-schedules create` to override parameters of parameterized cloud controls. ### BigLake - Added `--snowflake-user-identity-federation-role` flag to `gcloud beta biglake iceberg catalogs create` and `gcloud beta biglake iceberg catalogs update` to support user identity federation for Snowflake federated catalogs. ### BigQuery - Added a build status guidance message to `bq query` output when creating or replacing a Python user-defined function (UDF) via DDL. - Fixed an issue where specifying a regional endpoint (`--api`) for BigQuery or BigQuery Reservation commands could fail to load the bundled discovery document or crash on empty server discovery responses. - Added build status columns for Python user-defined functions in `bq show --routine`. - Added `--condition_expression`, `--condition_title`, and `--condition_description` flags in `bq mk --reservation_assignment` and `bq update --reservation_assignment`. - Removed the deprecated `--multi_region_auxiliary` flag from `bq mk --reservation` and `bq mk --capacity_commitment`, and the `multiRegionAuxiliary` column from reservation and capacity commitment output. - Updated the bundled `yaml` (`PyYAML`) dependency to package the Python 3 library directly and removed the legacy Python 2 compatibility shim. ### Cloud Backup DR - Promoted `gcloud backup-dr restore-templates` command group to GA. - Promoted `gcloud backup-dr restore-template-executions` command group to GA. - Promoted `gcloud backup-dr restore-verification-plans` command group to GA. - Promoted `gcloud backup-dr restore-verification-plan-associations` command group to GA. ### Cloud Bigtable - Rebuild with go.opentelemetry.io/otel/sdk 1.45.0 to fix CVE-2026-81870. ### Cloud Bigtable Emulator - Rebuild cbt-emulator with go 1.26.9. ### Cloud IAM - Added `--actor-token-field-name` and `--actor-token-type` flags and support for combining `--credential-source-file` with `--credential-cert-path` to `gcloud iam workload-identity-pools create-cred-config` to enable certificate-bound OAuth 2.0 token exchanges and actor token delegation. ### Cloud Key Management Service - Updated `gcloud kms locations list` to include the `HSM_SINGLE_TENANT_AVAILABLE` column in the default table output. ### Cloud Memorystore - Added `ipVersion` key to `--endpoints` flag of `gcloud beta memorystore instances create` to support IPv6 Private Service Connect auto-created endpoints. ### Cloud Run - Added `--[no-]ambient-networking` and `--ambient-scope` flags for Cloud Run services, allowing users to enable ambient networking and choose a `regional` (default) or `global` scope. These flags are available in `gcloud beta run deploy`, `gcloud beta run services update`, and `gcloud beta run multi-region-services update`. ### Cloud Shell - Deprecated `gcloud cloud-shell get-mount-command`. It will be removed in a future release. ### Cloud Spanner - Added `gcloud alpha spanner databases wait-for-reencryption` to wait for background CMEK re-encryption to finish. - `gcloud spanner databases update` now provides instructions to wait until background re-encryption finishes when using the `--kms-keys` or `--clear-kms-keys` flags. ### Cloud Storage - Fixed an issue with `gcloud storage rsync` on Windows where incorrect file sorting caused unchanged files to be re-copied or deleted. ### Cloud Workstations - Promoted `--disk-provisioned-iops` and `--disk-provisioned-throughput` flags of `gcloud workstations configs create` and `gcloud workstations configs update` to GA. ### Cluster Director - Added `gcloud cluster-director clusters export` and `gcloud cluster-director clusters import` commands to export and import Cluster Director cluster configurations. - Fixed an issue in `gcloud cluster-director clusters update` where `startupScript`, `labels`, and `bootDisk` values specified under `computeInstance` in `--update-slurm-node-sets` were ignored. - Promoted `--managed-instance-groups` flag of `gcloud cluster-director clusters create` and `--add-managed-instance-groups`, `--update-managed-instance-groups`, and `--remove-managed-instance-groups` flags of `gcloud cluster-director clusters update` to beta to support configuring Compute Engine managed instance group orchestration on clusters. ### Compute Engine - Promoted `--svsm-config` flag to GA in `gcloud compute instances create`, `gcloud compute instances bulk create`, `gcloud compute instances create-with-container`, and `gcloud compute instance-templates create`. - Added support for regional backend services to `--service-lb-policy` flag of `gcloud compute backend-services create`. - Promoted `--linked-custom-hardware` flag of `gcloud compute routers add-bgp-peer` to beta. - Promoted `--require-specific-reservation` flag in `gcloud compute reservations update` to GA. - Promoted `--content-type`, `--http-status`, `--backend-service`, and `--backend-bucket` flags to GA in `gcloud compute url-maps invalidate-cdn-cache` to support cache invalidation by the new matchers. - Updated `--host` flag in `gcloud compute url-maps invalidate-cdn-cache` to support wildcard hostnames (e.g. `*.example.com`). ### Config Connector - Updated Google Cloud Config Connector to version 1.160.0. See Config Connector Overview for more details . ### Database Migration - Added `--schemas-filter`, `--tables-filter`, `--excluded-schemas-filter`, and `--excluded-tables-filter` flags to `gcloud database-migration migration-jobs create` and `update` commands to support schema- and table-level object filtering and exclusion. ### Device Run - Added `--target-app`, `--pre-target-apps`, and `--post-target-apps` flags to `gcloud beta device-run sessions submit instrumentation` to specify the application under test and the applications to install before and after it. - Deprecated `--apps` flag of `gcloud beta device-run sessions submit instrumentation`. Use `--target-app`, `--pre-target-apps`, and `--post-target-apps` instead. ### Eventarc - Fixed issue where `gcloud eventarc triggers list` failed when listing triggers without event filters. ### GKE Hub - Added `--auto-rollout-scope` and `--ignored-clusters-selector` flags to `gcloud container fleet|hub rolloutsequences create` and `update` commands. - Added `--clear-ignored-clusters-selector` flag to `gcloud container fleet|hub rolloutsequences update` command. - Added `--read-only` flag to `gcloud container fleet|hub memberships register` to register a non-GKE cluster with a `READ_ONLY` membership type, which skips cluster mutations and the Connect agent installation. ### Kubernetes Engine - Added `--default-compute-class` flag to `gcloud container clusters create` and `gcloud container clusters update`. - Updated `gcloud container clusters create` to reject more flags that only configure the default node pool, such as `--boot-disk-kms-key` and `--workload-metadata`, when used with `--num-nodes=0`. - Fixed `gcloud container clusters describe` suggesting a node upgrade for clusters that have no node pools. - Updated `gcloud container clusters upgrade` to fail with a clear error when the cluster has no node pools and neither `--master` nor `--node-pool` is specified. - Updated `gcloud container clusters update` to fail with a clear error when `--enable-autoscaling` is specified without `--node-pool` for a cluster that has no node pools. - Updated `gcloud container clusters resize` to fail with a clear error for clusters that have no node pools. - Updated `gcloud container clusters list` and `gcloud container clusters create` to show `0` in the `NUM_NODES` column for clusters without nodes, instead of leaving it empty. - Updated default kubectl from 1.35.9 to 1.36.6. - Removed kubectl version 1.31 as extended support has expired. - Additional kubectl versions: - 1.32.13 - 1.33.13 - 1.34.13 - 1.35.10 - 1.36.6 - 1.37.2 - Fixed an issue where `gcloud beta container clusters create` and `gcloud alpha container clusters create` with `--stack-type=ipv6` required `--enable-ip-alias` for `--enable-private-nodes` and rejected `--no-enable-ip-alias`. IP aliases do not apply to IPv6-only clusters, so `--no-enable-ip-alias` is now ignored with a warning. ### Looker - Promoted `--workforce-auth-enabled` and `--google-auth-enabled` flags to GA for `gcloud looker instances create` and `gcloud looker instances update`. ### Model Armor - Added `--filter-version-selector` and `--filter-version-selector-alias` flags to `gcloud model-armor templates create` and `gcloud model-armor templates update`. ### Network Connectivity - Promoted `--export-psc-published-services-and-regional-google-apis` and `--export-psc-global-google-apis` flags of `gcloud network-connectivity hubs create` and `gcloud network-connectivity hubs update` commands to GA. ### Network Management - Added `--source-datastream-private-connection` flag to `gcloud network-management connectivity-tests`. ### Network Services - Added `gcloud beta network-services express-links` which manages Network Services ExpressLink resources. ### Oracle Database - Added `gcloud oracle-database cloud-vm-clusters enable-identity-connector`, `gcloud oracle-database cloud-vm-clusters disable-identity-connector`, `gcloud oracle-database exadb-vm-clusters enable-identity-connector` and `gcloud oracle-database exadb-vm-clusters disable-identity-connector` commands to manage the Workload Identity Connector of Exadata and Exascale VM Clusters. - Added `--identity-connector-disabled` flag to `gcloud oracle-database cloud-vm-clusters create` and `gcloud oracle-database exadb-vm-clusters create` to opt out of provisioning the Workload Identity Connector. ### Secure Source Manager - Added `--enable-vulnerability-scanning` argument to `gcloud source-manager repos create` and `gcloud source-manager repos update` commands. ### Service Health - Added `gcloud beta service-health impacts` command group to list and describe asset impacts under a project. Subscribe to these release notes at . **Compute Engine** Feature For your regional managed instance groups (MIGs), you can view planned instance allocations across zones and machine types, check the number of instances waiting for capacity, and configure alerts based on this data. Compute Engine records these details in instance distribution logs in Cloud Logging when you create a regional MIG or increase its target size. For more information, see [View instance distribution logs](https://docs.cloud.google.com/compute/docs/instance-groups/view-instance-distribution-logs.md.txt). **Gemini Enterprise** Feature **Gemini Enterprise: Gemini 4 Carbon available in web app, mobile app, Workflow Builder, and AI developer tools** Gemini 4 Carbon is generally available (GA) for the Gemini Enterprise web app, mobile app, Workflow Builder, and AI developer tools. - **Location availability** : Supported in `global`, `us`, and `eu` multi-regions, with data residency and ML processing support in `us` and `eu`. For more information, see [Data residency for Gemini Enterprise](https://docs.cloud.google.com/gemini/enterprise/docs/locations). - **App availability** : Turned off by default. Gemini 4 Carbon is supported in the web app and mobile app. For more information about turning on the model, see [Manage features on the web app](https://docs.cloud.google.com/gemini/enterprise/docs/manage-web-app-features). - **Workflow Builder** : Gemini 4 Carbon is available in Workflow Builder. For more information, see [Workflow Builder](https://docs.cloud.google.com/gemini/enterprise/docs/workflow-builder). - **AI developer tools** : Enabled by default for licensed users when **Antigravity authorized models** uses the default selection. If your organization specifies a custom model list, an administrator must manually select Gemini 4 Carbon. For more information, see [Configure AI developer tools settings](https://docs.cloud.google.com/gemini/enterprise/docs/ai-developer-tools-settings). **Gemini Enterprise Agent Platform** Feature **Cross-project governance for semantic governance policies** You can use semantic governance policies in a multi-project (hub-and-spoke) architecture to centrally govern agents deployed across multiple Google Cloud projects. When you configure a Resource Manager management boundary with the `AGENT_MANAGEMENT` capability, Agent Registry in the central management project automatically discovers agents across all member projects with their runtime identities intact. You can then provision a single Agent Gateway and semantic governance policy engine in the management project to author and enforce policies across member project agents. For more information, see [Govern agents across multiple projects](https://docs.cloud.google.com/gemini-enterprise-agent-platform/govern/policies/configure-semantic-governance.md.txt#cross-project-governance) and [Cross-project boundaries](https://docs.cloud.google.com/agent-registry/boundaries-and-topology.md.txt). Feature **Provisioned Throughput supports more detailed order statuses** Provisioned Throughput supports more granular order statuses in the Google Cloud console in [General Availability (GA)](https://cloud.google.com/products#product-launch-stages). You can track order lifecycle states across `Declined`, `Cancelled`, and `Terminated`, in addition to `Pending review`, `Approved`, `Active`, and `Expired`. For more information, see [Check order status](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/provisioned-throughput/purchase-provisioned-throughput.md.txt#check-order-status). Fixed **CodeMender updates (v0.20.0)** This release introduces updates to CodeMender: - **Bug fixes** : - Fixed patch application failures during validation on large repositories and projects with mixed LF and CRLF line endings. - Fixed scan error handling to properly surface permission denied errors when scanning unreadable directories instead of reporting zero findings. For more information, see the [CodeMender documentation](https://docs.cloud.google.com/gemini-enterprise-agent-platform/agents/codemender.md.txt). Feature **Gemini 4 Carbon and Gemini 4 Carbon for cyber (GA)** [Gemini 4 Carbon](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/gemini/4-carbon.md.txt) (`gemini-4-carbon`) and [Gemini 4 Carbon for cyber](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/gemini/4-carbon.md.txt#cyber) (`gemini-4-carbon-cyber-permissive`) are [generally available (GA)](https://cloud.google.com/products#product-launch-stages). Gemini 4 Carbon is Google's frontier model for complex, real-world tasks across coding, finance, legal, cybersecurity, and science, with a unified 1,048,576-token input and output limit, long decodes up to 1,048,576 tokens using `continuation_token`, configurable thinking levels (`LOW`, `MEDIUM`, and `HIGH`), implicit context caching with durable caching, Microsoft Office and OpenDocument file inputs, and [Provisioned Throughput](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/provisioned-throughput/supported-models.md.txt#google-models) support. Gemini 4 Carbon for cyber is a defensive cybersecurity variant available behind the [Fairwind Program](https://deepmind.google/fairwind-program/) allowlist. **Google Cloud Contact Center as a Service** Announcement **Google Cloud CCaaS prerelease notes 6.33** Here are the prerelease notes for what we expect to be the next version of Google Cloud CCaaS. When we release this version, we expect the new capabilities to be as shown here. Fixed This release addresses the following issues: - Fixed an issue where numbers on the inbound blocklist weren't blocked when calling a direct line. - Fixed an issue where Telnyx calls became stuck in a queue indefinitely if a hang-up notification was lost during high-load periods. - Fixed an issue where callback calls that were abandoned while waiting in a queue were incorrectly recorded as system failures instead of end-user hang-ups, and didn't maintain their first-in, first-out priority order when transitioning between queue groups. - Fixed an issue where the call adapter incorrectly redialed a call immediately after hang-up, causing the participant status to fail and the mandatory disposition panel to close prematurely. - Fixed an issue where auto-answer calls entered an infinite re-offer loop to the same agent if a connection timeout occurred, preventing over-capacity deflection from triggering. - Fixed an issue where scheduled callback redials were placed after their maximum deferral deadline, causing calls to reach customers later than promised. - Fixed an issue where an agent's next status prematurely cleared and didn't appear in **Agent Monitoring** if a voice call's wrap-up ended while they still had active chats. - Fixed an issue where the logout confirmation dialog on the **Agents** page appeared in English when the CCaaS portal language was set to French Canadian (`fr_CA`). - Fixed an issue where virtual-agent-to-virtual-agent chat transfers failed if the transfer turn also ended the conversation. - Fixed an issue in the **Agents** view where the team filter incorrectly displayed agents from unrelated teams due to stale data records. - Fixed an issue where the `{ACCOUNT_ID}` placeholder resolved to an empty string during virtual agent chats, causing CRM API request failures. - Fixed an issue where large, unbounded date range queries on the Manager API `calls` endpoint caused request timeouts. Requests to this endpoint now require a bounded date range. - Fixed an issue where loading holiday settings or ending a call in the agent desktop caused significant system slowness due to inefficient database lookups. - Fixed an issue where retrieving agent call history caused significant performance delays and system instability. **Google Kubernetes Engine** Change #### (2026-R47) Version updates GKE cluster versions have been updated. **New versions available for upgrades and new clusters.** The following versions are now available for new GKE clusters, and for manual control plane upgrades and node upgrades for existing clusters. For more information about versioning and upgrades, see [GKE versioning and support](https://cloud.google.com/kubernetes-engine/versioning) and [About GKE cluster upgrades](https://cloud.google.com/kubernetes-engine/upgrades). ### Rapid channel > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.37.1-gke.2097000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-2097000) is now the default version for cluster creation in the Rapid channel. - The following versions are now available in the Rapid channel: - [1.34.12-gke.1698000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1698000) - [1.35.9-gke.1673000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-9-gke-1673000) - [1.36.5-gke.2262000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-5-gke-2262000) - [1.37.2-gke.1042000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-2-gke-1042000) - [Alpha version](https://cloud.google.com/kubernetes-engine/versioning#alpha-versions) 1.38.0-gke.4814000+preview is now available for GKE alpha clusters in the Rapid channel. - The following versions are no longer available in the Rapid channel: - 1.34.12-gke.1209000 - 1.34.12-gke.1363000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Rapid channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.35.8-gke.1975000 - 1.35.8-gke.2308000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Rapid channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.2377000 - 1.36.5-gke.1259000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Rapid channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.37.1-gke.1697000 - 1.37.1-gke.3020000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Rapid channel. This version will be removed in 90 days, or at the end of support, if sooner. - Alpha version 1.38.0-gke.2884000+preview is no longer available in the Rapid channel. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.12-gke.1539000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1539000) - 1.34 to [1.35.9-gke.1505000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-9-gke-1505000) - 1.35 to [1.36.5-gke.1982000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-5-gke-1982000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.12-gke.1539000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1539000) - 1.35 to [1.35.9-gke.1505000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-9-gke-1505000) - 1.36 to [1.36.5-gke.1982000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-5-gke-1982000) - 1.37 to [1.37.1-gke.2097000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-2097000) ### Regular channel > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.36.4-gke.2377000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2377000) is now the default version for cluster creation in the Regular channel. - The following versions are no longer available in the Regular channel: - 1.34.12-gke.1011000 - 1.34.12-gke.1153000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Regular channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.2046003 - 1.36.4-gke.2326000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Regular channel. This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.12-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1209000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.12-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1209000) - 1.36 to [1.36.4-gke.2377000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2377000) ### Stable channel > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.35.8-gke.1796000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1796000) is now the default version for cluster creation in the Stable channel. - The following versions are no longer available in the Stable channel: - 1.34.11-gke.1102000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Stable channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.34.11-gke.1209000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Stable channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.35.8-gke.1439001 - 1.35.8-gke.1626001 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Stable channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.1391002 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Stable channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.1495002 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Stable channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.1495003 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Stable channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.2046002 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Stable channel. This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.12-gke.1011000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1011000) - 1.34 to [1.35.8-gke.1796000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1796000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.12-gke.1011000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1011000) - 1.35 to [1.35.8-gke.1796000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1796000) - 1.36 to [1.36.4-gke.2046003](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046003) ### Extended channel > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.36.4-gke.2377000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2377000) is now the default version for cluster creation in the Extended channel. - The following versions are now available in the Extended channel: - [1.32.13-gke.2788000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2788000) - [1.32.13-gke.3004000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-3004000) - [1.33.13-gke.2074000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-2074000) - [1.33.13-gke.2339000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-2339000) - The following versions are no longer available in the Extended channel: - 1.32.13-gke.2662000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.32.13-gke.2906000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.33.13-gke.1915000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.33.13-gke.2207000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.34.12-gke.1011000 - 1.34.12-gke.1153000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.2046003 - 1.36.4-gke.2326000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or deprecated APIs, preventing upgrades: - 1.31 to [1.32.13-gke.2701000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2701000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or other factors preventing minor version upgrades: - 1.32 to [1.32.13-gke.2701000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2701000) - 1.33 to [1.33.13-gke.1952000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1952000) - 1.34 to [1.34.12-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1209000) - 1.36 to [1.36.4-gke.2377000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2377000) ### No channel (deprecated) > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.36.4-gke.2377000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2377000) is now the default version for cluster creation. - The following versions are now available: - [1.34.12-gke.1698000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1698000) - [1.35.9-gke.1673000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-9-gke-1673000) - [1.36.5-gke.2262000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-5-gke-2262000) - [1.37.2-gke.1042000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-2-gke-1042000) - The following node versions are now available: - [1.32.13-gke.3004000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-3004000) - [1.33.13-gke.2339000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-2339000) - [1.34.12-gke.1698000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1698000) - [1.35.9-gke.1673000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-9-gke-1673000) - [1.36.5-gke.2262000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-5-gke-2262000) - [1.37.2-gke.1042000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-2-gke-1042000) - The following versions are no longer available: - 1.34.11-gke.1102000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.34.11-gke.1209000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.34.12-gke.1153000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.34.12-gke.1363000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.35.6-gke.1250001 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.35.8-gke.1626001 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.35.8-gke.2308000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.1391002 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.1495002 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.1495003 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.2046002 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.2326000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.5-gke.1259000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.37.1-gke.3020000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.12-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1209000) - 1.34 to [1.35.8-gke.1796000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1796000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.12-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1209000) - 1.35 to [1.35.8-gke.1796000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1796000) - 1.36 to [1.36.4-gke.2377000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2377000) Security #### (2026-R47) Security updates This release includes new GKE versions that use updated Container-Optimized OS images. These updated images are cumulative, incorporating security fixes from all Container-Optimized OS versions released since the previous GKE release. To identify the specific vulnerabilities that were resolved in each updated Container-Optimized OS image, see the **Security** release notes for that image. The following table includes links to the release notes for each updated Container-Optimized OS image: | GKE version | Container-Optimized OS version | Details | |---|---|---| | 1.32.13-gke.3004000 | cos-121-18867-652-12 | [cos-121-18867-652-12 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m121.md.txt#cos-121-18867-652-12_) | | 1.37.2-gke.1042000 | cos-133-19999-44-170 | [cos-133-19999-44-170 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m133.md.txt#cos-133-19999-44-170_) | | 1.38.0-gke.4814000+preview | cos-dev-138-20162-0-0 | [cos-dev-138-20162-0-0 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m138#cos-dev-138-20162-0-0_) |
Change #### (2026-R47) Version updates > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.35.8-gke.1796000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1796000) is now the default version for cluster creation in the Stable channel. - The following versions are no longer available in the Stable channel: - 1.34.11-gke.1102000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Stable channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.34.11-gke.1209000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Stable channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.35.8-gke.1439001 - 1.35.8-gke.1626001 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Stable channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.1391002 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Stable channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.1495002 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Stable channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.1495003 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Stable channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.2046002 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Stable channel. This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.12-gke.1011000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1011000) - 1.34 to [1.35.8-gke.1796000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1796000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.12-gke.1011000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1011000) - 1.35 to [1.35.8-gke.1796000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1796000) - 1.36 to [1.36.4-gke.2046003](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046003) Change #### (2026-R47) Version updates > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.36.4-gke.2377000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2377000) is now the default version for cluster creation in the Regular channel. - The following versions are no longer available in the Regular channel: - 1.34.12-gke.1011000 - 1.34.12-gke.1153000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Regular channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.2046003 - 1.36.4-gke.2326000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Regular channel. This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.12-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1209000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.12-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1209000) - 1.36 to [1.36.4-gke.2377000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2377000) Change #### (2026-R47) Version updates > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.37.1-gke.2097000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-2097000) is now the default version for cluster creation in the Rapid channel. - The following versions are now available in the Rapid channel: - [1.34.12-gke.1698000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1698000) - [1.35.9-gke.1673000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-9-gke-1673000) - [1.36.5-gke.2262000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-5-gke-2262000) - [1.37.2-gke.1042000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-2-gke-1042000) - [Alpha version](https://cloud.google.com/kubernetes-engine/versioning#alpha-versions) 1.38.0-gke.4814000+preview is now available for GKE alpha clusters in the Rapid channel. - The following versions are no longer available in the Rapid channel: - 1.34.12-gke.1209000 - 1.34.12-gke.1363000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Rapid channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.35.8-gke.1975000 - 1.35.8-gke.2308000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Rapid channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.2377000 - 1.36.5-gke.1259000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Rapid channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.37.1-gke.1697000 - 1.37.1-gke.3020000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Rapid channel. This version will be removed in 90 days, or at the end of support, if sooner. - Alpha version 1.38.0-gke.2884000+preview is no longer available in the Rapid channel. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.12-gke.1539000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1539000) - 1.34 to [1.35.9-gke.1505000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-9-gke-1505000) - 1.35 to [1.36.5-gke.1982000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-5-gke-1982000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.12-gke.1539000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1539000) - 1.35 to [1.35.9-gke.1505000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-9-gke-1505000) - 1.36 to [1.36.5-gke.1982000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-5-gke-1982000) - 1.37 to [1.37.1-gke.2097000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-2097000) Change #### (2026-R47) Version updates > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.36.4-gke.2377000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2377000) is now the default version for cluster creation. - The following versions are now available: - [1.34.12-gke.1698000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1698000) - [1.35.9-gke.1673000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-9-gke-1673000) - [1.36.5-gke.2262000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-5-gke-2262000) - [1.37.2-gke.1042000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-2-gke-1042000) - The following node versions are now available: - [1.32.13-gke.3004000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-3004000) - [1.33.13-gke.2339000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-2339000) - [1.34.12-gke.1698000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1698000) - [1.35.9-gke.1673000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-9-gke-1673000) - [1.36.5-gke.2262000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-5-gke-2262000) - [1.37.2-gke.1042000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-2-gke-1042000) - The following versions are no longer available: - 1.34.11-gke.1102000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.34.11-gke.1209000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.34.12-gke.1153000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.34.12-gke.1363000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.35.6-gke.1250001 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.35.8-gke.1626001 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.35.8-gke.2308000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.1391002 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.1495002 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.1495003 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.2046002 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.2326000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.5-gke.1259000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.37.1-gke.3020000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.12-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1209000) - 1.34 to [1.35.8-gke.1796000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1796000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.12-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1209000) - 1.35 to [1.35.8-gke.1796000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1796000) - 1.36 to [1.36.4-gke.2377000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2377000) Change #### (2026-R47) Version updates > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.36.4-gke.2377000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2377000) is now the default version for cluster creation in the Extended channel. - The following versions are now available in the Extended channel: - [1.32.13-gke.2788000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2788000) - [1.32.13-gke.3004000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-3004000) - [1.33.13-gke.2074000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-2074000) - [1.33.13-gke.2339000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-2339000) - The following versions are no longer available in the Extended channel: - 1.32.13-gke.2662000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.32.13-gke.2906000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.33.13-gke.1915000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.33.13-gke.2207000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.34.12-gke.1011000 - 1.34.12-gke.1153000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.2046003 - 1.36.4-gke.2326000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or deprecated APIs, preventing upgrades: - 1.31 to [1.32.13-gke.2701000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2701000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or other factors preventing minor version upgrades: - 1.32 to [1.32.13-gke.2701000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2701000) - 1.33 to [1.33.13-gke.1952000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1952000) - 1.34 to [1.34.12-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1209000) - 1.36 to [1.36.4-gke.2377000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2377000) **Model Armor** Feature Model Armor image screening is [generally available (GA)](https://cloud.google.com/products#product-launch-stages). You can extract and screen images embedded within supported rich text documents (PDF, Word, Excel, and PowerPoint). Pricing for image screening is in effect and converts processed images into tokens based on image size. For more information, see [Screen images](https://docs.cloud.google.com/model-armor/screen-images), [Pricing](https://docs.cloud.google.com/model-armor/overview.md.txt#pricing), and [Token calculation and pricing for images](https://docs.cloud.google.com/model-armor/screen-images#tokens). **Network Connectivity Center** Fixed [IPv6 dynamic routes](https://docs.cloud.google.com/network-connectivity/docs/network-connectivity-center/concepts/spoke-filters-overview.md.txt) (Preview) traffic sent to hybrid spokes from VPC spokes will incur Advanced Data Networking (ADN) charges at the same rate as IPv4 traffic. For detailed pricing information, see [Network Connectivity Center pricing](https://docs.cloud.google.com/network-connectivity/docs/network-connectivity-center/pricing#ncc-pricing). **Service Health** Feature Personalized Service Health supports **resource-level impact** in [Preview](https://docs.cloud.google.com/products#product-launch-stages) for supported products through the Service Health `v1beta` API and the `gcloud beta` CLI. For more information, see [Impacted resources](https://docs.cloud.google.com/service-health/docs/concepts.md.txt#impacted-resources) and [List impacted resources in a project](https://docs.cloud.google.com/service-health/docs/project-events.md.txt#list-impacted-resources). **Spanner** Feature Spanner [parameterized views](https://docs.cloud.google.com/spanner/docs/parameterized-views.md.txt) are now generally available ([GA](https://docs.cloud.google.com/products#product-launch-stages)). Parameterized views let you dynamically filter data based on session context parameters passed with queries, helping you isolate tenant data and restrict data access in AI agent and LLM applications. For more information, see [Create a parameterized view](https://docs.cloud.google.com/spanner/docs/create-manage-views.md.txt#create-parameterized-view) and [Use parameterized views](https://docs.cloud.google.com/spanner/docs/use-parameterized-views.md.txt). **Vertex AI Search** Feature **Agent Search: Search-as-you-type for custom search apps (Preview)** You can configure schema fields to support search-as-you-type in custom search apps. Search-as-you-type returns a refreshed set of ranked documents on every keystroke before a user finishes typing a full query. Unlike autocomplete, which suggests query strings, search-as-you-type returns matching documents so that users can browse an updating result list and find the right result mid-query. This feature is in Public Preview. For more information, see [Configure field settings](https://docs.cloud.google.com/generative-ai-app-builder/docs/configure-field-settings). ## November 09, 2026 **AI Hypercomputer** Feature **Generally available** : [Pathways on Cloud](https://docs.cloud.google.com/ai-hypercomputer/docs/workloads/pathways-on-cloud/pathways-intro.md.txt) is now generally available on Google Kubernetes Engine (GKE). Major features include the following: - **Single-controller execution model**: Coordinate multi-slice and multi-host Cloud TPU workloads from a single Python client process. Pathways uses asynchronous dispatch and centralized scheduling to support both Single Program, Multiple Data (SPMD) and Multiple Program, Multiple Data (MPMD) workloads. For example, training and reinforcement learning (RL) loops. - **Resilient and elastic training** : Keep training jobs running across hardware interruptions with [resilient training](https://docs.cloud.google.com/ai-hypercomputer/docs/workloads/pathways-on-cloud/resilient-training.md.txt), including the following capabilities: - **[Elastic training](https://docs.cloud.google.com/ai-hypercomputer/docs/workloads/pathways-on-cloud/resilient-training.md.txt#elastic-training)**: Dynamically scale down to healthy Cloud TPU slices during unplanned hardware failures and scale back up when replacement slices rejoin without restarting the entire job. - **Suspend-resume**: Automatically save and restore high-bandwidth memory (HBM) state to Cloud Storage during planned GKE preemption events. - **Hot-swapping**: Remap interrupted workloads onto standby or lower-priority Cloud TPU slices. - **[Colocated Python sidecar containers](https://docs.cloud.google.com/ai-hypercomputer/docs/workloads/pathways-on-cloud/porting-jax-workloads.md.txt#colocated-python)** : Run custom Python code directly on Cloud TPU host VMs alongside Pathways workers. For example, multi-host data loading with [Grain](https://github.com/google/grain) or `RemoteIterator`, and distributed asynchronous checkpointing with [Orbax](https://github.com/google/orbax). - **Interactive mode and Shared Pathways Service** : Run, inspect, and debug JAX workloads interactively from a notebook or terminal using [interactive mode](https://docs.cloud.google.com/ai-hypercomputer/docs/workloads/pathways-on-cloud/pathways-interactive-mode.md.txt), or share a long-running pool of Cloud TPU slices on demand across multiple users and jobs with the [Shared Pathways Service](https://github.com/AI-Hypercomputer/pathways-utils/tree/main/pathwaysutils/experimental/shared_pathways_service). - **Cluster Director, Cluster Toolkit, and GKE integration** : Launch JAX workloads on the Pathways runtime using [Cluster Director](https://docs.cloud.google.com/cluster-director/docs/overview.md.txt) or [Cluster Toolkit](https://docs.cloud.google.com/cluster-toolkit/docs/deploy/gke/run-workloads-pathways.md.txt) (`gcluster` with `--pathways` and `--pathways-headless`), or by deploying Kubernetes JobSet manifests on GKE. - **`pathwaysutils` utility package** : Use the [`pathwaysutils`](https://github.com/AI-Hypercomputer/pathways-utils) Python package for advanced features such as the Shared Pathways Service, [elasticity](https://docs.cloud.google.com/ai-hypercomputer/docs/workloads/pathways-on-cloud/resilient-training.md.txt#elastic-training), and [`experimental.reshard`](https://github.com/AI-Hypercomputer/pathways-utils/blob/main/pathwaysutils/experimental/reshard.py) for device-side data transfers across hosts over Inter-Chip Interconnect (ICI) or Data Center Network (DCN). - **Standard `libtpu.so` layering and custom `libtpu.so` support** : Pathways is layered over the standard `libtpu.so` shared library and provides a way to dynamically link in a user-provided `libtpu.so` at runtime using [`PathwaysJobSet.with_custom_libtpu`](https://github.com/AI-Hypercomputer/pathways-utils/tree/main/pathwaysutils/experimental/gke) in `pathwaysutils`. - **Single-process profiling, observability, and compilation cache**: Capture end-to-end JAX profiler traces across the client, proxy, resource manager, and Cloud TPU hosts from a single process. Reuse compiled XLA modules with a persistent compilation cache on Cloud Storage, and view Pathways control and data plane metrics in Cloud Monitoring. - **Agentic workload debugging** : Troubleshoot failed, crashing, or stalled Pathways workloads on GKE using the [`pathways-workload` agent skill](https://github.com/google/skills/tree/main/skills/cloud/pathways-workload). With this skill, AI agents can inspect Cloud Logging container logs, node kernel logs, and GKE events to help identify root causes and fixes. - **Supported Cloud TPU versions, JAX versions, and container images** : Supports TPU7x (Ironwood), TPU v6e (Trillium), TPU v5p, and TPU v5e for JAX versions 0.12.0.1, 0.12.0, 0.11.2, 0.11.1, 0.11.0, 0.10.2, and 0.10.1, with container images published in Artifact Registry: - **Image locations** : - **Pathways resource manager and worker** : `us-docker.pkg.dev/cloud-tpu-v2-images/cloud-pathways/server:TAG` - **IFRT proxy server** : `us-docker.pkg.dev/cloud-tpu-v2-images/cloud-pathways/proxy_server:TAG` - **Colocated Python sidecar** : `us-docker.pkg.dev/cloud-tpu-v2-images/cloud-pathways/colocated_python_sidecar:TAG` - **Image tags** : Replace `TAG` with one of the following tags, which are created automatically when a Pathways build passes qualification tests and is promoted to production: - `YYYYMMDD-jax_JAX_VERSION`: Pinned tag created by combining the UTC promotion date (`YYYYMMDD`) with `-jax_` and the verified JAX version (`JAX_VERSION`) after per-version qualification tests pass. For example, `20261108-jax_0.12.0.1`. - `jax-JAX_VERSION`: Rolling tag updated after per-version qualification tests pass to point to the most recent verified image for that JAX release. For example, `jax-0.12.0.1` or `jax-0.12.0`. - `latest`: Rolling tag updated when a build passes qualification tests against the most recent supported JAX release. For more information, see [Introduction to Pathways on Cloud](https://docs.cloud.google.com/ai-hypercomputer/docs/workloads/pathways-on-cloud/pathways-intro.md.txt). **AlloyDB for PostgreSQL** Feature The following AlloyDB AI features and improvements are generally available ([GA](https://cloud.google.com/products#product-launch-stages)): - Smart batching for AI functions: AI function acceleration is generally available for `ai.if`, `ai.rank`, `ai.analyze_sentiment`, `ai.summarize`, `ai.extract`, `ai.classify`, and `ai.generate` on AlloyDB clusters running PostgreSQL 17 and later. Smart batching automatically batches and offloads eligible AI operations for asynchronous evaluation. It improves query execution speed without requiring you to rewrite queries into complex array structures. In PostgreSQL 18 and later, this feature is enabled by default. For more information, see [Accelerate performance for queries with AI functions](https://docs.cloud.google.com/alloydb/docs/ai/accelerate-ai-queries.md.txt). - Sentiment analysis: the `ai.analyze_sentiment` function is generally available on AlloyDB clusters running PostgreSQL 17 and later. This built-in function classifies the sentiment of text as positive, negative, or neutral directly within SQL queries in real time. For more information, see [Analyze text sentiment](https://docs.cloud.google.com/alloydb/docs/ai/analyze-sentiment.md.txt). **Anthos Config Management** Change Addressed multiple Common Vulnerabilities and Exposures (CVEs) by updating dependencies. Change Upgraded the `git-sync` dependency from v4.4.2 to v4.5.0 to pick up vulnerability fixes. For more details, see [git-sync releases](https://github.com/kubernetes/git-sync/releases). Change Upgraded the Open Telemetry image from 0.152.0 to 0.159.0 to pick up vulnerability fixes. To understand the changes in each release, review the full changelog for [opentelemetry-collector-contrib](https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/CHANGELOG.md). **Anti Money Laundering AI** Announcement New minor engine version released for the commercial line of business within the `v004.009` version line (`aml-commercial.default.v004.009.202610-000`). This version extends support for the major engine version and includes no significant changes compared to the previous minor version. **Apigee Edge for Private Cloud** Announcement Released Apigee Edge for Private Cloud 4.54.00.01. For the list of updated RPM packages and the patch update procedure, see [Install 4.54.00.x patch updates](https://docs.apigee.com/private-cloud/v4.54.00/update-apigee-edge-45400-patch#4540001). Security Fixed multiple security vulnerabilities in Apigee Edge for Private Cloud, including security hardening across Edge runtime, management, New Edge UI, OpenLDAP, Apigee mTLS, and Nginx components. Fixed Resolved the following issues in Apigee Edge for Private Cloud 4.54.00.01: - Fixed an issue in the New Edge UI where creating an OpenAPI Specification in the `OASValidation` policy modal stored the specification resource under `yaml://` or `json://` instead of `oas://`. - Fixed an issue where running `setup.sh -p uapim` failed during `edge-uapim-connector` setup. - Apigee Edge for Private Cloud 4.54.00 and its patch releases support Red Hat Enterprise Linux, Oracle Linux, and Rocky Linux 8.10, 9.6, 9.7, and 9.8. See [Supported software and supported versions](https://docs.apigee.com/release/supported-software#apigeeedgeforprivatecloudsupportedversions). **BigQuery** Feature To support your FinOps practices, you can now opt in to [compute cost attribution](https://docs.cloud.google.com/bigquery/docs/reservations-monitoring.md.txt#reservation_cost_attribution) in BigQuery editions. This feature attributes billed compute charges directly to the query projects that use your administration project's reservation capacity. Allocating costs based on actual commitment and autoscaling slot usage lets you accurately track project-level costs and manage internal chargebacks. This feature is available in [Preview](https://cloud.google.com/products#product-launch-stages). Feature Query performance troubleshooting and job and system performance comparison in the BigQuery jobs explorer are [generally available](https://cloud.google.com/products#product-launch-stages) (GA). For more information, see [Troubleshoot job performance](https://docs.cloud.google.com/bigquery/docs/admin-jobs-explorer.md.txt#get-job-details) and [Diagnose performance regressions by comparing jobs and systems](https://docs.cloud.google.com/bigquery/docs/admin-jobs-explorer.md.txt#compare-jobs). Feature When you [create](https://docs.cloud.google.com/bigquery/docs/create-pipelines.md.txt) or [schedule](https://docs.cloud.google.com/bigquery/docs/schedule-pipelines.md.txt) a pipeline, you can specify the maximum number of concurrently executed pipeline tasks. This feature is [generally available](https://cloud.google.com/products#product-launch-stages) (GA). Feature You can use [compression functions](https://docs.cloud.google.com/bigquery/docs/reference/standard-sql/compression-functions.md.txt) in GoogleSQL to compress or decompress bytes or string values by using the Zstandard (Zstd) lossless data compression algorithm. The following functions are supported: - [`ZSTD_COMPRESS`](https://docs.cloud.google.com/bigquery/docs/reference/standard-sql/compression-functions.md.txt#zstd_compress) - [`ZSTD_DECOMPRESS_TO_BYTES`](https://docs.cloud.google.com/bigquery/docs/reference/standard-sql/compression-functions.md.txt#zstd_decompress_to_bytes) - [`ZSTD_DECOMPRESS_TO_STRING`](https://docs.cloud.google.com/bigquery/docs/reference/standard-sql/compression-functions.md.txt#zstd_decompress_to_string) These functions are in [Preview](https://cloud.google.com/products/#product-launch-stages). **Bigtable** Feature You can use the Google Cloud console to create and manage Apache Avro schema bundles for your Bigtable tables. You can also view Avro schema bundle definitions in Bigtable Studio. This feature is in [Preview](https://cloud.google.com/products#product-launch-stages). For more information, see [Create and manage Avro schemas](https://docs.cloud.google.com/bigtable/docs/create-manage-avro-schemas.md.txt). Libraries ### Java #### [1.95.0](https://github.com/googleapis/google-cloud-java/compare/v1.94.0...v1.95.0) (2026-11-02) ##### Bug Fixes - **bigtable:** avoid mutating Query in-place in createPointReadCallable ([#14797](https://github.com/googleapis/google-cloud-java/issues/14797)) ([1b1c6a7](https://github.com/googleapis/google-cloud-java/commit/1b1c6a72fb29dd7a8e04b6ddb2e402603ad6ac90)) - **bigtable:** check isOk and getRejected first in RetryingVRpc.shouldRetry ([#14795](https://github.com/googleapis/google-cloud-java/issues/14795)) ([d821bd3](https://github.com/googleapis/google-cloud-java/commit/d821bd3e81aacea3b8aeb7adf471b88e47cb3764)) - **bigtable:** check remaining deadline on client-initiated retries in RetryingVRpc ([#14796](https://github.com/googleapis/google-cloud-java/issues/14796)) ([a04e24c](https://github.com/googleapis/google-cloud-java/commit/a04e24c1beb3558a6c7f93aab6293beb0c4428c9)) - **bigtable:** Fix empty RowResult semantics in TestProxy. ([#14810](https://github.com/googleapis/google-cloud-java/issues/14810)) ([1d2fb9a](https://github.com/googleapis/google-cloud-java/commit/1d2fb9a698f0c3eae14f8c0d06afea2440d5aca0)) - **bigtable:** include reversed in Query equals, hashCode, and toString ([#14799](https://github.com/googleapis/google-cloud-java/issues/14799)) ([fe9232b](https://github.com/googleapis/google-cloud-java/commit/fe9232bb7fa3debbafe067e453a156a5dd8fbd2a)) - **bigtable:** pass cell value size to RowBuilder.startCell in RowBuilderShim ([#14800](https://github.com/googleapis/google-cloud-java/issues/14800)) ([cfa7949](https://github.com/googleapis/google-cloud-java/commit/cfa7949755b23c7e86acb798d87ff6a11a426d7f)) - **bigtable:** reject empty split points in RowSetUtil and clarify QueryPaginator Javadoc ([#14811](https://github.com/googleapis/google-cloud-java/issues/14811)) ([1bc507f](https://github.com/googleapis/google-cloud-java/commit/1bc507f80adc6b85af4761420f5408cb6acb15f7)) - **bigtable:** remove legacy PollingConfiguration migration in ClientConfigurationManager ([#14822](https://github.com/googleapis/google-cloud-java/issues/14822)) ([95ead45](https://github.com/googleapis/google-cloud-java/commit/95ead459480137a07d5b62ad75ff9978ecb8099a)) - **bigtable:** resolve session diversion through a single shared rule ([#14738](https://github.com/googleapis/google-cloud-java/issues/14738)) ([00f7bea](https://github.com/googleapis/google-cloud-java/commit/00f7bea135eb77de710e71c97ae5be3a2829886d)) - **bigtable:** respect query limit smaller than pageSize and avoid mutating Query in QueryPaginator ([#14821](https://github.com/googleapis/google-cloud-java/issues/14821)) ([cecd09e](https://github.com/googleapis/google-cloud-java/commit/cecd09e27d3511de8def4983a94cf7823a248af3)) ##### Documentation - **bigtable:** document that skipped large rows count towards row limit ([#14801](https://github.com/googleapis/google-cloud-java/issues/14801)) ([91d60e0](https://github.com/googleapis/google-cloud-java/commit/91d60e05e5c81d47288c53f55e25961169c2b3c5)) ### Java #### [1.96.0](https://github.com/googleapis/google-cloud-java/compare/v1.95.0...v1.96.0) (2026-11-05) ##### Bug Fixes - **bigtable:** allow non-default service accounts for session DirectAccess ([#14926](https://github.com/googleapis/google-cloud-java/issues/14926)) ([9f4a76a](https://github.com/googleapis/google-cloud-java/commit/9f4a76acfb576048729c2f35a768531eba1dad5c)) **Cloud Asset Inventory** Feature The following resource type is publicly available through the [ExportAssets](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/exportAssets.md.txt), [ListAssets](https://docs.cloud.google.com/asset-inventory/docs/listing-assets), [BatchGetAssetsHistory](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/batchGetAssetsHistory.md.txt), [QueryAssets](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/queryAssets.md.txt), [Feed](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/feeds.md.txt), [SearchAllResources](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/searchAllResources.md.txt), and [SearchAllIamPolicies](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/searchAllIamPolicies.md.txt) APIs. - Dataflow - `dataflow.googleapis.com/Snapshot` Feature The following resource types are publicly available through the [ExportAssets](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/exportAssets.md.txt), [ListAssets](https://docs.cloud.google.com/asset-inventory/docs/listing-assets), [BatchGetAssetsHistory](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/batchGetAssetsHistory.md.txt), [QueryAssets](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/queryAssets.md.txt), [Feed](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/feeds.md.txt), and Search ([SearchAllResources](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/searchAllResources.md.txt), [SearchAllIamPolicies](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/searchAllIamPolicies.md.txt)) APIs. - Apigee - `apigee.googleapis.com/Deployment` - `apigee.googleapis.com/EndpointAttachment` - `apigee.googleapis.com/EnvironmentGroup` - `apigee.googleapis.com/EnvironmentGroupAttachment` - `apigee.googleapis.com/SharedFlow` - `apigee.googleapis.com/SharedFlowRevision` - `apigee.googleapis.com/TargetServer` **Cloud Load Balancing** Feature Server Name Indication (SNI)-based routing with TLS routes for Proxy Network Load Balancers is now in **General Availability**. You can route TLS traffic to backend services based on SNI hostnames by using the `TLSRoute` API resource. This provides TLS passthrough without terminating the connection at the load balancer. For more information, see the following documentation: - [SNI-based routing with TLS routes](https://docs.cloud.google.com/load-balancing/docs/tcp.md.txt#sni-based-routing) - [Routing configuration size and quota units](https://docs.cloud.google.com/load-balancing/docs/routing-config-size-quota.md.txt) - [Quotas and limits](https://docs.cloud.google.com/load-balancing/docs/quotas.md.txt#config-size-limits) **Cloud Run** Feature Detect vulnerabilities and exposed secrets in the container images of your Cloud Run services, jobs, and worker pools with [Vulnerability Assessment for Cloud Run](https://docs.cloud.google.com/run/docs/securing/cloud-run-vulnerability-scanning.md.txt) ([Preview](https://cloud.google.com/products#product-launch-stages)). **Cloud SQL for MySQL** Feature The [C4D machine series](https://docs.cloud.google.com/sql/docs/mysql/machine-series-overview.md.txt#c4d) is available for Cloud SQL for MySQL Enterprise Plus instances in the following regions: - `africa-south1` --- Johannesburg - `asia-northeast1` --- Tokyo - `europe-west1` --- Belgium - `europe-west2` --- London - `europe-west3` --- Frankfurt - `europe-west4` --- Netherlands - `europe-west9` --- Paris - `us-east1` --- South Carolina - `us-east4` --- Northern Virginia The C4D machine series provides the following benefits: - Runs on 5th Generation AMD EPYC processors (Turin) and Google Titanium. - Uses Hyperdisk Balanced storage with customizable IOPS and throughput. - Delivers consistent, predictable high performance for demanding workloads. **Cloud SQL for PostgreSQL** Feature The [C4D machine series](https://docs.cloud.google.com/sql/docs/postgres/machine-series-overview.md.txt#c4d) is available for Cloud SQL for PostgreSQL Enterprise Plus instances in the following regions: - `africa-south1` --- Johannesburg - `asia-northeast1` --- Tokyo - `europe-west1` --- Belgium - `europe-west2` --- London - `europe-west3` --- Frankfurt - `europe-west4` --- Netherlands - `europe-west9` --- Paris - `us-east1` --- South Carolina - `us-east4` --- Northern Virginia The C4D machine series provides the following benefits: - Runs on 5th Generation AMD EPYC processors (Turin) and Google Titanium. - Uses Hyperdisk Balanced storage with customizable IOPS and throughput. - Delivers consistent, predictable high performance for demanding workloads. **Cloud SQL for SQL Server** Feature Starting November 9, 2026, newly created Cloud SQL for SQL Server instances send metadata and schema updates to [Knowledge Catalog (formerly Dataplex Universal Catalog)](https://docs.cloud.google.com/sql/docs/sqlserver/dataplex-catalog-integration.md.txt) in [near real-time](https://docs.cloud.google.com/sql/docs/sqlserver/dataplex-catalog-integration.md.txt#near-real-time). Integration with Knowledge Catalog is enabled by default for newly created instances. You can [verify](https://docs.cloud.google.com/sql/docs/sqlserver/dataplex-catalog-integration.md.txt#verify-dataplex-catalog) or [update the integration](https://docs.cloud.google.com/sql/docs/sqlserver/dataplex-catalog-integration.md.txt#deactivate-dataplex-catalog) at any time. Feature The [C4D machine series](https://docs.cloud.google.com/sql/docs/sqlserver/machine-series-overview.md.txt#c4d) is available for Cloud SQL for SQL Server Enterprise Plus instances in the following regions: - `africa-south1` --- Johannesburg - `asia-northeast1` --- Tokyo - `europe-west1` --- Belgium - `europe-west2` --- London - `europe-west3` --- Frankfurt - `europe-west4` --- Netherlands - `europe-west9` --- Paris - `us-east1` --- South Carolina - `us-east4` --- Northern Virginia The C4D machine series provides the following benefits: - Runs on 5th Generation AMD EPYC processors (Turin) and Google Titanium. - Uses Hyperdisk Balanced storage with customizable IOPS and throughput. - Delivers consistent, predictable high performance for demanding workloads. **Cloud Service Mesh** Announcement **1.31.3-asm.7 is now available for in-cluster Cloud Service Mesh.** For details on upgrading Cloud Service Mesh, see [Upgrade Cloud Service Mesh](https://docs.cloud.google.com/service-mesh/docs/upgrade/upgrade.md.txt). Cloud Service Mesh 1.31.3-asm.7 uses Envoy v1.39.5-dev. This release resolves the security vulnerability listed in Security Bulletin [GCP-2026-080](https://cloud.google.com/service-mesh/docs/security-bulletins#gcp-2026-080) ([ISTIO-SECURITY-2026-009](https://istio.io/latest/news/security/istio-security-2026-009/)). Fixed Patch 1.31.3-asm.7 contains the fix for the following platform CVEs: | CVE | Proxy | Control Plane | Distroless | CNI | Severity | |---|---|---|---|---|---| | [CVE-2026-89161](https://nvd.nist.gov/vuln/detail/CVE-2026-89161) | Yes | Yes | No | Yes | Medium (7.8) | | [CVE-2026-116587](https://nvd.nist.gov/vuln/detail/CVE-2026-116587) | Yes | Yes | Yes | Yes | High (7.5) | | [CVE-2026-89157](https://nvd.nist.gov/vuln/detail/CVE-2026-89157) | Yes | Yes | No | Yes | Medium (7.4) | | [CVE-2026-89158](https://nvd.nist.gov/vuln/detail/CVE-2026-89158) | Yes | Yes | No | Yes | Medium (6.5) | | [CVE-2026-89160](https://nvd.nist.gov/vuln/detail/CVE-2026-89160) | Yes | Yes | No | Yes | Medium (6.5) | | [CVE-2026-89156](https://nvd.nist.gov/vuln/detail/CVE-2026-89156) | Yes | Yes | No | Yes | Medium (5.9) | | [CVE-2026-103111](https://nvd.nist.gov/vuln/detail/CVE-2026-103111) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-109518](https://nvd.nist.gov/vuln/detail/CVE-2026-109518) | Yes | Yes | No | Yes | High (0.0) | | [CVE-2026-86145](https://nvd.nist.gov/vuln/detail/CVE-2026-86145) | Yes | Yes | No | Yes | Medium (0.0) | Announcement **1.30.7-asm.7 is now available for in-cluster Cloud Service Mesh.** For details on upgrading Cloud Service Mesh, see [Upgrade Cloud Service Mesh](https://docs.cloud.google.com/service-mesh/v1.30/docs/upgrade/upgrade.md.txt). Cloud Service Mesh 1.30.7-asm.7 uses Envoy v1.38.10-dev. This release resolves the security vulnerability listed in Security Bulletin [GCP-2026-080](https://cloud.google.com/service-mesh/docs/security-bulletins#gcp-2026-080) ([ISTIO-SECURITY-2026-009](https://istio.io/latest/news/security/istio-security-2026-009/)). Fixed Patch 1.30.7-asm.7 contains the fix for the following platform CVEs: | CVE | Proxy | Control Plane | Distroless | CNI | Severity | |---|---|---|---|---|---| | [CVE-2026-89161](https://nvd.nist.gov/vuln/detail/CVE-2026-89161) | Yes | Yes | No | Yes | Medium (7.8) | | [CVE-2026-89157](https://nvd.nist.gov/vuln/detail/CVE-2026-89157) | Yes | Yes | No | Yes | Medium (7.4) | | [CVE-2026-89158](https://nvd.nist.gov/vuln/detail/CVE-2026-89158) | Yes | Yes | No | Yes | Medium (6.5) | | [CVE-2026-89160](https://nvd.nist.gov/vuln/detail/CVE-2026-89160) | Yes | Yes | No | Yes | Medium (6.5) | | [CVE-2026-89156](https://nvd.nist.gov/vuln/detail/CVE-2026-89156) | Yes | Yes | No | Yes | Medium (5.9) | | [CVE-2026-103111](https://nvd.nist.gov/vuln/detail/CVE-2026-103111) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-109518](https://nvd.nist.gov/vuln/detail/CVE-2026-109518) | Yes | Yes | No | Yes | High (0.0) | | [CVE-2026-86145](https://nvd.nist.gov/vuln/detail/CVE-2026-86145) | Yes | Yes | No | Yes | Medium (0.0) | **Colab Enterprise** Feature Python 3.13 is now available in Colab Enterprise and is the latest Python version. Runtime templates that are configured to use the latest Python version, including default runtime templates, now create runtimes that use Python 3.13. Existing runtimes keep their current Python version. For more information, see [Python versions](https://docs.cloud.google.com/colab/docs/runtimes.md.txt#python). **Compute Engine** Feature **Preview** : To enforce VM extension configurations across multiple projects, you can create and manage global and zonal VM extension policies by using VM Extension Manager at the Google Cloud organization and folder levels. In addition, VM Extension Manager provides read-only `get` and `list` methods that let you view extension policies, supported VM extensions, and the runtime state of installed extensions on each Compute Engine instance. For more information, see the following documentation: - [About VM Extension Manager](https://docs.cloud.google.com/compute/docs/vm-extensions/about-vm-extension-manager.md.txt#hierarchy-scopes) - [Install VM extensions by creating extension policies](https://docs.cloud.google.com/compute/docs/vm-extensions/create-extension-policy.md.txt) - [Manage VM extensions by using extension policies](https://docs.cloud.google.com/compute/docs/vm-extensions/manage-vm-extensions.md.txt) - [View VM extension details and status](https://docs.cloud.google.com/compute/docs/vm-extensions/view-vm-extension-details.md.txt) **Dataform** Feature You can limit how many actions run concurrently within a single [workflow execution](https://docs.cloud.google.com/dataform/docs/trigger-execution#limit-concurrent-actions) or [workflow configuration schedule](https://docs.cloud.google.com/dataform/docs/schedule-runs.md.txt#create-workflow-configuration). This feature is [generally available](https://cloud.google.com/products#product-launch-stages) (GA). **Firestore with MongoDB compatibility** Feature Firestore with MongoDB compatibility offers conversational analytics, which lets you query operational data using natural language. This feature is powered by the [Conversational Analytics API](https://docs.cloud.google.com/gemini/data-agents/conversational-analytics-api/overview.md.txt). This feature is in [Preview](https://cloud.google.com/products#product-launch-stages). For more information, see [Conversational analytics for Firestore with MongoDB compatibility](https://docs.cloud.google.com/gemini/data-agents/conversational-analytics/firestore-mongodb-compatibility.md.txt). **Gemini Enterprise Agent Platform** Feature **Gemini 3.8 Flash regional support in Canada and Japan** [Gemini 3.8 Flash](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/gemini/3-8-flash.md.txt) (`gemini-3.8-flash`) is [generally available (GA)](https://cloud.google.com/products#product-launch-stages) in Canada (`northamerica-northeast1`) and Japan (`asia-northeast1`). On Gemini Enterprise Agent Platform, both regions support regional endpoints, in-region ML processing for data residency, and Provisioned Throughput. For more information, see [Deployments and endpoints](https://docs.cloud.google.com/gemini-enterprise-agent-platform/resources/locations) and [Data residency](https://docs.cloud.google.com/gemini-enterprise-agent-platform/resources/data-residency). Feature **Fast mode for Anthropic Claude models is generally available** [Fast mode](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/partner-models/claude/fast-mode.md.txt) for supported Anthropic Claude models, starting with [Claude Fable 5.2](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/partner-models/claude/fable-5-2.md.txt) (`claude-fable-5-2`), is available in [General Availability (GA)](https://cloud.google.com/products#product-launch-stages). You can set `"speed": "fast"` in online pay-as-you-go prediction requests to accelerate output token generation for latency-sensitive agentic workflows. For more information, see [Fast mode with Anthropic Claude models](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/partner-models/claude/fast-mode.md.txt). Feature **Anthropic's Claude Fable 5.2** [Claude Fable 5.2](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/partner-models/claude/fable-5-2.md.txt) (`claude-fable-5-2`) is available in [General Availability (GA)](https://cloud.google.com/products#product-launch-stages) in Model Garden, including support for [fast mode](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/partner-models/claude/fast-mode.md.txt) (`"speed": "fast"`). Feature **Meta Muse models in Preview** [Muse Wonder from Meta](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/partner-models/meta/muse-wonder-1-0.md.txt) (`meta/muse-wonder-1.0`), [Muse Ember from Meta](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/partner-models/meta/muse-ember-1-0.md.txt) (`meta/muse-ember-1.0`), and [Muse Spark 1.3 from Meta](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/partner-models/meta/muse-spark-1-3.md.txt) (`meta/muse-spark-1.3`) are available in [Preview](https://cloud.google.com/products#product-launch-stages) on the global endpoint through the OpenAI-compatible Responses API. Muse Wonder and Muse Spark 1.3 accept text, image, and PDF inputs, and Muse Ember accepts text and image inputs. All three models support reasoning, function calling, structured output, and a 1M-token context window. For more information, see [Muse models from Meta](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/partner-models/meta.md.txt). **Google Kubernetes Engine** Feature GKE Gateway now supports Server Name Indication (SNI)-based routing with TLS passthrough. You can use TLS protocol-specific rules to route incoming TLS streams from the Gateway to Kubernetes Services based on SNI without terminating TLS at the GKE Gateway load balancer. Application developers can create TLSRoute resources to expose secure TLS traffic to applications that run in the GKE cluster. Creating TLSRoute resources requires the Gateway API version 1.5.0 or later CRDs (Standard channel), which are installed in GKE version 1.35.2-gke.1842000 or later. This feature supports single-cluster and multi-cluster GKE Gateway load balancers by using the following GatewayClass resources: - `gke-l7-rilb` - `gke-l7-regional-external-managed` - `gke-l7-rilb-mc` - `gke-l7-regional-external-managed-mc` - `gke-l7-cross-regional-internal-managed-mc` For more information, see [Deploy a TLS passthrough Gateway](https://docs.cloud.google.com/kubernetes-engine/docs/how-to/deploy-tls-passthrough-gateway.md.txt). Feature Agent Substrate on GKE is now Generally Available (GA) for GKE Standard clusters running version 1.37 or later. Agent Substrate is an infrastructure layer designed for large-scale, high-density AI agent workloads, such as personal assistants and coding agents. Because interactive agents often remain idle while waiting for user input, running them on traditional microservice infrastructure can underutilize CPU and memory resources. Agent Substrate uses a lightweight control plane that bypasses standard Kubernetes Pod scheduling limits to provide fast sandbox provisioning and efficient suspend-and-resume capabilities. For more information, see [About Agent Substrate on GKE](https://docs.cloud.google.com/kubernetes-engine/ai-ml/about-agent-substrate.md.txt). **Managed Service for Apache Spark** Announcement Managed Service for Apache Spark (formerly Google Cloud Serverless for Apache Spark): [Runtime version 4.0](https://docs.cloud.google.com/managed-spark/docs/concepts/versions/spark-runtime-4.0.md.txt) is generally available ([GA](https://cloud.google.com/products#product-launch-stages)). This version includes the following components: - Apache Spark 4.2.0 - BigQuery Connector 0.46.0 - Cloud Storage Connector 4.0.7 - Java 25 - Python 3.13 - Scala 2.13.17 Runtime 4.0 also introduces the following changes: - Batch workloads run in the [premium tier](https://docs.cloud.google.com/managed-spark/docs/tiers.md.txt) and use [Lightning Engine](https://docs.cloud.google.com/managed-spark/docs/guides/lightning-engine-serverless.md.txt) by default. - [Memory shapes](https://docs.cloud.google.com/managed-spark/docs/concepts/versions/spark-runtime-4.0.md.txt#memory-shapes) determine the memory of drivers and executors. The default `highmem` memory shape provides 7.75 GiB of memory per vCPU. - Premium tier workloads that use the default driver configuration are eligible to run the driver on a [fast-startup VM](https://docs.cloud.google.com/managed-spark/docs/concepts/versions/spark-runtime-4.0.md.txt#fast-startup-driver), which reduces startup time. - The [Lakehouse runtime catalog](https://docs.cloud.google.com/managed-spark/docs/guides/create-lakehouse.md.txt#default-catalog) is the default Spark catalog for batch workloads and interactive sessions. - Workloads that don't use GPUs consume the [Data Compute Units quota](https://docs.cloud.google.com/managed-spark/quotas-serverless.md.txt#dataproc-serverless-dcu-quota) instead of Compute Engine CPU and disk quotas. Runtime 4.0 doesn't support some features of earlier runtimes, such as SparkR batches, Jupyter sessions, and the Persistent History Server. For more information, see [Unsupported functionality and behavior changes](https://docs.cloud.google.com/managed-spark/docs/concepts/versions/spark-runtime-4.0.md.txt#unsupported). **Memorystore for Redis** Feature Memorystore for Redis supports the `CLIENT` command and the following subcommands: - `CLIENT` \| `CACHING` - `CLIENT` \| `GETNAME` - `CLIENT` \| `GETREDIR` - `CLIENT` \| `HELP` - `CLIENT` \| `ID` - `CLIENT` \| `INFO` - `CLIENT` \| `KILL` - `CLIENT` \| `LIST` - `CLIENT` \| `NO-TOUCH` - `CLIENT` \| `REPLY` - `CLIENT` \| `SETNAME` - `CLIENT` \| `TRACKING` - `CLIENT` \| `TRACKINGINFO` For more information about the `CLIENT` command and its supported subcommands, see [Supported and blocked commands](https://docs.cloud.google.com/memorystore/docs/redis/supported-commands.md.txt). This feature is [generally available (GA)](https://docs.cloud.google.com/products#product-launch-stages). **SAP on Google Cloud** Announcement **Google Cloud's Agent for SAP version 3.16** Version 3.16 of Google Cloud's Agent for SAP is generally available (GA). This version introduces enhancements for the agent's `configureinstance` command and some framework level updates. For more information, see [What's new with Google Cloud's Agent for SAP](https://docs.cloud.google.com/sap/docs/agent-for-sap/whats-new.md.txt). **Security Command Center** Feature Security Command Center predefined roles are modified. For information about the changes and how to migrate your custom roles, see [Migrating custom roles](https://docs.cloud.google.com/security-command-center/docs/access-control.md.txt#migration-custom-roles). Feature **Preview** : Security Command Center Vulnerability Assessment for Google Cloud helps you detect vulnerabilities and exposed secrets in the container images of your Cloud Run services, jobs, and worker pools with [Vulnerability Assessment for Cloud Run](https://docs.cloud.google.com/run/docs/securing/cloud-run-vulnerability-scanning.md.txt) ([Preview](https://cloud.google.com/products#product-launch-stages)). For more information, see [Enable and use Vulnerability Assessment for Google Cloud](https://docs.cloud.google.com/security-command-center/docs/vulnerability-assessment-google-cloud.md.txt). **Virtual Private Cloud** Feature **General Availability** : You can create an internal range with the `INTERNAL_ADDRESS` purpose to allocate global internal IPv4 addresses for [Private Service Connect endpoints that access global Google APIs](https://docs.cloud.google.com/vpc/docs/about-accessing-google-apis-endpoints). For more information, see [Internal ranges for Private Service Connect endpoints](https://docs.cloud.google.com/vpc/docs/internal-ranges#reserve-for-endpoints). ## November 08, 2026 **Cloud Asset Inventory** Feature The following resource type is publicly available through the [SearchAllResources](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/searchAllResources.md.txt) and [SearchAllIamPolicies](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/searchAllIamPolicies.md.txt) APIs. - Gemini for Google Cloud - `cloudaicompanion.googleapis.com/Topic` **Google Cloud Marketplace Partners** Feature You can now create reseller private offer plans to amend existing public orders and existing private offers created through the [private offer flow](https://docs.cloud.google.com/marketplace/docs/partners/offers.md.txt). For more information, see [reseller private offer plans](https://docs.cloud.google.com/marketplace/docs/partners/resell/reseller-private-offer-plans.md.txt). **Google SecOps** Feature **Operations in Emerging Threats Center General Availability** The **Operations** feature in the **Emerging Threats Center** feed is now in General Availability (GA). For more information see, [Operations in Emerging Threats Center](https://docs.cloud.google.com/chronicle/docs/secops/release-notes.md.txt#August_24_2026). **Google SecOps SOAR** Announcement Release 6.3.106 is being rolled out to the first phase of regions as listed [here](https://docs.cloud.google.com/chronicle/docs/soar/overview-and-introduction/soar-gradual-release.md.txt). Feature **Case activity tagging** You can now use custom tags for individual activities, comments, tasks, and actions on the Case Wall, and filter the wall view by those tags. This allows you to categorize specific observations and filter the timeline to view only the entries relevant to your investigation or team. For more information, see [Add a tag to a Case Wall activity](https://docs.cloud.google.com/chronicle/docs/soar/investigate/working-with-cases/define-tags-in-cases-admin.md.txt#add-activity-tag). ## November 07, 2026 **Google SecOps SOAR** Announcement [Release 6.3.105](https://docs.cloud.google.com/chronicle/docs/soar/release-notes.md.txt#November_01_2026) is now available for all regions. ## November 06, 2026 **Agent Registry** Feature Skill security scanning and governance in Agent Registry are available. You can automatically scan standalone skill revisions for security issues, review `Finding` resources, enforce scanning policies across your organization using custom Organization Policy constraints, and grant least-privilege skill management access. For more information, see [Scan skills for security issues](https://docs.cloud.google.com/agent-registry/scan-skills.md.txt) and [Agent Registry roles and permissions](https://docs.cloud.google.com/agent-registry/roles-permissions.md.txt). Feature Standalone skills in Agent Registry are [generally available (GA)](https://cloud.google.com/products#product-launch-stages). You can register, version, search, and govern standalone `Skill` resources, immutable `SkillRevision` packages, and verified `Publisher` details. For more information, see [Skills architecture](https://docs.cloud.google.com/agent-registry/skills-architecture.md.txt), [Register skills](https://docs.cloud.google.com/agent-registry/register-skills.md.txt), and [Manage skills](https://docs.cloud.google.com/agent-registry/manage-skills.md.txt). **AlloyDB for PostgreSQL** Feature Blocked query analysis in AlloyDB for PostgreSQL is [generally available (GA)](https://cloud.google.com/products#product-launch-stages). This feature lets you identify active queries that hold locks and the dependent queries that are blocked by them so that you can terminate the root blockers. For more information, see [Blocked query analysis](https://docs.cloud.google.com/alloydb/docs/monitor-active-queries.md.txt#blocked-query-analysis). **Assured Open Source Software** Feature The Assured Open Source Software Premium tier supports [Google Cloud regions and multi-regions](https://docs.cloud.google.com/security-command-center/docs/integrate-aoss-with-scc#supported-regions) for remote (or proxy) Artifact Registry repositories. For the list of supported regions, see [Supported regions](https://docs.cloud.google.com/security-command-center/docs/integrate-aoss-with-scc#supported-regions). **BigQuery** Announcement You can now use [BigQuery Graph](https://docs.cloud.google.com/bigquery/docs/graph-overview.md.txt) and run Graph Query Language (GQL) queries when you use on-demand pricing. Breaking Starting January 31, 2027, the [BigQuery Data Transfer Service for Shopify connector](https://docs.cloud.google.com/bigquery/docs/shopify-transfer) will no longer support the following fields: - The `legacyMode` field from the `DeliveryProfile` dataset schema - The `permitSkuSharing` field from the `FulfillmentService` dataset schema For more information, see [January 31, 2027](https://docs.cloud.google.com/bigquery/docs/transfer-changes.md.txt#Jan31-shopify). Feature You can now use a [custom organization policy](https://docs.cloud.google.com/bigquery/docs/custom-constraints.md.txt) to allow or deny specific operations on models in BigQuery. This feature is in [preview](https://cloud.google.com/products/#product-launch-stages). **Bigtable** Feature You can [configure a Bigtable automated backup policy](https://docs.cloud.google.com/bigtable/docs/managing-backups.md.txt#configure-hot-automated-backups) on SSD instances to create daily [hot backups](https://docs.cloud.google.com/bigtable/docs/backups.md.txt#hot-backups) and specify how long the backups remain hot before automatically transitioning to standard backups. This feature is [generally available (GA)](https://cloud.google.com/products#product-launch-stages). **Cloud Asset Inventory** Feature The following resource type is publicly available through the [SearchAllResources](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/searchAllResources.md.txt) and [SearchAllIamPolicies](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/searchAllIamPolicies.md.txt) APIs. - Cloud Key Management Service - `cloudkms.googleapis.com/KajPolicyConfig` **Cloud Load Balancing** Feature Frontend configuration for load balancing incoming IPv6 traffic is now generally available (GA) for the following load balancers: - Regional external Application Load Balancer - Regional external proxy Network Load Balancer - Regional internal Application Load Balancer - Regional internal proxy Network Load Balancer - Cross-region internal Application Load Balancer - Cross-region internal proxy Network Load Balancer To support client IPv6 traffic, you can configure the proxy-only subnet with a stack type of either `IPV4_ONLY` or `IPV4_IPV6` (dual-stack). For more information, see the following documentation: - [Forwarding rules overview](https://docs.cloud.google.com/load-balancing/docs/forwarding-rule-concepts.md.txt) - [IPv6 for Application Load Balancers and proxy Network Load Balancers](https://docs.cloud.google.com/load-balancing/docs/ipv6.md.txt) - [Convert Application Load Balancer to IPv6](https://docs.cloud.google.com/load-balancing/docs/https/convert-applb-dualstack.md.txt) - [Convert Proxy Network Load Balancer to IPv6](https://docs.cloud.google.com/load-balancing/docs/tcp/convert-proxynetlb-dualstack.md.txt) - [Proxy-only subnets for Envoy-based load balancers](https://docs.cloud.google.com/load-balancing/docs/proxy-only-subnets.md.txt#proxy_only_subnet_create) **Cloud Trace** Feature You can reprovision an existing `_Trace` bucket to satisfy regulatory requirements for data residency and encryption. After reprovisioning, the storage location and encryption configuration of the `_Trace` bucket match your default settings for observability buckets. Reprovisioning is a destructive operation. This feature is [generally available](https://cloud.google.com/products#product-launch-stages). For more information, see [Remediate data residency and CMEK requirements](https://docs.cloud.google.com/stackdriver/docs/observability/reprovision-observability-bucket.md.txt). **Config Controller** Change Config Controller now uses the following versions of its included products: - Config Connector v1.159.0, [release notes](https://docs.cloud.google.com/config-connector/docs/release-notes.md.txt#October_13_2026) **Container Optimized OS** Change ### cos-125-19216-801-14 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.12.114](https://cos.googlesource.com/third_party/kernel/+/1dcdbc3f0dcd16137863cab1347dee8c604b87c0) | v27.5.1 | v2.2.7 | [See List](https://storage.googleapis.com/cos-tools/19216.801.14/lakitu/gpu_driver_versions.textproto) | Announcement This is an [LTS Refresh release.](https://docs.cloud.google.com/container-optimized-os/docs/concepts/versioning.md.txt#lts_refresh_releases) Feature Added RTC support in A4X-Max images. Feature Enabled PCI peer to peer direct memory access for 64k kernels. Fixed Fixed a 60 second outage after an idpf function reset on IPU E2100 caused by misreading PFGEN_RSTAT. Fixed Updated cos-gpu-installer to v2.7.12. It installs ucodes firmwares for r615 and newer GPU driver versions. Fixed Upgraded app-arch/gzip to v1.15. Fixed Upgraded app-containers/docker-credential-helpers to v0.9.12. Fixed Upgraded app-misc/ca-certificates to v20260816.3.131.1. Fixed Upgraded dev-db/sqlite to v3.54.1. Fixed Upgraded dev-libs/nss to v3.132. Fixed Upgraded sys-apps/less to v710. Fixed Upgraded sys-libs/timezone-data to v2026f. Security Fixed CVE-2025-31133 in cri-tools. Security Fixed CVE-2025-52565 in docker. Security Fixed CVE-2025-52881 in cri-tools. Security Fixed CVE-2026-116587 in google-osconfig-agent. Security Fixed CVE-2026-32285 in cni-plugins. Security Fixed CVE-2026-32285 in cri-tools. Security Fixed CVE-2026-63209 in containerd. Security Fixed CVE-2026-63209 in node-problem-detector. Security Fixed CVE-2026-63209, CVE-2026-39883, CVE-2024-25621 in google-osconfig-agent. Security Fixed CVE-2026-84304 in containerd. Security Fixed CVE-2026-84304 in docker. Security Fixed CVE-2026-84304 in google-guest-agent. Security Fixed CVE-2026-84304, CVE-2026-29181 in node-problem-detector. Security Fixed CVE-2026-84445, CVE-2026-116587 in cos-extensions. Security Fixed CVE-2026-84445, CVE-2026-63209 in docker. Security Updated curl to v8.22.0. This resolves CVE-2026-18924, CVE-2026-13608, CVE-2026-80229, CVE-2026-80255 and CVE-2026-19931. Security Updated libpcre2 to v10.49. This resolves CVE-2026-86145 and CVE-2026-103111. Security Updated pyjwt to v2.14.0. This resolves CVE-2026-102266, CVE-2026-102267, CVE-2026-102268 and CVE-2026-102271. Change ### cos-129-19506-625-14 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.12.114](https://cos.googlesource.com/third_party/kernel/+/1bac64d736f17f5ed23cbcb8ec3f6edf39ccab9a) | v27.5.1 | v2.2.7 | [See List](https://storage.googleapis.com/cos-tools/19506.625.14/lakitu/gpu_driver_versions.textproto) | Announcement This is an [LTS Refresh release.](https://docs.cloud.google.com/container-optimized-os/docs/concepts/versioning.md.txt#lts_refresh_releases) Change Upgraded sys-apps/casfs to v0.1.24. Feature Added RTC support in A4X-Max images. Feature Enabled PCI peer to peer direct memory access for 64k kernels. Fixed Fixed a 60 second outage after an idpf function reset on IPU E2100 caused by misreading PFGEN_RSTAT. Fixed Updated cos-gpu-installer to v2.7.12. It installs ucodes firmwares for r615 and newer GPU driver versions. Security Fixed CVE-2024-41110 in cri-tools. Security Fixed CVE-2026-116587 in guest-agent. Security Fixed CVE-2026-29181, CVE-2025-31133, CVE-2024-25621 in docker. Security Fixed CVE-2026-32285, CVE-2026-84304 in cni-plugins. Security Fixed CVE-2026-34986 in guest-agent. Security Fixed CVE-2026-35469 in cri-tools. Security Fixed CVE-2026-39883 in cos-extensions. Security Fixed CVE-2026-39883 in docker. Security Fixed CVE-2026-45022, CVE-2026-24051, CVE-2026-53488 in google-osconfig-agent. Security Fixed CVE-2026-63209 in containerd. Security Fixed CVE-2026-63209 in node-problem-detector. Security Fixed CVE-2026-63209, CVE-2025-65637 in google-osconfig-agent. Security Fixed CVE-2026-84304 in containerd. Security Fixed CVE-2026-84304 in docker. Security Fixed CVE-2026-84304 in kubernetes. Security Fixed CVE-2026-84304, CVE-2026-29181 in node-problem-detector. Security Fixed CVE-2026-84304, CVE-2026-32285 in cri-tools. Security Fixed CVE-2026-84445 in google-guest-agent. Security Fixed CVE-2026-84445 in google-osconfig-agent. Security Fixed CVE-2026-84445 in guest-agent. Security Updated curl to v8.22.0. This resolves CVE-2026-18924, CVE-2026-13608, CVE-2026-80229, CVE-2026-80255 and CVE-2026-19931. Security Updated libpcre2 to v10.49. This resolves CVE-2026-86145 and CVE-2026-103111. Security Updated pyjwt to v2.14.0. This resolves CVE-2026-102266, CVE-2026-102267, CVE-2026-102268 and CVE-2026-102271. **Firestore with MongoDB compatibility** Feature Support for the [`drop()` command](https://docs.cloud.google.com/firestore/mongodb-compatibility/docs/bulk-delete.md.txt) is generally available ([GA](https://cloud.google.com/products#product-launch-stages)). **Gemini Enterprise** Announcement **Gemini Enterprise: End of Gemini Code Assist entitlement for existing subscriptions** Bundled Gemini Code Assist entitlements for existing Gemini Enterprise Standard and Gemini Enterprise Plus subscriptions will end on March 31, 2027. After this date, the entitlement will be removed from existing subscriptions. Support for Gemini Code Assist until March 31, 2027 is limited to the Gemini 3.x model family only. Effective October 9, 2026, new Gemini Enterprise subscriptions no longer include an entitlement to Gemini Code Assist. To transition your developer workflows, agentic coding assistance is available through Google Antigravity, which is included in Gemini Enterprise editions. For more information, see the [Gemini Code Assist sunset page](https://docs.cloud.google.com/gemini/docs/codeassist/sunset). Feature **Gemini Enterprise: Video generation upgrades to Omni 1.2 Flash** [Gemini Omni 1.2 Flash](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/gemini/omni-1-2-flash) is generally available (GA) and replaces Veo 3.1 for video generation in the `global` region. Omni 1.2 Flash improves clarity and instruction following. To use video generation, an administrator must turn on the **Enable video generation** setting. For more information, see: - [Generate a video](https://docs.cloud.google.com/gemini/enterprise/docs/assistant-analyze.md.txt#generate_a_video) - [Manage web app features](https://docs.cloud.google.com/gemini/enterprise/docs/manage-web-app-features.md.txt) - [Gemini Enterprise limitations](https://docs.cloud.google.com/gemini/enterprise/docs/locations.md.txt#product-limitations) Breaking **Gemini Notebook Enterprise: Updated web addresses** The URL path for the Gemini Notebook Enterprise web app is changing in two ways. In both cases, existing links redirect automatically. **"go/" added** : Starting immediately, `go/` is being added to the URL path: - For Gemini Notebook Enterprise, `notebooklm.cloud.google.com/us/` changes to `notebooklm.cloud.google.com/go/us/`. - For Gemini Notebook within Gemini Enterprise, `vertexaisearch.cloud.google.com/notebooklm/global/` changes to `vertexaisearch.cloud.google.com/notebooklm/go/global/`. The dates for this `go/` path change are as follows: | Region | Rollout date | |---|---| | `global` and `us` | Live | | `eu` | Rolling out | | All other locations | Starting November 9, 2026 | **"lm" removed** : Starting November 16, 2026, `lm` is being removed from the hostname: - For Gemini Notebook Enterprise authenticated with [Google Identity](https://docs.cloud.google.com/gemini/enterprise/docs/configure-identity-provider.md.txt#choose_your_identity_provider_type), `notebooklm.cloud.google.com` changes to `notebook.cloud.google.com`. - For Gemini Notebook Enterprise authenticated with Workforce Identity Federation, `notebooklm.cloud.google` changes to `notebook.cloud.google`. **Action is required**: if your organization uses a firewall, proxy, or secure web gateway that allows access to Gemini Notebook by a specific URL path. If this applies to you, Google recommends that you add the following URLs to your allowlist: 1. Allowlist `notebooklm.cloud.google.com/*` and `notebook.cloud.google.com/*` 2. If you use Workforce Identity Federation, allowlist `notebooklm.cloud.google/*` and `notebook.cloud.google/*` 3. If you use Gemini Notebook within Gemini Enterprise, allowlist `vertexaisearch.cloud.google.com/notebooklm/*`. Google recommends allowing entire domains (`/*`) so that future path changes don't require additional updates. If you don't allow `/*`, you must allow both `/REGION` and `/go/REGION`, where `REGION` is your location value: `global`, `us`, `eu`, `asia-northeast1`, `au`, `ca`, `de`, `europe-west2`, `in`, `kr`, or `sg`. For example, `notebooklm.cloud.google.com/us/` and `notebooklm.cloud.google.com/go/us/` **Temporary workaround** : If your firewall blocks users before you update your allowlist, users themselves can access the original URLs by removing `/go` from the URL and adding `version=legacy`. For example: `notebooklm.cloud.google.com/eu/?project=1234567&version=legacy`. This fix will fail when Google sunsets the legacy version. Feature **Gemini Enterprise: Adobe data store (Preview)** The [Adobe](https://docs.cloud.google.com/gemini/enterprise/docs/connectors/adobe.md.txt) data store is available in Public Preview in Gemini Enterprise. You can use natural language to search, share, and manage your Adobe Creative Cloud assets, customize Adobe Express templates, apply Lightroom presets, and edit images. For more information, see [Connect a third-party data source](https://docs.cloud.google.com/gemini/enterprise/docs/connectors/connect-third-party-data-source.md.txt). Feature **Gemini Enterprise: Model availability respects resource location policies** If the resource locations organization policy for your project doesn't allow the `global` location, Gemini Enterprise administrators can't turn on Gemini models that aren't supported in the app's location, because traffic for these models is routed to the `global` endpoint. In the Google Cloud console, the toggles for these models are unavailable. If one of these models is already turned on, a warning appears under its toggle so that administrators can turn it off. For more information, see: - [Turn on or turn off a Gemini model](https://docs.cloud.google.com/gemini/enterprise/docs/manage-web-app-features#turn-on-gemini-model) - [Data residency for Gemini Enterprise](https://docs.cloud.google.com/gemini/enterprise/docs/locations.md.txt) **Gemini Enterprise Agent Platform** Feature **Dedicated Memory Bank functionality in the Google Cloud console** You can create, configure, and inspect Agent Platform Memory Bank instances from the dedicated **Memory Bank** page in the Google Cloud console, with updated memory management controls for deployed agents in Agent Runtime: - **Memory Bank list and creation** : View and manage standalone memory banks on the **Memory Bank** page (separate from deployed agents on the **Deployments** page), edit basic information or labels, delete instances, and click **Create memory bank** to create an instance with default memory settings and Google-managed or Cloud KMS encryption. - **Memories inspection and filtering** : On the **Memories** tab, switch between **Unstructured** and **Structured** views, filter memories by `key:value` scope pairs or scope chips, edit or delete unstructured memories, inspect structured memory profiles and underlying facts in the **Memory details** panel, and select **View revisions** to inspect revision history. - **Instance and schema configuration** : On the **Configuration** tab, view and edit **Details** , **Generation** (memory extraction toggle, perspective, and managed or custom topics), **Retrieval** (embedding model, configurable before you store the first memory), and **Retention** (expiration and revision history TTL), or click **Schemas** to add and edit profile schemas. - **Agent integration snippets** : Click **Link to an agent** to get installation commands and prefilled Python code (populated with your project, region, and memory bank ID) for connecting with Agent Development Kit (ADK) or retrieving memories. - **Agent Runtime memory updates** : On the **Deployments** page, deployed agents include `key:value` scope filtering and **View revisions** on the **Memories** tab, along with **Generation** , **Retrieval** , and **Retention** configuration controls under **Service configuration** in the **Memory bank** section. For more information, see [Set up Memory Bank](https://docs.cloud.google.com/gemini-enterprise-agent-platform/scale/memory-bank/setup), [Fetch memories](https://docs.cloud.google.com/gemini-enterprise-agent-platform/scale/memory-bank/fetch-memories), [Memory Profiles](https://docs.cloud.google.com/gemini-enterprise-agent-platform/scale/memory-bank/profiles), and [Memory revisions](https://docs.cloud.google.com/gemini-enterprise-agent-platform/scale/memory-bank/revisions). **Google Cloud Contact Center as a Service** Announcement **Google Cloud CCaaS 6.32** We've released version 6.32 of Google Cloud CCaaS. The timing of the update to your instance depends on the deployment schedule that you have chosen. For more information, see [Deployment schedules](https://docs.cloud.google.com/contact-center/ccai-platform/docs/deployment-schedules). Fixed This release addresses the following issues: - Fixed an issue where abandoned queue records incorrectly calculated wait times from the call's initial queue entry rather than the time the caller entered the specific queue they abandoned from. - Fixed an issue where the call adapter header title on **SmartActions** and virtual task assistant screens was truncated with an ellipsis, preventing users from viewing the full text. - Fixed an issue where the agent adapter froze on **Calling** and didn't dial the customer during recovery calls following an unanswered in-app call. - Fixed an issue where inbound calls became unroutable and remained stuck in the queue until abandoned if an agent's browser delivered a delayed connection request after a timeout. - Fixed an issue in the CCaaS portal where active Spanish IVR queues were incorrectly displayed as **Setup is required** and grayed out when switching languages from English to Spanish. - Fixed an issue where transient network errors during platform validation incorrectly marked virtual agent credentials as invalid. - Fixed an issue where SMS and WhatsApp virtual agent chats became unresponsive and didn't escalate to a human agent when encountering a custom payload validation error. - Fixed an issue where campaigns didn't resume after being paused, resulting in repeated call session failures and missing participant information. - Fixed an issue where call-related actions such as disconnecting or updating status took up to 72 seconds to complete. - Fixed an issue where a **Not Found** banner incorrectly appeared in the call adapter when a phone number couldn't be matched in the CRM. - Fixed an issue where the **In-email** status bar in the agent desktop appeared white. - Fixed an issue where agents in the **In-email** status couldn't change their status directly from the status bar. - Fixed an issue where the first letter of uppercase acronym field names was incorrectly lowercased in virtual task assistant input placeholders. - Fixed an issue where agents were incorrectly set to an **Unresponsive** status instead of receiving a missed call when a new deltacast offer arrived while the call adapter was already ringing. - Fixed an issue where agents became stuck in a projected state and stopped receiving calls after a caller abandoned the call at the moment of routing. - Fixed an issue where transient carrier timeouts during outbound callbacks were incorrectly classified as invalid numbers. - Fixed an issue where forced virtual agent callbacks booked through the Apps API were incorrectly routed to the original call's queue instead of the requested destination. - Fixed an issue where scheduled callback capacity was under-calculated due to a mathematical rounding error. - Fixed an issue where inbound calls were prematurely disconnected if the initial connection request timed out and was retried. - Fixed an issue where valid Canadian phone numbers using newer area codes were rejected by the Callback call API. - Fixed an issue where certain agents were missing from the directory during outbound calls, preventing other agents from transferring calls or adding them to a call. - Fixed an issue where dynamic queues incorrectly offered a minimum of one slot even when WFM staffing was zero or resulted in less than one available slot. - Fixed an issue where Dynamic Agent Availability queues were saved without a required custom queue identifier, causing workforce management synchronization to fail silently. - Fixed an issue where Salesforce cases and contacts were incorrectly created for voice calls handled entirely by a virtual agent, even when the **Create CRM records for calls attended by Virtual Agents** setting was disabled. - Fixed an issue where voice transfers addressed to a specific agent were never offered to the target and didn't expire, leaving callers on hold indefinitely. - Fixed an issue where NICE WFM session data exports didn't generate for instances with subdomains exceeding 20 characters. - Fixed an issue where virtual callbacks routed through external Dynamic Contact Routing (DCR) were missing captured virtual agent custom parameters, causing routing engines to lose the caller's intent. - Fixed an issue where Agent Assist transcriptions permanently stopped following transient network or quota errors. - Fixed an issue where outbound phone number restriction rules weren't applied to agents with the **Allow unrestricted international calling** setting enabled. **Looker** Announcement **Looker 26.24** will roll out to Looker (original) instances on the following schedule: - Expected deployment start: **Sunday, November 8, 2026** - Expected final deployment and download available: **Tuesday, December 8, 2026** Looker 26.24 is expected to include the following changes, features, and fixes. The Looker 26.24 rollout for Looker (Google Cloud core) will be announced separately. Fixed An issue has been fixed where custom tooltips in KPI visualizations didn't apply the visualization's **Value Format** and **Comparison Value Format** settings. This feature now performs as expected. Fixed An issue has been fixed where custom tooltips in KPI visualizations didn't respect the configured left, center, or right alignment setting. This feature now performs as expected. Fixed An issue has been fixed where the custom tooltip editor prevented the saving of and rejected comparison Liquid variables (`comparison_value`, `comparison_rendered_value`, `comparison.value`, and `comparison.rendered`) for KPI visualizations. This feature now performs as expected. Fixed An issue has been fixed where expanding a long tile note on a KPI visualization could cause the note to overlap the KPI value, comparison, and sparkline. Long expanded notes now scroll within half of the tile. Fixed An issue has been fixed where scheduled deliveries to Google Sheets created duplicate spreadsheets instead of overwriting existing spreadsheets when filenames contained spaces, and scheduled deliveries to Google Drive replaced spaces in filenames with underscores. This feature now performs as expected. Fixed An issue has been fixed where scheduled deliveries could fail if the schedule owner had Development Mode enabled and lacked `develop` permission on the schedule's model. This feature now performs as expected. Fixed An issue has been fixed where screen readers didn't announce the filter name or label for Yes/No filters and group filter controls on dashboards. This feature now performs as expected. Fixed An issue has been fixed where switching a database connection from default credentials to OAuth authentication could retain stale configuration fields and cause connection failures. Connections that were switched to OAuth before this update must be re-saved once on the **Admin \> Connections** page to clear stale persistent derived table (PDT) overrides. Fixed An issue has been fixed where Databricks OAuth refresh tokens were treated as expired after seven days on the client side even when a longer token lifetime was configured in Databricks. This feature now performs as expected. Fixed An issue has been fixed where creating a visual modeling canvas on a project-scoped connection failed unless advanced connection governance was enabled. This feature now performs as expected. Fixed An issue has been fixed where updating roles for an Admin user who used the API could fail with an error. This feature now performs as expected. Fixed An issue has been fixed where passing malformed dashboard filter attributes to the `dashboard_filters` API endpoints could cause an `HTTP 500` error instead of returning an `HTTP 422 Unprocessable Entity` response. This feature now performs as expected. Fixed An issue has been fixed where model set matching treated underscores in model names as wildcards, which could grant self-service access to connections that were linked to similarly named models. This feature now performs as expected. Fixed An issue has been fixed where dashboard tag list filters and their drop-down menus resized horizontally when multiple values were selected. This feature now performs as expected. Fixed An issue has been fixed where the `GET` `/auth` endpoint returned an `HTTP 500 Internal Server Error` instead of an `HTTP 400 Bad Request` response when the endpoint received a malformed `redirect_uri` parameter. This feature now performs as expected. Fixed An issue has been fixed where the data upload file picker could fail to accept XLS files. This feature now performs as expected. Fixed An issue has been fixed where sending a `POST /api/token` request without a `Content-Type` header resulted in an `HTTP 500` error. This feature now performs as expected. Fixed An issue has been fixed where multi-select filter drop-down menus could immediately reopen after being closed. This feature now performs as expected. Fixed An issue has been fixed where **Show Percent of Previous** arrows and labels overlapped bars instead of appearing between them on column charts that use the Modern visualization theme, custom **Group Spacing** settings, or unevenly spaced dates. This feature now performs as expected. Fixed Time zone settings have been updated so that scheduled job triggers and table calculation time zone evaluations reflect recent regional daylight saving time (DST) changes. Fixed An issue has been fixed where a non-admin user could delete another user's undeployed development project through the API. This feature now performs as expected. Fixed An issue has been fixed where Sankey charts that were created with **Chart Config Override** could fail with errors such as `requires exactly two dimensions` or `cyclical data is not supported`. This feature now performs as expected. Fixed An issue has been fixed where favoriting or unfavoriting a dashboard or Look updated its last-accessed timestamp and erroneously removed the item from the **Unused Content** list. This feature now performs as expected. Fixed An issue has been fixed where screen readers didn't announce individual data points on charts with 200 or more data points per series. This feature now performs as expected. Fixed An issue has been fixed where updating legacy Marketplace plugins could fail with a timeout error on instances with large Git repositories. This feature now performs as expected. Fixed An issue has been fixed where switching **Series Positioning** from **Stacked** to **Overlay** or **Grouped** on an area, a column, or a bar chart didn't update the chart rendering. This feature now performs as expected. Fixed An issue has been fixed where scheduled deliveries to Slack, Google Drive, Cloud Storage, Microsoft Azure, and Dropbox could deliver corrupted single-column dashboard PDF files and unformatted Workflow Agent HTML files. This feature now performs as expected. Fixed Roles in the identity provider (IdP) group role mapping drop-down menu are now sorted alphabetically and searchable on the SAML and OIDC configuration pages. Fixed An issue has been fixed where hyperlink tooltips inside dashboard tile notes couldn't be clicked. This feature now performs as expected. Fixed An issue has been fixed where numeric parameter filters without an `allowed_values` property were misclassified as tier filters in the dashboard filter editor, which exposed invalid operator options and cleared default values. This feature now performs as expected. Fixed An issue has been fixed in the System Activity **Conversational Analytics** dashboard where the **Conversations by Type** and **Weekly Conversations** tiles incorrectly counted workflow agent runs as dashboard conversations. This feature now performs as expected. Fixed An issue has been fixed where editing a Conversational Analytics agent could overwrite its **Code Interpreter** setting, fail to immediately update active conversations, or allow **Code Interpreter** to remain active when disabled at the instance level. This feature now performs as expected. Fixed An issue has been fixed in the System Activity **Conversational Analytics** dashboard where filtering by the **Agent** filter on the **Engagement** tab returned no results for agents on user-defined dashboards. This feature now performs as expected. Fixed In the System Activity **Conversational Analytics** dashboard, the **Top Agents** and **Agents Not Used in Last 30 Days** tiles on the **Engagement** tab now display the agent name alongside the Agent ID. Fixed An issue has been fixed in the System Activity **Conversational Analytics** dashboard where clicking a dashboard Agent ID on the **Engagement** tab linked to a nonexistent standalone agent page (returning an `HTTP 404` error) instead of the parent dashboard. This feature now performs as expected. Feature The [filters as tiles](https://docs.cloud.google.com/looker/docs/filters-user-defined-dashboards.md.txt#filters_as_tiles) feature is now generally available. **Managed Service for Apache Airflow** Announcement A new Managed Service for Apache Airflow release has started on **November 06, 2026**. Get ready for upcoming changes and features as we roll out the new release to all regions. This release is in progress at the moment. Listed changes and features might not be available in some regions yet. Feature *(Available without upgrading)* Managed Airflow now supports [setting Custom Organization Policy constraints](https://docs.cloud.google.com/composer/docs/composer-3/create-custom-constraints.md.txt) on Airflow configuration overrides and web server network access controls. You can define policies on the following fields of the `composer.googleapis.com/Environment` resource: - `resource.config.softwareConfig.airflowConfigOverrides` - `resource.config.webServerNetworkAccessControl.allowedIpRanges.description` - `resource.config.webServerNetworkAccessControl.allowedIpRanges.value` Feature [Upgrade rollbacks](https://docs.cloud.google.com/composer/docs/composer-3/upgrade-environments.md.txt#rollback) are available in Managed Airflow (Gen 3). You can roll back an environment upgrade if you encounter degraded performance, Airflow bugs, or compatibility issues with your DAGs, plugins, or dependencies. This feature is now available in all regions supported by Managed Airflow. The feature was announced previously and has finished gradually rolling out. Feature [Database retention](https://docs.cloud.google.com/composer/docs/composer-3/configure-db-retention.md.txt) in Managed Airflow (Gen 3) now includes new Airflow 3 metadata tables, and updated retention logs to report the exact number of removed rows. This feature is now available in all regions supported by Managed Airflow. The feature was announced previously and has finished gradually rolling out. Fixed Startup failure logs for Airflow workloads in Managed Airflow (Gen 3) now include entries for KubernetesPodOperator and KubernetesExecutor workloads. This update extends the [previous change](https://docs.cloud.google.com/composer/docs/release-notes.md.txt?e=48754805#October_13_2026). The fix will gradually roll out to all Managed Airflow Gen 3 environments. You can upgrade your environment to receive this update immediately. Fixed Fixed an issue where DAG file processor crashes caused the `composer.googleapis.com/environment/dag_processing/parse_error_count` metric to stop returning data. Fixed *(Available without upgrading)* Fixed an issue where DAG details (description, schedule, and start date) were missing, and task listings failed. This issue occurred in environments where the `[core]compress_serialized_dags` Airflow configuration option was set to `True`. Fixed Fixed an issue where saving and loading snapshots failed in Managed Airflow (Gen 3) environments that had a large number of custom PyPI packages installed. Change The `apache-airflow-providers-cncf-kubernetes` package was [upgraded to version 10.25.0](https://airflow.apache.org/docs/apache-airflow-providers-cncf-kubernetes/stable/changelog.html). For changes in other packages, see the [preinstalled packages changelog](https://cloud.google.com/composer/docs/versions-packages). Change New [Airflow builds](https://docs.cloud.google.com/composer/docs/composer-versions.md.txt#images-composer-3) are available in Managed Airflow (Gen 3): - [composer-3-airflow-3.3.1-build.6](https://docs.cloud.google.com/composer/docs/versions-packages.md.txt#composer-3-airflow-3-3-1-build-6) - [composer-3-airflow-3.2.2-build.10](https://docs.cloud.google.com/composer/docs/versions-packages.md.txt#composer-3-airflow-3-2-2-build-10) - [composer-3-airflow-2.11.1-build.23](https://docs.cloud.google.com/composer/docs/versions-packages.md.txt#composer-3-airflow-2-11-1-build-23) (default) Change New [images](https://docs.cloud.google.com/composer/docs/composer-versions.md.txt#images-composer-2) are available in Managed Airflow (Gen 2): - [composer-2.17.17-airflow-2.11.1](https://docs.cloud.google.com/composer/docs/versions-packages.md.txt#composer-2-17-17-airflow-2-11-1) (default) Deprecated The following Managed Airflow versions and builds have reached their [end of support period](https://docs.cloud.google.com/composer/docs/composer-versioning-overview.md.txt#version-deprecation-and-support): composer-3-airflow-2.9.3-build.39, composer-3-airflow-2.9.3-build.38, composer-3-airflow-2.9.3-build.37, composer-3-airflow-2.10.5-build.19, composer-3-airflow-2.10.5-build.18, composer-3-airflow-2.10.5-build.17, composer-2.15.3-airflow-2.9.3, composer-2.15.3-airflow-2.10.5, composer-2.15.2-airflow-2.9.3, composer-2.15.2-airflow-2.10.5, composer-2.15.1-airflow-2.9.3, composer-2.15.1-airflow-2.10.5, composer-2.15.0-airflow-2.9.3, composer-2.15.0-airflow-2.10.5. **VPC Service Controls** Feature **VPC Service Controls feature:** Quota enforcement and observability for VPC Service Controls and Access Context Manager are integrated with Cloud Quotas and [generally available](https://cloud.google.com/products#product-launch-stages). Organization administrators can view quota usage and system limits for perimeters, protected resources, access levels, and scoped access policies directly in the Google Cloud console or through the Cloud Quotas API. For more information, see [Quotas and limits](https://docs.cloud.google.com/vpc-service-controls/quotas.md.txt). ## November 05, 2026 **Apigee Edge for Public Cloud** Announcement **Scheduled maintenance of Management/Control Plane for the Apigee Edge for Public Cloud on November 6, 2026.** Scheduled maintenance of Management/Control Plane for the Apigee Edge for Public Cloud production will take place on Friday, November 6, 2026, from 9:00 PM PT to 10:00 PM PT (Saturday, November 7, 2026, from 5:00 AM UTC to 6:00 AM UTC). This maintenance follows the monthly maintenance window schedule documented in the [Apigee Edge release notes archive](https://docs.apigee.com/release/notes/apigee-release-notes). During the scheduled maintenance window, the following services will be temporarily unavailable, and attempts to access them will return a `4xx` status code: - Management Services UI - Management Services APIs - Monetization Management APIs - New proxy deployments - DevPortal Service - Microgateway Services - Edge Query (Analytics Stats APIs) Runtime API calls to deployed API proxies are unaffected. While access to analytics queries may be temporarily unavailable during the maintenance window, all analytics and metrics data from this period will be available once maintenance ends. **Apigee hybrid** Announcement ### v1.14.10 On November 5, 2026 we released an updated version of the Apigee hybrid software, v1.14.10. - For information about upgrading, see [Upgrading Apigee hybrid to v1.14.10](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/upgrade.md.txt). - For information about new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/big-picture.md.txt). > [!NOTE] > **Note:** This is a patch release. The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch by using the Helm chart automatically updates the images. You don't typically need to make manual image changes. For information about container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images). Fixed #### Fixed in this release | Bug ID | Description | |---|---| | **578314600** | **Fixed an issue where `apigee-connect-agent` ignored `HTTPS_PROXY` and failed to establish a tether in clusters that require an HTTP forward proxy for egress; the agent now uses HTTP/2 keepalive pings on the control-plane connection while honoring `HTTPS_PROXY` (including proxy credentials).** | | **576707253** | **Removed the compromised emSign roots and the cross-signing Comodo AAA Services root from the system and Java (`cacerts`) trust stores across containers.** | | **573622417** | **Fixed an issue where `apigee-ingressgateway` forwarded the `x-envoy-decorator-operation` header to upstream runtime and target backends.** | | **571378258** | **The `apigee-redis` container now uses the Valkey engine (version 8.1.10). The RESP2 wire protocol and `redis-server` and `redis-cli` binary names are unchanged.** | | **554114419** | **Fixed an issue where an `AssignMessage`, `HTTPModifier`, or `RaiseFault` policy that creates a new request (`createNew="true"`) in an HTTP/2 flow could not set the `:path` and `:authority` pseudo-headers and failed with an invalid-header error.** | | **524115876** | **Fixed an intermittent HTTP `400` error in the `OASValidation` policy's strict parameter validation that rejected valid requests under load.** | | **449228485** | **Fixed an issue where `podDisruptionBudget` overrides configured in the Helm charts were dropped by the Kubernetes API server.** | | **432315283** | **Fixed an issue where changes to a multi-certificate truststore's trust anchors required a Message Processor restart when `features.truststore.multi_cert_bundle.enabled` was toggled at runtime; the outbound `SSLContext` now rebuilds automatically.** | Security | Bug ID | Description | |---|---| | **N/A** | **Security fixes for `apigee-asm-ingress`.** This addresses the following vulnerabilities: - [CVE-2026-116585](https://nvd.nist.gov/vuln/detail/CVE-2026-116585) - [CVE-2026-116586](https://nvd.nist.gov/vuln/detail/CVE-2026-116586) - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-63209](https://nvd.nist.gov/vuln/detail/CVE-2026-63209) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) | | **N/A** | **Security fixes for `apigee-asm-istiod`.** This addresses the following vulnerabilities: - [CVE-2026-116585](https://nvd.nist.gov/vuln/detail/CVE-2026-116585) - [CVE-2026-116586](https://nvd.nist.gov/vuln/detail/CVE-2026-116586) - [CVE-2026-40179](https://nvd.nist.gov/vuln/detail/CVE-2026-40179) - [CVE-2026-42151](https://nvd.nist.gov/vuln/detail/CVE-2026-42151) - [CVE-2026-42154](https://nvd.nist.gov/vuln/detail/CVE-2026-42154) - [CVE-2026-44903](https://nvd.nist.gov/vuln/detail/CVE-2026-44903) - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-63209](https://nvd.nist.gov/vuln/detail/CVE-2026-63209) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) - [GHSA-gcjh-h69q-9w9g](https://osv.dev/vulnerability/GHSA-gcjh-h69q-9w9g) | | **N/A** | **Security fixes for `apigee-connect-agent`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) | | **N/A** | **Security fixes for `apigee-envoy`.** This addresses the following vulnerabilities: - [CVE-2026-5450](https://nvd.nist.gov/vuln/detail/CVE-2026-5450) - [CVE-2026-5928](https://nvd.nist.gov/vuln/detail/CVE-2026-5928) | | **N/A** | **Security fixes for `apigee-fluent-bit`.** This addresses the following vulnerabilities: - [CVE-2026-111497](https://nvd.nist.gov/vuln/detail/CVE-2026-111497) - [CVE-2026-35189](https://nvd.nist.gov/vuln/detail/CVE-2026-35189) - [CVE-2026-35191](https://nvd.nist.gov/vuln/detail/CVE-2026-35191) - [CVE-2026-42772](https://nvd.nist.gov/vuln/detail/CVE-2026-42772) - [CVE-2026-5450](https://nvd.nist.gov/vuln/detail/CVE-2026-5450) - [CVE-2026-54872](https://nvd.nist.gov/vuln/detail/CVE-2026-54872) - [CVE-2026-54873](https://nvd.nist.gov/vuln/detail/CVE-2026-54873) - [CVE-2026-54875](https://nvd.nist.gov/vuln/detail/CVE-2026-54875) - [CVE-2026-58050](https://nvd.nist.gov/vuln/detail/CVE-2026-58050) - [CVE-2026-58051](https://nvd.nist.gov/vuln/detail/CVE-2026-58051) - [CVE-2026-5928](https://nvd.nist.gov/vuln/detail/CVE-2026-5928) - [CVE-2026-66032](https://nvd.nist.gov/vuln/detail/CVE-2026-66032) - [CVE-2026-66033](https://nvd.nist.gov/vuln/detail/CVE-2026-66033) - [CVE-2026-66034](https://nvd.nist.gov/vuln/detail/CVE-2026-66034) - [CVE-2026-66035](https://nvd.nist.gov/vuln/detail/CVE-2026-66035) - [CVE-2026-72897](https://nvd.nist.gov/vuln/detail/CVE-2026-72897) - [CVE-2026-75804](https://nvd.nist.gov/vuln/detail/CVE-2026-75804) - [CVE-2026-75805](https://nvd.nist.gov/vuln/detail/CVE-2026-75805) - [CVE-2026-75806](https://nvd.nist.gov/vuln/detail/CVE-2026-75806) - [CVE-2026-77696](https://nvd.nist.gov/vuln/detail/CVE-2026-77696) - [CVE-2026-8286](https://nvd.nist.gov/vuln/detail/CVE-2026-8286) - [CVE-2026-84782](https://nvd.nist.gov/vuln/detail/CVE-2026-84782) - [CVE-2026-84784](https://nvd.nist.gov/vuln/detail/CVE-2026-84784) - [CVE-2026-8924](https://nvd.nist.gov/vuln/detail/CVE-2026-8924) - [CVE-2026-8927](https://nvd.nist.gov/vuln/detail/CVE-2026-8927) - [CVE-2026-92392](https://nvd.nist.gov/vuln/detail/CVE-2026-92392) | | **N/A** | **Security fixes for `apigee-hybrid-cassandra`.** This addresses the following vulnerabilities: - [CVE-2026-18401](https://nvd.nist.gov/vuln/detail/CVE-2026-18401) - [CVE-2026-54512](https://nvd.nist.gov/vuln/detail/CVE-2026-54512) - [CVE-2026-54513](https://nvd.nist.gov/vuln/detail/CVE-2026-54513) - [CVE-2026-54514](https://nvd.nist.gov/vuln/detail/CVE-2026-54514) - [CVE-2026-54515](https://nvd.nist.gov/vuln/detail/CVE-2026-54515) - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-59888](https://nvd.nist.gov/vuln/detail/CVE-2026-59888) - [CVE-2026-59889](https://nvd.nist.gov/vuln/detail/CVE-2026-59889) - [CVE-2026-68494](https://nvd.nist.gov/vuln/detail/CVE-2026-68494) - [CVE-2026-77310](https://nvd.nist.gov/vuln/detail/CVE-2026-77310) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) | | **N/A** | **Security fixes for `apigee-hybrid-cassandra-client`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) | | **N/A** | **Security fixes for `apigee-kube-rbac-proxy`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) | | **N/A** | **Security fixes for `apigee-mart-server`.** This addresses the following vulnerabilities: - [CVE-2026-89407](https://nvd.nist.gov/vuln/detail/CVE-2026-89407) - [CVE-2026-89425](https://nvd.nist.gov/vuln/detail/CVE-2026-89425) - [CVE-2026-91776](https://nvd.nist.gov/vuln/detail/CVE-2026-91776) - [CVE-2026-91777](https://nvd.nist.gov/vuln/detail/CVE-2026-91777) | | **N/A** | **Security fixes for `apigee-mint-task-scheduler`.** This addresses the following vulnerabilities: - [CVE-2026-89407](https://nvd.nist.gov/vuln/detail/CVE-2026-89407) - [CVE-2026-89425](https://nvd.nist.gov/vuln/detail/CVE-2026-89425) - [CVE-2026-91776](https://nvd.nist.gov/vuln/detail/CVE-2026-91776) - [CVE-2026-91777](https://nvd.nist.gov/vuln/detail/CVE-2026-91777) | | **N/A** | **Security fixes for `apigee-open-telemetry-collector`.** This addresses the following vulnerabilities: - [CVE-2026-116585](https://nvd.nist.gov/vuln/detail/CVE-2026-116585) - [CVE-2026-116586](https://nvd.nist.gov/vuln/detail/CVE-2026-116586) - [CVE-2026-116587](https://nvd.nist.gov/vuln/detail/CVE-2026-116587) | | **N/A** | **Security fixes for `apigee-operators`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-63209](https://nvd.nist.gov/vuln/detail/CVE-2026-63209) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) | | **N/A** | **Security fixes for `apigee-prom-prometheus`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) | | **N/A** | **Security fixes for `apigee-prometheus-adapter`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) | | **N/A** | **Security fixes for `apigee-redis`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) | | **N/A** | **Security fixes for `apigee-runtime`.** This addresses the following vulnerabilities: - [CVE-2026-89407](https://nvd.nist.gov/vuln/detail/CVE-2026-89407) - [CVE-2026-89425](https://nvd.nist.gov/vuln/detail/CVE-2026-89425) - [CVE-2026-91776](https://nvd.nist.gov/vuln/detail/CVE-2026-91776) - [CVE-2026-91777](https://nvd.nist.gov/vuln/detail/CVE-2026-91777) | | **N/A** | **Security fixes for `apigee-synchronizer`.** This addresses the following vulnerabilities: - [CVE-2026-89407](https://nvd.nist.gov/vuln/detail/CVE-2026-89407) - [CVE-2026-89425](https://nvd.nist.gov/vuln/detail/CVE-2026-89425) - [CVE-2026-91776](https://nvd.nist.gov/vuln/detail/CVE-2026-91776) - [CVE-2026-91777](https://nvd.nist.gov/vuln/detail/CVE-2026-91777) | | **N/A** | **Security fixes for `apigee-udca`.** This addresses the following vulnerabilities: - [CVE-2026-116585](https://nvd.nist.gov/vuln/detail/CVE-2026-116585) - [CVE-2026-116586](https://nvd.nist.gov/vuln/detail/CVE-2026-116586) - [CVE-2026-116587](https://nvd.nist.gov/vuln/detail/CVE-2026-116587) - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) | | **N/A** | **Security fixes for `apigee-watcher`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-63209](https://nvd.nist.gov/vuln/detail/CVE-2026-63209) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) | **Application Integration** Feature The following Application Integration features are now [generally available (GA)](https://cloud.google.com/products#product-launch-stages): - [Mask sensitive data in logs](https://docs.cloud.google.com/application-integration/docs/mask-sensitive-data-logs.md.txt) - [Test cases](https://docs.cloud.google.com/application-integration/docs/test-cases.md.txt) - [Manage Application Integration resources using custom constraints](https://docs.cloud.google.com/application-integration/docs/custom-constraints.md.txt) - [Config variables](https://docs.cloud.google.com/application-integration/docs/variables.md.txt#config_var) - [Data Transformer Script task](https://docs.cloud.google.com/application-integration/docs/configure-data-transformer-script-task.md.txt) and [Data Transformer functions](https://docs.cloud.google.com/application-integration/docs/data-transformer-functions-reference.md.txt) - [View OpenAPI specification for an integration](https://docs.cloud.google.com/application-integration/docs/view-openapi-spec.md.txt) Announcement The `iam.serviceAccounts.actAs` check on run-as service accounts already applies when you publish or test any integration. Starting January 15, 2027 (UTC), the new authorization behavior also applies to existing integrations created before October 15, 2026. Specifically, you must have a run-as service account to publish or test an integration with a scheduled or event trigger. For more information, see [Prepare for upcoming authorization changes](https://docs.cloud.google.com/application-integration/docs/prepare-for-authorization-changes.md.txt) and the [GCP-2026-068](https://docs.cloud.google.com/application-integration/docs/security-bulletins.md.txt#gcp-2026-068) security bulletin. **BigQuery** Feature In the query execution graph's [query text heatmap](https://docs.cloud.google.com/bigquery/docs/query-plan-explanation#query_text_heatmap), you can now view and navigate through a hierarchical list of context references, such as nested function calls or view references, for stage steps. This feature is [generally available](https://cloud.google.com/products#product-launch-stages) (GA). Feature In the query execution graph, the [query text heatmap](https://docs.cloud.google.com/bigquery/docs/query-plan-explanation#query_text_heatmap) now supports displaying the SQL text for persistent and temporary user-defined functions (UDFs). This feature is [generally available](https://cloud.google.com/products#product-launch-stages) (GA). Change The BigQuery **Metadata curation** console page has been removed. You can now use Knowledge Catalog to schedule [Cloud Storage discovery scans](https://docs.cloud.google.com/knowledge-catalog/docs/cloud-storage-discovery.md.txt), manage [data profiling](https://docs.cloud.google.com/knowledge-catalog/docs/data-profiling-overview.md.txt) and [data quality](https://docs.cloud.google.com/knowledge-catalog/docs/use-auto-data-quality.md.txt#console), and perform related data governance tasks. Feature [Conversational analytics in BigQuery](https://docs.cloud.google.com/bigquery/docs/conversational-analytics.md.txt) is now available in the `asia-northeast1` (Tokyo) location. For more information, see [Locations](https://docs.cloud.google.com/bigquery/docs/conversational-analytics.md.txt#locations). **Compute Engine** Change M4N network performance improvements provide up to 400 Gbps maximum bandwidth for internal network communications, and up to 200 Gbps for external network communications. For more information, see [M4N machine types](https://docs.cloud.google.com/compute/docs/network-optimized-machines.md.txt#m4n_machine_types). **Container Optimized OS** Change ### cos-133-19999-44-193 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.18.55](https://cos.googlesource.com/third_party/kernel/+/e794243e77b51f9bdf8954da0cb3ce2c79661328) | v29.4.3 | v2.4.1 | [See List](https://storage.googleapis.com/cos-tools/19999.44.193/lakitu/gpu_driver_versions.textproto) | Change Upgraded sys-apps/casfs to v0.1.24. Feature Enabled PCI peer to peer direct memory access for 64k kernels. Fixed Added support for NVIDIA driver v580.196.07. Fixed Added support for NVIDIA driver v595.112.07. Fixed Updated cos-gpu-installer to v2.7.12. It installs ucodes firmwares for r615 and newer GPU driver versions. Fixed Upgraded app-admin/google-guest-configs to v20261027.00. Fixed Upgraded app-admin/oslogin to v20261021.00. Fixed Upgraded app-admin/sosreport to v4.12.1. Fixed Upgraded app-arch/bzip2 to v1.0.8-r5. Fixed Upgraded app-containers/docker-credential-helpers to v0.9.12. Fixed Upgraded app-editors/vim to v9.2.1229, Upgraded app-editors/vim-core to v9.2.1229. Fixed Upgraded app-misc/ca-certificates to v20260816.3.131.1. Fixed Upgraded app-misc/jq to v1.8.2. Fixed Upgraded dev-db/sqlite to v3.54.1. Fixed Upgraded dev-libs/nss to v3.132. Fixed Upgraded sys-libs/talloc to v2.5.0. Fixed Upgraded net-fs/cifs-utils to v7.8. Fixed Upgraded net-libs/gnutls to v3.8.13. Fixed Upgraded sys-fs/mdadm to v4.6-r1. Fixed Upgraded sys-libs/libcap-ng to v0.9.6. Fixed Upgraded sys-libs/libxcrypt to v4.4.38-r1. Security Fixed CVE-2024-41110 in cri-tools. Security Fixed CVE-2026-116587 in containerd. Security Fixed CVE-2026-24051, CVE-2026-34986 in cos-extensions. Security Fixed CVE-2026-29181 in guest-agent. Security Fixed CVE-2026-33186 in cni-plugins. Security Fixed CVE-2026-35469 in cri-tools. Security Fixed CVE-2026-39883 in google-osconfig-agent. Security Fixed CVE-2026-63209 in node-problem-detector. Security Fixed CVE-2026-84304 in containerd. Security Fixed CVE-2026-84304 in docker. Security Fixed CVE-2026-84304, CVE-2026-32285 in cri-tools. Security Fixed CVE-2026-84445 in containerd. Security Fixed CVE-2026-84445 in kubernetes. Change ### cos-121-18867-652-29 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.6.159](https://cos.googlesource.com/third_party/kernel/+/c87b8de2956ad6b99b07834c48be0a022d71d1d4) | v27.5.1 | v2.0.10 | [See List](https://storage.googleapis.com/cos-tools/18867.652.29/lakitu/gpu_driver_versions.textproto) | Fixed Added support for NVIDIA driver v580.196.07. Fixed Upgraded app-admin/google-guest-configs to v20261027.00. Fixed Upgraded app-arch/gzip to v1.15. Fixed Upgraded app-containers/docker-credential-helpers to v0.9.12. Fixed Upgraded app-editors/vim to v9.2.1229. Fixed Upgraded app-editors/vim-core to v9.2.1229. Fixed Upgraded app-misc/ca-certificates to v20260816.3.131.1. Fixed Upgraded dev-db/sqlite to v3.54.1. Fixed Upgraded dev-libs/nss to v3.132. Fixed Upgraded sys-apps/less to v710. Fixed Upgraded sys-libs/libxcrypt to v4.4.38-r1. Fixed Upgraded sys-libs/timezone-data to v2026f. Security Fixed CVE-2024-25621, CVE-2026-53488 in docker. Security Fixed CVE-2024-41110, CVE-2026-33186 in cri-tools. Security Fixed CVE-2025-15558, CVE-2024-25621, CVE-2026-71556 in google-osconfig-agent. Security Fixed CVE-2025-52881 in cri-tools. Security Fixed CVE-2026-116587, CVE-2026-63209 in google-osconfig-agent. Security Fixed CVE-2026-24051, CVE-2025-31133, CVE-2026-63209 in docker. Security Fixed CVE-2026-29181, CVE-2026-84304 in cos-extensions. Security Fixed CVE-2026-29181, CVE-2026-84304, CVE-2026-63209 in containerd. Security Fixed CVE-2026-33186 in cni-plugins. Security Fixed CVE-2026-33186 in containerd. Security Fixed CVE-2026-33186 in docker. Security Fixed CVE-2026-33186 in guest-agent. Security Fixed CVE-2026-46595 in docker. Security Fixed CVE-2026-46595, CVE-2026-42508 in google-osconfig-agent. Security Fixed CVE-2026-63209 in node-problem-detector. Security Fixed CVE-2026-84304 in google-guest-agent. Security Fixed CVE-2026-84445 in google-osconfig-agent. Security Fixed CVE-2026-84445, CVE-2026-84304 in guest-agent. Security Fixed KCTF-d095321 in the Linux kernel. Security Updated app-arch/brotli to 1.0.10. This resolves CVE-2026-111497. Security Upgraded dev-libs/expat to v2.8.4. This fixes CVE-2026-76957. **Data Studio** Feature You can now combine tables vertically in Data Studio blends by using the **Union** merge operator, which appends rows across up to five tables and removes duplicate rows. In addition, blend UI labels now use *merge* (such as **Merge another table** , **Merge conditions** , and **Hide repeated merge fields** ) to encompass both join and union operations. For more information, see [How blends work in Data Studio](https://docs.cloud.google.com/data-studio/how-blends-work.md.txt) and [Create, edit, and manage blends](https://docs.cloud.google.com/data-studio/create-edit-and-manage-blends.md.txt). **Gemini Enterprise** Feature **Gemini Enterprise: Prepaid credits for Pay-as-you-go subscriptions and usage above quota** Prepaid credits are generally available (GA) for self-serve (online) Cloud Billing accounts. You can buy credits to pay for usage without an invoiced billing account. Your billing account's credit balance covers usage in the Pay-as-you-go edition and pay-as-you-go usage above quota in the Gemini Enterprise app, Gemini Enterprise Agent Platform, and AI developer tools, such as Google Antigravity. Pay-as-you-go subscriptions have no license fee because you pay for what you use at pay-as-you-go rates. Cloud Billing still bills your account directly for seat-based license fees in editions such as Standard and Plus. - **Buy credits and configure auto-reload**: Buy prepaid credits, track your balance and transactions, and configure auto-reload with an optional monthly auto-charge limit. Usage is blocked if your credit balance reaches zero or a project reaches its monthly spend limit. Because credits are deducted after usage occurs, your balance might briefly drop below zero if usage occurs before the deduction runs. - **Use AI developer tools on self-serve accounts**: With an upgraded paid self-serve billing account and an active non-trial Gemini Enterprise subscription, you can enable AI developer tools and pay with prepaid credits for Pay-as-you-go edition usage or pay-as-you-go usage above quota. Eligible editions include Standard, Plus, eligible Standard Emerging Market, and Pay-as-you-go. Free-trial subscriptions, free-tier billing accounts, and reseller-managed subaccounts aren't eligible. - **Monitor costs and invoices**: View 30-day costs across the Gemini Enterprise app, Gemini Enterprise Agent Platform, and AI developer tools, and view and download prepayment and monthly consumption invoices. For more information, see: - [Manage prepaid credits](https://docs.cloud.google.com/gemini/enterprise/docs/manage-prepaid-credits.md.txt) - [Configure pay-as-you-go usage above quota](https://docs.cloud.google.com/gemini/enterprise/docs/configure-pay-as-you-go-usage-above-quota) - [Quotas and pricing for the Pay-as-you-go edition](https://docs.cloud.google.com/gemini/enterprise/docs/quotas-and-pay-as-you-go-usage#quotas-pay-as-you-go) - [AI developer tools overview](https://docs.cloud.google.com/gemini/enterprise/docs/ai-developer-tools-overview) - [View costs](https://docs.cloud.google.com/gemini/enterprise/docs/view-costs.md.txt) **Gemini Enterprise Agent Platform** Feature **Gemini Omni 1.2 Flash** [Gemini Omni 1.2 Flash](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/gemini/omni-1-2-flash.md.txt) (`gemini-omni-1.2-flash`) is available in [General Availability (GA)](https://cloud.google.com/products#product-launch-stages). Gemini Omni 1.2 Flash is an omni-modal foundation model that processes text, image, and video inputs to generate text and high-definition video with synchronized audio through the [Interactions API](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/capabilities/interactions.md.txt). Gemini Omni 1.2 Flash introduces the following capabilities: - **Standalone video upscaling** : Upscale previously generated videos from 360p to 720p or 1080p, and from 720p to 1080p or 4K using `task: "upscale"`. See [Upscale videos](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/video/upscale-videos.md.txt). - **Extended video generation and editing duration**: Generate or edit videos up to 15 seconds in length across text-to-video, image-to-video, reference-to-video, and video editing tasks (up to 10 seconds for first-and-last-frame interpolation and video extension). - **Reference-guided video editing and extension** : Supply up to 2 reference images along with an input video when editing or extending videos. See [Edit videos](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/video/edit-videos.md.txt) and [Extend videos](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/video/extend-videos.md.txt). - **Deterministic generation and billing labels** : Specify `seed` for reproducible video outputs and attach custom `labels` to Interactions API requests. - **Standard PayGo and Provisioned Throughput** : Available with [Standard Pay-as-you-go (PayGo)](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/standard-paygo.md.txt) and [Provisioned Throughput](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/provisioned-throughput/gemini-omni-models.md.txt) (685 tokens per second per GSU). Feature **Interactions API long decodes for Gemini 4 Argon** Long decodes up to 1,048,576 tokens (minus input tokens) on the [Interactions API](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/capabilities/interactions.md.txt) (`v1beta1`) are available in [General Availability (GA)](https://cloud.google.com/products#product-launch-stages) for [Gemini 4 Argon](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/gemini/4-argon.md.txt) (`gemini-4-argon` and `gemini-4-argon-cyber-permissive`). You can extend single-turn outputs beyond the per-segment limit (65,536 streaming or 32,768 non-streaming tokens) using automatic continuation in the Google Gen AI SDK (`google-genai >= 2.34.0` for Python, `@google/genai >= 2.32.0` for JavaScript/TypeScript, Go `>= 1.77.0`, and Java `>= 1.80.0`), server-managed background execution (`background=true`), or custom stored (`store=true`) and stateless (`store=false`) `continuation_token` loops. For code samples, continuation options, and implementation rules, see [Long decodes in the developer's guide to Gemini 4 Argon](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/guides/gemini-4-argon.md.txt#long-decodes). Fixed **CodeMender updates (v0.18.0)** This release introduces updates to CodeMender: - **Verification tool-turn guardrails** : Added exploratory tool-turn limits to `cm verify` sessions to prevent unbounded command execution loops. - **Release notes link in update prompts**: Added a direct link to DevSite release notes when CodeMender prompts to update to a newer CLI version. - **Agent IAM diagnostic guidance** : Added actionable `roles/aiplatform.agentsUser` IAM binding commands to CLI setup and error messages for service account and CI/CD environments. - **Bug fixes** : - Improved the reliability of agent sessions, including verification and resumed sessions. - Improved compatibility across shell environments. - Improved the sign-in flow during interactive activation. - Improved error reporting when the service is temporarily unavailable. - Includes security and stability improvements. For more information, see the [CodeMender documentation](https://docs.cloud.google.com/gemini-enterprise-agent-platform/agents/codemender.md.txt). **Google SecOps** Feature **\[Spotlight Feature\] Case activity tagging** You can now use custom tags for individual activities, comments, tasks, and actions on the Case Wall, and filter the wall view by those tags. This allows you to categorize specific observations and filter the timeline to view only the entries relevant to your investigation or team. For more information, see [Add a tag to a Case Wall activity](https://docs.cloud.google.com/chronicle/docs/soar/investigate/working-with-cases/define-tags-in-cases-admin.md.txt#add-activity-tag). This feature is being rolled out in waves starting Monday, November 16 and continuing through Thursday, November 19. **Model Armor** Feature You can enable or disable the child sexual abuse material (CSAM) filter in Model Armor templates and floor settings, and configure granular confidence levels (`High`, `Medium and above`, and `Low and above`). For more information, see [Model Armor filters](https://docs.cloud.google.com/model-armor/overview#ma-csam-detection) and [Create and manage templates](https://docs.cloud.google.com/model-armor/manage-templates#configure-detections). **Security Command Center** Deprecated Data Security Posture Management (DSPM) is no longer available to new organizations. If DSPM is already enabled for your organization, you retain full access until its scheduled shutdown on February 1, 2027. For more information, see [Deprecations and shut down features](https://docs.cloud.google.com/security-command-center/docs/deprecations.md.txt) and [alternative detection capabilities](https://docs.cloud.google.com/security-command-center/docs/dspm-data-security.md.txt#data-security-framework). ## November 04, 2026 **API Gateway** Announcement **Negative backend deadlines are no longer deprecated** The deprecation of negative backend `deadline` values announced on October 23, 2026 is withdrawn. In an OpenAPI 2.0 `x-google-backend` extension or a gRPC `BackendRule`, a negative deadline continues to use the default deadline, the same as `0`, and won't be rejected. OpenAPI 3.x backends still reject a negative deadline. For more information, see [OpenAPI 2.0 extensions](https://docs.cloud.google.com/api-gateway/docs/oasv2-extensions.md.txt#deadline) and [OpenAPI 3.x extensions](https://docs.cloud.google.com/api-gateway/docs/oasv3-extensions.md.txt#backends_object). **AlloyDB for PostgreSQL** Feature Direct Iceberg access in AlloyDB for PostgreSQL is available for PostgreSQL 18 and later ([in Preview](https://cloud.google.com/products#product-launch-stages)). This feature lets you query Apache Iceberg tables in Cloud Storage or Lakehouse runtime catalog and accelerate analytical queries using the AlloyDB columnar engine. For more information, see [Access Iceberg data from AlloyDB](https://docs.cloud.google.com/alloydb/docs/access-iceberg-data-from-alloydb). Feature Syncing data from BigQuery into AlloyDB is generally available ([GA](https://cloud.google.com/products#product-launch-stages)). This feature lets you copy or mirror analytical tables from BigQuery into AlloyDB for low-latency operational access using the `alloydb_sync` extension. For more information, see [Sync BigQuery data to AlloyDB](https://docs.cloud.google.com/alloydb/docs/sync-bigquery-data-to-alloydb.md.txt). Feature AlloyDB Express is available in [Preview](https://cloud.google.com/products#product-launch-stages) for PostgreSQL 18. Optimized for rapid prototyping and for workflows that use AI coding agents, this configuration provides the following features: - Fast provisioning - Scale-to-zero compute when idle - A monthly free tier for the first 12 months of usage - One-click upgrades to AlloyDB for PostgreSQL For more information, see [AlloyDB Express overview](https://docs.cloud.google.com/alloydb/docs/express-overview.md.txt). **Apigee Edge for Public Cloud** Announcement Released Edge Microgateway 3.3.12. Edge Microgateway 3.3.12 includes the following component versions: | Component | Version | |---|---| | [microgateway](https://github.com/apigee-internal/microgateway/releases) | 3.3.12 | | [plugins](https://github.com/apigee/microgateway-plugins/releases) | 3.3.9 | | [edgeauth](https://github.com/apigee/microgateway-edgeauth/releases) | 3.2.2 | To upgrade, install version 3.3.12 of the `edgemicro` npm package or pull the `gcr.io/apigee-microgateway/edgemicro:3.3.12` Docker image. For the npm upgrade steps, see [Upgrading Edge Microgateway](https://docs.apigee.com/api-platform/microgateway/3.3.x/operation-and-configuration-reference-edge-microgateway#upgradingedgemicrogateway). For earlier Edge Microgateway releases, see [Edge Microgateway release notes](https://docs.apigee.com/release/notes/edge-microgateway-release-notes-0). Breaking Removed support for Node.js 20 from Edge Microgateway. Use Node.js 22, 24, or 26 instead. Edge Microgateway 3.3.12 supports only Node.js 22, 24, and 26. Support for Node.js 26 is new in this release. Before you upgrade an npm installation of Edge Microgateway to 3.3.12, upgrade the Node.js runtime on each host to version 22, 24, or 26. The 3.3.12 Docker image is built on Node.js 24, so Docker deployments need no action for this change. For supported versions, see [Supported software and supported versions](https://docs.apigee.com/release/supported-software#apigeeedgemicrogateway). Breaking Removed the `npm` and `npx` command-line tools from the Edge Microgateway Docker image. Install custom plugin dependencies before you add the plugins to the container. Starting with version 3.3.12, the Edge Microgateway Docker image doesn't include `npm` or `npx`, and commands that run either tool inside the container fail. The change doesn't affect how Edge Microgateway runs. If your custom plugins have npm dependencies, run `npm install` in each plugin directory before you add the plugins to the container, so that each plugin's `node_modules` directory is included. For the steps, see [Adding a custom plugin](https://docs.apigee.com/api-platform/microgateway/3.3.x/docker#adding_a_custom_plugin). This change doesn't affect npm installations of Edge Microgateway. Security Fixed multiple security vulnerabilities in Edge Microgateway. Upgrade to Edge Microgateway 3.3.12. Edge Microgateway 3.3.12 fixes the following vulnerabilities: - [CVE-2026-12590](https://nvd.nist.gov/vuln/detail/CVE-2026-12590) - [CVE-2026-14257](https://nvd.nist.gov/vuln/detail/CVE-2026-14257) - [CVE-2026-45819](https://nvd.nist.gov/vuln/detail/CVE-2026-45819) - [CVE-2026-54272](https://nvd.nist.gov/vuln/detail/CVE-2026-54272) - [CVE-2026-59870](https://nvd.nist.gov/vuln/detail/CVE-2026-59870) - [CVE-2026-69152](https://nvd.nist.gov/vuln/detail/CVE-2026-69152) - [CVE-2026-69192](https://nvd.nist.gov/vuln/detail/CVE-2026-69192) - [CVE-2026-69198](https://nvd.nist.gov/vuln/detail/CVE-2026-69198) - [CVE-2026-73088](https://nvd.nist.gov/vuln/detail/CVE-2026-73088) - [CVE-2026-73089](https://nvd.nist.gov/vuln/detail/CVE-2026-73089) - [CVE-2026-82417](https://nvd.nist.gov/vuln/detail/CVE-2026-82417) - [CVE-2026-82562](https://nvd.nist.gov/vuln/detail/CVE-2026-82562) - [CVE-2026-84375](https://nvd.nist.gov/vuln/detail/CVE-2026-84375) - [CVE-2026-87018](https://nvd.nist.gov/vuln/detail/CVE-2026-87018) - [CVE-2026-101910](https://nvd.nist.gov/vuln/detail/CVE-2026-101910) - [CVE-2026-101911](https://nvd.nist.gov/vuln/detail/CVE-2026-101911) - [CVE-2026-101912](https://nvd.nist.gov/vuln/detail/CVE-2026-101912) - [CVE-2026-101913](https://nvd.nist.gov/vuln/detail/CVE-2026-101913) - [CVE-2026-102276](https://nvd.nist.gov/vuln/detail/CVE-2026-102276) - [CVE-2026-102277](https://nvd.nist.gov/vuln/detail/CVE-2026-102277) - [CVE-2026-102278](https://nvd.nist.gov/vuln/detail/CVE-2026-102278) - [CVE-2026-109383](https://nvd.nist.gov/vuln/detail/CVE-2026-109383) - [CVE-2026-109869](https://nvd.nist.gov/vuln/detail/CVE-2026-109869) - [CVE-2026-109924](https://nvd.nist.gov/vuln/detail/CVE-2026-109924) - [CVE-2026-109932](https://nvd.nist.gov/vuln/detail/CVE-2026-109932) - [CVE-2026-110816](https://nvd.nist.gov/vuln/detail/CVE-2026-110816) - [CVE-2026-111181](https://nvd.nist.gov/vuln/detail/CVE-2026-111181) - [CVE-2026-111497](https://nvd.nist.gov/vuln/detail/CVE-2026-111497) - [CVE-2026-111997](https://nvd.nist.gov/vuln/detail/CVE-2026-111997) - [CVE-2026-115897](https://nvd.nist.gov/vuln/detail/CVE-2026-115897) The Edge Microgateway 3.3.12 Docker image is built on `node:24.22.1-trixie-slim`, which includes the Node.js fix for CVE-2026-111497. For npm installations of Edge Microgateway, upgrading the `edgemicro` package doesn't fix CVE-2026-111497. You must also upgrade the Node.js runtime on each host to one of the following versions, or to a later version in the same release line: | Node.js release line | Fixed version | |---|---| | 22.x | 22.23.4 | | 24.x | 24.22.1 | | 26.x | 26.12.1 | **Apigee Operator for kubernetes** Announcement On November 4, 2026, we released an updated version of Apigee. Feature **The Apigee Operator for Kubernetes version 1.1.2 is now available.** Security | Bug ID | Description | |---|---| | **521387476, 521388685, 521389473, 521389648, 521390401, 521390431, 521418315, 521467563, 521470029, 521523106, 521532318, 522502328, 522502515, 522502723, 522508097, 522515015, 522515987, 523406508, 524990439, 525000385, 525013469, 545525835, 545535262, 545546643, 545547894, 545594793, 545595426, 545604082, 545605504, 545613200, 545619209, 546865118, 549708263, 572097689, 572100132** | **Security fixes for Netty in the Apigee Operator for Kubernetes.** Upgraded Netty to 4.1.137.Final. This addresses the following vulnerabilities: - [CVE-2026-33870](https://nvd.nist.gov/vuln/detail/CVE-2026-33870) - [CVE-2026-33871](https://nvd.nist.gov/vuln/detail/CVE-2026-33871) - [CVE-2026-41417](https://nvd.nist.gov/vuln/detail/CVE-2026-41417) - [CVE-2026-42578](https://nvd.nist.gov/vuln/detail/CVE-2026-42578) - [CVE-2026-42579](https://nvd.nist.gov/vuln/detail/CVE-2026-42579) - [CVE-2026-42580](https://nvd.nist.gov/vuln/detail/CVE-2026-42580) - [CVE-2026-42581](https://nvd.nist.gov/vuln/detail/CVE-2026-42581) - [CVE-2026-42583](https://nvd.nist.gov/vuln/detail/CVE-2026-42583) - [CVE-2026-42584](https://nvd.nist.gov/vuln/detail/CVE-2026-42584) - [CVE-2026-42585](https://nvd.nist.gov/vuln/detail/CVE-2026-42585) - [CVE-2026-42587](https://nvd.nist.gov/vuln/detail/CVE-2026-42587) - [CVE-2026-44249](https://nvd.nist.gov/vuln/detail/CVE-2026-44249) - [CVE-2026-45416](https://nvd.nist.gov/vuln/detail/CVE-2026-45416) - [CVE-2026-45673](https://nvd.nist.gov/vuln/detail/CVE-2026-45673) - [CVE-2026-45674](https://nvd.nist.gov/vuln/detail/CVE-2026-45674) - [CVE-2026-47244](https://nvd.nist.gov/vuln/detail/CVE-2026-47244) - [CVE-2026-47691](https://nvd.nist.gov/vuln/detail/CVE-2026-47691) - [CVE-2026-48043](https://nvd.nist.gov/vuln/detail/CVE-2026-48043) - [CVE-2026-50010](https://nvd.nist.gov/vuln/detail/CVE-2026-50010) - [CVE-2026-50020](https://nvd.nist.gov/vuln/detail/CVE-2026-50020) - [CVE-2026-50560](https://nvd.nist.gov/vuln/detail/CVE-2026-50560) - [CVE-2026-55831](https://nvd.nist.gov/vuln/detail/CVE-2026-55831) - [CVE-2026-55833](https://nvd.nist.gov/vuln/detail/CVE-2026-55833) - [CVE-2026-56745](https://nvd.nist.gov/vuln/detail/CVE-2026-56745) - [CVE-2026-56746](https://nvd.nist.gov/vuln/detail/CVE-2026-56746) - [CVE-2026-56819](https://nvd.nist.gov/vuln/detail/CVE-2026-56819) - [CVE-2026-59898](https://nvd.nist.gov/vuln/detail/CVE-2026-59898) - [CVE-2026-59899](https://nvd.nist.gov/vuln/detail/CVE-2026-59899) - [CVE-2026-59900](https://nvd.nist.gov/vuln/detail/CVE-2026-59900) - [CVE-2026-59901](https://nvd.nist.gov/vuln/detail/CVE-2026-59901) - [CVE-2026-59903](https://nvd.nist.gov/vuln/detail/CVE-2026-59903) - [CVE-2026-59921](https://nvd.nist.gov/vuln/detail/CVE-2026-59921) - [CVE-2026-73508](https://nvd.nist.gov/vuln/detail/CVE-2026-73508) - [CVE-2026-75595](https://nvd.nist.gov/vuln/detail/CVE-2026-75595) - [CVE-2026-75596](https://nvd.nist.gov/vuln/detail/CVE-2026-75596)
| | **527492626, 527495614, 527497578, 527498733, 545553137, 572096453, 572096754, 572096884, 572097054, 572097090, 572097183, 572098198, 572098299, 572099894, 572100881, 578504005** | **Security fixes for Jackson in the Apigee Operator for Kubernetes.** Upgraded Jackson to 2.21.7. This addresses the following vulnerabilities: - [CVE-2026-18401](https://nvd.nist.gov/vuln/detail/CVE-2026-18401) - [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) - [CVE-2026-54512](https://nvd.nist.gov/vuln/detail/CVE-2026-54512) - [CVE-2026-54513](https://nvd.nist.gov/vuln/detail/CVE-2026-54513) - [CVE-2026-54514](https://nvd.nist.gov/vuln/detail/CVE-2026-54514) - [CVE-2026-54515](https://nvd.nist.gov/vuln/detail/CVE-2026-54515) - [CVE-2026-59888](https://nvd.nist.gov/vuln/detail/CVE-2026-59888) - [CVE-2026-59889](https://nvd.nist.gov/vuln/detail/CVE-2026-59889) - [CVE-2026-68494](https://nvd.nist.gov/vuln/detail/CVE-2026-68494) - [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) - [CVE-2026-77310](https://nvd.nist.gov/vuln/detail/CVE-2026-77310) - [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) - [CVE-2026-89407](https://nvd.nist.gov/vuln/detail/CVE-2026-89407) - [CVE-2026-89425](https://nvd.nist.gov/vuln/detail/CVE-2026-89425) - [CVE-2026-91776](https://nvd.nist.gov/vuln/detail/CVE-2026-91776) - [CVE-2026-91777](https://nvd.nist.gov/vuln/detail/CVE-2026-91777)
| | **521477919, 545546100, 545555197, 545603496, 545608493** | **Security fixes for Jetty in the Apigee Operator for Kubernetes.** Upgraded Jetty to 12.0.36. This addresses the following vulnerabilities: - [CVE-2025-11143](https://nvd.nist.gov/vuln/detail/CVE-2025-11143) - [CVE-2026-1605](https://nvd.nist.gov/vuln/detail/CVE-2026-1605) - [CVE-2026-2332](https://nvd.nist.gov/vuln/detail/CVE-2026-2332) - [CVE-2026-6790](https://nvd.nist.gov/vuln/detail/CVE-2026-6790) - [CVE-2026-8384](https://nvd.nist.gov/vuln/detail/CVE-2026-8384) - [CVE-2026-10050](https://nvd.nist.gov/vuln/detail/CVE-2026-10050) - [CVE-2026-10051](https://nvd.nist.gov/vuln/detail/CVE-2026-10051)
| | **522503039** | **Security fixes for Vert.x in the Apigee Operator for Kubernetes.** Upgraded Vert.x to 4.5.35. This addresses the following vulnerabilities: - [CVE-2026-1002](https://nvd.nist.gov/vuln/detail/CVE-2026-1002) - [CVE-2026-6860](https://nvd.nist.gov/vuln/detail/CVE-2026-6860)
| | **579151884** | **Security fixes for Guava in the Apigee Operator for Kubernetes.** Upgraded Guava to 33.7.2-jre. This addresses the following vulnerabilities: - [CVE-2026-102554](https://nvd.nist.gov/vuln/detail/CVE-2026-102554)
| **Bigtable** Feature Bigtable offers conversational analytics, which lets you query your operational data using natural language. This feature uses the [Conversational Analytics API](https://docs.cloud.google.com/gemini/data-agents/conversational-analytics-api/overview.md.txt) and is in [Preview](https://cloud.google.com/products#product-launch-stages). For more information, see [Conversational analytics for Bigtable overview](https://docs.cloud.google.com/gemini/data-agents/conversational-analytics/bigtable.md.txt). Feature The QueryData tool lets you query the data in your database using conversational language and build data agents. This feature is available in [Preview](https://cloud.google.com/products#product-launch-stages). For more information, see [QueryData tool overview](https://docs.cloud.google.com/gemini/data-agents/querydata/bigtable/data-agent-overview.md.txt). **Cloud Run** Feature Cloud Run ephemeral disk is in [General Availability (GA)](https://cloud.google.com/products#product-launch-stages). Ephemeral disk allows you to mount a volume that persists only for the duration of your [service](https://docs.cloud.google.com/run/docs/configuring/services/ephemeral-disk.md.txt), [job](https://docs.cloud.google.com/run/docs/configuring/jobs/ephemeral-disk.md.txt), or [worker pool](https://docs.cloud.google.com/run/docs/configuring/workerpools/ephemeral-disk.md.txt) instance. **Cloud SQL for SQL Server** Feature Cloud SQL for SQL Server now supports [read pool autoscaling](https://docs.cloud.google.com/sql/docs/sqlserver/read-pool-autoscaling.md.txt) ([GA](https://cloud.google.com/products#product-launch-stages)), which helps you more easily manage your application's workload needs. This feature automates read pool scale in and scale out operations based on one or both of the following conditions: - Allowed CPU usage of the read pool - Allowed number of client connections to the read pool Change Cloud SQL for SQL Server supports [additional metrics within the system insights dashboard](https://docs.cloud.google.com/sql/docs/sqlserver/use-system-insights.md.txt) ([GA](https://cloud.google.com/products#product-launch-stages)) related to engine memory, performance, and replication. For a detailed list of metrics and their descriptions, see [Cloud SQL for SQL Server default metrics](https://docs.cloud.google.com/sql/docs/sqlserver/use-system-insights.md.txt#default-metrics) and [Cloud SQL metrics](https://docs.cloud.google.com/sql/docs/sqlserver/admin-api/metrics.md.txt). **Cloud Storage** Feature You can pause hard deletions for a bucket when you need more time to restore soft-deleted objects before they're permanently deleted. For more information, see [Pause permanent (hard) deletions of soft-deleted objects](https://docs.cloud.google.com/storage/docs/pause-hard-deletions.md.txt). **Cloud Workstations** Feature The [Cloud Workstations base editor](https://docs.cloud.google.com/workstations/docs/preconfigured-ides.md.txt#cloud-workstations-base-editor) (Code OSS for Cloud Workstations) includes the [Antigravity extension](https://antigravity.google/docs/ide/extensions/vscode) by default. **Gemini Enterprise** Feature **Gemini Enterprise: Switch between teams in the mobile app** You can switch between multiple teams in the Gemini Enterprise mobile app without logging out and rescanning the QR code. (Teams were previously called instances.) When you open a team for the first time, the mobile app saves it to your teams list. Additionally, you can rename teams in the list and you can remove teams from your list. This feature is generally available (GA). For more information, see [Teams](https://docs.cloud.google.com/gemini/enterprise/docs/use-the-mobile-app.md.txt#teams) in *Use the mobile app*. **Gemini Enterprise Agent Platform** Feature **Provisioned Throughput support for supervised fine-tuned models (GA)** Provisioned Throughput [support for supervised fine-tuned models](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/provisioned-throughput/supported-models.md.txt#supervised-fine-tuned-model-support) is [generally available](https://cloud.google.com/products#product-launch-stages). Burndown rates for fine-tuned model inference can include a premium that's directly proportional to the model's fine-tuned inference pricing premium. Feature **AlphaGenome gRPC and unified HTTP serving support** AlphaGenome (`alphagenome-004`) now supports unified HTTP/2 gRPC streaming and chunked binary protobuf HTTP streaming on Gemini Enterprise Agent Platform: - Streams compressed binary tensor chunks directly over gRPC on shared endpoints (`PredictionService.StreamDirectRawPredict` on port `8081`) and chunked binary protobuf payloads (`proto_b64`) over HTTP on dedicated endpoints (`streamRawPredict` on port `8080`) across all seven `DnaModelService` methods (`predict_sequence`, `predict_interval`, `predict_variant`, `score_variant`, `score_interval`, `score_ism_variants`, and `output_metadata`) and 11 genomic modalities, reducing latency for 1 MB track predictions. - Supports concurrent multi-variant evaluation for in silico saturation mutagenesis (`score_ism_variants`) without HTTP gateway timeouts. - Supports model fold selection (`ALL_FOLDS`, `FOLD_0`, `FOLD_1`, `FOLD_2`, and `FOLD_3`) across both gRPC and HTTP clients through the unified `alphagenome_cloud_sdk` Python SDK. - Retains `alphagenome-003` in Model Garden for backward compatibility with existing legacy HTTP deployments. For more information, see the [AlphaGenome documentation](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/open-models/alphagenome.md.txt). **Google Distributed Cloud (software only) for VMware** Announcement Google Distributed Cloud (software only) for VMware 1.35.700-gke.124 is now available for download. To upgrade, see [Upgrade clusters](https://docs.cloud.google.com/kubernetes-engine/distributed-cloud/vmware/docs/how-to/upgrading.md.txt). Google Distributed Cloud 1.35.700-gke.124 runs on Kubernetes v1.35.8-gke.100. If you use a third-party storage vendor, check the listing of our previously-qualified [storage partners](https://docs.cloud.google.com/kubernetes-engine/enterprise/docs/resources/partner-storage.md.txt). After a release, it takes approximately 7 to 14 days for the version to become available for use with GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform. Feature The following changes were added in 1.35.700-gke.124: - Updated system components and container base images to remove the distrusted eMudhra (emSign) and AAA Certificate Services root CAs and reject compromised eMudhra intermediate CAs. - Upgraded Container-Optimized OS (COS) to milestone 121 (`cos-121-18867-652-7`), which removes the distrusted eMudhra (emSign) and AAA Certificate Services root CAs. - Updated the Ubuntu 24.04 node and admin workstation base image to `ubuntu-gke-op-2404-1-34-v20261024` to remove the distrusted eMudhra (emSign) root CAs (USN-8944-1). Fixed The following issues were fixed in 1.35.700-gke.124: - Fixed vulnerabilities listed in [Vulnerability fixes](https://docs.cloud.google.com/kubernetes-engine/distributed-cloud/vmware/docs/vulnerabilities.md.txt). - Fixed an issue where `audit-proxy` retried audit log exports indefinitely on permanent errors, generating excessive audit logging traffic. - Fixed an issue where the Kubernetes preflight health check scanned all namespaces in the admin cluster instead of the target cluster's namespace, causing cluster upgrades to fail if an unrelated cluster had stale reconciling resources. **Google Distributed Cloud (software only) for bare metal** Announcement Google Distributed Cloud (software only) for bare metal 1.35.700-gke.124 is now available for download. To upgrade, see [Upgrade clusters](https://docs.cloud.google.com/release-notes/how-to/upgrade). Google Distributed Cloud for bare metal 1.35.700-gke.124 runs on Kubernetes v1.35.8-gke.100. After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform. If you use a third-party storage vendor, check the listing of our previously-qualified [storage partners](https://docs.cloud.google.com/kubernetes-engine/enterprise/docs/resources/partner-storage.md.txt). Feature The following changes were added in 1.35.700-gke.124: - Updated system components and container base images to remove the distrusted eMudhra (emSign) and AAA Certificate Services root CAs and reject compromised eMudhra intermediate CAs. Fixed The following issues were fixed in 1.35.700-gke.124: - Fixed vulnerabilities listed in [Vulnerability fixes](https://docs.cloud.google.com/kubernetes-engine/distributed-cloud/bare-metal/docs/vulnerabilities.md.txt). - Fixed an issue where removing a node from a cluster left behind its local `PersistentVolume` resources instead of garbage collecting them. This fix applies to Google Distributed Cloud for bare metal local `PersistentVolume` resources created after upgrading to 1.35.700-gke.124; existing orphaned `PersistentVolume` resources must be deleted manually. - Fixed an issue where resetting or removing a control plane node could remove the wrong `etcd` or `etcd-events` member if another control plane node's IP address shared the same prefix (for example, `10.201.0.2` and `10.201.0.26`), causing the affected node to become `NotReady` and stalling cluster upgrades. - Improved `containerd` resilience against state corruption if a node reboots while unpacking container images. - Fixed an issue where the periodic configuration drift health check failed with a `version not supported` error while a cluster upgrade or rollback was in progress. - Fixed an issue where `audit-proxy` retried audit log exports indefinitely on permanent errors, generating excessive audit logging traffic. - Fixed an issue where the Kubernetes preflight health check scanned all namespaces in the admin cluster instead of the target cluster's namespace, causing cluster upgrades to fail if an unrelated cluster had stale reconciling resources. **Google SecOps** Announcement **\[Spotlight Feature\] Consolidated Settings and Navigation** The **Consolidated Settings and Navigation** feature is now in public preview. It replaces the separate SIEM Settings and SOAR Settings menus with a single Settings menu, grouped into Administration, Access Management, Investigation, Detection and Data Management, and also updates the left navigation menu. Each settings page is shown only to users with the correct permissions. Cloud IAM, Viewer and Editor users can now view certain SOAR settings pages in read-only mode. The Google SecOps documentation has been updated to reflect the new navigational changes. For more information, see [Navigate the Google SecOps platform](https://docs.cloud.google.com/chronicle/docs/secops/navigate-the-secops-platform.md.txt). This feature is being rolled out in waves starting Monday, November 9 and continuing through Thursday, November 12. **Knowledge Catalog** Feature Data products in Knowledge Catalog let you request access to an access group for a Google Group or on behalf of another user, in addition to yourself or a service account. Both the requester and the requested user or Google Group receive email notifications when an access request is submitted, approved, or rejected. This feature is [generally available](https://cloud.google.com/products#product-launch-stages). For more information, see [Request access to data products](https://docs.cloud.google.com/knowledge-catalog/docs/use-data-products.md.txt#request-access) and [Manage data product access requests](https://docs.cloud.google.com/knowledge-catalog/docs/manage-data-products.md.txt#manage-access-request). ## November 03, 2026 **API Gateway** Feature **Call Google Cloud APIs from streaming gateways** Streaming gateways can now call Google Cloud APIs such as `aiplatform.googleapis.com`. A gateway with an `effectiveStreamingMode` of `EFFECTIVE_STREAMING_MODE_ENABLED` authenticates to backends whose host ends in `.googleapis.com` or `.vertexai.goog` with an access token for the gateway's service account. Other backends still receive an ID token. An existing streaming gateway switches when API Gateway next rolls out a gateway update, or immediately when you update it to a new API config. For more information, see [Securing backend services](https://docs.cloud.google.com/api-gateway/docs/securing-backend-services.md.txt#other-gcp-apis). **AlloyDB for PostgreSQL** Change AlloyDB for PostgreSQL now defaults to [PostgreSQL major version 18](https://docs.cloud.google.com/alloydb/docs/db-version-policies.md.txt#support-table) for new clusters. **Apigee X** Announcement On November 3, 2026, we released an updated version of Apigee (1-18-0-apigee-8). > [!NOTE] > **Note:** Rollouts of this release began today and can take four or more business days to complete across all Google Cloud zones. Your instances might not have the features and fixes available until the rollout is complete. Security | Bug ID | Description | |---|---| | **N/A** | **Security fix for Apigee infrastructure.** | Fixed | Bug ID | Description | |---|---| | **574037227** | Added config override token `oauth_default_access_token_expiry_time_in_millis` (per-org via the deployment contract) that overrides the default OAuthV2 access token lifetime (ms) applied when a policy omits ``. When unset, behavior is unchanged (installation default, typically 30 days). | | **573326336** | Proxies that declare `MCP` are now recognized as [MCP proxies](https://docs.cloud.google.com/apigee/docs/api-platform/apigee-mcp/apigee-mcp-overview.md.txt) regardless of their basepath. | | **576697209** | LLMTokenQuota no longer counts tokens for responses that SemanticCacheLookup serves from the cache, and records no ai_llm_response_token_count for them. | | **578314600** | The Apigee Connect agent now uses HTTP/2 keepalive pings on the control-plane connection, detecting a silently dropped connection in \~80s (vs \~2h) while honoring HTTPS_PROXY (including proxy credentials), so proxy-only clusters re-establish connectivity. | | **N/A** | Updates to infrastructure and libraries. | **Apigee hybrid** Announcement ### v1.15.10 On November 3, 2026 we released an updated version of the Apigee hybrid software, v1.15.10. - For information about upgrading, see [Upgrading Apigee hybrid to v1.15.10](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/upgrade.md.txt). - For information about new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/big-picture.md.txt). > [!NOTE] > **Note:** This is a patch release. The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch by using the Helm chart automatically updates the images. You don't typically need to make manual image changes. For information about container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images). Fixed #### Fixed in this release | Bug ID | Description | |---|---| | **578314600** | **Fixed an issue where `apigee-connect-agent` ignored `HTTPS_PROXY` and failed to establish a tether in clusters that require an HTTP forward proxy for egress; the agent now uses HTTP/2 keepalive pings on the control-plane connection while honoring `HTTPS_PROXY` (including proxy credentials).** | | **576707253** | **Removed the compromised emSign roots and the cross-signing Comodo AAA Services root from the system and Java (`cacerts`) trust stores across containers.** | Security | Bug ID | Description | |---|---| | **N/A** | **Security fixes for `apigee-asm-ingress`.** This addresses the following vulnerabilities: - [CVE-2026-116585](https://nvd.nist.gov/vuln/detail/CVE-2026-116585) - [CVE-2026-116586](https://nvd.nist.gov/vuln/detail/CVE-2026-116586) - [CVE-2026-63209](https://nvd.nist.gov/vuln/detail/CVE-2026-63209) | | **N/A** | **Security fixes for `apigee-asm-istiod`.** This addresses the following vulnerabilities: - [CVE-2026-116585](https://nvd.nist.gov/vuln/detail/CVE-2026-116585) - [CVE-2026-116586](https://nvd.nist.gov/vuln/detail/CVE-2026-116586) - [CVE-2026-40179](https://nvd.nist.gov/vuln/detail/CVE-2026-40179) - [CVE-2026-42151](https://nvd.nist.gov/vuln/detail/CVE-2026-42151) - [CVE-2026-42154](https://nvd.nist.gov/vuln/detail/CVE-2026-42154) - [CVE-2026-44903](https://nvd.nist.gov/vuln/detail/CVE-2026-44903) - [CVE-2026-63209](https://nvd.nist.gov/vuln/detail/CVE-2026-63209) | | **N/A** | **Security fixes for `apigee-envoy`.** This addresses the following vulnerabilities: - [CVE-2026-5450](https://nvd.nist.gov/vuln/detail/CVE-2026-5450) - [CVE-2026-5928](https://nvd.nist.gov/vuln/detail/CVE-2026-5928) | | **N/A** | **Security fixes for `apigee-fluent-bit`.** This addresses the following vulnerabilities: - [CVE-2026-111497](https://nvd.nist.gov/vuln/detail/CVE-2026-111497) - [CVE-2026-8286](https://nvd.nist.gov/vuln/detail/CVE-2026-8286) - [CVE-2026-8924](https://nvd.nist.gov/vuln/detail/CVE-2026-8924) - [CVE-2026-8927](https://nvd.nist.gov/vuln/detail/CVE-2026-8927) - [CVE-2026-92392](https://nvd.nist.gov/vuln/detail/CVE-2026-92392) | | **N/A** | **Security fixes for `apigee-hybrid-cassandra`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) | | **N/A** | **Security fixes for `apigee-kube-rbac-proxy`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) | | **N/A** | **Security fixes for `apigee-operators`.** This addresses the following vulnerability: - [CVE-2026-63209](https://nvd.nist.gov/vuln/detail/CVE-2026-63209) | | **N/A** | **Security fixes for `apigee-prom-prometheus`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) | | **N/A** | **Security fixes for `apigee-udca`.** This addresses the following vulnerabilities: - [CVE-2026-116585](https://nvd.nist.gov/vuln/detail/CVE-2026-116585) - [CVE-2026-116586](https://nvd.nist.gov/vuln/detail/CVE-2026-116586) - [CVE-2026-116587](https://nvd.nist.gov/vuln/detail/CVE-2026-116587) | | **N/A** | **Security fixes for `apigee-watcher`.** This addresses the following vulnerability: - [CVE-2026-63209](https://nvd.nist.gov/vuln/detail/CVE-2026-63209) | **Application Design Center** Feature Application Design Center is available in the following regions: - Osaka, Japan (`asia-northeast2`) - Mumbai, India (`asia-south1`) - Bangkok, Thailand (`asia-southeast3`) - Sydney, Australia (`australia-southeast1`) - Berlin, Germany (`europe-west10`) - Moncks Corner, South Carolina (`us-east1`) - Dammam, Saudi Arabia (`me-central2`) For more information, see [App Design Center locations](https://docs.cloud.google.com/application-design-center/docs/locations.md.txt). **BigQuery** Feature You can now use persistent and temporary [SQL user-defined functions (UDFs)](https://docs.cloud.google.com/bigquery/docs/user-defined-functions.md.txt#continuous-queries) in [BigQuery continuous queries](https://docs.cloud.google.com/bigquery/docs/continuous-queries.md.txt#use-sql-udfs) to encapsulate and reuse custom real-time transformation logic. Only SQL UDFs are supported in continuous queries. Change In [BigQuery Studio](https://docs.cloud.google.com/bigquery/docs/bigquery-web-ui.md.txt#studio-overview), the left pane has been updated with new tab names. The **Classic Explorer** tab has been renamed to the **Data** tab, and the **Repository** tab has been renamed to the **Source control** tab. The **Data** tab now includes the **Add data** button and focuses on data hierarchies. These changes are [generally available](https://cloud.google.com/products#product-launch-stages) (GA). **Cloud SQL for PostgreSQL** Change The rollout of the following Cloud SQL for PostgreSQL minor version and extension upgrades is complete: **Minor versions** - 14.23 is upgraded to 14.24. - 15.18 is upgraded to 15.19. - 16.14 is upgraded to 16.15. - 17.10 is upgraded to 17.11. - 18.4 is upgraded to 18.6. This version includes a backported fix for [PostgreSQL bug #19616](https://git.postgresql.org/gitweb/?p=postgresql.git;h%3Dcaa463e3f8d2b9c1441e6a59c50f90b8598439f3) that prevents logical decoding from emitting `STREAM_ABORT` messages for unstreamed transactions when an aborted transaction with a subtransaction is truncated during memory eviction. **Extensions** - `hll` (`postgresql-hll`) is upgraded from 2.18 to 2.20. - `pg_qualstats` is upgraded from 2.1.2 to 2.1.4. - `pglogical` is upgraded from 2.4.5 (for PostgreSQL 17 and earlier) and 2.4.6 (for PostgreSQL 18) to 2.4.8. - `pgTAP` is upgraded from 1.3.0 to 1.3.4. - `pgtt` is upgraded from 4.0 to 4.6.0 for PostgreSQL 12 and later. - `PL/Proxy` is upgraded from 2.11.0 to 2.12.0. - `PostGIS` is upgraded from 3.5.2 (for PostgreSQL 13 through 17) and 3.6.0 (for PostgreSQL 18) to 3.6.4 for PostgreSQL 13 and later. - `roaringbitmap` (`pg_roaringbitmap`) is upgraded from 0.5 to 1.2 for PostgreSQL 12 and later. The new maintenance version is [`[PostgreSQL version].R20261013.02_04`](https://docs.cloud.google.com/sql/docs/postgres/maintenance-changelog.md.txt). If you use a maintenance window, then the updates to the minor and extension versions happen according to the timeframe that you set in the window. Otherwise, the updates occur within the next few weeks. For more information about checking your maintenance version, see [Perform self-service maintenance](https://docs.cloud.google.com/sql/docs/postgres/self-service-maintenance.md.txt). To find your maintenance window or to manage maintenance updates, see [Find and set maintenance windows](https://docs.cloud.google.com/sql/docs/postgres/set-maintenance-window.md.txt). For more information about supported extensions, see [Configure PostgreSQL extensions](https://docs.cloud.google.com/sql/docs/postgres/extensions.md.txt). **Cluster Toolkit** Feature Cluster Toolkit v1.108.0 is available. This release lets you pin node pools to reservation sub-blocks in the [`gke-node-pool` module](https://docs.cloud.google.com/cluster-toolkit/docs/modules/gke-node-pool.md.txt), adds Slurm support for Cloud TPU v5e, v5p, and v6e, and introduces the `gcluster explain` command to inspect blueprints and modules. This release also exposes the `wait_for_pods_ready` configuration for Kueue in the [`kubectl-apply` module](https://docs.cloud.google.com/cluster-toolkit/docs/modules/kubectl-apply.md.txt) and sets the `recovery_timeout` field to `0s` by default for [Pathways workloads](https://docs.cloud.google.com/cluster-toolkit/docs/deploy/gke/run-workloads-pathways.md.txt). Additionally, this release suppresses configuration drift for clusters and node pools in the `ignore_changes` argument of the `lifecycle` block for Google Kubernetes Engine (GKE), and upgrades the network modules for the Cloud Foundation Toolkit (CFT) to version 18.3 and later. This update also checks credentials for Artifact Registry and Docker only when a [job submission](https://docs.cloud.google.com/cluster-toolkit/docs/reference/gcluster-job-submit.md.txt) uses Crane to build container images. For more information, see the [release announcement on GitHub](https://github.com/GoogleCloudPlatform/cluster-toolkit/discussions/6622). **Gemini Enterprise** Feature **Gemini Enterprise: Salesforce federated data store** Connecting a Salesforce data source with Gemini Enterprise using data federation is generally available (GA). You can use the Gemini Enterprise app assistant to search across your Salesforce accounts, contacts, opportunities, cases, leads, and custom objects, get answers grounded in that content, and create, update, and delete records without needing to ingest the data. For more information, see [Set up a Salesforce data store](https://docs.cloud.google.com/gemini/enterprise/docs/connectors/salesforce/set-up-data-store.md.txt). **Google Kubernetes Engine** Feature In GKE version 1.37.0-gke.3570000 and later, you can split each Local SSD on a node between ephemeral storage and raw block storage. When you create a cluster or node pool, use the `capacity` property of the `--ephemeral-storage-local-ssd` flag to set how much Local SSD capacity GKE formats for ephemeral storage. GKE leaves the rest of each Local SSD unformatted, so that workloads like databases and caches can use it as raw block storage. This feature is available in GKE Standard clusters. For more information, see [Provision and use mixed Local SSDs for raw block and ephemeral storage](https://docs.cloud.google.com/kubernetes-engine/docs/how-to/persistent-volumes/mixed-local-ssd.md.txt). **Knowledge Catalog** Feature Governance workflows in Knowledge Catalog support batch metadata change requests. You can group up to 250 create, update, and delete operations for entries and entry links into a single change request and curate batch proposals generated by the enrichment agent before approval. This feature is [available in preview](https://cloud.google.com/products#product-launch-stages). For more information, see [About governance workflows](https://docs.cloud.google.com/knowledge-catalog/docs/about-governance-workflows.md.txt). **Oracle Database@Google Cloud** Feature Oracle Database@Google Cloud introduces Database Connections using which you can connect to your Oracle databases and execute SQL statements. For more information, see [Create Database Connections](https://docs.cloud.google.com/oracle/database/docs/create-database-connection.md.txt) and [Execute SQL statements](https://docs.cloud.google.com/oracle/database/docs/execute-sql.md.txt). This feature is [generally available (GA)](https://cloud.google.com/products#product-launch-stages). **Sensitive Data Protection** Change Sensitive Data Protection now records the [last generated timestamp](https://docs.cloud.google.com/sensitive-data-protection/docs/metrics-reference) for [data profiles](https://docs.cloud.google.com/sensitive-data-protection/docs/data-profiles) with improved precision, close to the time when the resource data is read. **VPC Service Controls** Feature [General availability](https://cloud.google.com/products#product-launch-stages) support for the following integration: - [Service Management](https://docs.cloud.google.com/vpc-service-controls/docs/supported-products.md.txt#table_management) **Virtual Private Cloud** Feature **General Availability** : VPC Flow Logs supports logging for IPv6 encapsulation flows. For more information, see [IpConnection field format](https://docs.cloud.google.com/vpc/docs/about-flow-logs-records.md.txt#IpConnection). ## November 02, 2026 **Agent Platform Workbench** Change ### 20261101.00_p0 Release Change Installed latest packages from upstream dependencies. Security Upgraded the container host to the latest Container-Optimized OS LTS release, rebasing onto the newest operating system, Go, and containerd security fixes. Security Updated the CA certificate configuration. Change ### 20261101.00_p0 Release Change Installed latest packages from upstream dependencies. Security Upgraded the container host to the latest Container-Optimized OS LTS release, rebasing onto the newest operating system, Go, and containerd security fixes. Security Updated the CA certificate configuration. **AlloyDB for PostgreSQL** Feature You can now tune SQL queries using AI. Available starting with version 1.6.2 of the `google_ml_integration` extension, the `ai.tune_sql` function uses an LLM along with query execution plans, schemas, and runtime stats to recommend query optimizations. The function identifies performance bottlenecks and provides recommendations for query rewrites, indexes, statistics collection, Grand Unified Configuration (GUC) flags, and table analyze and vacuum operations. This feature is in [Preview](https://cloud.google.com/products#product-launch-stages). For more information, see [Tune SQL queries using AI](https://docs.cloud.google.com/alloydb/docs/tune-sql-queries-ai.md.txt) and [Database advisor flags](https://docs.cloud.google.com/alloydb/docs/reference/database-advisor-flags.md.txt). **Apigee X** Announcement On November 2, 2026, we released an updated version of Apigee. > [!NOTE] > **Note:** Rollouts of this release began today and may take four or more business days to be completed across all Google Cloud zones. Your instances may not have the features and fixes available until the rollout is complete. Feature **EKM health monitoring** You can now monitor EKM health and configure alerts for EKM-related issues using Cloud Logging. For more information, see [EKM health monitoring](https://docs.cloud.google.com/apigee/docs/api-platform/security/ekm-monitoring.md.txt). **App Engine flexible environment Python** Feature Support for the [Python 3.15 runtime](https://docs.cloud.google.com/appengine/docs/flexible/python/runtime.md.txt) is in [Preview](https://cloud.google.com/products/#product-launch-stages). **App Engine standard environment Python** Feature Support for the [Python 3.15 runtime](https://docs.cloud.google.com/appengine/docs/standard/python3/runtime.md.txt) is in [Preview](https://cloud.google.com/products/#product-launch-stages). **BigQuery** Feature *Lakehouse* [caching](https://docs.cloud.google.com/lakehouse/docs/about-cross-cloud-data-access.md.txt#intelligent-caching) for cross-cloud data access is [generally available](https://cloud.google.com/products/#product-launch-stages) (GA). Cross-cloud caching is disabled by default. You can opt in to caching on a Lakehouse federated catalog or a BigQuery cross-cloud connection to cache remote files in your Google Cloud region. This helps reduce cross-cloud egress costs and accelerate subsequent queries. For more information, see [About cross-cloud data access](https://docs.cloud.google.com/lakehouse/docs/about-cross-cloud-data-access#intelligent-caching) and [Query remote data](https://docs.cloud.google.com/lakehouse/docs/query-remote-data.md.txt). Feature *Lakehouse* supports the following remote catalog providers for cross-cloud data access. This feature is [generally available](https://cloud.google.com/products/#product-launch-stages) (GA). - [Databricks Unity Catalog](https://docs.cloud.google.com/lakehouse/docs/set-up-cross-cloud-connection-databricks) on Amazon Web Services (AWS), Microsoft Azure, or Google Cloud - [AWS Glue Data Catalog](https://docs.cloud.google.com/lakehouse/docs/set-up-cross-cloud-connection-aws-glue) on AWS - [Snowflake Horizon Catalog](https://docs.cloud.google.com/lakehouse/docs/set-up-cross-cloud-connection-snowflake) on AWS, Microsoft Azure, or Google Cloud - [Workday Data Lake](https://docs.cloud.google.com/lakehouse/docs/set-up-cross-cloud-connection-workday.md.txt) on AWS or Google Cloud This feature lets you configure federated catalog endpoints to synchronize catalog metadata and query Apache Iceberg tables in remote catalogs directly from Google Cloud using BigQuery, Managed Service for Apache Spark, and Apache Spark without migrating data or building complex ETL pipelines. You can route background metadata refresh and queries over the public internet or privately over Cross-Cloud Interconnect, and protect cross-cloud data access with VPC Service Controls service perimeters. For Databricks Unity Catalog, you can also use [user identity federation](https://docs.cloud.google.com/lakehouse/docs/set-up-cross-cloud-connection-databricks#configure-user-identity-federation) to propagate end-user identities on queries for permission enforcement and audit logging. For more information, see [About cross-cloud data access](https://docs.cloud.google.com/lakehouse/docs/about-cross-cloud-data-access), [Query remote data](https://docs.cloud.google.com/lakehouse/docs/query-remote-data), and [Use VPC Service Controls with federated catalog endpoints](https://docs.cloud.google.com/lakehouse/docs/vpc-sc-federated-catalogs). Feature You can now [monitor](https://docs.cloud.google.com/bigquery/docs/create-data-agents.md.txt#monitor_agents_and_conversations) the performance, adoption, latency, and costs of your data agents and their conversations by using Google Cloud Observability in BigQuery. This feature is [generally available](https://cloud.google.com/products#product-launch-stages) (GA). Feature You can use the [`AI.PARSE_DOCUMENT` function](https://docs.cloud.google.com/bigquery/docs/reference/standard-sql/bigqueryml-syntax-ai-parse-document.md.txt) to extract layout elements such as titles, headings, paragraphs, lists, tables, and images by using the Document AI layout parser to convert unstructured documents into structured `JSON` data. This function is [generally available](https://cloud.google.com/products#product-launch-stages) (GA). Feature You can now use BigQuery change history and continuous queries for [Apache Iceberg managed tables](https://docs.cloud.google.com/bigquery/docs/biglake-iceberg-tables-in-bigquery.md.txt) in Lakehouse. You can use the `APPENDS` table-valued function (TVF) to track rows appended to Apache Iceberg managed tables over a specified time range, and use [BigQuery continuous queries](https://docs.cloud.google.com/bigquery/docs/continuous-queries.md.txt) to read incoming data from and write output rows to Apache Iceberg managed tables. This feature is [generally available](https://cloud.google.com/products#product-launch-stages) (GA). For more information, see [Work with change history](https://docs.cloud.google.com/lakehouse/docs/change-history) and [Introduction to continuous queries](https://docs.cloud.google.com/bigquery/docs/continuous-queries-introduction). Feature The [`SECURE_CONTEXT` function](https://docs.cloud.google.com/bigquery/docs/reference/standard-sql/security_functions.md.txt#secure_context) is now available in [Preview](https://cloud.google.com/products#product-launch-stages). `SECURE_CONTEXT` returns the value of a request-scoped secure context parameter provided at query runtime, allowing logical views to dynamically filter and evaluate data based on context variables such as user attributes, department IDs, or tenant identifiers. Feature The Data Engineering Agent now supports [BigQuery AI, ML, and object functions and statements in generated Dataform SQLX pipelines and agent instruction files](https://docs.cloud.google.com/bigquery/docs/data-engineering-agent-pipelines#bigquery-ai-ml-support). This feature is [generally available](https://cloud.google.com/products#product-launch-stages) (GA). **Bigtable** Libraries ### Node.js #### [7.5.1](https://github.com/googleapis/google-cloud-node/compare/bigtable-v7.5.0...bigtable-v7.5.1) (2026-10-28) ##### Bug Fixes - **bigtable:** Use ReadonlyMap for EncodedKeyMap implements clause ([#9709](https://github.com/googleapis/google-cloud-node/issues/9709)) ([f803bff](https://github.com/googleapis/google-cloud-node/commit/f803bff4714360aa7c05387251bcb319536ae3f3)) **Cloud Asset Inventory** Feature The following resource type is publicly available through the [ExportAssets](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/exportAssets.md.txt), [ListAssets](https://docs.cloud.google.com/asset-inventory/docs/listing-assets), [BatchGetAssetsHistory](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/batchGetAssetsHistory.md.txt), [QueryAssets](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/queryAssets.md.txt), [Feed](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/feeds.md.txt), [SearchAllResources](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/searchAllResources.md.txt), and [SearchAllIamPolicies](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/searchAllIamPolicies.md.txt) APIs. - Cloud Scheduler - `cloudscheduler.googleapis.com/Job` **Cloud Load Balancing** Feature Distributed tracing with Cloud Trace is available in [Preview](https://cloud.google.com/products#product-launch-stages) for Global external Application Load Balancers, Regional external Application Load Balancers, Regional internal Application Load Balancers, and Cross-region internal Application Load Balancers. Attach a telemetry policy to a load balancer's forwarding rule to generate trace spans that conform to W3C Trace Context and OpenTelemetry, and get end-to-end visibility into requests from clients through the load balancer to your backends. For more information, see [Distributed tracing overview](https://docs.cloud.google.com/load-balancing/docs/distributed-tracing-overview.md.txt). Feature For mutual TLS (mTLS) on Application Load Balancers, frontend mTLS validation relaxations are **generally available**. The `ALLOW_VALIDATION_RELAXATIONS` client validation mode on the Client Authentication (`ServerTlsPolicy`) resource allows you to configure specific X.509 certificate validation exceptions to standard client certificate validation rules. This simplifies migrations of legacy workloads while maintaining an active security posture. This mode supports the following client certificate validation relaxation parameters: - `ALLOW_MISSING_EKU`: Bypasses Extended Key Usage validation if the EKU extension is absent in the client certificate. - `ALLOW_SHA1_HASHING`: Permits client certificates signed with the legacy SHA-1 algorithm. - `ALLOW_EXPIRED_LEAF_CERTIFICATE`: Evaluates expired leaf certificates by validating them as of 1 second prior to their actual expiration time. This feature is available for all Application Load Balancer types. For more information, see [Client validation modes](https://docs.cloud.google.com/load-balancing/docs/mtls.md.txt#client-validation-mode). **Cloud NGFW** Feature Advanced malware sandbox (WildFire) integrates dynamic machine learning (ML) and cloud-based behavioral sandboxing to perform deep inspection of network-routed file transfers and block zero-day malware before it reaches your workloads. Advanced malware sandbox is available in the Cloud Next Generation Firewall Enterprise tier. For more information, see [Advanced malware sandbox overview](https://docs.cloud.google.com/firewall/docs/about-wildfire.md.txt) and [Configure Advanced malware sandbox in your network](https://docs.cloud.google.com/firewall/docs/configure-wildfire.md.txt). This feature is available in **General Availability**. **Cloud Run** Feature Support for the [Python 3.15 runtime](https://docs.cloud.google.com/run/docs/runtime-support.md.txt#python) is in [Preview](https://cloud.google.com/products/#product-launch-stages). **Cloud Run functions** Feature Support for the [Python 3.15 runtime](https://docs.cloud.google.com/functions/docs/concepts/execution-environment#python) is in [Preview](https://cloud.google.com/products/#product-launch-stages). **Cloud Service Mesh** Announcement **1.31.3-asm.3 is now available for in-cluster Cloud Service Mesh.** For details on upgrading Cloud Service Mesh, see [Upgrade Cloud Service Mesh](https://docs.cloud.google.com/service-mesh/docs/upgrade/upgrade.md.txt). Cloud Service Mesh 1.31.3-asm.3 uses Envoy v1.39.5-dev. This release resolves the security vulnerability listed in Security Bulletin [GCP-2026-076](https://cloud.google.com/service-mesh/docs/security-bulletins#gcp-2026-076) ([ISTIO-SECURITY-2026-008](https://istio.io/latest/news/security/istio-security-2026-008/)). Fixed Patch 1.31.3-asm.3 contains the fix for the following platform CVEs: | CVE | Proxy | Control Plane | Distroless | CNI | Severity | |---|---|---|---|---|---| | [CVE-2026-111497](https://nvd.nist.gov/vuln/detail/CVE-2026-111497) | Yes | Yes | No | Yes | High (9.8) | | [CVE-2026-85091](https://nvd.nist.gov/vuln/detail/CVE-2026-85091) | Yes | Yes | No | Yes | Medium (8.3) | | [CVE-2026-86409](https://nvd.nist.gov/vuln/detail/CVE-2026-86409) | Yes | Yes | No | Yes | Low (8.1) | | [CVE-2026-86414](https://nvd.nist.gov/vuln/detail/CVE-2026-86414) | Yes | Yes | No | Yes | Low (0.0) | | [CVE-2026-87862](https://nvd.nist.gov/vuln/detail/CVE-2026-87862) | Yes | Yes | No | Yes | Low (0.0) | | [CVE-2026-87863](https://nvd.nist.gov/vuln/detail/CVE-2026-87863) | Yes | Yes | No | Yes | Low (0.0) | | [CVE-2026-87864](https://nvd.nist.gov/vuln/detail/CVE-2026-87864) | Yes | Yes | No | Yes | Low (0.0) | | [CVE-2026-92388](https://nvd.nist.gov/vuln/detail/CVE-2026-92388) | Yes | Yes | No | Yes | Low (0.0) | | [CVE-2026-92389](https://nvd.nist.gov/vuln/detail/CVE-2026-92389) | Yes | Yes | No | Yes | Low (0.0) | | [CVE-2026-92391](https://nvd.nist.gov/vuln/detail/CVE-2026-92391) | Yes | Yes | No | Yes | Low (0.0) | | [CVE-2026-94266](https://nvd.nist.gov/vuln/detail/CVE-2026-94266) | Yes | Yes | No | Yes | Low (0.0) | Announcement **1.30.7-asm.3 is now available for in-cluster Cloud Service Mesh.** For details on upgrading Cloud Service Mesh, see [Upgrade Cloud Service Mesh](https://docs.cloud.google.com/service-mesh/v1.30/docs/upgrade/upgrade.md.txt). Cloud Service Mesh 1.30.7-asm.3 uses Envoy v1.38.8-dev. This release resolves the security vulnerability listed in Security Bulletin [GCP-2026-076](https://cloud.google.com/service-mesh/docs/security-bulletins#gcp-2026-076) ([ISTIO-SECURITY-2026-008](https://istio.io/latest/news/security/istio-security-2026-008/)). Fixed Patch 1.30.7-asm.3 contains the fix for the following platform CVEs: | CVE | Proxy | Control Plane | Distroless | CNI | Severity | |---|---|---|---|---|---| | [CVE-2026-111497](https://nvd.nist.gov/vuln/detail/CVE-2026-111497) | Yes | Yes | No | Yes | High (9.8) | | [CVE-2026-5450](https://nvd.nist.gov/vuln/detail/CVE-2026-5450) | No | No | Yes | No | Low (9.8) | | [CVE-2026-85091](https://nvd.nist.gov/vuln/detail/CVE-2026-85091) | Yes | Yes | No | Yes | Medium (8.3) | | [CVE-2026-86409](https://nvd.nist.gov/vuln/detail/CVE-2026-86409) | Yes | Yes | No | Yes | Low (8.1) | | [CVE-2026-116587](https://nvd.nist.gov/vuln/detail/CVE-2026-116587) | Yes | Yes | Yes | Yes | High (7.5) | | [CVE-2026-5928](https://nvd.nist.gov/vuln/detail/CVE-2026-5928) | No | No | Yes | No | Low (7.5) | | [CVE-2026-86414](https://nvd.nist.gov/vuln/detail/CVE-2026-86414) | Yes | Yes | No | Yes | Low (0.0) | | [CVE-2026-87862](https://nvd.nist.gov/vuln/detail/CVE-2026-87862) | Yes | Yes | No | Yes | Low (0.0) | | [CVE-2026-87863](https://nvd.nist.gov/vuln/detail/CVE-2026-87863) | Yes | Yes | No | Yes | Low (0.0) | | [CVE-2026-87864](https://nvd.nist.gov/vuln/detail/CVE-2026-87864) | Yes | Yes | No | Yes | Low (0.0) | | [CVE-2026-92388](https://nvd.nist.gov/vuln/detail/CVE-2026-92388) | Yes | Yes | No | Yes | Low (0.0) | | [CVE-2026-92389](https://nvd.nist.gov/vuln/detail/CVE-2026-92389) | Yes | Yes | No | Yes | Low (0.0) | | [CVE-2026-92391](https://nvd.nist.gov/vuln/detail/CVE-2026-92391) | Yes | Yes | No | Yes | Low (0.0) | | [CVE-2026-94266](https://nvd.nist.gov/vuln/detail/CVE-2026-94266) | Yes | Yes | No | Yes | Low (0.0) | Announcement **1.29.10-asm.0 is now available for in-cluster Cloud Service Mesh.** For details on upgrading Cloud Service Mesh, see [Upgrade Cloud Service Mesh](https://docs.cloud.google.com/service-mesh/v1.29/docs/upgrade/upgrade.md.txt). Cloud Service Mesh 1.29.10-asm.0 uses Envoy v1.37.10-dev. This release resolves the security vulnerability listed in Security Bulletin [GCP-2026-076](https://cloud.google.com/service-mesh/docs/security-bulletins#gcp-2026-076) ([ISTIO-SECURITY-2026-008](https://istio.io/latest/news/security/istio-security-2026-008/)). Fixed Patch 1.29.10-asm.0 contains the fix for the following platform CVEs: | CVE | Proxy | Control Plane | Distroless | CNI | Severity | |---|---|---|---|---|---| | [CVE-2026-111497](https://nvd.nist.gov/vuln/detail/CVE-2026-111497) | Yes | Yes | No | Yes | High (9.8) | | [CVE-2026-5450](https://nvd.nist.gov/vuln/detail/CVE-2026-5450) | No | No | Yes | No | Low (9.8) | | [CVE-2026-85091](https://nvd.nist.gov/vuln/detail/CVE-2026-85091) | Yes | Yes | No | Yes | Medium (8.3) | | [CVE-2026-86409](https://nvd.nist.gov/vuln/detail/CVE-2026-86409) | Yes | Yes | No | Yes | Low (8.1) | | [CVE-2026-116587](https://nvd.nist.gov/vuln/detail/CVE-2026-116587) | Yes | Yes | Yes | Yes | High (7.5) | | [CVE-2026-5928](https://nvd.nist.gov/vuln/detail/CVE-2026-5928) | No | No | Yes | No | Low (7.5) | | [CVE-2026-86414](https://nvd.nist.gov/vuln/detail/CVE-2026-86414) | Yes | Yes | No | Yes | Low (0.0) | | [CVE-2026-87862](https://nvd.nist.gov/vuln/detail/CVE-2026-87862) | Yes | Yes | No | Yes | Low (0.0) | | [CVE-2026-87863](https://nvd.nist.gov/vuln/detail/CVE-2026-87863) | Yes | Yes | No | Yes | Low (0.0) | | [CVE-2026-87864](https://nvd.nist.gov/vuln/detail/CVE-2026-87864) | Yes | Yes | No | Yes | Low (0.0) | | [CVE-2026-92388](https://nvd.nist.gov/vuln/detail/CVE-2026-92388) | Yes | Yes | No | Yes | Low (0.0) | | [CVE-2026-92389](https://nvd.nist.gov/vuln/detail/CVE-2026-92389) | Yes | Yes | No | Yes | Low (0.0) | | [CVE-2026-92391](https://nvd.nist.gov/vuln/detail/CVE-2026-92391) | Yes | Yes | No | Yes | Low (0.0) | | [CVE-2026-94266](https://nvd.nist.gov/vuln/detail/CVE-2026-94266) | Yes | Yes | No | Yes | Low (0.0) | Feature Configuring authorization policies (`GCPAuthzPolicy`) on Cloud Service Mesh sidecars on Google Kubernetes Engine (GKE) is now available ([Preview](https://cloud.google.com/products#product-launch-stages)). This feature is supported only for Cloud Service Mesh with the Gateway API. You can allow or deny inbound HTTP requests at the namespace or workload level, or delegate decisions to an external authorization engine (`GCPAuthzExtension`). For more information, see [Setup authorization policies on sidecars on GKE](https://docs.cloud.google.com/service-mesh/docs/gateway/authorization-policy-sidecar.md.txt). **Compute Engine** Feature **Generally available**: You can now create C4 sole-tenant nodes on Intel Granite Rapids with the following node types: - `c4-node-288-576` - `c4-node-288-1080` - `c4-node-288-1080-lssd` - `c4-node-288-2232` - `c4-node-288-2232-lssd` For more information, see [Sole-tenancy overview](https://docs.cloud.google.com/compute/docs/nodes/sole-tenant-nodes.md.txt). **Datastream** Feature Datastream is now available in the `africa-south1` (Johannesburg) region. For the list of all available regions, see [IP allowlists and regions](https://docs.cloud.google.com/datastream/docs/ip-allowlists-and-regions.md.txt). Feature Datastream is now available in the `asia-southeast3` (Bangkok) region. For the list of all available regions, see [IP allowlists and regions](https://docs.cloud.google.com/datastream/docs/ip-allowlists-and-regions.md.txt). **Gemini Enterprise Agent Platform** Feature **Serving tuned Gemini 3.x models on global endpoints** Serving tuned Gemini 3.x models on `global` endpoints is available in [General Availability (GA)](https://cloud.google.com/products#product-launch-stages). You can copy fine-tuned Gemini 3.x models to the `global` region using the Model Registry `models:copy` API, deploy them to global serving endpoints, and send inference requests directly to `aiplatform.googleapis.com`. For more information, see [About supervised fine-tuning for Gemini models](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/tuning/supervised-tuning.md.txt) and [Tune Gemini models with supervised fine-tuning](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/tuning/supervised-tuning/use.md.txt#copy-tuned-model). **Google Cloud Contact Center as a Service** Announcement **Google Cloud CCaaS 6.29** We've released version 6.29 of Google Cloud CCaaS. The timing of the update to your instance depends on the deployment schedule that you have chosen. For more information, see [Deployment schedules](https://docs.cloud.google.com/contact-center/ccai-platform/docs/deployment-schedules). Feature **Email session hiding (Apps API)** You can now hide email sessions from the agent adapter using two new Apps API endpoints. Hiding a session removes it from agent lists, counts, search, and the supervisor dashboard's live counters without deleting the session or changing its status. If an end-user replies to a hidden session, the session automatically unhides and follows your existing reply-handling rules. This capability is available through the Apps API only. By default, this capability is inactive. Contact Google Cloud Support to turn it on for your instance. Fixed This release addresses the following issues: - Fixed an issue where cross-language agent-to-queue voice transfers played whisper audio and displayed **Selected Language** in the source language instead of the transfer target language. - Fixed an issue where the unread chat badge in the agent adapter displayed an inflated count on chats escalated from a virtual agent when real-time redaction was enabled. - Fixed an issue where inbound calls with invalid or unformattable caller IDs didn't load for agents, causing calls to loop between agents until the caller hung up. - Fixed an issue where the **Deflections - Calls** dashboard double-counted calls redirected to a phone number. - Fixed an issue where call transcripts and **SmartActions** panels didn't load for blended SMS calls. - Fixed an issue where the Salesforce adapter failed to connect without logging an error when loaded in the agent desktop without a required security key. - Fixed an issue where warm transfers to a supervisor queue failed silently and looped repeatedly when the receiving agent had microphone permissions disabled. - Fixed an issue where the Microsoft 365 mailbox selection dropdown appeared empty during OAuth setup using client credentials when permissions were missing. - Fixed an issue where supervisor-initiated sign-outs for in-call agents discarded mandatory call dispositions and didn't record the interaction outcome in reporting. - Fixed an issue where the queue list in the CCaaS portal remained in a loading state for an extended period after signing in. - Fixed an issue where calls using Nexmo numbers disconnected when attempting pre-session deflection during virtual agent escalation. - Fixed an issue where unanswered extension and inbound calls that were abandoned by the caller were missing from the **Missed** list in the call adapter and were incorrectly classified as unknown errors. - Fixed an issue where call transfers didn't requeue immediately when the receiving agent had a microphone or device error. - Fixed an issue where after-hours and overcapacity announcement and options messages couldn't be customized at the individual user and team levels. - Fixed an issue where certain failed calls appeared as `"Failed: ()"` in session data exports and were missing from advanced reporting filters. - Fixed an issue where virtual agent call recordings weren't exported if a caller hung up immediately after being transferred to a post-session survey. - Fixed an issue where custom SIP headers weren't passed on direct inbound calls deflected to a contact list or queue. - Fixed an issue where inbound calls experienced delays and periods of silence before the virtual agent welcome prompt. - Fixed an issue where call recordings didn't consistently pause and resume when an agent clicked the redaction button multiple times during a single call. **Google SecOps** Deprecated **Deprecation of the ListCaseEvents API endpoint** Effective November 2, 2026, the `ListCaseEvents` API endpoint is deprecated. You should use the [`ListCaseEvidenceData`](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseEvidenceDatas/list.md.txt) API endpoint instead. **Infrastructure Manager** Feature Infrastructure Manager now supports Terraform version 1.16.5. Terraform version 1.16.5 is distributed under the Business Source License (BUSL) and is offered as a Paid version in Infrastructure Manager. Using Terraform version 1.16.5 incurs a resource management charge of $1.00 USD per resource-year beyond a free tier allowance of 500 resources per month per Cloud Billing account. Previews remain free of charge. For more information, see [Terraform versions](https://docs.cloud.google.com/infrastructure-manager/docs/infra-manager-terraform.md.txt#terraform_licensing_pricing). **Knowledge Catalog** Feature Knowledge Studio in Knowledge Catalog is available in [Preview](https://cloud.google.com/products#product-launch-stages). Knowledge Studio lets you explore data assets and semantic relationships using natural language and an interactive context graph, run automated enrichment tasks to generate and curate metadata from schemas, query logs, and enterprise knowledge signals, and package curated domain knowledge into context sets to ground AI agents through the Model Context Protocol (MCP) or Knowledge Catalog APIs. For more information, see [Knowledge Studio overview](https://docs.cloud.google.com/knowledge-catalog/docs/knowledge-studio.md.txt), [Context sets overview](https://docs.cloud.google.com/knowledge-catalog/docs/context-sets.md.txt), and [About enrichment tasks](https://docs.cloud.google.com/knowledge-catalog/docs/about-enrichment-tasks.md.txt). **Managed Service for Apache Spark** Announcement New **Serverless Spark** [runtime versions](https://docs.cloud.google.com/managed-spark/docs/concepts/versioning/serverless-spark-component-versions): - 1.2.90 - 2.2.90 - 2.3.43 Announcement New [**Managed Service for Apache Spark** (formerly Dataproc on Compute Engine) subminor cluster image versions](https://docs.cloud.google.com/managed-spark/docs/concepts/versioning/image-version-lists.md.txt#supported-dataproc-image-versions): - 2.1.121-debian11, 2.1.121-rocky8, 2.1.121-ubuntu20, 2.1.121-ubuntu20-arm - 2.2.89-debian12, 2.2.89-rocky9, 2.2.89-ubuntu22, 2.2.89-ubuntu22-arm - 2.3.38-debian12, 2.3.38-ml-ubuntu22, 2.3.38-rocky9, 2.3.38-ubuntu22, 2.3.38-ubuntu22-arm - 3.0.4-debian13, 3.0.4-ml-ubuntu24, 3.0.4-rocky9, 3.0.4-ubuntu24 Key updates in these image versions include: - **AlloyDB Connector:** Added support for the AlloyDB Connector (`ALLOYDB_CONNECTOR`) in `2.3` images. Fixed **Managed Service for Apache Spark** (formerly Dataproc on Compute Engine) and **Serverless Spark**: Included a fix for the eMudhra CVE in all latest image versions (2.1, 2.2, 2.3, 3.0) and Serverless Spark runtime versions (1.2, 2.2, 2.3). **Model Armor** Feature Support for template-specific exclusion rules in streaming sanitization (`StreamSanitizeUserPrompt` and `StreamSanitizeModelResponse`) is available in [Preview](https://cloud.google.com/products#product-launch-stages). You can use dictionary and regular expression exclusion rules in buffered mode (`STREAMING_MODE_BUFFERED`) with partial or full matching, and in real-time mode (`STREAMING_MODE_REALTIME`) with partial matching, to mitigate false-positive detections for prompt injection and jailbreak detection and responsible AI filters. For more information, see [Exclusion rules in streaming sanitization](https://docs.cloud.google.com/model-armor/configure-exclusion-rules#exclusion-rules-streaming). **Oracle Database@Google Cloud** Feature Oracle Database@Google Cloud supports creating custom DNS domains for your ODB Networks. You can use custom Domain Name Systems (DNS) to control the names of your resources and delegate DNS resolution within your organization. For more information, see [Create and manage custom DNS domains](https://docs.cloud.google.com/oracle/database/docs/create-manage-custom-dns.md.txt). You can use custom DNS domains only for [Exadata VM clusters](https://docs.cloud.google.com/oracle/database/docs/create-clusters.md.txt). This feature is [generally available (GA)](https://cloud.google.com/products#product-launch-stages). **Sensitive Data Protection** Feature Sensitive Data Protection can inspect TIFF images for sensitive data, including multi-page TIFF images with up to 50 pages. TIFF images are supported in [content inspection](https://docs.cloud.google.com/sensitive-data-protection/docs/inspecting-images), [inspection jobs for Cloud Storage](https://docs.cloud.google.com/sensitive-data-protection/docs/inspecting-storage#inspecting-gcs), and [discovery](https://docs.cloud.google.com/sensitive-data-protection/docs/supported-file-types.md.txt#file_clusters). For more information, see [Supported file types and scanning modes](https://docs.cloud.google.com/sensitive-data-protection/docs/supported-file-types). ## November 01, 2026 **Agent Platform Workbench** Change ### 20261101-2230-rc0 Release Change ### 20261101-2230-rc0 Release Change Installed latest packages from upstream dependencies. Change Installed latest packages from upstream dependencies. Security Updated the CA certificate configuration. Security Upgraded the container host to the latest Container-Optimized OS LTS release, rebasing onto the newest operating system, Go, and containerd security fixes. Security Updated the CA certificate configuration. Security Upgraded the container host to the latest Container-Optimized OS LTS release, rebasing onto the newest operating system, Go, and containerd security fixes. Change ### 20261101-2130-rc0 Release Change Installed latest packages from upstream dependencies. Security Updated the CA certificate configuration. Fixed Changes to the idle shutdown timeout now take effect on running instances without a restart. Previously, an instance could still be stopped after the old timeout until it was restarted. Fixed Fixed an issue where temporary metadata server errors could delay idle shutdown or stop it from working until the instance was restarted. Change ### M155 Release Change Installed latest packages from upstream dependencies. Security Updated the CA certificate configuration. Fixed Changes to the idle shutdown timeout now take effect on running instances without a restart. Previously, an instance could still be stopped after the old timeout until it was restarted. Fixed Fixed an issue where temporary metadata server errors could delay idle shutdown or stop it from working until the instance was restarted. **Google SecOps** Feature **Unified Case and Alert Playbooks view** The **Playbooks** tab in Cases now provides a consolidated view of all automated workflows associated with an investigation, displaying both case-level and alert-level playbooks in a single tab. For more information, see [View case and alert playbooks](https://docs.cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/attach-playbooks-to-alerts-cases.md.txt#view_case_and_alert_playbooks). **Google SecOps SOAR** Announcement Release 6.3.105 is being rolled out to the first phase of regions as listed [here](https://docs.cloud.google.com/chronicle/docs/soar/overview-and-introduction/soar-gradual-release.md.txt). This release contains internal and customer bug fixes. ## October 31, 2026 **Google SecOps** Feature **Basic Mode search** This feature is in public preview. The **SIEM Search** page now provides two search-execution modes: **Basic Mode** and **Advanced Mode** . **Basic Mode** (the default option) uses a streamlined, fast-path execution pipeline that bypasses secondary enrichment steps during search execution. This approach reduces end-to-end search wait times while preserving full data fidelity and query syntax parity. **Advanced Mode** is equivalent to the previous search experience. For more information, see [Choose the search-execution mode](https://docs.cloud.google.com/chronicle/docs/investigation/udm-search.md.txt#choose-search-execution-mode) and [Understand the search-execution modes](https://docs.cloud.google.com/chronicle/docs/investigation/udm-search.md.txt#search-execution-modes). **Google SecOps SOAR** Announcement [Release 6.3.104](https://docs.cloud.google.com/chronicle/docs/soar/release-notes.md.txt#October_25_2026) is now available for all regions. ## October 30, 2026 **Agent Registry** Feature Agent Registry supports cross-project [management boundaries](https://docs.cloud.google.com/agent-registry/boundaries-and-topology.md.txt) ([Preview](https://cloud.google.com/products#product-launch-stages)), letting you centrally discover, search, and govern AI agents, Model Context Protocol (MCP) servers, and tools across multiple Google Cloud projects from a central [management project](https://docs.cloud.google.com/agent-registry/boundaries-and-topology.md.txt#management-project). For more information, see [Cross-project boundaries](https://docs.cloud.google.com/agent-registry/boundaries-and-topology.md.txt) and [Configure a management boundary for multiple projects](https://docs.cloud.google.com/agent-registry/setup.md.txt#configure-boundary). **AlloyDB for PostgreSQL** Fixed For AlloyDB clusters compatible with PostgreSQL 18 or later, an instance restart is no longer required when you enable or edit [Advanced Query Insights](https://docs.cloud.google.com/alloydb/docs/using-advanced-query-insights.md.txt) settings, including changing the query length or enabling active query analysis. For clusters compatible with PostgreSQL 17 or earlier, saving changes still requires an instance restart. For more information, see [Use Advanced Query Insights](https://docs.cloud.google.com/alloydb/docs/using-advanced-query-insights.md.txt) and [Monitor active queries](https://docs.cloud.google.com/alloydb/docs/monitor-active-queries.md.txt). **Apigee hybrid** Announcement ### v1.16.13 On October 30, 2026 we released an updated version of the Apigee hybrid software, v1.16.13. - For information about upgrading, see [Upgrading Apigee hybrid to v1.16.13](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/upgrade.md.txt). - For information about new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/big-picture.md.txt). > [!NOTE] > **Note:** Do not use Apigee hybrid v1.16.12 due to a potential regression in `apigee-connect-agent` (see known issue [578314600](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt#578314600)). Use v1.16.13 instead. > [!NOTE] > **Note:** This is a patch release. The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch by using the Helm chart automatically updates the images. You don't typically need to make manual image changes. For information about container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images). Fixed #### Fixed in this release | Bug ID | Description | |---|---| | **578314600** | **Fixed an issue where `apigee-connect-agent` ignored `HTTPS_PROXY` and failed to establish a tether in clusters that require an HTTP forward proxy for egress; the agent now uses HTTP/2 keepalive pings on the control-plane connection while honoring `HTTPS_PROXY` (including proxy credentials).** | | **576707253** | **Removed the compromised emSign roots and the cross-signing Comodo AAA Services root from the system and Java (`cacerts`) trust stores across containers.** | | **573622417** | **Fixed an issue where `apigee-ingressgateway` forwarded the `x-envoy-decorator-operation` header to upstream runtime and target backends.** | | **492041991** | **Fixed an issue where `VerifyAPIKey` and `VerifyAccessToken` set the `apiproduct.operation.llmTokenQuota.*` flow variables from unmatched LLM operations; they are now set only from the LLM operations that matched the request.** | Security | Bug ID | Description | |---|---| | **N/A** | **Security fixes for `apigee-asm-ingress`.** This addresses the following vulnerabilities: - [CVE-2026-63209](https://nvd.nist.gov/vuln/detail/CVE-2026-63209) - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) | | **N/A** | **Security fixes for `apigee-asm-istiod`.** This addresses the following vulnerabilities: - [CVE-2026-40179](https://nvd.nist.gov/vuln/detail/CVE-2026-40179) - [CVE-2026-42151](https://nvd.nist.gov/vuln/detail/CVE-2026-42151) - [CVE-2026-42154](https://nvd.nist.gov/vuln/detail/CVE-2026-42154) - [CVE-2026-44903](https://nvd.nist.gov/vuln/detail/CVE-2026-44903) - [CVE-2026-63209](https://nvd.nist.gov/vuln/detail/CVE-2026-63209) - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) | | **N/A** | **Security fixes for `apigee-envoy`.** This addresses the following vulnerabilities: - [CVE-2026-5450](https://nvd.nist.gov/vuln/detail/CVE-2026-5450) - [CVE-2026-5928](https://nvd.nist.gov/vuln/detail/CVE-2026-5928) | | **N/A** | **Security fixes for `apigee-fluent-bit`.** This addresses the following vulnerabilities: - [CVE-2026-8286](https://nvd.nist.gov/vuln/detail/CVE-2026-8286) - [CVE-2026-8924](https://nvd.nist.gov/vuln/detail/CVE-2026-8924) - [CVE-2026-8927](https://nvd.nist.gov/vuln/detail/CVE-2026-8927) - [CVE-2026-92392](https://nvd.nist.gov/vuln/detail/CVE-2026-92392) | | **N/A** | **Security fixes for `apigee-hybrid-cassandra`.** This addresses the following vulnerabilities: - [CVE-2026-18401](https://nvd.nist.gov/vuln/detail/CVE-2026-18401) - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-39822](https://nvd.nist.gov/vuln/detail/CVE-2026-39822) - [CVE-2026-42505](https://nvd.nist.gov/vuln/detail/CVE-2026-42505) - [CVE-2026-54512](https://nvd.nist.gov/vuln/detail/CVE-2026-54512) - [CVE-2026-54513](https://nvd.nist.gov/vuln/detail/CVE-2026-54513) - [CVE-2026-54514](https://nvd.nist.gov/vuln/detail/CVE-2026-54514) - [CVE-2026-54515](https://nvd.nist.gov/vuln/detail/CVE-2026-54515) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-59888](https://nvd.nist.gov/vuln/detail/CVE-2026-59888) - [CVE-2026-59889](https://nvd.nist.gov/vuln/detail/CVE-2026-59889) - [CVE-2026-68494](https://nvd.nist.gov/vuln/detail/CVE-2026-68494) - [CVE-2026-77310](https://nvd.nist.gov/vuln/detail/CVE-2026-77310) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) | | **N/A** | **Security fixes for `apigee-kube-rbac-proxy`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) | | **N/A** | **Security fixes for `apigee-operators`.** This addresses the following vulnerability: - [CVE-2026-63209](https://nvd.nist.gov/vuln/detail/CVE-2026-63209) | | **N/A** | **Security fixes for `apigee-prom-prometheus`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) | | **N/A** | **Security fixes for `apigee-watcher`.** This addresses the following vulnerability: - [CVE-2026-63209](https://nvd.nist.gov/vuln/detail/CVE-2026-63209) | **Backup and DR** Feature > [!NOTE] > **Note:** These fixes and updates are available starting with Backup and DR release 11.0.17.508. These fixes aren't rolled out to the 11.0.16 release. To receive these updates, upgrade the backup/recovery appliance to version 11.0.17. The following feature is available for the Backup and DR agent: - Expanded Linux Changed Block Tracking (CBT) support across kernel updates for Red Hat Enterprise Linux (RHEL) 8, RHEL 9, and RHEL 10 distributions. For more information, see [Backup and DR supported operating systems and kernels](https://docs.cloud.google.com/backup-disaster-recovery/docs/reference/backupdr-supported-os-kernels.md.txt). Security > [!NOTE] > **Note:** These fixes and updates are available starting with Backup and DR release 11.0.17.508. These fixes aren't rolled out to the 11.0.16 release. To receive these updates, upgrade the backup/recovery appliance to version 11.0.17. The following security updates are available for the backup/recovery appliance: - Addressed multiple input sanitization vulnerabilities, including SQL injection and OS command injection, across appliance backend services and management workflows. - Strengthened TLS, certificate truststore, and SSH host key validation across appliance and cluster communications. - Remediated authorization and validation vulnerabilities in policy option management and host lookup workflows. - Addressed memory safety and access control vulnerabilities in appliance storage management services. The following security updates are available for the Backup and DR agent: - Strengthened local device access controls for Linux Changed Block Tracking (CBT) components to prevent unprivileged local access. - Improved temporary file creation, path verification, and file permission handling across Linux and Windows Backup and DR agents to mitigate symlink race conditions and local privilege escalation vulnerabilities. - Hardened Oracle and IBM Db2 database integration scripts on protected hosts to improve credential and directory permission handling during recovery and migration workflows. - Addressed memory handling vulnerabilities and refined system logging rules in Linux Backup and DR agent components. The following library updates are available for the backup/recovery appliance: - Upgraded the Java runtime environment and third-party application libraries on the appliance to remediate reported security vulnerabilities. - Updated base operating system and database packages across backup/recovery appliance and management server images to mitigate reported vulnerabilities. Feature You can now back up Cloud SQL instances to a backup vault that's located in a different region to the instance. This approach enhances data resilience and helps meet strict compliance and disaster recovery requirements by storing backups in a separate geographic location. Feature You can now edit existing backup plans for Cloud SQL instances to update settings such as backup rules and maximum custom on-demand retention periods. To learn more, see [Back up Cloud SQL instances to a backup vault](https://docs.cloud.google.com/backup-disaster-recovery/docs/cloud-console/sql/csql-backup.md.txt). Fixed > [!NOTE] > **Note:** The following fixes and updates are available starting with Backup and DR release 11.0.17.507. These fixes aren't rolled out to the 11.0.16 release. To receive the following updates, upgrade your backup/recovery appliance to version 11.0.17. The following issues are resolved for the backup/recovery appliance: - Application discovery and management API requests can time out when multiple discovery operations run concurrently. - Hostnames containing special characters prevented active jobs from being accurately detected during Backup and DR agent upgrade pre-checks. - Excessive informational log messages in appliance service logs when replication optimization was turned off. - Appliance image packaging issue by including required system libraries for fresh appliance deployments. The following issue is resolved for the Backup and DR agent: - Scheduling conflict where concurrent database log backups and full database backups, such as SAP Sybase IQ and SAP MaxDB backups, can interrupt an in-progress backup job. Deprecated > [!NOTE] > **Note:** These fixes and updates are available starting with Backup and DR release 11.0.17.508. These fixes aren't rolled out to the 11.0.16 release. To receive these updates, upgrade the backup/recovery appliance to version 11.0.17. The following deprecation applies to the Backup and DR agent: - Deprecated support for end-of-life and non-Extended Update Support (non-EUS) Red Hat Enterprise Linux (RHEL) and SUSE Linux Enterprise Server (SLES) releases. For more information, see [Backup and DR supported operating systems and kernels](https://docs.cloud.google.com/backup-disaster-recovery/docs/reference/backupdr-supported-os-kernels.md.txt). **BigQuery** Feature You can now retrieve query results [directly in the Apache Arrow format](https://docs.cloud.google.com/bigquery/docs/running-queries.md.txt#arrow-format) for faster retrieval speed and improved serialization efficiency. This feature is in [Preview](https://cloud.google.com/products#product-launch-stages). **Bigtable** Feature You can use Knowledge Catalog to discover authorized views, logical views, and continuous materialized views. This integration lets you search for these granular data assets alongside your Bigtable instances and tables. This feature is [generally available (GA)](https://cloud.google.com/products#product-launch-stages). For more information, see [Manage data assets using Knowledge Catalog](https://docs.cloud.google.com/bigtable/docs/manage-data-assets-using-knowledge-catalog.md.txt). **Cloud Asset Inventory** Feature The following resource types are publicly available through the [ExportAssets](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/exportAssets.md.txt), [ListAssets](https://docs.cloud.google.com/asset-inventory/docs/listing-assets), [BatchGetAssetsHistory](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/batchGetAssetsHistory.md.txt), [QueryAssets](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/queryAssets.md.txt), [Feed](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/feeds.md.txt), and Search ([SearchAllResources](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/searchAllResources.md.txt), [SearchAllIamPolicies](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/searchAllIamPolicies.md.txt)) APIs. - Oracle Database@Google Cloud - `oracledatabase.googleapis.com/DbSystem` - `oracledatabase.googleapis.com/ExadbVmCluster` - `oracledatabase.googleapis.com/ExascaleDbStorageVault` - `oracledatabase.googleapis.com/OdbNetwork` - `oracledatabase.googleapis.com/OdbSubnet` **Cloud Number Registry** Breaking Starting November 25, 2026, if your configuration doesn't have a designated project, Cloud Number Registry will stop discovering resources. For more information, see [Project designation enforcement](https://docs.cloud.google.com/number-registry/overview#project-designation-enforcement). **Cloud Run** Feature You can run Cloud Run jobs with [GPUs enabled](https://docs.cloud.google.com/run/docs/configuring/jobs/gpu.md.txt) for [up to 12 hours](https://docs.cloud.google.com/run/docs/tutorials/long-running-gpu-jobs.md.txt) ([Preview](https://cloud.google.com/products)). **Cloud SQL for MySQL** Announcement Starting November 1, 2026, at 02:00 a.m. local time, unpatched Cloud SQL for MySQL instances that evaluate certain local Canadian time zones (across Alberta, British Columbia, Manitoba, and Northwest Territories) will lag by one hour because the instances still follow the autumn fall back schedule. Stored timestamp data isn't modified. **What should I do?** Before November 1, 2026, do one of the following fixes: - **Apply self-service maintenance (Recommended):** If your applications rely on database functions to calculate, schedule, or display times in these Canadian time zones (such as Calgary, Edmonton, Vancouver, or Winnipeg), then update your instances to the latest maintenance release using the Google Cloud console or the gcloud CLI. Updated time zone rules that reflect permanent standard daylight offsets across Alberta, British Columbia, Manitoba, and Northwest Territories are supported in Cloud SQL for MySQL [maintenance release `*.R20260726.00_36` or later](https://docs.cloud.google.com/sql/docs/mysql/maintenance-changelog.md.txt). For more information, see [Perform self-service maintenance](https://docs.cloud.google.com/sql/docs/mysql/self-service-maintenance.md.txt). - **Database configuration stopgap:** If your organization can't restart instances before November 1, 2026, then you can set the time zone for your database session without causing downtime for your instance. Set the `default_time_zone` flag for the database session to your target fixed numeric offset (for example, `'-06:00'` for Alberta, `'-07:00'` for British Columbia, or `'-05:00'` for Manitoba). For more information about configuring database flags, see [Configure database flags](https://docs.cloud.google.com/sql/docs/mysql/flags.md.txt). **Cloud SQL for PostgreSQL** Announcement Starting November 1, 2026, at 02:00 a.m. local time, unpatched Cloud SQL for PostgreSQL instances that evaluate certain local Canadian time zones (across Alberta, British Columbia, Manitoba, and Northwest Territories) will lag by one hour because the instances still follow the autumn fall back schedule. Stored timestamp data isn't modified. **What should I do?** Before November 1, 2026, do one of the following fixes: - **Apply self-service maintenance (Recommended):** If your applications rely on database functions to calculate, schedule, or display times in these Canadian time zones (such as Calgary, Edmonton, Vancouver, or Winnipeg), then update your instances to the latest maintenance release using the Google Cloud console or the gcloud CLI. Updated time zone rules that reflect permanent standard daylight offsets across Alberta, British Columbia, Manitoba, and Northwest Territories are supported in Cloud SQL for PostgreSQL [maintenance release `*.R20260712.01_44` or later](https://docs.cloud.google.com/sql/docs/postgres/maintenance-changelog.md.txt). For more information, see [Perform self-service maintenance](https://docs.cloud.google.com/sql/docs/postgres/self-service-maintenance.md.txt). - **Database configuration stopgap:** If your organization can't restart instances before November 1, 2026, then you can set your database session time zone without downtime to an anchor zone. ```bash ALTER DATABASE database_name SET timezone TO 'anchor_zone'; ``` Replace the following: - `database_name`: the name of your database. - `anchor_zone`: the anchor zone to use as the time zone for your database. Specify an anchor zone that operates on a permanent offset. For example, `'America/Regina'` for Alberta and Northwest Territories (UTC-6), `'America/Whitehorse'` for British Columbia (UTC-7), or `'America/Coral_Harbour'` for Manitoba (UTC-5). **Cloud SQL for SQL Server** Announcement Starting November 1, 2026, at 02:00 a.m. local time, Cloud SQL for SQL Server instances that evaluate certain local Canadian time zones (across Alberta, British Columbia, Manitoba, and Northwest Territories) will lag by one hour because the instances still follow the autumn fall back schedule. Stored timestamp data isn't modified. **What should I do?** For SQL Server, Microsoft has [published guidance](https://devblogs.microsoft.com/azure-sql/canadas-2026-time-zone-updates-guidance-for-microsoft-sql/), recommending updating each applicable instance's time zone to the Windows time zone with the matching fixed offset. Update each instance's time zone to the Windows time zone with the matching fixed offset: | Jurisdiction | Current time zone | Recommended time zone | Fixed offset | |---|---|---|---| | British Columbia | Pacific Standard Time | Yukon Standard Time | UTC-07:00 | | Alberta / Inuvik, NWT | Mountain Standard Time | Canada Central Standard Time | UTC-06:00 | | Manitoba | Central Standard Time | Eastern Standard Time (Mexico) | UTC-05:00 | You can make the change in the Google Cloud console (**Edit instance** \> **Flags and parameters** \> **Time zone**) or with gcloud: ```bash gcloud sql instances patch INSTANCE_NAME \ --project=PROJECT_ID \ --time-zone="Yukon Standard Time" ``` **Cloud Storage** Feature The Cloud Storage Model Context Protocol (MCP) server includes the [`get_bucket_metadata`](https://docs.cloud.google.com/storage/docs/reference/mcp/tools_list/get_bucket_metadata.md.txt) tool to retrieve bucket metadata. In addition, the [`list_buckets`](https://docs.cloud.google.com/storage/docs/reference/mcp/tools_list/list_buckets.md.txt), [`get_object_metadata`](https://docs.cloud.google.com/storage/docs/reference/mcp/tools_list/get_object_metadata.md.txt), and [`list_objects`](https://docs.cloud.google.com/storage/docs/reference/mcp/tools_list/list_objects.md.txt) tools now return detailed bucket and object metadata. For more information, see [Use the Cloud Storage MCP server](https://docs.cloud.google.com/storage/docs/use-cloud-storage-mcp.md.txt) and [Cloud Storage MCP reference](https://docs.cloud.google.com/storage/docs/reference/mcp.md.txt). Feature Security and compliance findings in Storage Intelligence advisor are available in [Preview](https://cloud.google.com/products#product-launch-stages). You can use these findings to identify buckets with objects that violate default customer-managed encryption key (CMEK) policies or enforced encryption rules, and re-encrypt the affected objects. For more information, see the following resources: - [About Storage Intelligence advisor](https://docs.cloud.google.com/storage/docs/storage-intelligence/advisor-overview.md.txt#monitor-security-compliance) - [Re-encrypt objects that violate default CMEK bucket policies](https://docs.cloud.google.com/storage/docs/storage-intelligence/findings/re-encrypt-objects-default-cmek-policies.md.txt) - [Re-encrypt objects that violate enforced encryption rules](https://docs.cloud.google.com/storage/docs/storage-intelligence/findings/re-encrypt-objects-enforced-encryption-rules.md.txt) **Container Optimized OS** Change ### cos-129-19506-578-33 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.12.113](https://cos.googlesource.com/third_party/kernel/+/d85203a42d8b86ef624aecfdbd44361fa8a62c51) | v27.5.1 | v2.2.7 | [See List](https://storage.googleapis.com/cos-tools/19506.578.33/lakitu/gpu_driver_versions.textproto) | Fixed Fixed an IDPF bug that could cause indefinite IPv4 route loss after a hard NIC reset. Feature Enabled EROFS support. Fixed Added support for NVIDIA driver v580.196.07. Fixed Added support for NVIDIA driver v595.112.07. Fixed Upgraded app-arch/zstd to v1.5.7-r1. Fixed Upgraded app-containers/docker-credential-helpers to v0.9.12. Fixed Upgraded app-editors/vim to v9.2.1229, Upgraded app-editors/vim-core to v9.2.1229. Fixed Upgraded app-misc/ca-certificates to v20260816.3.131.1. Fixed Upgraded dev-db/sqlite to v3.54.1. Fixed Upgraded dev-libs/expat to v2.9.0. Fixed Upgraded dev-libs/nss to v3.132. Fixed Upgraded net-fs/nfs-utils to v2.6.4. Fixed Upgraded sys-libs/libxcrypt to v4.4.38-r1. Security Fixed CVE-2026-33186 in cni-plugins. Security Fixed CVE-2026-33186 in containerd. Security Fixed CVE-2026-33186 in google-osconfig-agent. Security Fixed CVE-2026-42508, CVE-2026-39834, CVE-2026-39832, CVE-2026-39831, CVE-2026-46595 in google-osconfig-agent. Security Fixed KCTF-d095321 in the Linux kernel. Security Updated app-arch/brotli to 1.0.10. This resolves CVE-2026-111497. Change ### cos-125-19216-760-32 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.12.113](https://cos.googlesource.com/third_party/kernel/+/44bf8b7767ac63010cad3d8a3afa241b262193de) | v27.5.1 | v2.2.7 | [See List](https://storage.googleapis.com/cos-tools/19216.760.32/lakitu/gpu_driver_versions.textproto) | Fixed Fixed an IDPF bug that could cause indefinite IPv4 route loss after a hard NIC reset. Security Fixed CVE-2024-41110, CVE-2026-33186 in cri-tools. Security Fixed CVE-2026-33186 in cni-plugins. Security Fixed CVE-2026-33186 in containerd. Security Fixed CVE-2026-33186 in guest-agent. Security Fixed CVE-2026-39832, CVE-2026-33186, CVE-2026-46595, CVE-2026-39831 in docker. Security Fixed CVE-2026-39834, CVE-2026-39831 in google-osconfig-agent. Security Fixed CVE-2026-77214 in dev-libs/expat. Security Fixed KCTF-d095321 in the Linux kernel. Security Updated app-arch/brotli to 1.0.10. This resolves CVE-2026-111497. Change ### cos-133-19999-44-174 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.18.55](https://cos.googlesource.com/third_party/kernel/+/ebad2aad500721882e43d07ea6b43fef5882463d) | v29.4.3 | v2.4.1 | [See List](https://storage.googleapis.com/cos-tools/19999.44.174/lakitu/gpu_driver_versions.textproto) | Security Fixed CVE-2026-42508, CVE-2026-39830, CVE-2026-39833 in google-osconfig-agent. Security Fixed CVE-2026-82474 in app-admin/sudo. Security Updated app-arch/brotli to 1.0.10. This resolves CVE-2026-111497. Security Fixed CVE-2026-98432 in the Linux kernel. Change Runtime sysctl changes: - Changed: fs.epoll.max_user_watches: 1807671 -\> 1807627 - Changed: fs.fanotify.max_user_marks: 68382 -\> 68378 - Changed: fs.inotify.max_user_watches: 64161 -\> 64158 - Changed: kernel.threads-max: 63445 -\> 63443 - Changed: net.ipv4.tcp_mem: 93972 125298 187944 -\> 93969 125295 187938 - Changed: net.ipv4.udp_mem: 187947 250597 375894 -\> 187941 250590 375882 - Changed: user.max_cgroup_namespaces: 31722 -\> 31721 - Changed: user.max_fanotify_marks: 68382 -\> 68378 - Changed: user.max_inotify_watches: 64161 -\> 64158 - Changed: user.max_ipc_namespaces: 31722 -\> 31721 - Changed: user.max_mnt_namespaces: 31722 -\> 31721 - Changed: user.max_net_namespaces: 31722 -\> 31721 - Changed: user.max_pid_namespaces: 31722 -\> 31721 - Changed: user.max_time_namespaces: 31722 -\> 31721 - Changed: user.max_user_namespaces: 31722 -\> 31721 - Changed: user.max_uts_namespaces: 31722 -\> 31721
**Dataflow** Feature Dataflow supports Apache Beam SDK version 2.77.0 for Java, Python, and Go ([SDK version support status](https://docs.cloud.google.com/dataflow/docs/support/sdk-version-support-status.md.txt)). This version offers new features such as: - BigQuery Storage Read API support for Lakehouse Apache Iceberg tables using four-part identifiers - Schema evolution options for `AddFiles` and Beam YAML - Event-time deduplication state bounding for the `Watch` transform - Gemini Enterprise Agent Platform Model Monitoring v2 for Python `RunInference` transforms - Payload and metadata support for `SolaceIO`, and `Decimal` column types for `ClickHouseIO` For more information, see the [Apache Beam SDK release notes](https://github.com/apache/beam/releases#release-v2.77.0). **Datastream** Feature Datastream integration with Knowledge Catalog is now [generally available (GA)](https://cloud.google.com/products#product-launch-stages). For more information, see [the documentation](https://docs.cloud.google.com/datastream/docs/knowledge-catalog-integration.md.txt). **Gemini Enterprise** Feature **Gemini Notebook Enterprise: Visual refresh** This update includes the following changes and features. These features are generally available (GA): - **Refreshed UI design**: The user interface features an updated color scheme and style that match the consumer and Google Workspace versions of Gemini Notebook. - **Audio overview language selection**: You can choose the language for the audio overview output. This lets you create an audio output in a language different from the notebook's language (Settings \> Output language). - **Infographic update**: You can see examples of the visual style before you choose one for your infographic. - **Customize the notebook summary** : You can replace the autogenerated summary of the notebook with your own custom summary. Select **Customize notebook** from the more_vert **More options** menu. - **Sharing notebooks**: When you notify people that you're sharing a notebook with them, you no longer have the option to write a welcome note. - **Fast Research on the web** : **Web** and **Fast Research** replace **Discover sources** . The **I'm feeling curious** button is no longer available. Feature **Gemini Enterprise: S\&P Global - Adaptive Retrieval data store (Preview)** The [S\&P Global - Adaptive Retrieval](https://docs.cloud.google.com/gemini/enterprise/docs/connectors/s_p_global_adaptive_retrieval.md.txt) data store is available in Public Preview in Gemini Enterprise. You can use natural language to ask questions about the S\&P Global data your S\&P Global account is entitled to access. For more information, see [Connect a third-party data source](https://docs.cloud.google.com/gemini/enterprise/docs/connectors/connect-third-party-data-source.md.txt). **Gemini Enterprise Agent Platform** Feature **Inference request metadata logging (GA)** Inference request metadata logging is generally available. Gemini Enterprise Agent Platform can write one Cloud Logging entry for every inference request your project serves. Each entry records the model, region, consumption option, token counts, Provisioned Throughput usage, latency and error code. Entries record metadata only and never contain prompts or responses. Logging is supported for Gemini models that use `generateContent` and `streamGenerateContent`, and for Claude models that use `rawPredict` and `streamRawPredict`. You can turn on logging in the Google Cloud console, from the Provisioned Throughput page, or with the REST API. Turning on logging in the console also turns on detailed metrics, which chart Provisioned Throughput traffic at one-second resolution. With logging on, the model observability dashboard adds 1-second resolution options to its charts for pay-as-you-go traffic. To attribute usage to a team, application or tenant, add request headers with the `x-goog-agent-platform-observability-label-` prefix, and query the entries with SQL in Observability Analytics. For more information, see [Log inference request metadata](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/capabilities/inference-metadata-logging). Feature **Computer use tool is available in General Availability** The [Computer use tool](https://docs.cloud.google.com/gemini-enterprise-agent-platform/agents/tools/computer-use) is available in [General Availability (GA)](https://cloud.google.com/products#product-launch-stages). This release introduces comprehensive Human-in-the-Loop (HITL) safety governance, enabling developers to selectively configure or override specific confirmation policies (such as financial transactions or data modification) while allowing administrators to mandate organization-wide guardrails using the `configurableComputerUseToolSafetyPolicies` constraint. **Looker** Announcement On November 1, 2026, several Canadian provinces and territories---Manitoba, Alberta, British Columbia, and parts of the Northwest Territories---transition to permanent daylight saving time (DST) or remain on their summer UTC offsets year-round. On unpatched Looker instances, these changes affect scheduled content delivery fire times and [table calculations](https://docs.cloud.google.com/looker/docs/table-calculations) that use `now()` with the affected Canadian time zones (`America/Winnipeg`, `Canada/Central`, `America/Rainy_River`, `America/Edmonton`, `Canada/Mountain`, `America/Vancouver`, `Canada/Pacific`, and `America/Inuvik`). Patched Looker builds update the scheduler (Ruby) and browser (JavaScript) time zone data, while server-evaluated `now()` table calculations on the JVM still use the bundled JDK time zone database (`tzdb 2026b`). To learn how to upgrade to a patched Looker build or configure an alternative schedule delivery time zone, see [2026 Canadian time zone changes](https://docs.cloud.google.com/looker/docs/canada-permanent-dst-2026). **Managed Service for Apache Airflow** Issue Starting October 24, 2026, Managed Airflow (Gen 3) and Managed Airflow (Gen 2) environments running Python 3.11 with `google-api-core` package versions 2.28.0 to 2.43.0 (including versions 2.30.3 to 2.43.0, which weren't previously affected) might experience degraded performance because of a Python 3.11 deprecation check that scans installed package metadata on every new Python subprocess import. You might observe increased DAG parsing times, longer task execution times, higher CPU usage on Airflow DAG processors and workers, and frequent `FutureWarning` log entries from `google/api_core/_python_version_support.py` about Python 3.11 support ending on `2027-10-24`. For the list of affected builds and available workarounds (installing `google-api-core>=2.43.1` on compatible Airflow 3 builds or applying a `sitecustomize.py` runtime patch), see the known issue for [Managed Airflow (Gen 3)](https://docs.cloud.google.com/composer/docs/composer-3/known-issues.md.txt#google-api-core-2-30-3-to-2-43-0) or [Managed Airflow (Gen 2)](https://docs.cloud.google.com/composer/docs/composer-2/known-issues.md.txt#google-api-core-2-30-3-to-2-43-0). **NetApp Volumes** Announcement Google Cloud NetApp Volumes now supports the Flex Unified service level, including custom performance, in the following regions: - northamerica-northeast1 (Montréal) - northamerica-northeast2 (Toronto) For more information about available regions, see [Supported regions](https://docs.cloud.google.com/netapp/volumes/docs/discover/service-levels.md.txt#supported_regions). **Resource Manager** Feature **Preview** : Management boundaries and capability configurations in Resource Manager are available in [Preview](https://cloud.google.com/products#product-launch-stages). Management boundaries establish dynamic, tag-based or hierarchy-wide administrative perimeters across multiple Google Cloud projects. This feature lets you centralize resource discovery and governance from a designated management project. You can configure `BoundaryConfig`, `Boundary`, and `CapabilityConfig` resources using Google Cloud CLI to partition projects by Tags values and enable management capabilities for [Agent Registry](https://docs.cloud.google.com/agent-registry/overview.md.txt). For more information, see [Management boundaries overview](https://docs.cloud.google.com/resource-manager/docs/boundaries-and-capabilities-overview) and [Configure management boundaries](https://docs.cloud.google.com/resource-manager/docs/manage-capability-configs). **SAP on Google Cloud** Announcement **Google SecOps for SAP is generally available (GA)** Google SecOps for SAP is generally available (GA). This solution helps you protect your enterprise SAP applications by integrating business-critical telemetry into Google SecOps to provide unified visibility, threat detection, and security response capabilities. This release includes: - Log ingestion from SAP RISE and self-managed SAP environments that run on Google Cloud, on-premises, or other clouds. - SAP-specific YARA-L threat detection rules available in the Google SecOps Detection Rules GitHub repository. - Automated threat response and containment capabilities by using the SAP RFC Gateway and SOAR playbooks ([Preview](https://cloud.google.com/products#product-launch-stages)). For more information, see [Secure SAP applications with Google SecOps](https://docs.cloud.google.com/sap/docs/secops/overview.md.txt). **Secure Source Manager** Feature You can now enable [vulnerability scanning](https://docs.cloud.google.com/secure-source-manager/docs/enable-vulnerability-scanning.md.txt) to detect known vulnerabilities in your dependencies. **Spanner** Feature Spanner supports equality and ordering comparisons on JSONB and JSON values. You can use these values in `GROUP_BY` and `ORDER BY` clauses without first converting them to another data type. In GoogleSQL, you can also convert other data types to `JSON` using `CAST(expression AS JSON)` and compare JSON values directly with non-JSON values. Spanner can implicitly coerces the non-JSON value to `JSON` for comparison. Additionally, you can use search indexes to accelerate equality comparisons such as `=` or `IN` on JSONB and JSON columns and subpaths. For more information, see [JSON comparison and sorting](https://docs.cloud.google.com/spanner/docs/reference/standard-sql/data-types.md.txt#comparison_and_sorting) , [JSON comparison coercion](https://docs.cloud.google.com/spanner/docs/reference/standard-sql/conversion_rules.md.txt#json_comparison_coercion) , [CAST AS JSON](https://docs.cloud.google.com/spanner/docs/reference/standard-sql/conversion_functions.md.txt#cast_as_json) , [JSON search indexes](https://docs.cloud.google.com/spanner/docs/full-text-search/json-indexes.md.txt) , and [Working with JSONB](https://docs.cloud.google.com/spanner/docs/working-with-jsonb.md.txt). Feature Spanner Graph supports the following enhancements: - You can create property graphs from SQL views that call [remote functions](https://docs.cloud.google.com/spanner/docs/cloud-run-remote-function.md.txt) ([Preview](https://cloud.google.com/products#product-launch-stages)) to compute node and edge properties. For more information, see [Compute properties with remote functions](https://docs.cloud.google.com/spanner/docs/graph/graph-with-views-how-to.md.txt#remote-functions-views). - You can write simplified queries on schemaless dynamic properties without explicit conversions to SQL data types. This lets you group and sort dynamic properties, and compare them directly with literal values or other dynamic properties. For more information, see [Filter, compare, and sort by dynamic properties](https://docs.cloud.google.com/spanner/docs/graph/manage-schemaless-data.md.txt#filter-property-values) and [JSON comparison and sorting](https://docs.cloud.google.com/spanner/docs/reference/standard-sql/data-types.md.txt#comparison_and_sorting). **reCAPTCHA** Change Fraud Defense Mobile SDK v18.9.4 is available for Android. This version includes the following: - Fixes a memory leak where destroyed activities were retained by lifecycle callbacks ([Issue #194](https://github.com/GoogleCloudPlatform/recaptcha-enterprise-mobile-sdk/issues/194)). - Fixes a dependency compatibility issue with Kotlin Coroutines and POM API dependencies. ## October 29, 2026 **AlloyDB for PostgreSQL** Feature AlloyDB AI adds pre-registered support for the following Gemini models in version 1.6.5 and later of the `google_ml_integration` extension: - `gemini-3.1-flash-lite` - `gemini-3.5-flash` - `gemini-3.5-flash-lite` - `gemini-3.6-flash` - `gemini-3.7-flash` - `gemini-3.8-flash` - `gemini-4-argon` Version 1.6.5 of the `google_ml_integration` extension sets `gemini-3.5-flash-lite` as the default Gemini model and removes the `gemini-2.0-flash`, `gemini-2.0-flash-lite`, `gemini-2.5-flash`, `gemini-2.5-flash-lite`, and `gemini-2.5-pro` models from the list of pre-registered models. Additionally, AlloyDB AI adds pre-registered support for the `semantic-ranker-512` reranking model. For more information, see [Pre-registered Agent Platform models](https://docs.cloud.google.com/alloydb/docs/reference/supported-ai-models.md.txt#pre-registered-models). **Anti Money Laundering AI** Announcement New minor engine version released for the retail line of business within the `v004.011` version line (`aml-retail.default.v004.011.202610-000`). This version extends support for the major engine version and includes no significant changes compared to the previous minor version. **Apigee hybrid** Announcement ### v1.17.3 On October 29, 2026 we released an updated version of the Apigee hybrid software, v1.17.3. - For information on upgrading, see [Upgrading Apigee hybrid to version v1.17.3](https://docs.cloud.google.com/apigee/docs/hybrid/v1.17/upgrade.md.txt). - For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.17/big-picture.md.txt). > [!NOTE] > **Note:** Do not use Apigee hybrid v1.17.2 due to a potential regression in `apigee-connect-agent` (see known issue [578314600](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt#578314600)). Use v1.17.3 instead. > [!NOTE] > **Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images). Fixed #### Fixed in this release | Bug ID | Description | |---|---| | **578314600** | **Fixed an issue where `apigee-connect-agent` ignored `HTTPS_PROXY` and failed to establish a tether in clusters that require an HTTP forward proxy for egress; the agent now uses HTTP/2 keepalive pings on the control-plane connection while honoring `HTTPS_PROXY` (including proxy credentials).** | | **576707253** | **Removed the compromised emSign roots and the cross-signing Comodo AAA Services root from the system and Java (`cacerts`) trust stores across containers.** | | **573622417** | **Fixed an issue where `apigee-ingressgateway` forwarded the `x-envoy-decorator-operation` header to upstream runtime and target backends.** | | **572025634** | **Fixed an issue where responses with a compressed `text/event-stream` body to a proxy with an `EventFlow` returned a corrupted body; compressed `text/event-stream` responses now skip `EventFlow` processing and pass through intact.** | | **571378258** | **The `apigee-redis` container now uses the Valkey engine (version 8.1.10). The RESP2 wire protocol and `redis-server` and `redis-cli` binary names are unchanged.** | | **568860869** | **Fixed an issue in the `RegularExpressionProtection` policy where patterns starting and ending with `.*` whose middle section contained regular expression syntax were matched as literal text instead of regular expressions.** | | **560272924** | **Apigee hybrid now supports continuous-scan bidirectional gRPC streaming for the `SanitizeModelResponse` policy over Server-Sent Events (SSE) streams, preserving native LLM provider SSE JSON envelopes and event framing.** | | **555332621** | **Fixed an issue where Model Armor policies did not honor `HTTPClient.managementplane.skip.proxy`: when set, Model Armor callouts now bypass the forward proxy like other `googleapis` traffic, while streaming (`ContinuousScan`) Model Armor traffic uses the forward proxy.** | | **554114419** | **Fixed an issue where an `AssignMessage`, `HTTPModifier`, or `RaiseFault` policy that creates a new request (`createNew="true"`) in an HTTP/2 flow could not set the `:path` and `:authority` pseudo-headers and failed with an invalid-header error.** | | **549779897** | **Apigee analytics now reports the Model Armor template, verdict, and matched filters for each request on both the prompt and model-response directions.** | | **546141116** | **The `SemanticCacheLookup` policy now reports the cache key and cache name to analytics in the `ai_semantic_cache_key` and `ai_semantic_cache_name` fields.** | | **535395491** | **Extension Processor (`ext_proc`) denials now return the status and body that the policy or FaultRule produced, instead of always returning HTTP `500`.** | | **524115876** | **Fixed an intermittent HTTP `400` error in the `OASValidation` policy's strict parameter validation that rejected valid requests under load.** | | **502231886** | **Fixed an issue where the `SanitizeUserPrompt` and `SanitizeModelResponse` policies failed to extract content using default source templates when the `` element was omitted and `` was set to `false`.** | | **492041991** | **Fixed an issue where `VerifyAPIKey` and `VerifyAccessToken` set the `apiproduct.operation.llmTokenQuota.*` flow variables from unmatched LLM operations; they are now set only from the LLM operations that matched the request.** | | **449228485** | **Fixed an issue where `podDisruptionBudget` overrides configured in the Helm charts were dropped by the Kubernetes API server.** | Security | Bug ID | Description | |---|---| | **N/A** | **Security fixes for `apigee-asm-ingress`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-63209](https://nvd.nist.gov/vuln/detail/CVE-2026-63209) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) | | **N/A** | **Security fixes for `apigee-asm-istiod`.** This addresses the following vulnerabilities: - [CVE-2026-40179](https://nvd.nist.gov/vuln/detail/CVE-2026-40179) - [CVE-2026-42151](https://nvd.nist.gov/vuln/detail/CVE-2026-42151) - [CVE-2026-42154](https://nvd.nist.gov/vuln/detail/CVE-2026-42154) - [CVE-2026-44903](https://nvd.nist.gov/vuln/detail/CVE-2026-44903) - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-63209](https://nvd.nist.gov/vuln/detail/CVE-2026-63209) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) - [GHSA-gcjh-h69q-9w9g](https://osv.dev/vulnerability/GHSA-gcjh-h69q-9w9g) | | **N/A** | **Security fixes for `apigee-connect-agent`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) | | **N/A** | **Security fixes for `apigee-envoy`.** This addresses the following vulnerabilities: - [CVE-2026-5450](https://nvd.nist.gov/vuln/detail/CVE-2026-5450) - [CVE-2026-5928](https://nvd.nist.gov/vuln/detail/CVE-2026-5928) | | **N/A** | **Security fixes for `apigee-fluent-bit`.** This addresses the following vulnerabilities: - [CVE-2026-35189](https://nvd.nist.gov/vuln/detail/CVE-2026-35189) - [CVE-2026-35191](https://nvd.nist.gov/vuln/detail/CVE-2026-35191) - [CVE-2026-42772](https://nvd.nist.gov/vuln/detail/CVE-2026-42772) - [CVE-2026-5450](https://nvd.nist.gov/vuln/detail/CVE-2026-5450) - [CVE-2026-54872](https://nvd.nist.gov/vuln/detail/CVE-2026-54872) - [CVE-2026-54873](https://nvd.nist.gov/vuln/detail/CVE-2026-54873) - [CVE-2026-54875](https://nvd.nist.gov/vuln/detail/CVE-2026-54875) - [CVE-2026-58050](https://nvd.nist.gov/vuln/detail/CVE-2026-58050) - [CVE-2026-58051](https://nvd.nist.gov/vuln/detail/CVE-2026-58051) - [CVE-2026-5928](https://nvd.nist.gov/vuln/detail/CVE-2026-5928) - [CVE-2026-66032](https://nvd.nist.gov/vuln/detail/CVE-2026-66032) - [CVE-2026-66033](https://nvd.nist.gov/vuln/detail/CVE-2026-66033) - [CVE-2026-66034](https://nvd.nist.gov/vuln/detail/CVE-2026-66034) - [CVE-2026-66035](https://nvd.nist.gov/vuln/detail/CVE-2026-66035) - [CVE-2026-72897](https://nvd.nist.gov/vuln/detail/CVE-2026-72897) - [CVE-2026-75804](https://nvd.nist.gov/vuln/detail/CVE-2026-75804) - [CVE-2026-75805](https://nvd.nist.gov/vuln/detail/CVE-2026-75805) - [CVE-2026-75806](https://nvd.nist.gov/vuln/detail/CVE-2026-75806) - [CVE-2026-77696](https://nvd.nist.gov/vuln/detail/CVE-2026-77696) - [CVE-2026-8286](https://nvd.nist.gov/vuln/detail/CVE-2026-8286) - [CVE-2026-84782](https://nvd.nist.gov/vuln/detail/CVE-2026-84782) - [CVE-2026-84784](https://nvd.nist.gov/vuln/detail/CVE-2026-84784) - [CVE-2026-8924](https://nvd.nist.gov/vuln/detail/CVE-2026-8924) - [CVE-2026-8927](https://nvd.nist.gov/vuln/detail/CVE-2026-8927) - [CVE-2026-92392](https://nvd.nist.gov/vuln/detail/CVE-2026-92392) | | **N/A** | **Security fixes for `apigee-hybrid-cassandra`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) | | **N/A** | **Security fixes for `apigee-hybrid-cassandra-client`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) | | **N/A** | **Security fixes for `apigee-kube-rbac-proxy`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) - [GHSA-gcjh-h69q-9w9g](https://osv.dev/vulnerability/GHSA-gcjh-h69q-9w9g) - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) | | **N/A** | **Security fixes for `apigee-mart-server`.** This addresses the following vulnerabilities: - [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) - [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) - [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) - [CVE-2026-89407](https://nvd.nist.gov/vuln/detail/CVE-2026-89407) - [CVE-2026-89425](https://nvd.nist.gov/vuln/detail/CVE-2026-89425) - [CVE-2026-91776](https://nvd.nist.gov/vuln/detail/CVE-2026-91776) - [CVE-2026-91777](https://nvd.nist.gov/vuln/detail/CVE-2026-91777) | | **N/A** | **Security fixes for `apigee-mint-task-scheduler`.** This addresses the following vulnerabilities: - [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) - [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) - [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) - [CVE-2026-89407](https://nvd.nist.gov/vuln/detail/CVE-2026-89407) - [CVE-2026-89425](https://nvd.nist.gov/vuln/detail/CVE-2026-89425) - [CVE-2026-91776](https://nvd.nist.gov/vuln/detail/CVE-2026-91776) - [CVE-2026-91777](https://nvd.nist.gov/vuln/detail/CVE-2026-91777) | | **N/A** | **Security fixes for `apigee-operators`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-63209](https://nvd.nist.gov/vuln/detail/CVE-2026-63209) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) | | **N/A** | **Security fixes for `apigee-prom-prometheus`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) | | **N/A** | **Security fixes for `apigee-prometheus-adapter`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) | | **N/A** | **Security fixes for `apigee-redis`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) | | **N/A** | **Security fixes for `apigee-runtime`.** This addresses the following vulnerabilities: - [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) - [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) - [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) - [CVE-2026-89407](https://nvd.nist.gov/vuln/detail/CVE-2026-89407) - [CVE-2026-89425](https://nvd.nist.gov/vuln/detail/CVE-2026-89425) - [CVE-2026-91776](https://nvd.nist.gov/vuln/detail/CVE-2026-91776) - [CVE-2026-91777](https://nvd.nist.gov/vuln/detail/CVE-2026-91777) | | **N/A** | **Security fixes for `apigee-synchronizer`.** This addresses the following vulnerabilities: - [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) - [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) - [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) - [CVE-2026-89407](https://nvd.nist.gov/vuln/detail/CVE-2026-89407) - [CVE-2026-89425](https://nvd.nist.gov/vuln/detail/CVE-2026-89425) - [CVE-2026-91776](https://nvd.nist.gov/vuln/detail/CVE-2026-91776) - [CVE-2026-91777](https://nvd.nist.gov/vuln/detail/CVE-2026-91777) | | **N/A** | **Security fixes for `apigee-watcher`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-63209](https://nvd.nist.gov/vuln/detail/CVE-2026-63209) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) | **Cloud Profiler** Security The Cloud Profiler Java agent is updated with a new Certification Authority (CA) certificate bundle, in response to security bulletin [GCP-2026-071](https://docs.cloud.google.com/support/bulletins.md.txt#gcp-2026-071). Google Cloud infrastructure and the Cloud Profiler backend service are not affected. If you use the Cloud Profiler Java agent, take one of the following actions: - Upgrade the Java agent to `cloud-profiler-java-agent_20261026_RC00` ([GitHub release v0.5.0](https://github.com/GoogleCloudPlatform/cloud-profiler-java/releases/tag/v0.5.0)) or later, and then rebuild and redeploy your applications. Download the updated archive, , or, for `musl`-based Alpine Linux containers, . - If you can't immediately upgrade or rebuild, update your host or container operating system's CA certificate store as described in [GCP-2026-071](https://docs.cloud.google.com/support/bulletins.md.txt#gcp-2026-071), and then set the `GRPC_DEFAULT_SSL_ROOTS_FILE_PATH` environment variable to point to the updated PEM bundle. For more information about installing the agent, see [Profiling Java applications](https://docs.cloud.google.com/profiler/docs/profiling-java.md.txt#installing-profiler). **Dataflow** Feature Dataflow has added the following features to tune horizontal autoscaling for Streaming Engine jobs: - Latency tiers: You can configure the backlog threshold by choosing a latency tier (`low_latency`, `medium_latency`, or `high_latency`), allowing you to configure the autoscaler's sensitivity to backlog duration and balance latency requirements with resource costs. For more information, see [Set the latency tier](https://docs.cloud.google.com/dataflow/docs/guides/tune-horizontal-autoscaling.md.txt#latency-tier). - Autoscaling schedules: You can configure recurring autoscaling schedules to automatically apply parameter overrides---such as minimum and maximum workers, worker utilization hints, or latency tiers---during specific time windows. For more information, see [Schedule autoscaling changes](https://docs.cloud.google.com/dataflow/docs/guides/tune-horizontal-autoscaling.md.txt#scheduled-autoscaling). You can configure these features when you create a job or update them while the job is running. **Dialogflow** Security **Dialogflow ES** : The Dialogflow ES [LINE integration](https://docs.cloud.google.com/dialogflow/es/docs/integrations/line.md.txt#signature-verification) validates the `X-Line-Signature` HTTP header on incoming webhook requests using your LINE channel secret and rejects requests with missing, duplicate, or invalid signatures with an HTTP `400 Bad Request` error. Make sure your configured channel secret matches your LINE Messaging API channel and that any intermediate proxy forwards the `X-Line-Signature` header and raw request body unmodified. **Gemini** Other ### Bug fixes in VS Code Various bug fixes and minor product enhancements. **Google Kubernetes Engine** Feature Managed OpenTelemetry for GKE is generally available (GA) on clusters running GKE version 1.37.1-gke.1697000 or later. You can collect OpenTelemetry Protocol (OTLP) traces, metrics, and logs from your workloads with a Google-managed collector instead of a self-managed OpenTelemetry Collector deployment: - Configure `otlp_grpc` in the Instrumentation custom resource (GKE version 1.37.1-gke.1697000 or later), or send telemetry directly to the in-cluster collector's gRPC endpoint on port 4317 in addition to HTTP on port 4318. - The managed collector routes logs alongside traces and metrics through the Cloud Telemetry API (`telemetry.googleapis.com`), with improved per-signal queueing and autoscaling for high-throughput clusters. (Logs ingested through `telemetry.googleapis.com` default to the `otlp` log name instead of `gke-managed-otel-collector`.) - [Multimodal prompts and responses collection](https://docs.cloud.google.com/kubernetes-engine/docs/how-to/managed-otel-gke.md.txt#multimodal-prompts-responses) for LangGraph ReAct and Agent Development Kit (ADK) agents, the `--managed-otel-scope` flag in the `gcloud` CLI (version 576.0.0 or later), and `managed_opentelemetry_config` in `terraform-provider-google` (v8.8.0 or later) are generally available. To use the GA collector and features, upgrade clusters from earlier Preview versions to 1.37.1-gke.1697000 or later. For architecture details and setup instructions, see [Managed OpenTelemetry for GKE](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/managed-otel-gke.md.txt) and [Deploy Managed OpenTelemetry for GKE](https://docs.cloud.google.com/kubernetes-engine/docs/how-to/managed-otel-gke.md.txt). **Identity and Access Management** Feature The Admin (`roles/admin`), Writer (`roles/writer`), and Reader (`roles/reader`) basic roles are generally available ([GA](https://cloud.google.com/products#product-launch-stages)). For more information, see [Basic roles](https://docs.cloud.google.com/iam/docs/roles-overview.md.txt#basic). The legacy basic roles---Owner (`roles/owner`), Editor (`roles/editor`), and Viewer (`roles/viewer`)---are still available for use and are being actively maintained. However, if you need to grant a basic role, we recommend granting the Admin, Writer, or Reader role instead of a legacy basic role. This is because the newer roles support additional features, such as the use of [IAM Conditions](https://docs.cloud.google.com/iam/docs/conditions-overview.md.txt). **Looker** Announcement Beginning October 26, 2026, the following features will be automatically enabled for Looker (original) and Looker (Google Cloud core) instances running Looker 26.20. Feature The ability to [generate a summary of an Explore by using Gemini assistance](https://docs.cloud.google.com/looker/docs/explore-summary-gemini) is now generally available. Feature The [bullet chart](https://docs.cloud.google.com/looker/docs/bullet-options.md.txt) visualization type is now generally available. Bullet charts let you evaluate a single primary metric's performance as one or more bars and mark your goal with a target line. You can plot both against shaded background ranges that represent performance thresholds, such as "poor," "satisfactory," and "good." For more information, see [Bullet chart options](https://docs.cloud.google.com/looker/docs/bullet-options.md.txt). Feature Looker now includes [network diagnostics](https://docs.cloud.google.com/looker/docs/admin-panel-database-connections.md.txt#network-diagnostics) to help you troubleshoot database connectivity issues. When a [database connection test](https://docs.cloud.google.com/looker/docs/connecting-to-your-db.md.txt#troubleshooting) fails, Looker automatically tests DNS resolution and TCP connectivity for the connection's endpoints and appends the results to the error message. To [test network reachability](https://docs.cloud.google.com/looker/docs/admin-panel-database-connections.md.txt#test-network-reachability) to any hostname and port without creating a connection, Looker administrators can click **Test Reachability** on the **Connections** page. **Note:** This item was added on October 30, 2026. Feature The **Table Row Grouping** feature and the [**Grouping** menu options](https://docs.cloud.google.com/looker/docs/table-options.md.txt#grouping-menu-options) are now generally available. The **Grouping** menu options let you display and customize the appearance of table chart data hierarchically in groups. Feature The [**Visualization Assistant**](https://docs.cloud.google.com/looker/docs/custom-looker-visualization-gemini.md.txt) is now generally available. Feature Looker Continuous Integration (CI) now supports hub-and-spoke projects. If your Looker project uses [local project imports](https://docs.cloud.google.com/looker/docs/importing-projects.md.txt#importing_local_projects) to import files from an upstream *hub* project on the same Looker instance, then you can use CI to automatically test downstream *spoke* projects. Testing runs whenever a pull request is opened or updated on the hub project. This capability lets you catch breaking changes in downstream Explores, content, or data tests before upstream LookML changes are merged. For more information, see [Creating a Continuous Integration suite](https://docs.cloud.google.com/looker/docs/ci-create-suite.md.txt#imported-project-trigger). Feature Two new legacy features, [**Use Legacy Explore and Merge Query Experience**](https://docs.cloud.google.com/looker/docs/legacy-feature-schedule.md.txt#use_legacy_explore_and_merge_query_experience) and [**Use Legacy Explore and Merge Query Experience for Embed**](https://docs.cloud.google.com/looker/docs/legacy-feature-schedule.md.txt#use_legacy_explore_and_merge_query_experience_for_embed), are now available for Looker (original) and Looker (Google Cloud core) instances. These features let administrators configure Explores and merged queries to open in the classic experience by default across an instance or in embedded contexts. For more information, see [Legacy feature schedule](https://docs.cloud.google.com/looker/docs/legacy-feature-schedule.md.txt). Feature Looker now includes a new [histogram chart](https://docs.cloud.google.com/looker/docs/histogram-options.md.txt) visualization option. A histogram chart is a graphical representation of the data distribution of an attribute. A histogram creates intervals (bins) and counts how many values fall into each bin. Feature The [KPI (Single Value)](https://docs.cloud.google.com/looker/docs/kpi-single-value-options.md.txt) chart type is now generally available. The KPI (Single Value) chart type replaces the Single Value chart type. Feature The new Looker Explore and merge query experience is now generally available and is the default interface for [Explores](https://docs.cloud.google.com/looker/docs/creating-and-editing-explores.md.txt) and for [joining data from multiple queries](https://docs.cloud.google.com/looker/docs/merged-results.md.txt). Feature When you enter values in a string filter on dashboards, Looks, or Explores, clicking **Done** or clicking outside the input field no longer creates a filter chip from uncommitted text. To create a filter chip, press Enter, enter a comma (`,`), or paste values into the input field. Feature The new [**Dashboard Tile Groups** preview feature](https://docs.cloud.google.com/looker/docs/admin-panel-general-preview-features.md.txt#dashboard-tile-groups) lets you [organize related tiles into collapsible containers](https://docs.cloud.google.com/looker/docs/editing-user-defined-dashboards.md.txt#organizing_tiles_into_groups) for improved visual organization. You can move, duplicate, or delete multiple tiles as a single unit on dashboards that use the newspaper layout. This update also adds LookML support for programmatically managing tile groups. Feature Now available in [preview](https://cloud.google.com/products#product-launch-stages), the [**Release Changelog**](https://docs.cloud.google.com/looker/docs/release-changelog.md.txt) gives Looker users and administrators real-time visibility into the features, behavioral changes, and bug fixes that are available for their instance. Feature The [**Legacy features** page](https://docs.cloud.google.com/looker/docs/legacy-feature-schedule.md.txt) is now available in the **Admin** panel for Looker (Google Cloud core) instances. Legacy features that appear on the Looker (Google Cloud core) **Legacy features** page might differ from those that are available on Looker (original) instances. For more information, see [Looker (Google Cloud core) admin settings](https://docs.cloud.google.com/looker/docs/looker-core-admin-looker). Announcement The latest versions in the Looker (Google Cloud core) [release channels](https://docs.cloud.google.com/looker/docs/looker-core-release-process.md.txt#release_channels) are beginning deployment as follows: - Latest version in the Rapid channel: **Looker 26.22** - Latest version in the No Channel channel: **Looker 26.22** The latest version in the Regular channel remains **Looker 26.18**. Breaking Some elements of the [Conversational Analytics System Activity dashboard](https://docs.cloud.google.com/looker/docs/system-activity-dashboards.md.txt#conversational-analytics) have been renamed. The dashboard layout and capabilities remain the same. On the **Token usage** tab, the **Conversational Analytics API** value in the **Feature** column and the **Feature Name** filter has been renamed to **Looker API**. This value refers to the Conversational Analytics methods for the Looker API. This rename might cause a breaking change if you built custom dashboards that reference the former **Feature** column or **Feature Name** filter value. Change The **Use Legacy Connections Page** [legacy feature](https://docs.cloud.google.com/looker/docs/legacy-feature-schedule.md.txt#legacy_connections) and the legacy database connection workflow have been removed. All database connections now use the connection workflow that is described in [Connecting Looker to your database](https://docs.cloud.google.com/looker/docs/connecting-to-your-db.md.txt). **Model Armor** Feature Model Armor is available in Brazil (`southamerica-east1`). This region provides data residency compliance for at-rest, in-use, and in-transit data with [limited feature support](https://docs.cloud.google.com/model-armor/feature-availability-by-region.md.txt#limited-support). The `southamerica-east1` region supports the following filters: - Prompt injection and jailbreak detection - Responsible AI - Sensitive Data Protection For more information, see [Locations](https://docs.cloud.google.com/model-armor/locations.md.txt), [Data residency and endpoints](https://docs.cloud.google.com/model-armor/data-residency.md.txt), and [Supported features by region](https://docs.cloud.google.com/model-armor/feature-availability-by-region.md.txt#supported-by-region). **SAP on Google Cloud** Announcement **ABAP SDK for Google Cloud version 1.15 (On-premises or any cloud edition)** Version 1.15 of the on-premises or any cloud edition of the ABAP SDK for Google Cloud is generally available (GA). This version enhances binary data handling to let you download archived `.msg` files and other binary formats without applying character decoding when you use Cloud Storage as a content repository for SAP. For more information, see [What's new with the on-premises or any cloud edition of the ABAP SDK for Google Cloud](https://docs.cloud.google.com/sap/docs/abap-sdk/on-premises-or-any-cloud/whats-new.md.txt#version-1-15). **VPC Service Controls** Feature [Preview stage](https://cloud.google.com/products#product-launch-stages) support for the following integration: - [App Optimize API](https://docs.cloud.google.com/vpc-service-controls/docs/supported-products.md.txt#table_app_optimize) ## October 28, 2026 **AlloyDB for PostgreSQL** Announcement The following AlloyDB AI and vector search features and improvements are generally available ([GA](https://cloud.google.com/products#product-launch-stages)): - The `alloydb_scann` extension supports four-level tree (4LT) ScaNN vector indexes on PostgreSQL 17 and later, providing support for tables with up to 10 billion vector rows. For more information, see [Four-level ScaNN tree indexes](https://docs.cloud.google.com/alloydb/docs/ai/create-scann-index.md.txt#create-scann-index-manual). - 4LT ScaNN vector indexes support automatic index maintenance. For more information, see [Create a ScaNN index](https://docs.cloud.google.com/alloydb/docs/ai/create-scann-index.md.txt) and [Maintain vector indexes automatically](https://docs.cloud.google.com/alloydb/docs/ai/maintain-vector-indexes.md.txt#maintain-index-automatically). - You can enable streaming functionality for ScaNN vector indexes by setting the `scann.satisfy_limit` parameter to `relaxed_order`. When enabled, the vector scan continues searching through additional leaf partitions until it finds enough results to satisfy the `LIMIT` clause of your query, improving recall on filtered searches. Additionally, you can enable this feature for parallel process scans by setting the `scann.enable_parallel_satisfy_limit` database flag to `on`. For more information, see [ScaNN index reference](https://docs.cloud.google.com/alloydb/docs/reference/ai/scann-index-reference.md.txt#scann-satisfy-limit) and [Best practices for tuning ScaNN indexes](https://docs.cloud.google.com/alloydb/docs/ai/best-practices-tuning-scann.md.txt#improve-recall-for-filtered-searches). - Vector assist simplifies the deployment and management of your AlloyDB vector workloads by helping you set up production-ready vector search capabilities, including embedding generation, query optimization, and index creation for vector types such as Hierarchical Navigable Small World (HNSW). For more information, see [Vector assist overview](https://docs.cloud.google.com/alloydb/docs/ai/vector-assist-overview.md.txt). - For AlloyDB for PostgreSQL instances running PostgreSQL 17 and later, the maximum supported value for `num_leaves` when building ScaNN vector indexes is increased from 30,000,000 to 104,857,600. For more information, see [Create a ScaNN index](https://docs.cloud.google.com/alloydb/docs/ai/create-scann-index.md.txt) and [ScaNN index reference](https://docs.cloud.google.com/alloydb/docs/reference/ai/scann-index-reference.md.txt). - You can use the [`external_search_fdw`](https://docs.cloud.google.com/alloydb/docs/reference/extensions.md.txt#external_search_fdw) extension to connect to external search clusters and query their data directly from your database using the following search sources: - [Elasticsearch](https://docs.cloud.google.com/alloydb/docs/elastic-search.md.txt) - [Solr](https://docs.cloud.google.com/alloydb/docs/solr-search.md.txt) - [OpenSearch](https://docs.cloud.google.com/alloydb/docs/opensearch.md.txt) - AlloyDB supports the `rum` extension for high-performance full-text search operations on PostgreSQL 17 and earlier. The `rum` extension extends standard GIN indexes by storing positional information directly in the index, letting you perform faster phrase searches and relevance ranking without accessing the table data. For more information, see [Create and manage a RUM index](https://docs.cloud.google.com/alloydb/docs/ai/create-rum-index.md.txt). Fixed AlloyDB provides more accurate memory usage estimation and prevents out-of-memory (OOM) errors when you build a ScaNN [four-level tree index](https://docs.cloud.google.com/alloydb/docs/ai/create-scann-index.md.txt#create-scann-index-manual). This feature is in [Preview](https://cloud.google.com/products#product-launch-stages). This update improves the stability of index builds by enforcing memory limits and improving memory estimation under constrained conditions. Feature Identity and Access Management (IAM) group authentication is generally available ([GA](https://cloud.google.com/products#product-launch-stages)) for new and existing AlloyDB clusters running PostgreSQL 15 and later. With IAM group authentication, you can manage database roles and privileges at the group level across primary instances and read pool instances, including first-time sign-ins directly to read pool instances. You can also preserve individual and IAM group user configurations when you migrate from a Cloud SQL for PostgreSQL backup. For more information, see [IAM database authentication overview](https://docs.cloud.google.com/alloydb/docs/database-users/iam-authentication) and [Manage IAM authentication](https://docs.cloud.google.com/alloydb/docs/database-users/manage-iam-auth). Security In response to [GCP-2026-071](https://docs.cloud.google.com/support/bulletins.md.txt#gcp-2026-071), Google is updating AlloyDB managed components. The fix to the certificate store is shipped in a new maintenance version that AlloyDB applies during [scheduled maintenance](https://docs.cloud.google.com/alloydb/docs/maintenance.md.txt#timing), so you don't need to manually update AlloyDB managed instances. You can also apply the fix by [performing self-service maintenance](https://docs.cloud.google.com/alloydb/docs/self-service-maintenance.md.txt). Depending on how you connect to AlloyDB, take the following actions: - If you use the AlloyDB Auth Proxy, then upgrade it to [v1.17.2 or later](https://docs.cloud.google.com/alloydb/docs/auth-proxy/connect.md.txt#install). If you run the standalone proxy binary, then also update the host's certificate authority (CA) certificates. - If you use the [AlloyDB Language Connectors](https://docs.cloud.google.com/alloydb/docs/connect-language-connectors.md.txt), then update the language runtime and operating system CA certificates (for example, Go 1.26.10 or 1.27.3 or later). **Application Integration** Security A Deserialization of Untrusted Data vulnerability was discovered in the `SubWorkflow` task in Application Integration versions prior to September 11, 2026. For more information, see the [GCP-2026-074](https://docs.cloud.google.com/application-integration/docs/security-bulletins.md.txt#gcp-2026-074) security bulletin. Feature **Application Integration agent skills** Application Integration agent skills are available in the public [`google/skills`](https://github.com/google/skills) repository: `application-integration-basics`, `application-integration-authoring`, and `application-integration-troubleshooting`. AI coding agents that use these skills can help you set up Application Integration; build, publish, and run integrations through the REST API; and troubleshoot failed runs. For more information, see [Application Integration agent skills](https://docs.cloud.google.com/application-integration/docs/agent-skills-overview.md.txt) and [Build an integration with an AI agent](https://docs.cloud.google.com/application-integration/docs/build-integration-ai-agent.md.txt). **Bigtable** Feature You can configure Bigtable tables with microsecond timestamp granularity to capture and store high-frequency data. By supporting microsecond precision for cell timestamps, Bigtable helps you prevent data loss from write collisions in workloads with high event rates. This feature is [generally available (GA)](https://cloud.google.com/products#product-launch-stages) for instances in the Enterprise Plus edition. For more information, see [Data type enforcement in Bigtable](https://docs.cloud.google.com/bigtable/docs/data-types.md.txt). **Cloud Asset Inventory** Feature The following resource types are publicly available through the [ExportAssets](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/exportAssets.md.txt), [ListAssets](https://docs.cloud.google.com/asset-inventory/docs/listing-assets), [BatchGetAssetsHistory](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/batchGetAssetsHistory.md.txt), [QueryAssets](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/queryAssets.md.txt), [Feed](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/feeds.md.txt), and Search ([SearchAllResources](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/searchAllResources.md.txt), [SearchAllIamPolicies](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/searchAllIamPolicies.md.txt)) APIs. - Google Cloud Migration Center - `migrationcenter.googleapis.com/DiscoveryClient` - `migrationcenter.googleapis.com/Group` - `migrationcenter.googleapis.com/ImportJob` - `migrationcenter.googleapis.com/PreferenceSet` - `migrationcenter.googleapis.com/ReportConfig` - `migrationcenter.googleapis.com/Settings` - `migrationcenter.googleapis.com/Source` **Cloud Database Migration Service** Feature Database Migration Service for homogeneous SQL Server migrations now supports Distributed Availability Group (DAG) migrations in general availability ([GA](https://cloud.google.com/products#product-launch-stages)). With DAG migrations, you can use gcloud CLI and Database Migration Service API to migrate databases from self-managed SQL Server Enterprise Edition instances directly to Cloud SQL for SQL Server over a private network connection. DAG migrations don't require exporting backup or transaction log files to Cloud Storage, and support post-promotion reverse replication for zero-data-loss failback. For more information, see [About Distributed Availability Group (DAG) migrations](https://docs.cloud.google.com/database-migration/docs/sqlserver/dag-migration-overview.md.txt) and [Migrate from self-managed SQL Server using Distributed Availability Groups](https://docs.cloud.google.com/database-migration/docs/sqlserver/dag-migration-guide.md.txt). **Cloud SQL for MySQL** Feature [Managed replica indexes](https://docs.cloud.google.com/sql/docs/mysql/replication/read-replica-indexes.md.txt#managed-replica-indexes) for Cloud SQL for MySQL are generally available ([GA](https://cloud.google.com/products#product-launch-stages)). This feature lets you automatically retain and restore secondary indexes on read replica instances when Cloud SQL re-creates a replica. Previously, re-creating a read replica deleted custom secondary indexes because primary backups don't have replica-only index definitions. With managed replica indexes, Cloud SQL tracks secondary index metadata on the primary instance, replicates this metadata to read replicas, and automatically rebuilds secondary indexes after replica re-creation. Managed replica indexes are supported on instances that are running Cloud SQL for MySQL 8.0 or later, Cloud SQL Enterprise edition or Cloud SQL Enterprise Plus edition, and maintenance version `R20260726.00_05` or later. For more information, see [Read replica indexes overview](https://docs.cloud.google.com/sql/docs/mysql/replication/read-replica-indexes.md.txt) and [Create and manage read replica indexes](https://docs.cloud.google.com/sql/docs/mysql/replication/create-manage-read-replica-indexes.md.txt). **Confidential Space** Announcement A new Confidential Space image (261001) is available. This image removes compromised CA certificates from the OS trust store. See the [security bulletin](https://docs.cloud.google.com/confidential-computing/confidential-space/docs/security-bulletins.md.txt#gcp-2026-071) for more details. This image also adds support for running workload containers as a non-root user. Workload authors can require non-root execution with the `tee.launch_policy.nonroot_container` launch policy, and workload operators can enable it with the `tee-nonroot-container` metadata variable. For more information, see [Non-root container execution](https://docs.cloud.google.com/confidential-computing/confidential-space/docs/create-customize-workloads.md.txt#non-root-container-execution). **Gemini Enterprise** Feature **Gemini Enterprise: Support for Brazil (`br`) region (GA with allowlist)** You can use the Gemini Enterprise app in the Brazil (`br`) in-country region with at-rest data residency (DRZ) and machine learning processing (MLP) in region. This location is available in GA with allowlist. To get access to this location for use with Gemini Enterprise, contact your Google account team. For more information, see [Data residency for Gemini Enterprise](https://docs.cloud.google.com/gemini/enterprise/docs/locations#in-country_regions). **Gemini Enterprise Agent Platform** Change **Use a single regional Agent Registry instance for Gemini Enterprise apps** For Gemini Enterprise apps, we recommend associating each Agent Gateway with a single regional Agent Registry instance in the same project and region as the gateway. Use the `us-central1` registry for `global` and `us` apps, and the `europe-west1` registry for `eu` apps. This note updates the [September 9, 2026](https://docs.cloud.google.com/gemini-enterprise-agent-platform/release-notes#September_09_2026) entry. For more information, see [Register your agents and destination resources](https://docs.cloud.google.com/gemini-enterprise-agent-platform/govern/gateways/set-up-agent-gateway#agent-registry). Fixed **CodeMender updates (v0.17.0)** This release introduces updates to CodeMender: - **Support bundle diagnostics** : Introduce `cm support-bundle` to collect environment metadata, configuration policies, health reports, and session logs into a compressed archive for streamlined troubleshooting. - **Plain output mode** : Add the persistent `--plain` flag (configurable via the `CM_PLAIN` environment variable or `output.plain` in `config.yaml`) to suppress decorative emojis, ANSI escape sequences, and Unicode borders for compatibility with screen readers and CI/CD log pipelines. - **Dedicated exit codes for setup failures**: Assign distinct exit codes (such as code 10 for credential issues) to configuration and authentication failures, preventing CI/CD pipelines from confusing environment setup issues with security findings. - **Tailored CI/CD credential guidance**: Provide environment-specific authentication guidance when running inside automated CI/CD systems such as GitHub Actions, GitLab CI, Buildkite, and Jenkins instead of interactive login prompts. - **Single-line JSONL statistics** : Add the `--jsonl` flag to `cm stats` to output single-line JSON records with model and team attribution for seamless integration with Cloud Logging and log aggregation pipelines. - **Granular sandbox and policy flags** : Replace the overloaded `--unrestricted` flag with orthogonal flags (`--sandbox=false`) and configurable command policies to decouple container sandboxing from execution safety controls. - **Sandbox configuration protections** : Mount `.git/hooks`, `.git/config`, and `.codemender` read-only within writable execution sandboxes during `cm fix` and `cm verify` to prevent modifications to repository security policies. - **Bug fixes** : - Added a security warning when commands are executed with both sandbox isolation disabled and interactive approval skipped. - Enforced `allowedRoots` path boundaries across host discovery and remediation file operations to prevent traversal via dangling symlinks. - Supplied exact finding line ranges to remediation agents during `cm fix` to eliminate manual file scanning overhead. - Updated `cm report import` to properly treat findings without location data as file-level findings rather than defaulting to the first line. - Ensured `cm session cancel` routes requests to the session's original region regardless of local environment overrides. - Fixed finding status tracking in `cm verify` so unexploitable verdicts update the local state database rather than leaving findings open. For more information, see the [CodeMender documentation](https://docs.cloud.google.com/gemini-enterprise-agent-platform/agents/codemender.md.txt). **Google SecOps** Fixed **Tools power-up: Environment filtering in Get Integration Instances** There was an issue where the **Get Integration Instances** action in the Tools power-up didn't correctly filter environments with names that contain an ampersand (`&`). This issue has been fixed in version 85.0 of the Tools power-up. For more information, see [Get Integration Instances](https://docs.cloud.google.com/chronicle/docs/soar/marketplace/power-ups/tools.md.txt#get-integration-instances). Announcement **Final shutdown of legacy managed BigQuery export datasets (chronicle-tla) for non-Enterprise+ customers** Following the [March 26, 2025 deprecation announcement](https://docs.cloud.google.com/chronicle/docs/release-notes.md.txt#March_26_2025), Google SecOps is completing the final shutdown of legacy Google-managed BigQuery datasets and API keys associated with the `chronicle-tla` Google Cloud project: - **What is changing:** Data exports to legacy Google-managed BigQuery datasets under the `chronicle-tla` project are being permanently turned off, and the associated managed datasets and API keys are being decommissioned. - **Who is impacted:** This shutdown applies only to non-Enterprise+ customers still provisioned on legacy `chronicle-tla` Google-managed BigQuery datasets (including tenants whose temporary transition exceptions expired in September 2025). Enterprise+ customers and customers using Bring Your Own BigQuery (BYOBQ) exports to customer-managed Google Cloud projects are not impacted. - **When:** Decommissioning begins on October 28, 2026. - **Action required:** To retain BigQuery access to Google SecOps data, configure [export to a customer-managed BigQuery project (BYOBQ)](https://docs.cloud.google.com/chronicle/docs/reports/export-to-customer-managed-project.md.txt) or contact your account team to upgrade to Enterprise+. **Google SecOps Marketplace** Feature **SAP ERP**: Version 1.0 - New **SAP ERP** integration. Feature **Google Threat Intelligence**: Version 23.0 - The following new action has been added: - **Ask Threat Intelligence Agent** Change **Microsoft Graph Mail Delegated**: Version 27.0 - Fixed an issue where overflowed alerts were skipped without saving their IDs or marking the emails as read, preventing infinite reprocessing loops and state loss in the following connector: - **Microsoft Graph Mail Delegated Connector** Change **Tools**: Version 85.0 - Fixed an issue where environment names containing ampersands (`&`) weren't properly filtered in the following action: - **Get Integration Instances** Change **Wiz**: Version 11.0 - Fixed inbound and outbound closure reason mappings between Wiz and Google SecOps in the following job: - **Wiz and Google SecOps Bi-directional Sync Job** - Updated predefined widgets in the following actions: - **Add Comment To Issue** - **Get Blue Agent Analysis** - **Get Issue Details** - **Ignore Issue** - **List Resource Vulnerability Findings** - **Reopen Issue** - **Resolve Issue** Change **Microsoft Graph Mail**: Version 50.0 - Fixed an issue where overflowed alerts were skipped without saving their IDs or marking the emails as read, preventing infinite reprocessing loops and state loss in the following connector: - **Microsoft Graph Mail Connector** Change **Google Chronicle**: Version 99.0 - Fixed an issue where the connector could stop ingesting alerts when composite detections failed to load or pagination did not progress in the following connector: - **Google Chronicle - Chronicle Alerts Connector** Change **Okta**: Version 19.0 - **Integration**: Updated OAuth authentication scopes to support user management actions. Change **Microsoft 365 Defender**: Version 34.0 - Added the **Time Frame** , **Start Time** , and **End Time** parameters to support time-based query filtering in the following action: - **Execute Custom Query** **Google SecOps SIEM** Announcement **Final shutdown of legacy managed BigQuery export datasets (chronicle-tla) for non-Enterprise+ customers** Following the [March 26, 2025 deprecation announcement](https://docs.cloud.google.com/chronicle/docs/release-notes.md.txt#March_26_2025), Google SecOps is completing the final shutdown of legacy Google-managed BigQuery datasets and API keys associated with the `chronicle-tla` Google Cloud project: - **What is changing:** Data exports to legacy Google-managed BigQuery datasets under the `chronicle-tla` project are being permanently turned off, and the associated managed datasets and API keys are being decommissioned. - **Who is impacted:** This shutdown applies only to non-Enterprise+ customers still provisioned on legacy `chronicle-tla` Google-managed BigQuery datasets (including tenants whose temporary transition exceptions expired in September 2025). Enterprise+ customers and customers using Bring Your Own BigQuery (BYOBQ) exports to customer-managed Google Cloud projects are not impacted. - **When:** Decommissioning begins on October 28, 2026. - **Action required:** To retain BigQuery access to Google SecOps data, configure [export to a customer-managed BigQuery project (BYOBQ)](https://docs.cloud.google.com/chronicle/docs/reports/export-to-customer-managed-project.md.txt) or contact your account team to upgrade to Enterprise+. **Media CDN** Feature Media CDN supports flexible origin shielding in Frankfurt (`europe-west3`). This feature is [generally available (GA)](https://cloud.google.com/products#product-launch-stages). For more information, see [Flexible shielding](https://docs.cloud.google.com/media-cdn/docs/origins.md.txt#flex-shielding). Feature Media CDN supports EU data residency in **Private GA** . This feature helps ensure that your content and end-user data are processed within the EU. To enable this feature, contact [Google Cloud sales](https://cloud.google.com/contact). **Memorystore for Redis Cluster** Feature The [basic token-based authentication](https://docs.cloud.google.com/memorystore/docs/cluster/manage-basic-auth.md.txt) feature is [Generally Available](https://docs.cloud.google.com/products#product-launch-stages). ## October 27, 2026 **AlloyDB for PostgreSQL** Announcement The following AlloyDB AI functions and improvements are available in [Preview](https://cloud.google.com/products#product-launch-stages): - The `ai.extract` function lets you extract structured data from unstructured text directly within your database queries without needing external extraction pipelines. For more information, see [Extract structured data](https://docs.cloud.google.com/alloydb/docs/ai/extract-structured-data.md.txt). - The `ai.classify` function lets you categorize unstructured text into predefined labels directly within your database queries. For more information, see [Classify text](https://docs.cloud.google.com/alloydb/docs/ai/classify-text.md.txt). - Parameter names and signatures for AI query engine functions (`ai.analyze_sentiment`, `ai.summarize`, and `ai.agg_summarize`) are updated. For more information, see [Model endpoint reference](https://docs.cloud.google.com/alloydb/docs/reference/model-endpoint.md.txt). - The `prompt` and `prompts` parameters are renamed to `input` and `inputs` in scalar and batch functions respectively. - An optional `additional_instructions` parameter is added to `ai.summarize` and `ai.agg_summarize` to provide custom instructions to guide summary formatting, length, and tone. - In cursor-based versions of `ai.analyze_sentiment` and `ai.summarize`, the `prompt` parameter is removed. - `ai.agg_summarize` supports multiple positional signatures, including passing optional additional instructions and specifying model IDs. **Apigee X** Feature The **Apigee API Health \& Availability** dashboard is now generally available in [Cloud Monitoring](https://console.cloud.google.com/monitoring/dashboards) to help you monitor the health, performance, and availability of your Apigee API proxies in real time: - **Golden signal scorecards** : track aggregate **Traffic** (requests per second), **Error Rate (5xx)** , and **Latency (p95)** scorecards. - **Status code and error trends** : visualize the **Request Rate by Status Code** chart over time and identify problematic APIs using the dedicated **5xx Error Rate by Proxy** and **4xx Error Rate by Proxy** charts. - **Granular filtering** : filter telemetry by `project_id`, `location`, and `proxy_name` to troubleshoot specific regions or proxies. For more information, see [API Monitoring](https://docs.cloud.google.com/apigee/docs/api-monitoring.md.txt). **Bigtable** Feature You can [use Apache Avro schema bundles](https://docs.cloud.google.com/bigtable/docs/create-manage-avro-schemas.md.txt) to query individual fields within Avro records stored as serialized bytes in Bigtable. You can [query your Avro data](https://docs.cloud.google.com/bigtable/docs/query-avro-data.md.txt) using GoogleSQL for Bigtable, continuous materialized views, and logical views. This feature is in [Preview](https://cloud.google.com/products#product-launch-stages). **Cloud DNS** Announcement Starting January 5, 2027, CNAME chasing behavior will change so that Cloud DNS follows CNAME chains between public and private zones. If your private zones or response policies have overlapping domain names with public CNAME targets, queries might resolve to unintended internal IP addresses or return resolution errors. The following table outlines the current and updated behaviors. | Source of CNAME answer | Current behavior (until January 5, 2027) | New behavior (starting January 5, 2027) | |---|---|---| | Cloud DNS public zone | Subsequent queries search only public DNS zones and internal DNS. Private zones, forwarding zones, and response policies are ignored. | Subsequent queries follow the complete VPC name resolution order: response policies, private zones, forwarding or peering zones, internal DNS, and public zones. | | Cloud DNS private zone | Subsequent queries search only authorized private zones. Public DNS zones are ignored. | Subsequent queries follow the complete VPC name resolution order. If the target isn't found in authorized private zones, Cloud DNS queries public DNS zones. | | Cloud DNS response policy zone | Cloud DNS systems don't perform queries for CNAME answers received from response policy local data rules. | Subsequent queries follow the complete VPC name resolution order. If the target isn't found in response policies or private zones, Cloud DNS queries public DNS zones. | Review your CNAME chasing needs before January 5, 2027. Test your DNS query paths using `dig` or `nslookup` to identify CNAME chasing scenarios. - **Look for private-to-public CNAME chasing scenarios** : Look for CNAME answers from response policies or private zones that don't match any response policy or record in a private zone. Previously, these queries resulted in a `NXDOMAIN` answer but after January 5, 2027, these scenarios might match a record in a public zone or continue to be `NXDOMAIN` responses. - **Look for public-to-private CNAME chasing scenarios** : Look for CNAME answers from public zones that don't match any record in a public zone. Previously, these CNAME chasing scenarios would have resulted in a `NXDOMAIN` response. After January 5, 2027, these scenarios might match a response policy or record in a private zone or continue to be `NXDOMAIN` responses if the private zone doesn't have the record. - **For CNAME chasing scenarios under your control**: As best practice, configure matching time-to-live (TTL) values for all records in the CNAME chain. Announcement Starting January 5, 2027, Cloud DNS will disable full responses to DNS queries of type `ANY` (`QTYPE=ANY`) in [public authoritative zones](https://docs.cloud.google.com/dns/docs/zones/zones-overview.md.txt). Instead, a single resource record will return for `ANY` queries, chosen from the existing resource record sets that match the query. Standard traffic from web browsers, applications, and API traffic query specific record types directly and are therefore unaffected with no action required. However, certain legacy scripts, automated health checkers, debugging commands (for example, `dig example.com ANY`), or custom third-party monitoring systems that explicitly query `ANY` records will receive the first available record instead of a full zone inventory. You must complete the following configuration updates before January 5, 2027: - **Identify legacy queries** : Review internal tools, deployment scripts, or third-party DNS monitoring configurations for commands or API calls that request the `ANY` record type. Cloud DNS logs in Cloud Logging can be helpful with this. - **Transition to specific queries** : Update the tools to query the specific, individual record types they require (for example, querying for `A`, `AAAA`, `MX`, or `TXT` records separately). - **Retrieve full zone records** : If you use `ANY` queries to retrieve all records in a zone, use the Cloud DNS REST API (`resourceRecordSets.list`), the gcloud CLI (`gcloud dns record-sets list`), or the Google Cloud Console instead. Risks associated with not making these changes include the following: - **False monitoring alarms** : Automated uptime or DNS monitoring tools checking `ANY` responses may misinterpret the new response as a system failure and trigger false alerts. - **Broken automation pipelines** : Internal deployment or CI/CD scripts that rely on parsing a full zone dump with an `ANY` query will fail to retrieve the expected data payload and may crash. - **Disrupted IT diagnostics**: Network administrators running manual legacy troubleshooting commands will no longer see a quick summary of all domain records, which could delay active network incident diagnostics. **Cloud Load Balancing** Feature Regular expression URL rewrites (`regexRewrite`) for route rules in URL maps are now **generally available** (GA) for Application Load Balancers. You can use regular expression pattern rewrite actions to rewrite URL paths by substituting or removing URL path components before forwarding requests to your backends. This feature is available in: - Global external Application Load Balancers - Regional external Application Load Balancers - Cross-region internal Application Load Balancers - Regional internal Application Load Balancers For more information, see [Regular expression URL rewrites for route rules](https://docs.cloud.google.com/load-balancing/docs/url-map-concepts#regex-url-rewrite). **Cloud Workstations** Feature Cloud Workstations supports [configuring direct access ports](https://docs.cloud.google.com/workstations/docs/access-http-servers-running-on-workstations.md.txt#configure-direct-access-ports) on workstation clusters in [Preview](https://cloud.google.com/products#product-launch-stages). Direct access ports let you connect directly to a workstation port using the standard `https://WORKSTATION_NAME.CLUSTER_ID.cloudworkstations.dev:PORT` URL format instead of encoding the port as a prefix in the URL. To set direct access ports, use the `--direct-access-ports` flag with the [`gcloud beta workstations clusters create`](https://docs.cloud.google.com/sdk/gcloud/reference/beta/workstations/clusters/create.md.txt) and [`gcloud beta workstations clusters update`](https://docs.cloud.google.com/sdk/gcloud/reference/beta/workstations/clusters/update.md.txt) commands---for example, `--direct-access-ports=80,8080`. **Config Connector** Announcement Config Connector version 1.160.0 is now available. Feature New Alpha Resources (Direct Reconciler): - `CCInsightsAnalysisRule` - Manage [Customer Experience Insights analysis rules](https://docs.cloud.google.com/gemini-enterprise-cx/insights/reference/rest/v1/projects.locations.analysisRules.md.txt) to define rules for analyzing conversational data. - `ConfigDeploymentGroup` - Manage [Infrastructure Manager deployment groups](https://docs.cloud.google.com/infrastructure-manager/docs/reference/rest/v1/projects.locations.deploymentGroups.md.txt) to orchestrate and manage deployments collectively. - `DataLineageProcess` - Manage [Knowledge Catalog data lineage processes](https://docs.cloud.google.com/knowledge-catalog/docs/reference/data-lineage/rest/v1/projects.locations.processes.md.txt) to track data origin and movement. - `DataplexDataProduct` - Manage [Knowledge Catalog data products](https://docs.cloud.google.com/knowledge-catalog/docs/reference/rest/v1/projects.locations.dataProducts.md.txt) to package and share data assets across an enterprise. - `DialogflowKnowledgeBase` - Manage [Dialogflow ES knowledge bases](https://docs.cloud.google.com/dialogflow/es/docs/reference/rest/v2/projects.locations.knowledgeBases.md.txt) to provide FAQs and articles for agent answers. - `DiscoveryEngineSchema` - Manage [Agent Search schemas](https://docs.cloud.google.com/generative-ai-app-builder/docs/reference/rest/v1/projects.locations.collections.dataStores.schemas.md.txt) to define document structures and schemas for data stores. - `DiscoveryEngineSession` - Manage [Agent Search sessions](https://docs.cloud.google.com/generative-ai-app-builder/docs/reference/rest/v1/projects.locations.collections.dataStores.sessions.md.txt) to maintain conversation context and history for search and recommendations. - `DiscoveryEngineSitemap` - Manage [Agent Search sitemaps](https://docs.cloud.google.com/generative-ai-app-builder/docs/reference/rest/v1/projects.locations.collections.dataStores.siteSearchEngine.sitemaps.md.txt) to crawl web pages for search data stores. - `ManagedKafkaConnectCluster` - Manage [Managed Service for Apache Kafka Connect clusters](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/reference/rest/v1/projects.locations.connectClusters.md.txt) to run connectors that integrate Apache Kafka with Google Cloud and external systems. - `MigrationCenterPreferenceSet` - Manage [Migration Center preference sets](https://docs.cloud.google.com/migration-center/docs/reference/rest/v1/projects.locations.preferenceSets.md.txt) to specify migration preferences and target cloud architecture assumptions. - `MigrationCenterSource` - Manage [Migration Center sources](https://docs.cloud.google.com/migration-center/docs/reference/rest/v1/projects.locations.sources.md.txt) to configure data sources for importing asset data. - `NetAppActiveDirectory` - Manage [NetApp Volumes Active Directory configurations](https://docs.cloud.google.com/netapp/volumes/docs/reference/rest/v1/projects.locations.activeDirectories.md.txt) to enable SMB and NFS domain-joined authentication. - `NetAppHostGroup` - Manage [NetApp Volumes host groups](https://docs.cloud.google.com/netapp/volumes/docs/reference/rest/v1/projects.locations.hostGroups.md.txt) to group client hosts for volume access. - `NetworkConnectivityTransport` - Manage [Network Connectivity transports](https://docs.cloud.google.com/network-connectivity/docs/reference/networkconnectivity/rest/v1/projects.locations.transports.md.txt) for connecting network endpoints. - `NetworkSecurityMirroringEndpointGroupAssociation` - Manage [Network Security Integration mirroring endpoint group associations](https://docs.cloud.google.com/network-security-integration/docs/reference/rest/v1/projects.locations.mirroringEndpointGroupAssociations.md.txt) to associate packet mirroring endpoint groups with Virtual Private Cloud (VPC) networks. - `NetworkServicesLBEdgeExtension` - Manage [Service Extensions load balancing edge extensions](https://docs.cloud.google.com/service-extensions/docs/reference/rest/v1/projects.locations.lbEdgeExtensions.md.txt) to customize Cloud CDN and edge proxy traffic processing. - `NetworkServicesLBTrafficExtension` - Manage [Service Extensions load balancing traffic extensions](https://docs.cloud.google.com/service-extensions/docs/reference/rest/v1/projects.locations.lbTrafficExtensions.md.txt) to customize request and response processing in Application Load Balancers. - `NetworkServicesServiceLBPolicy` - Manage [Cloud Service Mesh service load balancing policies](https://docs.cloud.google.com/service-mesh/docs/reference/network-services/rest/v1/projects.locations.serviceLbPolicies.md.txt) to configure fine-grained traffic distribution across backend services. - `SaaSServiceMgmtUnit` - Manage [App Lifecycle Manager units](https://docs.cloud.google.com/app-lifecycle-manager/reference/rest/v1/projects.locations.units.md.txt) to manage SaaS deployment units. - `StorageInsightsReportConfig` - Manage [Storage Insights report configurations](https://docs.cloud.google.com/storage/docs/insights/reference/rest/v1/projects.locations.reportConfigs.md.txt) to generate inventory and audit reports for Cloud Storage buckets. - `WorkloadManagerEvaluation` - Manage [Workload Manager evaluations](https://docs.cloud.google.com/workload-manager/docs/reference/rest/v1/projects.locations.evaluations.md.txt) to scan and evaluate workloads against best-practice rules. Feature New Fields: - [`BigtableTable`](https://docs.cloud.google.com/config-connector/docs/reference/resource-docs/bigtable/bigtabletable.md.txt) - Added support for `spec.columnFamily[].type`. - [`MemorystoreInstance`](https://docs.cloud.google.com/config-connector/docs/reference/resource-docs/memorystore/memorystoreinstance.md.txt) - Added support for `spec.gcsSource`. - [`MonitoringDashboard`](https://docs.cloud.google.com/config-connector/docs/reference/resource-docs/monitoring/monitoringdashboard.md.txt) - Added support for `timeSeriesQuery.opsAnalyticsQuery` in dashboard widgets. Feature New Features: - Added support for a configurable maximum exponential backoff delay ceiling and retry halting for direct controllers by using the `cnrm.cloud.google.com/backoff-max-delay-in-seconds` annotation. - Updated resource actuation to halt delete operations when the `cnrm.cloud.google.com/actuation-mode` annotation is set to `Paused` on an individual resource. Change Reconciliation Improvements: Added support for direct reconciliation to more resources, with opt-in behavior. The API is unchanged. To use the direct reconciler, add the `alpha.cnrm.cloud.google.com/reconciler: direct` annotation to the corresponding Config Connector object. The following resources now have direct reconciliation support: - [`ComputeNetworkFirewallPolicy`](https://docs.cloud.google.com/config-connector/docs/reference/resource-docs/compute/computenetworkfirewallpolicy.md.txt) - Added support for direct reconciliation (opt-in). - [`ComputeProjectMetadata`](https://docs.cloud.google.com/config-connector/docs/reference/resource-docs/compute/computeprojectmetadata.md.txt) - Added support for direct reconciliation (opt-in). - `FirebaseHostingSite` - Added support for direct reconciliation (opt-in). - `NetworkServicesEdgeCacheService` - Added support for direct reconciliation (opt-in). - `OSLoginSSHPublicKey` - Added support for direct reconciliation (opt-in). - [`SQLSSLCert`](https://docs.cloud.google.com/config-connector/docs/reference/resource-docs/sql/sqlsslcert.md.txt) - Added support for direct reconciliation (opt-in). Fixed Bug Fixes: - [`AlloyDBCluster`](https://docs.cloud.google.com/config-connector/docs/reference/resource-docs/alloydb/alloydbcluster.md.txt) ([#13963](https://github.com/GoogleCloudPlatform/k8s-config-connector/pull/13963)) - Fixed false-positive diffs on `labels`, `initialUser`, and `network` during takeover and re-reconciliation in the direct controller. - [`ArtifactRegistryRepository`](https://docs.cloud.google.com/config-connector/docs/reference/resource-docs/artifactregistry/artifactregistryrepository.md.txt) ([#13873](https://github.com/GoogleCloudPlatform/k8s-config-connector/pull/13873)) - Fixed migration diffs on `cleanupPolicies` and `cleanupPolicyDryRun` when switching from the Terraform-based controller to the direct controller. - [`ComputeRouterNAT`](https://docs.cloud.google.com/config-connector/docs/reference/resource-docs/compute/computerouternat.md.txt) ([#13787](https://github.com/GoogleCloudPlatform/k8s-config-connector/pull/13787)) - Fixed creation default and deletion behavior mismatches between the direct controller and the legacy controller. - [`ComputeSecurityPolicy`](https://docs.cloud.google.com/config-connector/docs/reference/resource-docs/compute/computesecuritypolicy.md.txt) ([#12775](https://github.com/GoogleCloudPlatform/k8s-config-connector/pull/12775)) - Fixed an issue where setting `rateLimitOptions.enforceOnKeyConfigs` failed with an API error unless `enforceOnKey: ""` was explicitly specified. - [`EssentialContactsContact`](https://docs.cloud.google.com/config-connector/docs/reference/resource-docs/essentialcontacts/essentialcontactscontact.md.txt) ([#13845](https://github.com/GoogleCloudPlatform/k8s-config-connector/pull/13845)) - Fixed `409 ALREADY_EXISTS` reconciliation errors by automatically acquiring an existing contact by email. - [`MemorystoreInstance`](https://docs.cloud.google.com/config-connector/docs/reference/resource-docs/memorystore/memorystoreinstance.md.txt) ([#13962](https://github.com/GoogleCloudPlatform/k8s-config-connector/pull/13962)) - Fixed unwanted drift when `maintenanceVersion` is omitted from the resource configuration by leaving the field unmanaged. **Container Optimized OS** Change ### cos-dev-138-20248-0-0 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.18.57](https://cos.googlesource.com/third_party/kernel/+/8d63d0a98e25398e4dda752bc9b925ab47532d8d) | v29.4.3 | v2.4.1 | [See List](https://storage.googleapis.com/cos-tools/20248.0.0/lakitu/gpu_driver_versions.textproto) | Change Updated the Linux kernel to v6.18.57. Change Upgraded sys-apps/casfs to v0.1.24. Feature Added KVM virtualization support for AMD CPUID faulting. Feature Added nvidia-container-toolkit to ARM images. Fixed Updated cos-gpu-installer to v2.7.11 and toolbox to v20261020. Fixed Upgraded app-editors/vim to v9.2.1152, Upgraded app-editors/vim-core to v9.2.1152. Fixed Upgraded app-misc/ca-certificates to v20260816.3.125. This removes the certificates affected by the eMudhra intermediate certificate compromise. Fixed Upgraded dev-libs/nss to v3.131.1. This removes the certificates affected by the eMudhra intermediate certificate compromise. Fixed Upgraded sys-libs/glibc to v2.41-r5. Security Fixed CVE-2024-4741 in dev-libs/openssl. Security Fixed CVE-2026-33186 in cri-tools. Security Fixed CVE-2026-39830 in guest-agent. Security Fixed CVE-2026-39831 in node-problem-detector. Security Fixed CVE-2026-39831, CVE-2026-46595 in docker. Security Fixed CVE-2026-39832, CVE-2026-46595 in kubernetes. Security Fixed CVE-2026-39833 in nvidia-container-toolkit. Security Fixed CVE-2026-42508, CVE-2026-39830, CVE-2026-39834 in google-guest-agent. Security Fixed CVE-2026-46595, CVE-2026-39831 in google-osconfig-agent. Security Fixed CVE-2026-46595, CVE-2026-39832 in cri-tools. Security Fixed CVE-2026-5435 in sys-libs/glibc. Security Fixed CVE-2026-82474 in app-admin/sudo. Security Fixed CVE-2026-84445, CVE-2026-24051, CVE-2026-84304, CVE-2026-39831, CVE-2026-39829, CVE-2026-39834, CVE-2026-34986, CVE-2026-39835, CVE-2026-39832, CVE-2026-39827, CVE-2026-81870, CVE-2026-46598, CVE-2026-29181, CVE-2026-39830, CVE-2026-46595, CVE-2026-39828, CVE-2026-25680, CVE-2026-39833, CVE-2026-39883, CVE-2026-84303, CVE-2026-46597, CVE-2026-42508 in cos-extensions. Security Fixed CVE-2026-98432 in the Linux kernel. Security Fixed CVE-2026-99999 in the Linux kernel. Security Upgraded dev-lang/go to v1.26.10. This fixes CVE-2026-111943. Security Upgraded dev-lang/go to v1.26.5. This fixes CVE-2026-39822. Security Upgraded dev-lang/go to v1.26.9. This fixes CVE-2026-94447. Security Upgraded dev-lang/python to v3.13.15. This fixes CVE-2026-15308. Security Upgraded dev-lang/python to v3.13.16. This fixes CVE-2026-19445. Change ### cos-125-19216-760-20 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.12.113](https://cos.googlesource.com/third_party/kernel/+/c0c0e54972faeecef0eb8728e9c1d6291f4f7dee) | v27.5.1 | v2.2.7 | [See List](https://storage.googleapis.com/cos-tools/19216.760.20/lakitu/gpu_driver_versions.textproto) | Change Updated app-admin/google-guest-configs to v20261025.00. Security Fixed CVE-2026-33186 in google-osconfig-agent. Security Fixed CVE-2026-82474 in app-admin/sudo. Change Runtime sysctl changes: - Changed: fs.epoll.max_user_watches: 1808562 -\> 1808517 - Changed: fs.fanotify.max_user_marks: 68416 -\> 68412 - Changed: fs.inotify.max_user_watches: 64192 -\> 64189 - Changed: kernel.threads-max: 63183 -\> 63178 - Changed: net.ipv4.tcp_mem: 94020 125361 188040 -\> 94017 125357 188034 - Changed: net.ipv4.udp_mem: 188040 250722 376080 -\> 188034 250715 376068 - Changed: user.max_cgroup_namespaces: 31591 -\> 31589 - Changed: user.max_fanotify_marks: 68416 -\> 68412 - Changed: user.max_inotify_watches: 64192 -\> 64189 - Changed: user.max_ipc_namespaces: 31591 -\> 31589 - Changed: user.max_mnt_namespaces: 31591 -\> 31589 - Changed: user.max_net_namespaces: 31591 -\> 31589 - Changed: user.max_pid_namespaces: 31591 -\> 31589 - Changed: user.max_time_namespaces: 31591 -\> 31589 - Changed: user.max_user_namespaces: 31591 -\> 31589 - Changed: user.max_uts_namespaces: 31591 -\> 31589
Change ### cos-129-19506-578-21 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.12.113](https://cos.googlesource.com/third_party/kernel/+/120d67cd4f74b312486d3b1efa79fde8fa440eaa) | v27.5.1 | v2.2.7 | [See List](https://storage.googleapis.com/cos-tools/19506.578.21/lakitu/gpu_driver_versions.textproto) | Change Updated app-admin/google-guest-configs to v20261025.00. Security Fixed CVE-2026-77214 in dev-libs/expat. Change Runtime sysctl changes: - Changed: fs.epoll.max_user_watches: 1808562 -\> 1808517 - Changed: fs.fanotify.max_user_marks: 68416 -\> 68412 - Changed: fs.inotify.max_user_watches: 64192 -\> 64189 - Changed: kernel.threads-max: 63183 -\> 63178 - Changed: net.ipv4.tcp_mem: 94020 125361 188040 -\> 94017 125357 188034 - Changed: net.ipv4.udp_mem: 188040 250722 376080 -\> 188034 250715 376068 - Changed: user.max_cgroup_namespaces: 31591 -\> 31589 - Changed: user.max_fanotify_marks: 68416 -\> 68412 - Changed: user.max_inotify_watches: 64192 -\> 64189 - Changed: user.max_ipc_namespaces: 31591 -\> 31589 - Changed: user.max_mnt_namespaces: 31591 -\> 31589 - Changed: user.max_net_namespaces: 31591 -\> 31589 - Changed: user.max_pid_namespaces: 31591 -\> 31589 - Changed: user.max_time_namespaces: 31591 -\> 31589 - Changed: user.max_user_namespaces: 31591 -\> 31589 - Changed: user.max_uts_namespaces: 31591 -\> 31589
Change ### cos-121-18867-652-12 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.6.159](https://cos.googlesource.com/third_party/kernel/+/f32de83646bdc7b4c004477f6c4977ebd5b03cd7) | v27.5.1 | v2.0.10 | [See List](https://storage.googleapis.com/cos-tools/18867.652.12/lakitu/gpu_driver_versions.textproto) | Change Updated app-admin/google-guest-configs to v20261025.00. Security Fixed CVE-2026-33186 in google-osconfig-agent. Change Runtime sysctl changes: - Changed: fs.epoll.max_user_watches: 1809051 -\> 1809007 - Changed: kernel.threads-max: 63204 -\> 63199 - Changed: net.ipv4.tcp_mem: 94044 125395 188088 -\> 94041 125391 188082 - Changed: net.ipv4.udp_mem: 188091 250790 376182 -\> 188085 250783 376170 - Changed: user.max_cgroup_namespaces: 31602 -\> 31599 - Changed: user.max_ipc_namespaces: 31602 -\> 31599 - Changed: user.max_mnt_namespaces: 31602 -\> 31599 - Changed: user.max_net_namespaces: 31602 -\> 31599 - Changed: user.max_pid_namespaces: 31602 -\> 31599 - Changed: user.max_time_namespaces: 31602 -\> 31599 - Changed: user.max_user_namespaces: 31602 -\> 31599 - Changed: user.max_uts_namespaces: 31602 -\> 31599
Change ### cos-beta-133-19999-44-170 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.18.55](https://cos.googlesource.com/third_party/kernel/+/90c4c51012dc5bb5d116a470e49476dd9dd3998c) | v29.4.3 | v2.4.1 | [See List](https://storage.googleapis.com/cos-tools/19999.44.170/lakitu/gpu_driver_versions.textproto) | Change Updated app-admin/google-guest-configs to v20261025.00. **Gemini Enterprise** Feature **Gemini Enterprise: VPC connectivity and static IP egress for custom MCP servers** You can configure Virtual Private Cloud (VPC) connectivity for custom Model Context Protocol (MCP) server data stores by routing outbound tool traffic through Agent Gateway (supported in `us-central1` and `europe-west1`). You can host private MCP servers inside your VPC network by using Private Service Connect (PSC) network attachments and agent connectivity templates. You can also route traffic to public MCP servers through Cloud NAT with static external IP addresses for strict IP allowlists. This feature is generally available (GA). For more information, see: - [Prerequisites to set up a custom MCP server data store with VPC connectivity](https://docs.cloud.google.com/gemini/enterprise/docs/connectors/custom-mcp-server/set-up-vpc-custom-mcp-server.md.txt) - [Set up your custom MCP server data store](https://docs.cloud.google.com/gemini/enterprise/docs/connectors/custom-mcp-server/set-up-custom-mcp-server.md.txt) **Gemini Enterprise Agent Platform** Feature **Gemini Robotics ER 2 (Preview)** [Gemini Robotics ER 2](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/gemini/gemini-robotics-er.md.txt) ([`gemini-robotics-er-2-preview`](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/gemini/robotics-er-2.md.txt)) is available in [Preview](https://cloud.google.com/products#product-launch-stages). Gemini Robotics ER 2 is an embodied reasoning vision-language model built on Gemini 3.5 Flash for robotics applications, including [spatial reasoning](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/gemini/gemini-robotics-er/spatial.md.txt), [agentic code execution](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/gemini/gemini-robotics-er/agentic.md.txt), [task orchestration](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/gemini/gemini-robotics-er/orchestration.md.txt), and [video understanding](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/gemini/gemini-robotics-er/video-understanding.md.txt). Feature **xAI's Grok 4.7 is generally available** [Grok 4.7](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/partner-models/grok/grok-4-7.md.txt) is now [generally available (GA)](https://cloud.google.com/products#product-launch-stages) for production use on the global endpoint and the US multi-region endpoint. **Google Cloud Armor** Feature Cloud Armor supports advanced match conditions to include attributes for inspecting request body content and parameters. This lets you write custom CEL rules to filter traffic based on raw body content, structured data (JSON, Form Data, GraphQL), and query parameters. For more information, see [Attributes](https://docs.cloud.google.com/armor/docs/create-security-policy-rules.md.txt#attributes) in "Create and view Cloud Armor security policy rules." This feature is [generally available (GA)](https://cloud.google.com/products#product-launch-stages). **Google Cloud VMware Engine** Feature VMware solution on Google Cloud is [generally available](https://cloud.google.com/products#section-22) (GA). VMware solution lets you deploy, configure, and manage VMware Cloud Foundation (VCF) on dedicated bare-metal Compute Engine instances within your Virtual Private Cloud (VPC) network under a Bring Your Own License (BYOL) model. Key features include the following: - Provision dedicated bare-metal ESXi nodes (`z3-highmem-192-highlssd-metal`) directly in your project with deletion protection and Local SSD storage for vSAN. - Automate node preparation, Secret Manager credential storage, vSwitch and Dynamic NIC networking, Cloud DNS zone and record synchronization, vSAN storage initialization, and VCF installer appliance deployment by using Terraform and the VMware solution toolkit. - Distribute nodes across isolated availability domains by using spread placement policies to align with vSAN fault domains for high availability. - Connect ESXi nodes and VLAN-tagged Dynamic NICs directly to your VPC subnets without requiring private services access peering. For more information, see [VMware solution on Google Cloud overview](https://docs.cloud.google.com/vmware-engine/docs/vmware-solution/overview.md.txt) and [Compare VMware Engine models](https://docs.cloud.google.com/vmware-engine/docs/vmware-solution/compare-models.md.txt). Feature VMware solution on Google Cloud is [generally available](https://cloud.google.com/products#section-22) (GA). VMware solution lets you deploy, configure, and manage VMware Cloud Foundation (VCF) on dedicated bare-metal Compute Engine instances within your Virtual Private Cloud (VPC) network under a Bring Your Own License (BYOL) model. Key features include the following: - Provision dedicated bare-metal ESXi nodes (`z3-highmem-192-highlssd-metal`) directly in your project with deletion protection and Local SSD storage for vSAN. - Automate node preparation, Secret Manager credential storage, vSwitch and Dynamic NIC networking, Cloud DNS zone and record synchronization, vSAN storage initialization, and VCF installer appliance deployment by using Terraform and the VMware solution toolkit. - Distribute nodes across isolated availability domains by using spread placement policies to align with vSAN fault domains for high availability. - Connect ESXi nodes and VLAN-tagged Dynamic NICs directly to your VPC subnets without requiring private services access peering. For more information, see [VMware solution on Google Cloud overview](https://docs.cloud.google.com/vmware-engine/docs/vmware-solution/overview.md.txt) and [Compare VMware Engine models](https://docs.cloud.google.com/vmware-engine/docs/vmware-solution/compare-models.md.txt). All future VMware solution release notes can be found on the [VMware solution on Google Cloud release notes](https://docs.cloud.google.com/vmware-engine/docs/vmware-solution/release-notes.md.txt) page. **Google Distributed Cloud (software only) for bare metal** Announcement The release notes for the following versions incorrectly stated that a fix for an issue where Metrics API operation, like `kubectl top`, Horizontal Pod Autoscaling, and Vertical Pod Autoscaling, could fail with TLS verification errors during certificate authority (CA) rotation: - [1.33.700-gke.71](https://docs.cloud.google.com/kubernetes-engine/distributed-cloud/bare-metal/docs/release-notes.md.txt#April_22_2026) - [1.34.300-gke.59](https://docs.cloud.google.com/kubernetes-engine/distributed-cloud/bare-metal/docs/release-notes.md.txt#April_15_2026) - [1.35.0-gke.525](https://docs.cloud.google.com/kubernetes-engine/distributed-cloud/bare-metal/docs/release-notes.md.txt#May_6_2026) This issue is fixed in the following versions: - 1.34.700-gke.93 and later 1.34 patch versions - 1.35.300-gke.87 and later 1.35 patch versions - All 1.36 and later versions This issue is not fixed in any 1.33 release as of this writing. To get the fix, upgrade your clusters to one of these versions. If you can't upgrade or you use a 1.33 version, see the workaround in [Metrics API becomes unavailable after CA rotation](https://docs.cloud.google.com/kubernetes-engine/distributed-cloud/bare-metal/docs/troubleshooting/known-issues.md.txt#metrics-api-cert-mismatch). **Google Kubernetes Engine** Change #### (2026-R46) Version updates GKE cluster versions have been updated. **New versions available for upgrades and new clusters.** The following versions are now available for new GKE clusters, and for manual control plane upgrades and node upgrades for existing clusters. For more information about versioning and upgrades, see [GKE versioning and support](https://cloud.google.com/kubernetes-engine/versioning) and [About GKE cluster upgrades](https://cloud.google.com/kubernetes-engine/upgrades). ### Rapid channel > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - The following versions are now available in the Rapid channel: - [1.34.12-gke.1539000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1539000) - [1.35.9-gke.1505000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-9-gke-1505000) - [1.36.5-gke.1982000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-5-gke-1982000) - [1.37.1-gke.3020000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-3020000) - [Alpha version](https://cloud.google.com/kubernetes-engine/versioning#alpha-versions) 1.38.0-gke.4162000+preview is now available for GKE alpha clusters in the Rapid channel. - Alpha version 1.38.0-gke.2743000+preview is no longer available in the Rapid channel. ### Regular channel > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - The following versions are now available in the Regular channel: - [1.34.12-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1209000) - [1.35.8-gke.1975000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1975000) - [1.36.4-gke.2377000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2377000) - Version 1.35.8-gke.1919000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Regular channel. This version will be removed in 90 days, or at the end of support, if sooner. ### Stable channel > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - The following versions are now available in the Stable channel: - [1.34.12-gke.1011000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1011000) - [1.35.8-gke.1796000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1796000) - [1.36.4-gke.1391002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391002) - [1.36.4-gke.1495002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495002) - [1.36.4-gke.1495003](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495003) - [1.36.4-gke.2046002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046002) - [1.36.4-gke.2046003](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046003) - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or other factors preventing minor version upgrades: - 1.36 to [1.36.4-gke.1391002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391002) ### Extended channel > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - The following versions are now available in the Extended channel: - [1.32.13-gke.2662000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2662000) - [1.32.13-gke.2701000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2701000) - [1.32.13-gke.2906000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2906000) - [1.33.13-gke.1915000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1915000) - [1.33.13-gke.1952000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1952000) - [1.33.13-gke.2207000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-2207000) - [1.34.12-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1209000) - [1.35.8-gke.1975000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1975000) - [1.36.4-gke.2377000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2377000) - The following versions are no longer available in the Extended channel: - 1.31.14-gke.2759000 - 1.31.14-gke.2825000 - 1.31.14-gke.3042000 - 1.32.13-gke.2504000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.32.13-gke.2567000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.32.13-gke.2788000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.33.13-gke.1721000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.33.13-gke.1815000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.33.13-gke.2074000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.35.8-gke.1919000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or deprecated APIs, preventing upgrades: - 1.31 to [1.32.13-gke.2662000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2662000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or other factors preventing minor version upgrades: - 1.32 to [1.32.13-gke.2662000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2662000) - 1.33 to [1.33.13-gke.1915000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1915000) ### No channel (deprecated) > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - The following versions are now available: - [1.34.12-gke.1539000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1539000) - [1.35.9-gke.1505000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-9-gke-1505000) - [1.36.4-gke.1391002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391002) - [1.36.4-gke.1495003](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495003) - [1.36.4-gke.2046002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046002) - [1.36.5-gke.1982000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-5-gke-1982000) - [1.37.1-gke.3020000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-3020000) - The following node versions are now available: - [1.32.13-gke.2906000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2906000) - [1.33.13-gke.2207000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-2207000) - [1.34.12-gke.1539000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1539000) - [1.35.9-gke.1505000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-9-gke-1505000) - [1.36.5-gke.1982000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-5-gke-1982000) - [1.37.1-gke.3020000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-3020000) - Version 1.35.8-gke.1919000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. Security #### (2026-R46) Security updates This release includes new GKE versions that use updated Container-Optimized OS images. These updated images are cumulative, incorporating security fixes from all Container-Optimized OS versions released since the previous GKE release. To identify the specific vulnerabilities that were resolved in each updated Container-Optimized OS image, see the **Security** release notes for that image. The following table includes links to the release notes for each updated Container-Optimized OS image: | GKE version | Container-Optimized OS version | Details | |---|---|---| | 1.32.13-gke.2906000 | cos-121-18867-652-7 | [cos-121-18867-652-7 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m121.md.txt#cos-121-18867-652-7_) | | 1.33.13-gke.2207000 | cos-121-18867-652-7 | [cos-121-18867-652-7 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m121.md.txt#cos-121-18867-652-7_) | | 1.34.12-gke.1539000 | cos-125-19216-760-8 | [cos-125-19216-760-8 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m125.md.txt#cos-125-19216-760-8_) | | 1.35.9-gke.1505000 | cos-125-19216-760-8 | [cos-125-19216-760-8 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m125.md.txt#cos-125-19216-760-8_) | | 1.36.5-gke.1982000 | cos-129-19506-578-9 | [cos-129-19506-578-9 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m129.md.txt#cos-129-19506-578-9_) | | 1.37.1-gke.3020000 | cos-133-19999-44-159 | [cos-133-19999-44-159 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m133.md.txt#cos-133-19999-44-159_) | | 1.38.0-gke.4162000+preview | cos-dev-138-20162-0-0 | [cos-dev-138-20162-0-0 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m138#cos-dev-138-20162-0-0_) |
Change #### (2026-R46) Version updates > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - The following versions are now available in the Stable channel: - [1.34.12-gke.1011000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1011000) - [1.35.8-gke.1796000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1796000) - [1.36.4-gke.1391002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391002) - [1.36.4-gke.1495002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495002) - [1.36.4-gke.1495003](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495003) - [1.36.4-gke.2046002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046002) - [1.36.4-gke.2046003](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046003) - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or other factors preventing minor version upgrades: - 1.36 to [1.36.4-gke.1391002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391002) Change #### (2026-R46) Version updates > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - The following versions are now available in the Regular channel: - [1.34.12-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1209000) - [1.35.8-gke.1975000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1975000) - [1.36.4-gke.2377000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2377000) - Version 1.35.8-gke.1919000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Regular channel. This version will be removed in 90 days, or at the end of support, if sooner. Change #### (2026-R46) Version updates > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - The following versions are now available in the Rapid channel: - [1.34.12-gke.1539000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1539000) - [1.35.9-gke.1505000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-9-gke-1505000) - [1.36.5-gke.1982000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-5-gke-1982000) - [1.37.1-gke.3020000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-3020000) - [Alpha version](https://cloud.google.com/kubernetes-engine/versioning#alpha-versions) 1.38.0-gke.4162000+preview is now available for GKE alpha clusters in the Rapid channel. - Alpha version 1.38.0-gke.2743000+preview is no longer available in the Rapid channel. Change #### (2026-R46) Version updates > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - The following versions are now available: - [1.34.12-gke.1539000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1539000) - [1.35.9-gke.1505000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-9-gke-1505000) - [1.36.4-gke.1391002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391002) - [1.36.4-gke.1495003](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495003) - [1.36.4-gke.2046002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046002) - [1.36.5-gke.1982000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-5-gke-1982000) - [1.37.1-gke.3020000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-3020000) - The following node versions are now available: - [1.32.13-gke.2906000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2906000) - [1.33.13-gke.2207000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-2207000) - [1.34.12-gke.1539000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1539000) - [1.35.9-gke.1505000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-9-gke-1505000) - [1.36.5-gke.1982000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-5-gke-1982000) - [1.37.1-gke.3020000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-3020000) - Version 1.35.8-gke.1919000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. Change #### (2026-R46) Version updates > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - The following versions are now available in the Extended channel: - [1.32.13-gke.2662000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2662000) - [1.32.13-gke.2701000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2701000) - [1.32.13-gke.2906000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2906000) - [1.33.13-gke.1915000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1915000) - [1.33.13-gke.1952000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1952000) - [1.33.13-gke.2207000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-2207000) - [1.34.12-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1209000) - [1.35.8-gke.1975000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1975000) - [1.36.4-gke.2377000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2377000) - The following versions are no longer available in the Extended channel: - 1.31.14-gke.2759000 - 1.31.14-gke.2825000 - 1.31.14-gke.3042000 - 1.32.13-gke.2504000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.32.13-gke.2567000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.32.13-gke.2788000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.33.13-gke.1721000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.33.13-gke.1815000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.33.13-gke.2074000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.35.8-gke.1919000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or deprecated APIs, preventing upgrades: - 1.31 to [1.32.13-gke.2662000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2662000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or other factors preventing minor version upgrades: - 1.32 to [1.32.13-gke.2662000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2662000) - 1.33 to [1.33.13-gke.1915000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1915000) **Looker** Feature The latest version of the Looker-Excel Connector ODBC driver, version 1.0.7, is now available to download. See the [Looker-Excel Connector](https://docs.cloud.google.com/looker/docs/excel-connector.md.txt#install-driver) documentation page for information. **Model Armor** Feature You can test Model Armor templates in the Google Cloud console by using custom sample prompts to verify which safety and security filters the prompts trigger and how Sensitive Data Protection redacts sensitive data. Testing templates helps you evaluate template behavior and fine-tune filter configurations. This feature is generally available ([GA](https://cloud.google.com/products#product-launch-stages)). For more information, see [Test a Model Armor template](https://docs.cloud.google.com/model-armor/manage-templates#test-ma-template). **Oracle Database@Google Cloud** Feature For Exadata Database Service, Oracle Database@Google Cloud is available in `northamerica-south1` (Querétaro, Mexico) region. For a list of supported locations, see [Supported regions and zones](https://docs.cloud.google.com/oracle/database/docs/regions-and-zones.md.txt). **Spanner** Feature Spanner supports the `ON DELETE SET NULL` foreign key action for GoogleSQL and PostgreSQL dialects. Use `ON DELETE SET NULL` when you delete a referenced row to set the referencing columns to `NULL`. For more information, see [Foreign key actions](https://docs.cloud.google.com/spanner/docs/foreign-keys/overview.md.txt#how-to-define-foreign-key-action) and [Create and manage foreign key relationships](https://docs.cloud.google.com/spanner/docs/foreign-keys/how-to.md.txt). ## October 26, 2026 **Agent Platform Workbench** Change ### 20261025.00_p0 Release Change Installed latest packages from upstream dependencies. Security Updated certifi, pip, and conda ca-certificates to the latest versions. Change ### 20261025.00_p0 Release Change Installed latest packages from upstream dependencies. Security Addressed multiple reported security vulnerabilities in bundled packages. Security Updated certifi, pip, and conda ca-certificates to the latest versions. Feature **Custom organization policies for Agent Platform Workbench instances** You can now use custom organization policies to allow or deny the creation and update of Agent Platform Workbench instances based on their configuration. Custom constraints for the `notebooks.googleapis.com/Instance` resource are enforced when you create or update an instance, and support dry-run mode. This feature is now generally available ([GA](https://cloud.google.com/products#product-launch-stages)). For more information, see [Create custom organization policy constraints](https://docs.cloud.google.com/gemini-enterprise-agent-platform/notebooks/workbench/instances/custom-constraints). **Apigee X** Feature **Model Context Protocol (MCP) tool arguments are sent to the location their OpenAPI parameter declares** This change applies to Apigee X in all supported regions. An MCP tool argument whose OpenAPI parameter declares `in: header` is now sent to your backend as a request header, and one that declares `in: cookie` is sent in the `Cookie` header. Previously both were appended to the query string. `in: query` and `in: path` parameters are unchanged, and every parameter still appears in the tool's `inputSchema`, so MCP clients supply arguments exactly as before. If a backend reads one of these values from the query string, declare the parameter `in: query` or read it from its declared location. On a tool call that supplies at least one cookie argument, the `Cookie` header is replaced with only the declared cookie parameters, omitting any others. Any cookie your backend relies on must be declared as an `in: cookie` parameter. An MCP proxy that was already deployed continues to use the previous query-string behavior until its configuration is next regenerated. To adopt the new routing on an existing MCP proxy, deploy a new revision of it. For the full mapping, see [Tool argument placement on the backend request](https://docs.cloud.google.com/apigee/docs/api-platform/apigee-mcp/apigee-mcp-overview#tool-argument-placement). Security **On October 24, 2026, we published a security bulletin for Apigee.** Two vulnerabilities in PHP core ([CVE-2026-109618](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-109618) and [CVE-2026-109619](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-109619), "PHP2Shell") allow an unauthenticated attacker to execute code remotely on a server running a vulnerable PHP version. The impact is limited to Drupal-based Apigee developer portals, which customers deploy and operate. Apigee, Apigee Hybrid, and the Apigee integrated portal don't use PHP and aren't affected. **Security bulletin published: [GCP-2026-072](https://docs.cloud.google.com/apigee/docs/security-bulletins/security-bulletins.md.txt#gcp-2026-072)** **Bigtable** Libraries ### Python #### [2.50.2](https://github.com/googleapis/google-cloud-python/compare/google-cloud-bigtable-v2.50.1...google-cloud-bigtable-v2.50.2) (2026-10-22) ##### Bug Fixes - **bigtable:** preserve resource labels on batcher metrics ([#18712](https://github.com/googleapis/google-cloud-python/issues/18712)) ([f18cc6b](https://github.com/googleapis/google-cloud-python/commit/f18cc6b4086a3a1ea38c5bd45ccca79d927185ab)) - **bigtable:** resolve O(n\^2) bottleneck in ReadRowsQuery.add_range ([#18706](https://github.com/googleapis/google-cloud-python/issues/18706)) ([5ac7cc6](https://github.com/googleapis/google-cloud-python/commit/5ac7cc6b1168fa674340e11598bc6e5866a53c16)) ### Java #### [1.94.0](https://github.com/googleapis/google-cloud-java/compare/v1.93.0...v1.94.0) (2026-10-22) ##### Features - **bigtable:** add per-method session diversion configuration ([#14681](https://github.com/googleapis/google-cloud-java/issues/14681)) ([042dd3e](https://github.com/googleapis/google-cloud-java/commit/042dd3eeff4b60fc5be076de58e0015d2fa65c67)) - **bigtable:** support SessionCheckAndMutateRow on the session client ([#14565](https://github.com/googleapis/google-cloud-java/issues/14565)) ([86de9c1](https://github.com/googleapis/google-cloud-java/commit/86de9c171da56be0b442a9bba023c1c625c3d9b2)) - **bigtable:** support SessionReadModifyWriteRow on the session client ([#14585](https://github.com/googleapis/google-cloud-java/issues/14585)) ([8e653b2](https://github.com/googleapis/google-cloud-java/commit/8e653b2b3c7ebe6031b89f5610b502deafe95f01)) **Capacity Planner** Feature **Preview** : You can use the Capacity Planner remote Model Context Protocol (MCP) server (`capacityplanner.googleapis.com`) to connect AI applications and agents to your Capacity Planner data ([Preview](https://cloud.google.com/products#product-launch-stages)). You can use the Capacity Planner MCP tools to query historical resource usage, usage forecasts, and reservation data across your projects, folders, and organizations. For more information, see the [Capacity Planner MCP reference](https://docs.cloud.google.com/capacity-planner/docs/reference/mcp.md.txt) and [Google Cloud MCP servers overview](https://docs.cloud.google.com/mcp/overview.md.txt). **Cloud Database Migration Service** Feature You can now create heterogeneous conversion workspaces by importing database schema metadata files from a Cloud Storage bucket without requiring direct network connectivity between Database Migration Service and your source database during the schema conversion phase. For more information, see the following pages: - [Create a conversion workspace for Oracle to Cloud SQL for PostgreSQL](https://docs.cloud.google.com/database-migration/docs/oracle-to-postgresql/create-conversion-workspace.md.txt#use-cloud-storage) - [Create a conversion workspace for Oracle to AlloyDB for PostgreSQL](https://docs.cloud.google.com/database-migration/docs/oracle-to-alloydb/create-conversion-workspace.md.txt#use-cloud-storage) - [Create a conversion workspace for SQL Server to Cloud SQL for PostgreSQL](https://docs.cloud.google.com/database-migration/docs/sqlserver-to-csql-pgsql/create-conversion-workspace.md.txt#use-cloud-storage) - [Create a conversion workspace for SQL Server to AlloyDB for PostgreSQL](https://docs.cloud.google.com/database-migration/docs/sqlserver-to-alloydb/create-conversion-workspace.md.txt#use-cloud-storage) **Compute Engine** Security A vulnerability (CVE-2026-85299) about incorrect authorization in Compute Engine was discovered and has been addressed. For more information, see the [GCP-2026-073 security bulletin](https://docs.cloud.google.com/compute/docs/security-bulletins.md.txt#gcp-2026-073). **Developer Connect** Feature The Developer Connect Model Context Protocol (MCP) server is available in [Preview](https://docs.cloud.google.com/products#product-launch-stages). AI applications and coding assistants can use the Developer Connect MCP server to read commits, diffs, file blame, and pull requests. They can also open, update, and comment on pull requests in repositories that you link from GitHub, GitHub Enterprise, GitLab, and GitLab Enterprise. The same operations are available as `GitRepositoryLink` methods in the [Developer Connect REST API](https://docs.cloud.google.com/developer-connect/docs/api/reference/rest/v1/projects.locations.connections.gitRepositoryLinks). For more information, see the [Developer Connect MCP reference](https://docs.cloud.google.com/developer-connect/docs/api/reference/mcp). **Gemini Enterprise Agent Platform** Feature **Control user intent matching for semantic governance policies** You can now turn user intent matching on or off for semantic governance policies by setting the `sgpUserIntentMatching` key on the authorization extension metadata. User intent matching is on by default; set the key to `DISABLED` to turn it off. Turning it off reduces protection against indirect prompt injection. When the key is set, policy evaluation logs report the mode each evaluation used in the `sgpUserIntentMatchingMode` field. For more information, see [Control user intent matching](https://docs.cloud.google.com/gemini-enterprise-agent-platform/govern/policies/configure-semantic-governance.md.txt#control-intent-matching). Feature **Cloud Storage output support for Gemini image generation models** Direct Cloud Storage output persistence is [generally available (GA)](https://cloud.google.com/products#product-launch-stages) for [Gemini Nano Banana 2.1](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/gemini/nano-banana-2-1.md.txt) (`gemini-nano-banana-2.1`), [Gemini 3.1 Flash Image](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/gemini/3-1-flash-image.md.txt) (`gemini-3.1-flash-image`), [Gemini 3.1 Flash-Lite Image](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/gemini/3-1-flash-lite-image.md.txt) (`gemini-3.1-flash-lite-image`), and [Gemini 3 Pro Image](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/gemini/3-pro-image.md.txt) (`gemini-3-pro-image`). You can set `outputConfig.outputUriPrefix` and `generationConfig.responseFormat[].image.delivery` to `"URI"` in `generateContent` and `streamGenerateContent` requests to write generated and edited images directly to a Cloud Storage bucket and receive the object URI in `fileData.fileUri` instead of inline bytes. For more information, see [Save generated images to Cloud Storage](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/capabilities/image-generation.md.txt#save-generated-images-cloud-storage). Feature **Gemini 3.8 Flash TTS and Gemini 3.8 Flash-Lite TTS are Generally Available (GA)** [Gemini 3.8 Flash TTS](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/gemini/3-8-flash-tts.md.txt) and [Gemini 3.8 Flash-Lite TTS](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/gemini/3-8-flash-lite-tts) are available in [General Availability (GA)](https://cloud.google.com/products#product-launch-stages) in the `global` location and the `us` and `eu` multi-regions. The models support structured speaker and style metadata, inline vocal tags, multi-speaker dialogue, and streaming. [Voice design](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/text-to-speech/voice-design) and [voice replication](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/text-to-speech/voice-replication) capabilities remain available in Preview. For more information, see [Generate speech with Gemini TTS](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/text-to-speech/overview). Feature **Semantic governance policies support more model providers** Semantic governance policies now evaluate tool calls from agents that use models from providers other than Gemini. The policy engine reads each provider's request and response format, so the same policies apply whichever model your agent uses. Supported APIs include the Gemini Developer API and Gemini models on Gemini Enterprise Agent Platform, the Anthropic Messages API, Claude models on Gemini Enterprise Agent Platform, the OpenAI Chat Completions API, the Mistral AI API, the OpenAI-compatible endpoint on Gemini Enterprise Agent Platform (including Llama models), and self-hosted OpenAI-compatible servers such as vLLM. Streamed model responses aren't supported. To govern these providers, update the `when` condition of your authorization policy to match each provider's request path. The updated condition also matches requests that include a query string. For more information, see [Supported model providers](https://docs.cloud.google.com/gemini-enterprise-agent-platform/govern/policies/semantic-governance-overview.md.txt#supported-providers) and [Connect the policy engine to Agent Gateway](https://docs.cloud.google.com/gemini-enterprise-agent-platform/govern/policies/configure-semantic-governance.md.txt#connect-policy-engine). **Google Distributed Cloud (software only) for bare metal** Fixed The [1.34.1000-gke.111 release notes](https://docs.cloud.google.com/kubernetes-engine/distributed-cloud/bare-metal/docs/release-notes.md.txt#October_22_2026) incorrectly omitted the following fix, which is fixed in 1.34.1000-gke.111: - Fixed an issue where the Whereabouts IPAM garbage collector (`whereabouts-gc`) prematurely deleted active IP address reservations on secondary networks, causing [duplicate IP addresses to be assigned to running Pods](https://docs.cloud.google.com/kubernetes-engine/distributed-cloud/bare-metal/docs/troubleshooting/known-issues.md.txt#whereabouts-gc-duplicate-ip). **Google Kubernetes Engine** Change #### (2026-R45) Version updates GKE cluster versions have been updated. **New versions available for upgrades and new clusters.** The following versions are now available for new GKE clusters, and for manual control plane upgrades and node upgrades for existing clusters. For more information about versioning and upgrades, see [GKE versioning and support](https://cloud.google.com/kubernetes-engine/versioning) and [About GKE cluster upgrades](https://cloud.google.com/kubernetes-engine/upgrades). ### Rapid channel > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.37.1-gke.1697000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-1697000) is now the default version for cluster creation in the Rapid channel. - The following versions are now available in the Rapid channel: - [1.34.12-gke.1363000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1363000) - [1.35.8-gke.2308000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-2308000) - [1.36.5-gke.1259000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-5-gke-1259000) - [1.37.1-gke.2097000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-2097000) - [Alpha version](https://cloud.google.com/kubernetes-engine/versioning#alpha-versions) 1.38.0-gke.3229000+preview is now available for GKE alpha clusters in the Rapid channel. - The following versions are no longer available in the Rapid channel: - 1.34.12-gke.1153000 - 1.35.8-gke.1919000 - 1.36.4-gke.2326000 - 1.37.1-gke.1552000 - Alpha version 1.38.0-gke.2240000+preview is no longer available in the Rapid channel. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.12-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1209000) - 1.34 to [1.35.8-gke.1975000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1975000) - 1.35 to [1.36.4-gke.2377000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2377000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.12-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1209000) - 1.35 to [1.35.8-gke.1975000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1975000) - 1.36 to [1.36.4-gke.2377000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2377000) - 1.37 to [1.37.1-gke.1697000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-1697000) ### Regular channel > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.36.4-gke.2046003](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046003) is now the default version for cluster creation in the Regular channel. - The following versions are now available in the Regular channel: - [1.34.12-gke.1153000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1153000) - [1.35.8-gke.1919000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1919000) - [1.36.4-gke.2326000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2326000) - [1.37.1-gke.1552000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-1552000) - The following versions are no longer available in the Regular channel: - 1.34.11-gke.1209000 - 1.35.8-gke.1626001 - 1.36.4-gke.1495002 - 1.36.4-gke.1495003 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Regular channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.2046002 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Regular channel. This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.12-gke.1011000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1011000) - 1.34 to [1.35.8-gke.1796000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1796000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.12-gke.1011000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1011000) - 1.35 to [1.35.8-gke.1796000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1796000) - 1.36 to [1.36.4-gke.2046003](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046003) - 1.37 to [1.37.1-gke.1552000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-1552000) ### Stable channel > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.35.8-gke.1439001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1439001) is now the default version for cluster creation in the Stable channel. - The following versions are now available in the Stable channel: - [1.34.11-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1209000) - [1.35.8-gke.1626001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1626001) - The following versions are no longer available in the Stable channel: - 1.34.11-gke.1056000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Stable channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.35.6-gke.1250001 - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.11-gke.1102000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1102000) - 1.34 to [1.35.8-gke.1439001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1439001) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.11-gke.1102000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1102000) - 1.35 to [1.35.8-gke.1439001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1439001) ### Extended channel > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.36.4-gke.2046003](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046003) is now the default version for cluster creation in the Extended channel. - The following versions are now available in the Extended channel: - [1.31.14-gke.3042000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-3042000) - [1.32.13-gke.2788000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2788000) - [1.33.13-gke.2074000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-2074000) - [1.34.12-gke.1153000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1153000) - [1.35.8-gke.1919000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1919000) - [1.36.4-gke.2326000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2326000) - [1.37.1-gke.1552000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-1552000) - The following versions are no longer available in the Extended channel: - 1.31.14-gke.2963000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.32.13-gke.2701000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.33.13-gke.1952000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.34.11-gke.1209000 - 1.35.8-gke.1626001 - 1.36.4-gke.1495002 - 1.36.4-gke.1495003 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.2046002 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.12-gke.1011000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1011000) - 1.35 to [1.35.8-gke.1796000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1796000) - 1.36 to [1.36.4-gke.2046003](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046003) - 1.37 to [1.37.1-gke.1552000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-1552000) ### No channel (deprecated) > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.36.4-gke.2046003](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046003) is now the default version for cluster creation. - The following versions are now available: - [1.34.12-gke.1363000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1363000) - [1.35.8-gke.2308000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-2308000) - [1.36.5-gke.1259000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-5-gke-1259000) - [1.37.1-gke.1552000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-1552000) - [1.37.1-gke.1697000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-1697000) - [1.37.1-gke.2097000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-2097000) - The following node versions are now available: - [1.31.14-gke.3042000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-3042000) - [1.32.13-gke.2788000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2788000) - [1.33.13-gke.2074000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-2074000) - [1.34.12-gke.1363000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1363000) - [1.35.8-gke.2308000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-2308000) - [1.36.5-gke.1259000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-5-gke-1259000) - [1.37.1-gke.1552000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-1552000) - [1.37.1-gke.1697000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-1697000) - [1.37.1-gke.2097000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-2097000) - The following versions are no longer available: - 1.34.11-gke.1056000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.35.6-gke.1250000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.1391002 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.1495003 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.2046002 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.12-gke.1011000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1011000) - 1.34 to [1.35.8-gke.1439001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1439001) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.12-gke.1011000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1011000) - 1.35 to [1.35.8-gke.1439001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1439001) - 1.36 to [1.36.4-gke.2046003](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046003) - 1.37 to [1.37.1-gke.1552000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-1552000) Security #### (2026-R45) Security updates This release includes new GKE versions that use updated Container-Optimized OS images. These updated images are cumulative, incorporating security fixes from all Container-Optimized OS versions released since the previous GKE release. To identify the specific vulnerabilities that were resolved in each updated Container-Optimized OS image, see the **Security** release notes for that image. The following table includes links to the release notes for each updated Container-Optimized OS image: | GKE version | Container-Optimized OS version | Details | |---|---|---| | 1.31.14-gke.3042000 | cos-121-18867-638-5 | [cos-121-18867-638-5 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m121.md.txt#cos-121-18867-638-5_) | | 1.32.13-gke.2788000 | cos-121-18867-638-5 | [cos-121-18867-638-5 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m121.md.txt#cos-121-18867-638-5_) | | 1.33.13-gke.2074000 | cos-121-18867-638-5 | [cos-121-18867-638-5 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m121.md.txt#cos-121-18867-638-5_) | | 1.35.8-gke.2308000 | cos-125-19216-739-5 | [cos-125-19216-739-5 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m125.md.txt#cos-125-19216-739-5_) | | 1.37.1-gke.1552000 | cos-133-19999-44-85 | [cos-133-19999-44-85 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m133.md.txt#cos-133-19999-44-85_) | | 1.37.1-gke.2097000 | cos-133-19999-44-106 | [cos-133-19999-44-106 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m133.md.txt#cos-133-19999-44-106_) | | 1.38.0-gke.3229000+preview | cos-133-19999-44-85 | [cos-133-19999-44-85 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m133.md.txt#cos-133-19999-44-85_) |
Change #### (2026-R45) Version updates > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.35.8-gke.1439001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1439001) is now the default version for cluster creation in the Stable channel. - The following versions are now available in the Stable channel: - [1.34.11-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1209000) - [1.35.8-gke.1626001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1626001) - The following versions are no longer available in the Stable channel: - 1.34.11-gke.1056000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Stable channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.35.6-gke.1250001 - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.11-gke.1102000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1102000) - 1.34 to [1.35.8-gke.1439001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1439001) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.11-gke.1102000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1102000) - 1.35 to [1.35.8-gke.1439001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1439001) Change #### (2026-R45) Version updates > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.36.4-gke.2046003](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046003) is now the default version for cluster creation in the Regular channel. - The following versions are now available in the Regular channel: - [1.34.12-gke.1153000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1153000) - [1.35.8-gke.1919000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1919000) - [1.36.4-gke.2326000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2326000) - [1.37.1-gke.1552000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-1552000) - The following versions are no longer available in the Regular channel: - 1.34.11-gke.1209000 - 1.35.8-gke.1626001 - 1.36.4-gke.1495002 - 1.36.4-gke.1495003 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Regular channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.2046002 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Regular channel. This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.12-gke.1011000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1011000) - 1.34 to [1.35.8-gke.1796000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1796000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.12-gke.1011000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1011000) - 1.35 to [1.35.8-gke.1796000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1796000) - 1.36 to [1.36.4-gke.2046003](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046003) - 1.37 to [1.37.1-gke.1552000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-1552000) Change #### (2026-R45) Version updates > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.37.1-gke.1697000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-1697000) is now the default version for cluster creation in the Rapid channel. - The following versions are now available in the Rapid channel: - [1.34.12-gke.1363000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1363000) - [1.35.8-gke.2308000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-2308000) - [1.36.5-gke.1259000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-5-gke-1259000) - [1.37.1-gke.2097000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-2097000) - [Alpha version](https://cloud.google.com/kubernetes-engine/versioning#alpha-versions) 1.38.0-gke.3229000+preview is now available for GKE alpha clusters in the Rapid channel. - The following versions are no longer available in the Rapid channel: - 1.34.12-gke.1153000 - 1.35.8-gke.1919000 - 1.36.4-gke.2326000 - 1.37.1-gke.1552000 - Alpha version 1.38.0-gke.2240000+preview is no longer available in the Rapid channel. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.12-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1209000) - 1.34 to [1.35.8-gke.1975000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1975000) - 1.35 to [1.36.4-gke.2377000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2377000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.12-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1209000) - 1.35 to [1.35.8-gke.1975000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1975000) - 1.36 to [1.36.4-gke.2377000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2377000) - 1.37 to [1.37.1-gke.1697000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-1697000) Change #### (2026-R45) Version updates > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.36.4-gke.2046003](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046003) is now the default version for cluster creation. - The following versions are now available: - [1.34.12-gke.1363000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1363000) - [1.35.8-gke.2308000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-2308000) - [1.36.5-gke.1259000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-5-gke-1259000) - [1.37.1-gke.1552000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-1552000) - [1.37.1-gke.1697000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-1697000) - [1.37.1-gke.2097000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-2097000) - The following node versions are now available: - [1.31.14-gke.3042000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-3042000) - [1.32.13-gke.2788000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2788000) - [1.33.13-gke.2074000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-2074000) - [1.34.12-gke.1363000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1363000) - [1.35.8-gke.2308000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-2308000) - [1.36.5-gke.1259000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-5-gke-1259000) - [1.37.1-gke.1552000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-1552000) - [1.37.1-gke.1697000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-1697000) - [1.37.1-gke.2097000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-2097000) - The following versions are no longer available: - 1.34.11-gke.1056000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.35.6-gke.1250000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.1391002 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.1495003 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.2046002 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.12-gke.1011000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1011000) - 1.34 to [1.35.8-gke.1439001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1439001) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.12-gke.1011000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1011000) - 1.35 to [1.35.8-gke.1439001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1439001) - 1.36 to [1.36.4-gke.2046003](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046003) - 1.37 to [1.37.1-gke.1552000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-1552000) Feature The [C4D bare metal machine types](https://docs.cloud.google.com/compute/docs/general-purpose-machines.md.txt#c4d_series) (`c4d-standard-384-metal`, `c4d-highcpu-384-metal`, and `c4d-highmem-384-metal`) are generally available on GKE. You can create C4D bare metal node pools in Standard clusters that run version 1.36 or later. In version 1.37.0-gke.4713000 or later, you can also use C4D bare metal nodes with cluster autoscaler, node auto-provisioning, and custom ComputeClasses, including in Autopilot clusters that use a custom ComputeClass. In earlier versions, you must scale C4D bare metal node pools manually. For more information, see [Machine support with GKE](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/machine-support.md.txt#machine-support). Change #### (2026-R45) Version updates > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.36.4-gke.2046003](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046003) is now the default version for cluster creation in the Extended channel. - The following versions are now available in the Extended channel: - [1.31.14-gke.3042000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-3042000) - [1.32.13-gke.2788000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2788000) - [1.33.13-gke.2074000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-2074000) - [1.34.12-gke.1153000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1153000) - [1.35.8-gke.1919000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1919000) - [1.36.4-gke.2326000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2326000) - [1.37.1-gke.1552000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-1552000) - The following versions are no longer available in the Extended channel: - 1.31.14-gke.2963000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.32.13-gke.2701000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.33.13-gke.1952000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.34.11-gke.1209000 - 1.35.8-gke.1626001 - 1.36.4-gke.1495002 - 1.36.4-gke.1495003 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.2046002 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.12-gke.1011000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1011000) - 1.35 to [1.35.8-gke.1796000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1796000) - 1.36 to [1.36.4-gke.2046003](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046003) - 1.37 to [1.37.1-gke.1552000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-1552000) **Knowledge Catalog** Feature Support for Looker (Google Cloud core) in Data lineage is now [generally available](https://cloud.google.com/products#product-launch-stages). This support includes lineage views for LookML views and Explores, Looker dashboards, dashboard elements, Looks, LookML dashboards, and Conversational Analytics agents. You can control data lineage ingestion at the organization, folder, and project levels. You can also visualize the end-to-end flow of your data from BigQuery sources through the Looker semantic layer to downstream assets. For more information, see [Track data lineage with Knowledge Catalog](https://docs.cloud.google.com/looker/docs/looker-core-lineage.md.txt), [About data lineage](https://docs.cloud.google.com/knowledge-catalog/docs/about-data-lineage.md.txt#other), and [About data lineage ingestion control](https://docs.cloud.google.com/knowledge-catalog/docs/control-lineage-ingestion.md.txt#supported-service-integrations). **Looker** Feature [Looker (Google Cloud core) data lineage](https://docs.cloud.google.com/looker/docs/looker-core-lineage.md.txt) is now generally available (GA). The GA launch adds end-to-end visibility for [LookML dashboards](https://docs.cloud.google.com/looker/docs/building-lookml-dashboards.md.txt) and [Conversational Analytics agents](https://docs.cloud.google.com/looker/docs/conversational-analytics-looker-data-agents.md.txt). Lineage enablement is now managed independently through the Data Lineage API and service-level ingestion controls, which decouples it from Looker's internal Knowledge Catalog metadata settings. For more information, see [About data lineage](https://docs.cloud.google.com/knowledge-catalog/docs/about-data-lineage.md.txt). Feature The [Looker-managed Model Context Protocol (MCP) server](https://docs.cloud.google.com/looker/docs/mcp.md.txt) is now generally available (GA), allowing AI agents to securely interact with business data and LookML models without the need for additional middleware. This launch is supported by a new [**Manage OAuth Clients** admin page](https://docs.cloud.google.com/looker/docs/admin-panel-authentication-oauth-clients.md.txt), which provides a centralized interface for governing identity-based access for AI agents and other external applications. Administrators can now quickly enable pre-configured integrations from the Application Library or register custom OAuth clients with specific redirect URIs and group-based access controls. **Model Armor** Feature Model Armor enforces the `constraints/modelarmor.managed.requireTemplateDataResidencyCompliance` managed Organization Policy Service constraint by default. When you create or update a template, this constraint prevents you from setting `data_residency_compliant` to `false` or clearing the **Enforce data residency** option unless an Organization Policy Administrator disables the constraint. This feature is generally available ([GA](https://cloud.google.com/products#product-launch-stages)). For more information, see [Disable the organization policy constraint for data residency](https://docs.cloud.google.com/model-armor/manage-templates#disable-data-residency-constraint). **Oracle Database@Google Cloud** Feature The Oracle Database@Google Cloud remote MCP server is [generally available (GA)](https://cloud.google.com/products#product-launch-stages) and adds tools to create and manage Database Connections and run SQL statements with `database_connection_executesql`. It lets you interact easily with Oracle Database@Google Cloud resources from LLMs, AI applications, and AI-enabled development platforms. For more information, see [Use the Oracle Database@Google Cloud remote MCP server](https://docs.cloud.google.com/oracle/database/docs/use-oracledatabase-mcp.md.txt). ## October 25, 2026 **Agent Platform Workbench** Change ### 20261025-2230-rc0 Release Change ### 20261025-2230-rc0 Release Change Installed latest packages from upstream dependencies. Change Installed latest packages from upstream dependencies. Security Updated certifi, pip, and conda ca-certificates to the latest versions. Fixed Fixed dataset and table search in the BigQuery panel, which sometimes failed to return results. Root cause is due to Datacatalog API being sunsetted in favor of Dataplex API. Fixed Fixed an issue where Jupyter Server terminal configuration could overwrite the Dataproc plugin server extension setting or fail to apply the terminal disable setting on container startup. Security Addressed multiple reported security vulnerabilities in bundled packages. Security Updated certifi, pip, and conda ca-certificates to the latest versions. Fixed Fixed an issue where Jupyter Server terminal configuration could overwrite the Dataproc plugin server extension setting or fail to apply the terminal disable setting on container startup. Security Addressed multiple reported security vulnerabilities in bundled packages. Change ### 20261025-2130-rc0 Release Change Installed latest packages from upstream dependencies. **Google SecOps** Feature **Resize inline images in Case Wall comments** You can now resize inline images directly in rich-text comments on the Case Wall. To resize an image, switch the comment box to rich-text mode and insert an image either by using the toolbar's image menu or by pasting it into the comment. Click the image to display the resizing overlay, then drag the bottom-right handle to adjust its dimensions. **Google SecOps SOAR** Announcement Release 6.3.104 is being rolled out to the first phase of regions as listed [here](https://docs.cloud.google.com/chronicle/docs/soar/overview-and-introduction/soar-gradual-release.md.txt). This release contains internal and customer bug fixes. ## October 24, 2026 **App Engine flexible environment .NET** Security The following runtime language contains important security updates: - [.NET 6 and later](https://docs.cloud.google.com/appengine/docs/flexible/lifecycle/support-schedule.md.txt#net): `6.0.428`, `8.0.415`, `10.0.100` The following stacks and their underlying operating system packages have also been updated: - `google-22`, `google-22-full` - `google-24`, `google-24-full` Take immediate protective action by rebuilding and redeploying your resources with updated dependencies. See [Security bulletins for Google Cloud](https://docs.cloud.google.com/support/bulletins.md.txt) for more information. **App Engine flexible environment Go** Security The following runtime language contains important security updates: - [Go 1.24 and later](https://docs.cloud.google.com/appengine/docs/flexible/lifecycle/support-schedule.md.txt#go): `1.24.13`, `1.25.14`, `1.26.10`, `1.27.3` The following stacks and their underlying operating system packages have also been updated: - `google-22`, `google-22-full` - `google-24`, `google-24-full` Take immediate protective action by rebuilding and redeploying your resources with updated dependencies. See [Security bulletins for Google Cloud](https://docs.cloud.google.com/support/bulletins.md.txt) for more information. **App Engine flexible environment Java** Security The following runtime language contains important security updates: - [Java 17 and later](https://docs.cloud.google.com/appengine/docs/flexible/lifecycle/support-schedule.md.txt#java): `17.0.20_101`, `21.0.12_101.0.LTS`, `25.0.5_8.0.LTS` The following stacks and their underlying operating system packages have also been updated: - `google-22`, `google-22-full` - `google-24`, `google-24-full` Take immediate protective action by rebuilding and redeploying your resources with updated dependencies. See [Security bulletins for Google Cloud](https://docs.cloud.google.com/support/bulletins.md.txt) for more information. **App Engine flexible environment Node.js** Security The following runtime language contains important security updates: - [Node.js 22 and later](https://docs.cloud.google.com/appengine/docs/flexible/lifecycle/support-schedule.md.txt#nodejs): `22.23.4`, `24.22.1`, `26.12.1` The following stacks and their underlying operating system packages have also been updated: - `google-22`, `google-22-full` - `google-24`, `google-24-full` Take immediate protective action by rebuilding and redeploying your resources with updated dependencies. See [Security bulletins for Google Cloud](https://docs.cloud.google.com/support/bulletins.md.txt) for more information. **App Engine flexible environment PHP** Security The following runtime language contains important security updates: - [PHP 8.2 and later](https://docs.cloud.google.com/appengine/docs/flexible/lifecycle/support-schedule.md.txt#php): `8.2.35`, `8.3.36`, `8.4.27`, `8.5.12` The following stacks and their underlying operating system packages have also been updated: - `google-22`, `google-22-full` - `google-24`, `google-24-full` Take immediate protective action by rebuilding and redeploying your resources with updated dependencies. See [Security bulletins for Google Cloud](https://docs.cloud.google.com/support/bulletins.md.txt) for more information. **App Engine flexible environment Python** Security The following runtime language contains important security updates: - [Python 3.10 and later](https://docs.cloud.google.com/appengine/docs/flexible/lifecycle/support-schedule.md.txt#python): `3.10.22`, `3.11.17`, `3.12.15`, `3.13.15`, `3.14.6` The following stacks and their underlying operating system packages have also been updated: - `google-22`, `google-22-full` - `google-24`, `google-24-full` Take immediate protective action by rebuilding and redeploying your resources with updated dependencies. See [Security bulletins for Google Cloud](https://docs.cloud.google.com/support/bulletins.md.txt) for more information. **App Engine flexible environment Ruby** Security The following runtime language contains important security updates: - [Ruby 3.3 and later](https://docs.cloud.google.com/appengine/docs/flexible/lifecycle/support-schedule.md.txt#ruby): `3.3.12`, `3.4.11`, `4.0.7` The following stacks and their underlying operating system packages have also been updated: - `google-22`, `google-22-full` - `google-24`, `google-24-full` Take immediate protective action by rebuilding and redeploying your resources with updated dependencies. See [Security bulletins for Google Cloud](https://docs.cloud.google.com/support/bulletins.md.txt) for more information. **App Engine standard environment Go** Security The following runtime language contains important security updates: - [Go 1.24 and later](https://docs.cloud.google.com/appengine/docs/standard/lifecycle/support-schedule.md.txt#go): `1.24.13`, `1.25.14`, `1.26.10`, `1.27.3` The following stacks and their underlying operating system packages have also been updated: - `google-22`, `google-22-full` - `google-24`, `google-24-full` Take immediate protective action by rebuilding and redeploying your resources with updated dependencies. See [Security bulletins for Google Cloud](https://docs.cloud.google.com/support/bulletins.md.txt) for more information. **App Engine standard environment Java** Security The following runtime language contains important security updates: - [Java 17 and later](https://docs.cloud.google.com/appengine/docs/standard/lifecycle/support-schedule.md.txt#java): `17.0.20_101`, `21.0.12_101.0.LTS`, `25.0.5_8.0.LTS` The following stacks and their underlying operating system packages have also been updated: - `google-22`, `google-22-full` - `google-24`, `google-24-full` Take immediate protective action by rebuilding and redeploying your resources with updated dependencies. See [Security bulletins for Google Cloud](https://docs.cloud.google.com/support/bulletins.md.txt) for more information. **App Engine standard environment Node.js** Security The following runtime language contains important security updates: - [Node.js 22 and later](https://docs.cloud.google.com/appengine/docs/standard/lifecycle/support-schedule.md.txt#nodejs): `22.23.4`, `24.22.1`, `26.12.1` The following stacks and their underlying operating system packages have also been updated: - `google-22`, `google-22-full` - `google-24`, `google-24-full` Take immediate protective action by rebuilding and redeploying your resources with updated dependencies. See [Security bulletins for Google Cloud](https://docs.cloud.google.com/support/bulletins.md.txt) for more information. **App Engine standard environment PHP** Security The following runtime language contains important security updates: - [PHP 8.2 and later](https://docs.cloud.google.com/appengine/docs/standard/lifecycle/support-schedule.md.txt#php): `8.2.35`, `8.3.36`, `8.4.27`, `8.5.12` The following stacks and their underlying operating system packages have also been updated: - `google-22`, `google-22-full` - `google-24`, `google-24-full` Take immediate protective action by rebuilding and redeploying your resources with updated dependencies. See [Security bulletins for Google Cloud](https://docs.cloud.google.com/support/bulletins.md.txt) for more information. **App Engine standard environment Python** Security The following runtime language contains important security updates: - [Python 3.10 and later](https://docs.cloud.google.com/appengine/docs/standard/lifecycle/support-schedule.md.txt#python): `3.10.22`, `3.11.17`, `3.12.15`, `3.13.15`, `3.14.6` The following stacks and their underlying operating system packages have also been updated: - `google-22`, `google-22-full` - `google-24`, `google-24-full` Take immediate protective action by rebuilding and redeploying your resources with updated dependencies. See [Security bulletins for Google Cloud](https://docs.cloud.google.com/support/bulletins.md.txt) for more information. **App Engine standard environment Ruby** Security The following runtime language contains important security updates: - [Ruby 3.3 and later](https://docs.cloud.google.com/appengine/docs/standard/lifecycle/support-schedule.md.txt#ruby): `3.3.12`, `3.4.11`, `4.0.7` The following stacks and their underlying operating system packages have also been updated: - `google-22`, `google-22-full` - `google-24`, `google-24-full` Take immediate protective action by rebuilding and redeploying your resources with updated dependencies. See [Security bulletins for Google Cloud](https://docs.cloud.google.com/support/bulletins.md.txt) for more information. **Buildpacks** Security The following runtime languages contain important security updates: - [Go 1.24 and later](https://docs.cloud.google.com/docs/buildpacks/runtime-support.md.txt#go): `1.24.13`, `1.25.14`, `1.26.10`, `1.27.3` - [Node.js 22 and later](https://docs.cloud.google.com/static/docs/buildpacks/runtime-support#node.js): `22.23.4`, `24.22.1`, `26.12.1` - [Java 17 and later](https://docs.cloud.google.com/docs/buildpacks/runtime-support.md.txt#java): `17.0.20_101`, `21.0.12_101.0.LTS`, `25.0.5_8.0.LTS` - [PHP 8.2 and later](https://docs.cloud.google.com/docs/buildpacks/runtime-support.md.txt#php): `8.2.35`, `8.3.36`, `8.4.27`, `8.5.12` - [Python 3.10 and later](https://docs.cloud.google.com/docs/buildpacks/runtime-support.md.txt#python): `3.10.22`, `3.11.17`, `3.12.15`, `3.13.15`, `3.14.6` - [Ruby 3.3 and later](https://docs.cloud.google.com/docs/buildpacks/runtime-support.md.txt#ruby): `3.3.12`, `3.4.11`, `4.0.7` - [.NET 6 and later](https://docs.cloud.google.com/docs/buildpacks/runtime-support.md.txt#.net): `6.0.428`, `8.0.415`, `10.0.100` The following stacks and their underlying operating system packages have also been updated: - `google-22`, `google-22-full` - `google-24`, `google-24-full` Take immediate protective action by rebuilding and redeploying your resources with updated dependencies. See [Security bulletins for Google Cloud](https://docs.cloud.google.com/support/bulletins.md.txt) for more information. **Cloud Run** Security The following runtime languages contain important security updates: - [Go 1.24 and later](https://docs.cloud.google.com/run/docs/runtime-support.md.txt#go): `1.24.13`, `1.25.14`, `1.26.10`, `1.27.3` - [Node.js 22 and later](https://docs.cloud.google.com/static/run/docs/runtime-support#node.js): `22.23.4`, `24.22.1`, `26.12.1` - [Java 17 and later](https://docs.cloud.google.com/run/docs/runtime-support.md.txt#java): `17.0.20_101`, `21.0.12_101.0.LTS`, `25.0.5_8.0.LTS` - [PHP 8.2 and later](https://docs.cloud.google.com/run/docs/runtime-support.md.txt#php): `8.2.35`, `8.3.36`, `8.4.27`, `8.5.12` - [Python 3.10 and later](https://docs.cloud.google.com/run/docs/runtime-support.md.txt#python): `3.10.22`, `3.11.17`, `3.12.15`, `3.13.15`, `3.14.6` - [Ruby 3.3 and later](https://docs.cloud.google.com/run/docs/runtime-support.md.txt#ruby): `3.3.12`, `3.4.11`, `4.0.7` - [.NET 6 and later](https://docs.cloud.google.com/run/docs/runtime-support.md.txt#.net): `6.0.428`, `8.0.415`, `10.0.100` The following stacks and their underlying operating system packages have also been updated: - `google-22`, `google-22-full` - `google-24`, `google-24-full` Take immediate protective action by rebuilding and redeploying your resources with updated dependencies. See [Security bulletins for Google Cloud](https://docs.cloud.google.com/support/bulletins.md.txt) for more information. **Cloud Run functions** Security The following runtime languages contain important security updates: - [Go 1.24 and later](https://docs.cloud.google.com/functions/docs/runtime-support.md.txt#go): `1.24.13`, `1.25.14`, `1.26.10`, `1.27.3` - [Node.js 22 and later](https://docs.cloud.google.com/static/functions/docs/runtime-support#node.js): `22.23.4`, `24.22.1`, `26.12.1` - [Java 17 and later](https://docs.cloud.google.com/functions/docs/runtime-support.md.txt#java): `17.0.20_101`, `21.0.12_101.0.LTS`, `25.0.5_8.0.LTS` - [PHP 8.2 and later](https://docs.cloud.google.com/functions/docs/runtime-support.md.txt#php): `8.2.35`, `8.3.36`, `8.4.27`, `8.5.12` - [Python 3.10 and later](https://docs.cloud.google.com/functions/docs/runtime-support.md.txt#python): `3.10.22`, `3.11.17`, `3.12.15`, `3.13.15`, `3.14.6` - [Ruby 3.3 and later](https://docs.cloud.google.com/functions/docs/runtime-support.md.txt#ruby): `3.3.12`, `3.4.11`, `4.0.7` - [.NET 6 and later](https://docs.cloud.google.com/functions/docs/runtime-support.md.txt#.net): `6.0.428`, `8.0.415`, `10.0.100` The following stacks and their underlying operating system packages have also been updated: - `google-22`, `google-22-full` - `google-24`, `google-24-full` Take immediate protective action by rebuilding and redeploying your resources with updated dependencies. See [Security bulletins for Google Cloud](https://docs.cloud.google.com/support/bulletins.md.txt) for more information. **Google Cloud Contact Center as a Service** Announcement **Google Cloud CCaaS 6.26** We've released version 6.26 of Google Cloud CCaaS. The timing of the update to your instance depends on the deployment schedule that you have chosen. For more information, see [Deployment schedules](https://docs.cloud.google.com/contact-center/ccai-platform/docs/deployment-schedules). Feature **Scheduled callback for IVR overcapacity** Scheduled callback is now available as an overcapacity deflection option for IVR queues. When a queue is over capacity, callers can choose to schedule a callback. Google Cloud CCaaS then hands the call to your configured virtual agent, which books the callback through the Callback call API. Administrators choose the virtual agent, an optional greeting, and the data parameters to pass at the global or queue level. Reporting shows whether each caller submitted a callback or left without one. Administrators: You can configure scheduled callback for overcapacity deflection globally at **Settings \> Call \> Overcapacity Deflection** , or per queue at **Settings \> Queue \> IVR (Interactive Voice Response) \> Edit / View \> \[QUEUE\] \> Overcapacity Deflection \> Configure**. For more information, see [Overcapacity deflection per-queue](https://docs.cloud.google.com/contact-center/ccai-platform/docs/overcapacity-deflection-per-queue) and [Callback call API](https://docs.cloud.google.com/contact-center/ccai-platform/docs/callback-call-api.md.txt). By default, this capability is inactive. Contact Google Cloud Support to turn it on for your instance. Feature **Salesforce: PKCE and refresh token rotation support** You can now connect Google Cloud CCaaS to Salesforce apps that require Proof Key for Code Exchange (PKCE) and refresh token rotation. Salesforce turns both settings on automatically for newly created connected apps and external client apps. Google Cloud CCaaS uses PKCE when authorizing Salesforce administrator and agent connections. It also saves replacement refresh tokens returned by Salesforce, keeping connections working across subsequent token refreshes. Salesforce apps that don't use these settings keep working as before. This update adds no new configuration steps in Google Cloud CCaaS. For more information, see [Salesforce integration guide](https://docs.cloud.google.com/contact-center/ccai-platform/docs/salesforce-integration-guide). By default, this capability is inactive. Contact Google Cloud Support to turn it on for your instance. Fixed This release addresses the following issues: - Fixed an issue where the **Branded caller ID** label was truncated in the **Outbound Number** selector when the agent application language was set to French Canadian. - Fixed an issue where inbound calls experienced significant delays in connecting after being assigned to an agent. - Fixed an issue where whisper announcements played more than once and the call panel was slow to load in the agent desktop. - Fixed an issue where Salesforce case creation was delayed until the end of a call for inbound callers without a matching contact record. - Fixed an issue where callbacks to Norwegian, Danish, and Swedish landline numbers were incorrectly dialed with a +1 prefix, causing the calls to fail. - Fixed an issue where merged call recordings incorrectly reported only the duration of the first segment in the Calls API. - Salesforce account linking now completes only in the browser that started it. An authorization link opened in another browser or an incognito window is refused and can't be reused afterwards, and an administrator's **Link New User** action must be finished by the same signed-in administrator. Android and iOS agent apps link as before. This behavior is off by default and can be enabled per instance. - Fixed an issue that affected call connection stability during active calls for instances using Agent Assist. - Fixed an issue where virtual agent callback calls incorrectly required manual acceptance even when queues were configured for **Auto-Answer**. - Fixed an issue where Telnyx and Twilio virtual agent calls remained stuck in a connected state for an extended period if the carrier didn't send a terminal status callback. - Fixed an issue where SMS replies to auto-dismissed chats were incorrectly recorded as an agent timeout instead of an end-user timeout. - Fixed an issue where the **Unanswered Transferred Call Expiration** setting wasn't enforced for calls parked in an overcapacity deflection state. - Fixed an issue that affected connection stability and prevented calls from being accurately recorded as end-user hangups when callers hung up while waiting in a queue. - Fixed an issue where the external Dynamic Contact Routing (DCR) new call event payload was missing the queue service level field. - Fixed an issue where callers were disconnected when an agent finished their wrap-up following a queue transfer to a virtual agent. - Fixed an issue where voice calls escalated from a virtual agent to a human agent reported inaccurate call-level queue and wait durations in reporting and data exports. - Fixed an issue where unrecorded voicemails incorrectly created Salesforce cases even when the **Create CRM records for abandoned calls** setting was disabled. - Fixed an issue where activating a new language in the CCaaS portal caused the **Languages \& Messages** page to crash or display an infinite loading spinner. - Fixed an issue where session metadata files were duplicated across different day folders in external storage when re-uploads occurred after midnight. - Fixed an issue where voice calls became permanently stuck in a queued status without reaching a terminal state. - Fixed an issue where active agents were incorrectly signed out due to inactivity because the system didn't recognize activity outside the embedded call panel. - Fixed an issue where a permanent loading spinner appeared in the agent desktop top bar for instances with the email channel disabled. - Fixed an issue where inbound keypad (DTMF) entries didn't reach the virtual agent during periods of stream instability or reconnection. - Fixed an issue where the external Dynamic Contact Routing (DCR) new call event payload was missing required parameters. - Fixed an issue where inbound calls involving a virtual agent didn't record an end time and duration when deflected to an overcapacity queue. - Fixed an issue where call recordings weren't fetched or saved when CRM ticket creation failed. - Fixed an issue where after-hours phone deflections didn't appear in the **Deflections** dashboard if the outbound dial timed out or failed. - Fixed an issue where scheduled phone number obfuscation caused degraded performance for live calls. - Fixed an issue where CRM ticket assignees weren't consistently updated following an agent's pickup of a chat. - Fixed an issue where voice calls became stuck in a queued state after a caller selected a callback during a cold transfer to a specific agent. - Fixed an issue where Smart Disposition suggestions weren't pre-selected on the wrap-up screen, causing the disposition field to remain empty after a call ended. - Fixed an issue where calls were incorrectly routed to agents even when the minimum available agent floor wasn't met. - Fixed an issue where cold transfers to a direct agent extension didn't trigger overcapacity deflection, leaving callers on hold until they disconnected. - Fixed an issue where virtual agent replies were cut off or silenced when using bidirectional streaming with barge-in disabled. - Fixed an issue where JSON chat transcripts in external storage contained unredacted message text even when the setting to store unredacted transcripts was disabled. - Fixed an issue where the **Keep Waiting** label in the overcapacity deflection screen displayed an inconsistent font style compared to other menu options. **Google SecOps** Breaking **GitSync power-up: Version 53.0 rolled back** Version 54.0 of the GitSync power-up reverts the Chronicle API refactoring that was [introduced in version 53.0](https://docs.cloud.google.com/chronicle/docs/soar/marketplace-integrations/release-notes.md.txt#October_07_2026) and restores the version 52.0 code. All deployments must run on version 52.0 or version 54.0. If you're using version 53.0, roll back to version 52.0 or update to version 54.0. Then, point the **Branch** parameter back to your previous repository branch. For more information, see [Version 53.0 rollback](https://docs.cloud.google.com/chronicle/docs/soar/marketplace/power-ups/gitsync.md.txt#version-54-rollback-guidance). **Google SecOps Marketplace** Change **GitSync**: Version 54.0 - (REGRESSIVE) **Integration**: Reverted the Chronicle API refactoring introduced in version 53.0. The integration code is restored to version 52.0. > [!CAUTION] > **Caution:** All deployments must run on version 54.0 or version 52.0. > > If > you're currently on version 53.0, roll back to version 52.0 or update > to version 54.0, and point the **Branch** parameter back to the previous > repository branch. > > For instructions, see [Version 53.0 rollback](https://docs.cloud.google.com/chronicle/docs/soar/marketplace/power-ups/gitsync.md.txt#version-54-rollback-guidance). **Google SecOps SOAR** Announcement [Release 6.3.103](https://docs.cloud.google.com/chronicle/docs/soar/release-notes.md.txt#October_18_2026) is now available for all regions. ## October 23, 2026 **API Gateway** Deprecated **Negative backend deadlines are deprecated** A negative backend `deadline` in an OpenAPI 2.0 `x-google-backend` extension or a gRPC `BackendRule` uses the default deadline, the same as `0`. Negative values there are deprecated and will be rejected in a future release; until then, creating an API config with one returns a warning in the operation metadata. OpenAPI 3.x backends already reject a negative deadline. To use the default, omit the field or set it to `0`. For more information, see [OpenAPI 2.0 extensions](https://docs.cloud.google.com/api-gateway/docs/oasv2-extensions.md.txt#deadline) and [OpenAPI 3.x extensions](https://docs.cloud.google.com/api-gateway/docs/oasv3-extensions.md.txt#backends_object). **Cloud Database Migration Service** Security On Saturday, October 17, 2026, Google received a report from a security researcher regarding the compromise of private keys associated with eight eMudhra subordinate Certification Authority (CA) certificates, including those cross-signed by AAA Certificate Services. Consequently, these CA certificates are no longer trusted and are being revoked. To continue connecting to a source database after its CA certificate is updated, upload the new CA certificate to the Database Migration Service source connection profile: - Update the connection profile using [`gcloud database-migration connection-profiles update`](https://docs.cloud.google.com/sdk/gcloud/reference/database-migration/connection-profiles/update.md.txt) or the [`connectionProfiles.patch`](https://docs.cloud.google.com/database-migration/docs/reference/rest/v1/projects.locations.connectionProfiles/patch.md.txt) API method. - Modify the connection profile in the Google Cloud console: - [MySQL connection profiles](https://docs.cloud.google.com/database-migration/docs/mysql/manage-connection-profiles.md.txt#update_a_connection_profile) - [PostgreSQL to Cloud SQL connection profiles](https://docs.cloud.google.com/database-migration/docs/postgres/manage-connection-profiles.md.txt#update_a_connection_profile) - [PostgreSQL to AlloyDB for PostgreSQL connection profiles](https://docs.cloud.google.com/database-migration/docs/postgresql-to-alloydb/manage_connection-profiles#modify_a_connection_profile) - [Oracle to Cloud SQL connection profiles](https://docs.cloud.google.com/database-migration/docs/oracle-to-postgresql/manage-connection-profiles.md.txt#update_a_connection_profile) - [Oracle to AlloyDB for PostgreSQL connection profiles](https://docs.cloud.google.com/database-migration/docs/oracle-to-alloydb/manage-connection-profiles.md.txt#update_a_connection_profile) - [SQL Server to Cloud SQL connection profiles](https://docs.cloud.google.com/database-migration/docs/sqlserver-to-csql-pgsql/manage-connection-profiles.md.txt#update_a_connection_profile) - [SQL Server to AlloyDB for PostgreSQL connection profiles](https://docs.cloud.google.com/database-migration/docs/sqlserver-to-alloydb/manage-connection-profiles.md.txt#update_a_connection_profile) For more information, see security bulletin [GCP-2026-071](https://docs.cloud.google.com/support/bulletins.md.txt#gcp-2026-071). **Cloud Monitoring** Fixed Ops Agent version 2.73.0 includes patches for a Go vulnerability involving system root certificates, [CVE-2026-111943](https://www.cve.org/CVERecord?id=CVE-2026-111943). For more information, see [Ops Agent 2.73.0 notes](https://github.com/GoogleCloudPlatform/ops-agent/releases/tag/2.73.0). **Cloud SQL for MySQL** Security In response to [GCP-2026-071](https://docs.cloud.google.com/support/bulletins.md.txt#gcp-2026-071), Google is updating Cloud SQL's managed components. No manual updates to the certificate store are required for Cloud SQL-managed instances. The fix is shipping in a new maintenance version that will be applied during [scheduled maintenance](https://docs.cloud.google.com/sql/docs/mysql/maintenance.md.txt). You can also apply the fix by [performing self-service maintenance](https://docs.cloud.google.com/sql/docs/mysql/self-service-maintenance). An announcement will be published when the self-service maintenance fix is available. **What should I do?** - If you use the Cloud SQL Auth Proxy, then upgrade the Cloud SQL Auth Proxy to [2.26.3 or later](https://docs.cloud.google.com/sql/docs/mysql/sql-proxy.md.txt#install) and the Cloud SQL Proxy Operator to [1.8.4 or later](https://docs.cloud.google.com/sql/docs/mysql/connect-proxy-operator.md.txt). If you run the standalone proxy binary, then also update the host's certificate authority (CA) certificates. - If you use a Cloud SQL Language Connector, then update the language runtime and operating system CA certificates used with the [Cloud SQL Language Connector](https://docs.cloud.google.com/sql/docs/mysql/connect-connectors.md.txt) (for example, Go 1.26.10 or 1.27.3 or later, certifi 2026.10.19 or later). - If you're using the gcloud CLI to install the Cloud SQL Auth Proxy, then update the gcloud CLI to [590.0.1](https://docs.cloud.google.com/sdk/gcloud.md.txt#download_and_install_the). **Cloud SQL for PostgreSQL** Security In response to [GCP-2026-071](https://docs.cloud.google.com/support/bulletins.md.txt#gcp-2026-071), Google is updating Cloud SQL's managed components. No manual updates to the certificate store are required for Cloud SQL-managed instances. The fix is shipping in a new maintenance version that will be applied during [scheduled maintenance](https://docs.cloud.google.com/sql/docs/postgres/maintenance.md.txt). You can also apply the fix by [performing self-service maintenance](https://docs.cloud.google.com/sql/docs/postgres/self-service-maintenance). An announcement will be published when the self-service maintenance fix is available. **What should I do?** - If you use the Cloud SQL Auth Proxy, then upgrade the Cloud SQL Auth Proxy to [2.26.3 or later](https://docs.cloud.google.com/sql/docs/postgres/sql-proxy.md.txt#install) and the Cloud SQL Proxy Operator to [1.8.4 or later](https://docs.cloud.google.com/sql/docs/postgres/connect-proxy-operator.md.txt). If you run the standalone proxy binary, then also update the host's certificate authority (CA) certificates. - If you use a Cloud SQL Language Connector, then update the language runtime and operating system CA certificates used with the [Cloud SQL Language Connector](https://docs.cloud.google.com/sql/docs/postgres/connect-connectors.md.txt) (for example, Go 1.26.10 or 1.27.3 or later, certifi 2026.10.19 or later). - If you're using the gcloud CLI to install the Cloud SQL Auth Proxy, then update the gcloud CLI to [590.0.1](https://docs.cloud.google.com/sdk/gcloud.md.txt#download_and_install_the). **Cloud SQL for SQL Server** Security In response to [GCP-2026-071](https://docs.cloud.google.com/support/bulletins.md.txt#gcp-2026-071), Google is updating Cloud SQL's managed components. No manual updates to the certificate store are required for Cloud SQL-managed instances. The fix is shipping in a new maintenance version that will be applied during [scheduled maintenance](https://docs.cloud.google.com/sql/docs/sqlserver/maintenance.md.txt). You can also apply the fix by [performing self-service maintenance](https://docs.cloud.google.com/sql/docs/sqlserver/self-service-maintenance). An announcement will be published when the self-service maintenance fix is available. **What should I do?** - If you use the Cloud SQL Auth Proxy, then upgrade the Cloud SQL Auth Proxy to [2.26.3 or later](https://docs.cloud.google.com/sql/docs/sqlserver/sql-proxy.md.txt#install) and the Cloud SQL Proxy Operator to [1.8.4 or later](https://docs.cloud.google.com/sql/docs/sqlserver/connect-proxy-operator.md.txt). If you run the standalone proxy binary, then also update the host's certificate authority (CA) certificates. - If you use a Cloud SQL Language Connector, then update the language runtime and operating system CA certificates used with the [Cloud SQL Language Connector](https://docs.cloud.google.com/sql/docs/sqlserver/connect-connectors.md.txt) (for example, Go 1.26.10 or 1.27.3 or later, certifi 2026.10.19 or later). - If you're using the gcloud CLI to install the Cloud SQL Auth Proxy, then update the gcloud CLI to [590.0.1](https://docs.cloud.google.com/sdk/gcloud.md.txt#download_and_install_the). **Datastream** Security On Saturday, October 17, 2026, Google received a report from a security researcher regarding the compromise of private keys associated with eight eMudhra subordinate Certification Authority (CA) certificates, including those cross-signed by AAA Certificate Services. Consequently, these CA certificates are no longer trusted and are being revoked. To continue connecting to a source database after its CA certificate is updated, upload the new CA certificate to the Datastream source connection profile: - [Modify connection profiles](https://docs.cloud.google.com/datastream/docs/modify-connection-profiles.md.txt) in the Google Cloud console. - Update the connection profile using [`gcloud datastream connection-profiles update`](https://docs.cloud.google.com/sdk/gcloud/reference/datastream/connection-profiles/update.md.txt) or the [`connectionProfiles.patch`](https://docs.cloud.google.com/datastream/docs/reference/rest/v1/projects.locations.connectionProfiles/patch.md.txt) API method. For more information, see security bulletin [GCP-2026-071](https://docs.cloud.google.com/support/bulletins.md.txt#gcp-2026-071). **Service Extensions** Feature You can use edge extensions (`CdnEdgeExtension`) to attach plugins directly to Media CDN Edge Cache services (`EdgeCacheService`). These extensions let you inspect and modify HTTP request and response headers in the Media CDN processing path. This feature is available in [Preview](https://cloud.google.com/products#product-launch-stages). For more information, see [Media CDN extensions overview](https://docs.cloud.google.com/service-extensions/docs/media-cdn-extensions-overview) and [Configure a Media CDN edge extension](https://docs.cloud.google.com/service-extensions/docs/configure-media-cdn-edge-extensions). ## October 22, 2026 **Apigee X** Announcement On October 22, 2026, we released an updated version of Apigee (1-18-0-apigee-7). > [!NOTE] > **Note:** Rollouts of this release began today and can take four or more business days to complete across all Google Cloud zones. Your instances might not have the features and fixes available until the rollout is complete. Security | Bug ID | Description | |---|---| | **573663408** | **Security fix for Apigee.** Upgraded the ingress gateway to patch security vulnerabilities. | | **N/A** | **Security fix for Apigee infrastructure.** | Fixed | Bug ID | Description | |---|---| | **568535165** | Skip main_task_wait_time and nio_task_wait_time metrics for the first 12 Prometheus scrapes during Message Processor startup warmup. | | **573602919** | Fix generated OpenAPI specs' servers\[\] to carry the Apigee envgroup hostname instead of the backend target host. | | **562964081** | The sgpUserIntentMatchingMode verdict-log field is now always present, including on dry-run policy records, and shows the mode used for the evaluation, including when sgpUserIntentMatching isn't set (CONSTRAINTS_AND_INTENT, or INTENT_ONLY when no policies match the tool call). | | **524115876** | Fix an intermittent HTTP 400 error in the OASValidation policy's strict parameter validation that rejected valid requests. | | **572025634** | Responses with a compressed text/event-stream body to a proxy with an EventFlow now skip EventFlow processing and pass through intact instead of returning a corrupted body. | | **549078690** | If no SGP policy is attributed for a denial, a customer sees the generic fallback message. This fix short-circuits to show the rationale instead when no matched policy has a configured denial message. | | **492041991** | VerifyAPIKey and VerifyAccessToken now set the apiproduct.operation.llmTokenQuota.\* flow variables only from the LLM operation(s) that matched the request; they are no longer set from unmatched LLM operations or for requests that match no LLM operation. | | **567244615** | Semantic Governance now evaluates LLM requests it previously skipped, such as OpenAI requests whose message content is an array of parts, which can produce new denials and judge-model usage. It considers every system message rather than only the last, and a non-streaming OpenAI or an Ollama tool call whose arguments are not valid JSON is now an evaluation error. | | **567244615** | Semantic Governance no longer evaluates a request or response with a field it cannot read when a tool call is involved. It records verdict ERROR naming the field, with status MODEL_ERROR. The inline SemanticGovernance policy instead raises GovernedLLMResponseParseError or GovernedLLMProviderDetectionFailed (HTTP 500), in DRY_RUN too unless continueOnError is true. It also reads every text part of a Gemini system instruction and Gemini tool parameters given as parametersJsonSchema, and no longer loses the rest of a Claude or Gemini request when one field has an unexpected shape. | | **560272924** | Added continuous-scan bidirectional gRPC streaming support for the SanitizeModelResponse policy over Server-Sent Events (SSE) streams, preserving native LLM provider SSE JSON envelopes and event framing. | | **555332621** | Model Armor policies now honor HTTPClient.managementplane.skip.proxy: with it set, Model Armor callouts bypass the forward proxy like other googleapis traffic. Streaming (ContinuousScan) Model Armor traffic uses the forward proxy. | | **158204922** | VerifyJWT now rejects a JWT whose header contains "b64":false, with fault steps.jwt.InvalidToken, as RFC 7797 section 7 requires. Previously, such a token could be accepted if KnownHeaders listed b64, IgnoreCriticalHeaders was true, or the header had no crit. | | **158204922** | GenerateJWS supports RFC 7797 unencoded payloads. GenerateJWS now raises MissingPayload, InvalidPayload or FailedToResolveVariable for payload errors, where it previously raised GenerationFailed. KnownHeaders and CriticalHeaders in the JWS and JWT policies accept names separated by whitespace, such as one per line. A b64 header supplied through AdditionalHeaders is now rejected, with steps.jws.InvalidNameForAdditionalHeader for GenerateJWS and steps.jwt.InvalidNameForAdditionalHeader for GenerateJWT. A proxy that set b64 through an AdditionalHeaders variable produced an RFC 7797 JWS before this change, and must move to UnencodedPayload, with DetachContent for the detached form. | | **158204922** | VerifyJWS verifies RFC 7797 unencoded-payload JWS (b64:false), attached or detached. b64 in crit no longer needs a KnownHeaders entry. VerifyJWS rejects b64:false unless crit lists b64, with the new fault steps.jws.UnencodedPayloadNotCritical; IgnoreCriticalHeaders does not change that. DecodeJWS reports the raw payload of such a JWS. | | **559228730** | ext_proc: ImmediateResponse now carries any Content-Type (raw body bytes + preserved Content-Type); replies too large to buffer use StreamedImmediateResponse. | | **544751120** | Semantic Governance Policies marked as dry run are now evaluated and logged without blocking the request. Each dry-run policy adds a second judge evaluation per tool-calling response, whose tokens are billed. Dry-run verdicts are written to the semantic-governance-policy log as separate records flagged sgpDryRunPolicyEvaluation=true; queries that count verdicts should add sgpDryRunPolicyEvaluation != true to exclude them. | | **554114419** | Fixed: an AssignMessage/HTTPModifier/RaiseFault policy that creates a new request (createNew="true") in an HTTP/2 flow can now set the :path and :authority pseudo-headers instead of failing with an invalid-header error. | | **567812025** | FILESYSTEM persistence mode makes the synchronizer skip Cassandra entirely (no connections, reads, writes, or datastore health probes). | | **559009293** | Fixed elevated OAuth latency and Cassandra read load for AppGroup apps, including access token verification and token and authorization-code generation, by caching AppGroup lookups in the message processor runtime, matching Developer behavior. | | **568860869** | Fixed `RegularExpressionProtection` patterns of the form `"...."` whose middle section contains regular expression syntax (for example, `".?Exception in thread."` or `"(?i).\.*"`) being matched as literal text instead of as regular expressions. Such patterns now raise `steps.regexprotection.ThreatDetected` for all matching input. | | **564945600** | Enhance VerifyAPIKey policy to better handle leading spaces. | | **502231886** | Fixed the default source templates for SanitizeUserPrompt and SanitizeModelResponse so a policy that omits the source element extracts content correctly when IgnoreUnresolvedVariables is false. | | **562964081** | Semantic Governance now honors the `sgpUserIntentMatching` `AuthzExtension` metadata key (`ENABLED` or `DISABLED`) to toggle user-intent matching in policy evaluation; `DISABLED` evaluates against constraints only. | | **565004219** | Fixed Semantic Governance Policy skipping evaluation for Anthropic requests that send `system` as a content-block array (the form ADK and LiteLlm emit). Affected agents are now evaluated, which may produce new denials and new judge-model usage on the consumer project. | | **527517087** | SGP policy logs written to your project now identify their originating region. resource.type changes from "global" to "generic_node" and the region appears in resource.labels.location. Anything selecting these entries by resource.type="global" must be updated -- including log-based metrics, sinks, exclusion filters and alerts, which stop matching silently rather than erroring. | | **575439485** | JavaCallout policies that run remotely (per-contract offload) can now pass every value type allowed by the GCP-2025-023 setVariable restriction between policies (collections, maps, arrays, primitive wrappers including Character, Date, BigDecimal, UUID, java.time, atomics, JDK enums, Optional), with their types preserved, instead of failing with steps.remotepolicy.NonSerializableVariable. | | **575439485** | Remotely executed (per-contract offload) JavaCallout policies with continueOnError="true" now continue the flow when the callout faults, instead of returning HTTP 500. | | **567244901** | In enforce mode, Semantic Governance now blocks a tool call when the governance check cannot be completed, instead of letting it through. | | **573622417** | Fixed an issue where istio-ingressgateway forwarded the x-envoy-decorator-operation header to upstream runtime and target backends. | | **571679067** | removes old version of ApigeeTelemetry CRD. | | **571378258** | The Apigee Redis container is now built from the Valkey engine (BSD-3-Clause, Linux Foundation) at version 8.1.10. Wire protocol is unchanged (RESP2) and the redis-server/redis-cli binary names are preserved. | | **N/A** | Updates to infrastructure and libraries. | **App Engine flexible environment PHP** Security All supported versions of [PHP 8.2](https://docs.cloud.google.com/appengine/docs/flexible/lifecycle/support-schedule.md.txt#php) and later are patched. Take immediate protective action by redeploying your resources with updated dependencies. See [Responding to core PHP vulnerabilities](https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619) for more information. **App Engine standard environment PHP** Security All supported versions of [PHP 8.2](https://docs.cloud.google.com/appengine/docs/standard/lifecycle/support-schedule.md.txt#php) and later are patched. Take immediate protective action by redeploying your resources with updated dependencies. See [Responding to core PHP vulnerabilities](https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619) for more information. **Audit Manager** Feature Support for organization-level audits, [audit scheduling](https://docs.cloud.google.com/audit-manager/docs/run-audit), and a [new UI experience with updated reports](https://docs.cloud.google.com/audit-manager/docs/view-audit) are generally available ([GA](https://cloud.google.com/products#product-launch-stages)). **BigQuery** Feature The [`AI.TRANSLATE` function](https://docs.cloud.google.com/bigquery/docs/reference/standard-sql/bigqueryml-syntax-ai-translate.md.txt) lets you translate text strings between languages. `AI.TRANSLATE` supports standard Neural Machine Translation (NMT) workloads and Translation LLM (TLLM) capabilities. This function is [generally available](https://cloud.google.com/products#product-launch-stages) (GA). **Cloud Run** Feature You can configure [Direct VPC ingress for Cloud Run instances](https://docs.cloud.google.com/run/docs/configuring/vpc-direct-vpc.md.txt#direct-vpc-instance) ([Preview](https://cloud.google.com/products#product-launch-stages)). Direct VPC ingress lets Cloud Run instances on a VPC network use their own ephemeral private IP address to communicate with each other and with other resources on the VPC network. Security All supported versions of [PHP 8.2](https://docs.cloud.google.com/run/docs/runtime-support.md.txt#php) and later are patched. Take immediate protective action by redeploying your resources with updated dependencies. See [Responding to core PHP vulnerabilities](https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619) for more information. **Cloud Run functions** Security All supported versions of [PHP 8.2](https://docs.cloud.google.com/functions/docs/runtime-support.md.txt#php) and later are patched. Take immediate protective action by redeploying your resources with updated dependencies. See [Responding to core PHP vulnerabilities](https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619) for more information. **Compute Engine** Feature You can view how a managed instance group (MIG) distributes its instances across zones and machine types, directly from the MIG's **Monitoring** tab in the Google Cloud console. For more information, see [Monitor instance distribution in MIGs](https://docs.cloud.google.com/compute/docs/instance-groups/monitor-instance-distribution.md.txt). Feature **Generally available** : Resource-based committed use discounts (CUDs) are available for block storage resources like Google Cloud Hyperdisk Balanced and Google Cloud Hyperdisk Throughput Exapool capacity. You can purchase 1-year and 3-year block storage commitments for Hyperdisk Balanced and Hyperdisk Throughput Exapool capacity and receive discounted rates for the capacity units that you consume as part of applicable Google Cloud Hyperdisk Exapools. For more information, see [Block storage commitments](https://docs.cloud.google.com/compute/docs/instances/signing-up-committed-use-discounts.md.txt#block_storage_commitments) and [Purchase block storage commitments for Exapools](https://docs.cloud.google.com/compute/docs/committed-use-discounts/purchase-block-storage-commitments.md.txt). **Container Optimized OS** Change ### cos-133-19999-44-159 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.18.55](https://cos.googlesource.com/third_party/kernel/+/90c4c51012dc5bb5d116a470e49476dd9dd3998c) | v29.4.3 | v2.4.1 | [See List](https://storage.googleapis.com/cos-tools/19999.44.159/lakitu/gpu_driver_versions.textproto) | Feature Added KVM virtualization support for AMD CPUID faulting. Feature Added nvidia-container-toolkit to ARM images. Fixed Added support for net-fs/lustre-client-drivers v2.14.0_p262-r1. Fixed Updated cos-gpu-installer to v2.7.11 and toolbox to v20261020. Fixed Upgraded app-editors/vim to v9.2.1152, Upgraded app-editors/vim-core to v9.2.1152. Fixed Upgraded app-misc/ca-certificates to v20260816.3.125. This removes the certificates affected by the eMudhra intermediate certificate compromise. Fixed Upgraded dev-libs/nss to v3.131.1. This removes the certificates affected by the eMudhra intermediate certificate compromise. Security Fix CVE-2026-80256 in net-misc/curl. Security Fixed CVE-2026-33186 in cri-tools. Security Fixed CVE-2026-33186 in google-osconfig-agent. Security Fixed CVE-2026-39830 in cos-extensions. Security Fixed CVE-2026-39831 in node-problem-detector. Security Fixed CVE-2026-39832, CVE-2026-39833 in docker. Security Fixed CVE-2026-39832, CVE-2026-39834, CVE-2026-39830, CVE-2026-42508 in google-guest-agent. Security Fixed CVE-2026-39832, CVE-2026-46595 in kubernetes. Security Fixed CVE-2026-39833 in nvidia-container-toolkit. Security Fixed CVE-2026-42508 in guest-agent. Security Fixed CVE-2026-46595, CVE-2026-39832 in cri-tools. Security Fixed CVE-2026-5435 in sys-libs/glibc. Security Upgraded dev-lang/go to v1.26.10. This fixes CVE-2026-111943. Change Runtime sysctl changes: - Changed: fs.epoll.max_user_watches: 1807627 -\> 1807671 - Changed: fs.fanotify.max_user_marks: 68378 -\> 68382 - Changed: fs.inotify.max_user_watches: 64158 -\> 64161 - Changed: kernel.threads-max: 63443 -\> 63445 - Changed: net.ipv4.tcp_mem: 93969 125295 187938 -\> 93972 125298 187944 - Changed: net.ipv4.udp_mem: 187941 250590 375882 -\> 187947 250597 375894 - Changed: user.max_cgroup_namespaces: 31721 -\> 31722 - Changed: user.max_fanotify_marks: 68378 -\> 68382 - Changed: user.max_inotify_watches: 64158 -\> 64161 - Changed: user.max_ipc_namespaces: 31721 -\> 31722 - Changed: user.max_mnt_namespaces: 31721 -\> 31722 - Changed: user.max_net_namespaces: 31721 -\> 31722 - Changed: user.max_pid_namespaces: 31721 -\> 31722 - Changed: user.max_time_namespaces: 31721 -\> 31722 - Changed: user.max_user_namespaces: 31721 -\> 31722 - Changed: user.max_uts_namespaces: 31721 -\> 31722
Change ### cos-125-19216-760-8 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.12.113](https://cos.googlesource.com/third_party/kernel/+/bac32aa947d1d7d52552c51d3bd2f355ecc21464) | v27.5.1 | v2.2.7 | [See List](https://storage.googleapis.com/cos-tools/19216.760.8/lakitu/gpu_driver_versions.textproto) | Announcement This is an [LTS Refresh release.](https://docs.cloud.google.com/container-optimized-os/docs/concepts/versioning.md.txt#lts_refresh_releases) Fixed Updated cos-gpu-installer to v2.7.11 and toolbox to v20261020. Fixed Upgraded app-misc/ca-certificates to v20260816.3.125. This removes the certificates affected by the eMudhra intermediate certificate compromise. Fixed Upgraded dev-libs/nss to v3.131.1. This removes the certificates affected by the eMudhra intermediate certificate compromise. Security Fixed CVE-2026-111943 in dev-lang/go. Security Fixed CVE-2026-39831 in guest-agent. Security Fixed CVE-2026-39831 in node-problem-detector. Security Fixed CVE-2026-39832, CVE-2026-39831 in cos-extensions. Security Fixed CVE-2026-39833 in nvidia-container-toolkit. Security Fixed CVE-2026-39833, CVE-2024-28180, CVE-2025-11065, CVE-2026-25680, CVE-2025-47914, GHSA-w67g-5rqw-f597, CVE-2026-84304, GHSA-fv92-fjc5-jj9h, CVE-2023-47108, CVE-2024-51744, CVE-2026-35469, CVE-2025-65637, CVE-2025-30204, CVE-2024-45337, CVE-2025-52565, CVE-2026-42508, CVE-2026-46598, CVE-2023-45142, CVE-2024-45310, CVE-2026-39830, CVE-2026-41579, CVE-2026-46595, CVE-2024-24786, CVE-2026-39832, CVE-2026-10722, CVE-2026-39831, CVE-2025-22869 in kubernetes. Security Fixed CVE-2026-42508, CVE-2026-46595 in cri-tools. Security Fixed CVE-2026-46595 in google-guest-agent. Security Fixed CVE-2026-46595, CVE-2026-42508 in google-osconfig-agent. Security Fixed CVE-2026-98432 in the Linux kernel. Change ### cos-121-18867-652-7 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.6.159](https://cos.googlesource.com/third_party/kernel/+/f32de83646bdc7b4c004477f6c4977ebd5b03cd7) | v27.5.1 | v2.0.10 | [See List](https://storage.googleapis.com/cos-tools/18867.652.7/lakitu/gpu_driver_versions.textproto) | Announcement This is an [LTS Refresh release.](https://docs.cloud.google.com/container-optimized-os/docs/concepts/versioning.md.txt#lts_refresh_releases) Fixed Updated cos-gpu-installer to v2.7.11 and toolbox to v20261020. Fixed Upgraded app-misc/ca-certificates to v20260816.3.125. This removes the certificates affected by the eMudhra intermediate certificate compromise. Fixed Upgraded dev-libs/nss to v3.131.1. This removes the certificates affected by the eMudhra intermediate certificate compromise. Security Fixed CVE-2026-111943 in dev-lang/go. Security Fixed CVE-2026-39830 in google-osconfig-agent. Security Fixed CVE-2026-39831 in node-problem-detector. Security Fixed CVE-2026-39832 in cos-extensions. Security Fixed CVE-2026-39833 in nvidia-container-toolkit. Security Fixed CVE-2026-39833, CVE-2024-28180, CVE-2025-11065, CVE-2026-25680, CVE-2025-47914, GHSA-w67g-5rqw-f597, CVE-2026-84304, GHSA-fv92-fjc5-jj9h, CVE-2023-47108, CVE-2024-51744, CVE-2026-35469, CVE-2025-65637, CVE-2025-30204, CVE-2024-45337, CVE-2025-52565, CVE-2026-42508, CVE-2026-46598, CVE-2023-45142, CVE-2024-45310, CVE-2026-39830, CVE-2026-41579, CVE-2026-46595, CVE-2024-24786, CVE-2026-39832, CVE-2026-10722, CVE-2026-39831, CVE-2025-22869 in kubernetes. Security Fixed CVE-2026-42508, CVE-2026-46595 in cri-tools. Security Fixed CVE-2026-42508, CVE-2026-46595, CVE-2026-39831, CVE-2026-39830 in containerd. Security Fixed CVE-2026-46595 in guest-agent. Security Fixed CVE-2026-98432 in the Linux kernel. Change ### cos-129-19506-578-9 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.12.113](https://cos.googlesource.com/third_party/kernel/+/38d8fc183d307b8c9fd3db3d33f44d32f55ae31e) | v27.5.1 | v2.2.7 | [See List](https://storage.googleapis.com/cos-tools/19506.578.9/lakitu/gpu_driver_versions.textproto) | Announcement This is an [LTS Refresh release.](https://docs.cloud.google.com/container-optimized-os/docs/concepts/versioning.md.txt#lts_refresh_releases) Fixed Updated cos-gpu-installer to v2.7.11 and toolbox to v20261020. Fixed Upgraded app-misc/ca-certificates to v20260816.3.125. This removes the certificates affected by the eMudhra intermediate certificate compromise. Fixed Upgraded dev-libs/nss to v3.131.1. This removes the certificates affected by the eMudhra intermediate certificate compromise. Security Fixed CVE-2026-111943 in dev-lang/go. Security Fixed CVE-2026-33186 in cri-tools. Security Fixed CVE-2026-39831 in node-problem-detector. Security Fixed CVE-2026-39833 in nvidia-container-toolkit. Security Fixed CVE-2026-46595, CVE-2026-39832 in cri-tools. Security Fixed CVE-2026-98432 in the Linux kernel. Change Runtime sysctl changes: - Changed: fs.epoll.max_user_watches: 1808517 -\> 1808562 - Changed: fs.fanotify.max_user_marks: 68412 -\> 68416 - Changed: fs.inotify.max_user_watches: 64189 -\> 64192 - Changed: kernel.threads-max: 63178 -\> 63183 - Changed: net.ipv4.tcp_mem: 94017 125357 188034 -\> 94020 125361 188040 - Changed: net.ipv4.udp_mem: 188034 250715 376068 -\> 188040 250722 376080 - Changed: user.max_cgroup_namespaces: 31589 -\> 31591 - Changed: user.max_fanotify_marks: 68412 -\> 68416 - Changed: user.max_inotify_watches: 64189 -\> 64192 - Changed: user.max_ipc_namespaces: 31589 -\> 31591 - Changed: user.max_mnt_namespaces: 31589 -\> 31591 - Changed: user.max_net_namespaces: 31589 -\> 31591 - Changed: user.max_pid_namespaces: 31589 -\> 31591 - Changed: user.max_time_namespaces: 31589 -\> 31591 - Changed: user.max_user_namespaces: 31589 -\> 31591 - Changed: user.max_uts_namespaces: 31589 -\> 31591
**Data Studio** Feature You can connect Data Studio to a BigQuery Graph or query a graph by using a custom SQL query in the BigQuery connector, which imports graph measures as metrics that you can use in your reports. For more information, see [Connect to Google BigQuery](https://docs.cloud.google.com/data-studio/connect-to-google-bigquery#connect-to-a-bigquery-table-or-view). **Firestore** Feature [Data modification language (DML) operations](https://docs.cloud.google.com/firestore/native/docs/pipeline/dml.md.txt) are generally available ([GA](https://cloud.google.com/products#product-launch-stages)). Added support for [`insert`](https://docs.cloud.google.com/firestore/native/docs/pipeline/stages/output/insert.md.txt) and [`upsert`](https://docs.cloud.google.com/firestore/native/docs/pipeline/stages/output/upsert.md.txt). **Gemini Enterprise** Feature **Gemini Enterprise: Single-user quota limits** Gemini Enterprise administrators can configure single-user quota limits on the **Usage \& Spending \> Usage** page in the Google Cloud console to prevent an individual user from using all of an edition's shared subscription quota pool. You can enable a single-user quota limit and set a quota multiplier for each edition and location across the Gemini Enterprise Standard, Gemini Enterprise Plus, and Gemini Enterprise Standard Emerging Market editions. This feature is generally available (GA). For more information, see: - [Single-user quota limits](https://docs.cloud.google.com/gemini/enterprise/docs/quotas-and-pay-as-you-go-usage.md.txt#single-user-quota-limits) - [Configure a single-user quota limit](https://docs.cloud.google.com/gemini/enterprise/docs/feature-usage.md.txt#configure-single-user-quota-limit) - [Configure pay-as-you-go usage above quota](https://docs.cloud.google.com/gemini/enterprise/docs/configure-pay-as-you-go-usage-above-quota.md.txt#configure-single-user-quota-limit) Announcement **Gemini Enterprise: Gemini 4 Argon becomes the default model for AlphaEvolve on October 26, 2026** On October 26, 2026, Gemini 4 Argon will replace Gemini 3.8 Flash as the default model for new AlphaEvolve experiments. AlphaEvolve uses the default model when you don't specify a model in the `models` field of `generationSettings`. From that date, new experiments that use the default model are billed at Gemini 4 Argon token prices instead of Gemini 3.8 Flash token prices. To keep using Gemini 3.8 Flash, specify `gemini-3.8-flash` in the `models` field. Experiments created before October 26, 2026 keep the model recorded in their configuration. For more information, see [Default model](https://docs.cloud.google.com/gemini/enterprise/docs/alphaevolve/reference-guide/api-reference#default-model). **Google Cloud Contact Center as a Service** Announcement **Advanced reporting dashboards prerelease notes 6.24** Here are the pre-release notes for updates to the advanced reporting dashboards and other reporting in CCAI Platform. When we release these updates, we expect the new capabilities to be as shown here. > [!IMPORTANT] > **Important:** The next version of the advanced reporting dashboards could be greater than 6.24. Fixed This release addresses the following issues: - Fixed an issue where call and chat type names were cut off in the **Dashboard Reports** selector on wide-screen displays. - Fixed an issue where the **Individual Call History** and **Individual Chat History** reports, run for all agents, left out calls and chats that were never assigned to an agent (for example, abandoned, deflected, or expired calls) when only one agent or no agents had activity in the selected period. The **All Call History** and **All Chat History** files are now always included. - Fixed an issue where the **Interactions Detail by Agent** report omitted outbound calls placed without a queue when generated for all agents. - Fixed an issue where the **Real-time Queue Monitoring** and **Campaign** dashboards incorrectly displayed English queue names for French and Spanish interactions. - Fixed an issue where "wrap-up" and "hold" metrics in advanced reporting were displayed with inconsistent and inaccurate French Canadian (`fr_CA`) translations. - Fixed an issue where Spanish chat queues incorrectly displayed English names in **Real-time Queue Monitoring** and advanced reporting dashboards. - Fixed an issue where call disposition fields appeared blank on dashboards when viewing date ranges between 46 and 365 days. **Google Distributed Cloud (software only) for VMware** Announcement Google Distributed Cloud (software only) for VMware 1.34.1000-gke.111 is now available for download. To upgrade, see [Upgrade clusters](https://docs.cloud.google.com/kubernetes-engine/distributed-cloud/vmware/docs/how-to/upgrading.md.txt). Google Distributed Cloud 1.34.1000-gke.111 runs on Kubernetes v1.34.7-gke.200. If you use a third-party storage vendor, check the listing of our previously-qualified [storage partners](https://docs.cloud.google.com/kubernetes-engine/enterprise/docs/resources/partner-storage.md.txt). After a release, it takes approximately 7 to 14 days for the version to become available for use with GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform. Fixed The following issues were fixed in 1.34.1000-gke.111: - Fixed vulnerabilities listed in [Vulnerability fixes](https://docs.cloud.google.com/kubernetes-engine/distributed-cloud/vmware/docs/vulnerabilities.md.txt). - Fixed an issue where updating or upgrading a cluster to an [advanced cluster](https://docs.cloud.google.com/kubernetes-engine/distributed-cloud/vmware/docs/concepts/advanced-clusters) failed to join control plane nodes if the cluster's certificate authorities (CAs) were previously rotated. For more information, see [Control plane nodes fail to join during an update or upgrade to an advanced cluster after CA rotation](https://docs.cloud.google.com/kubernetes-engine/distributed-cloud/vmware/docs/troubleshooting/known-issues.md.txt#advanced-cluster-upgrade-fails-after-ca-rotation). **Google Distributed Cloud (software only) for bare metal** Announcement Google Distributed Cloud (software only) for bare metal 1.34.1000-gke.111 is now available for download. To upgrade, see [Upgrade clusters](https://docs.cloud.google.com/release-notes/how-to/upgrade). Google Distributed Cloud for bare metal 1.34.1000-gke.111 runs on Kubernetes v1.34.7-gke.200. After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform. If you use a third-party storage vendor, check the listing of our previously-qualified [storage partners](https://docs.cloud.google.com/kubernetes-engine/enterprise/docs/resources/partner-storage.md.txt). Feature The following features were introduced in 1.34.1000-gke.111: - Fixed an issue in clusters using bundled BGP load balancing where control plane upgrades or configuration updates could cause up to 20 seconds of API server connection failures while a control plane node restarted. After the fix, failover to a healthy control plane node completes in approximately 4 seconds. - Fixed an issue where the `NodePool` controller prematurely updated `Status.ManagedFields` on partial reconciliation failures, causing removed taints and labels to remain stranded on affected nodes. Fixed The following issues were fixed in 1.34.1000-gke.111: - Fixed vulnerabilities listed in [Vulnerability fixes](https://docs.cloud.google.com/kubernetes-engine/distributed-cloud/bare-metal/docs/vulnerabilities.md.txt). - Fixed `BareMetalMachine` conditions during maintenance mode transitions. - Fixed an issue where updating control plane configurations caused multiple API servers to restart simultaneously, leading to transient control plane unavailability. This note is missing a fix included in 1.34.1000-gke.111. See entry for [October 26, 2026](https://docs.cloud.google.com/kubernetes-engine/distributed-cloud/bare-metal/docs/release-notes.md.txt#October_26_2026). **Google SecOps** Feature **Bulk case selection** In the enhanced Investigation Management experience, you can select up to 50 cases at a time in the case queue to perform bulk operations: - **Range selection:** Hold `Shift` while clicking to select a range of cases. - **Select all:** Click the header checkbox to select up to 50 loaded cases; this action automatically scrolls your view back to the top of the list. **Consolidated Settings and Navigation** The **Consolidated Settings and Navigation** feature is now in public preview. It replaces the separate SIEM Settings and SOAR Settings menus with a single Settings menu, grouped into Administration, Access Management, Investigation, Detection and Data Management, and updates the navigation menu. Each settings page is shown only to users with the correct permissions. Cloud IAM, Viewer and Editor users can now view certain SOAR settings pages in read-only mode. Note that the Google SecOps documentation has been updated to reflect the new navigational changes imposed by the unified Settings menu. For more information, see [Navigate the Google SecOps platform](https://docs.cloud.google.com/chronicle/docs/secops/navigate-the-secops-platform.md.txt). **Looker** Announcement **Looker 26.22** will roll out to Looker (original) instances on the following schedule: - Expected Looker (original) deployment start: **Monday, October 26, 2026** - Expected Looker (original) final deployment and download available: **Monday, November 9, 2026** The Looker 26.22 rollout for Looker (Google Cloud core) will be announced separately. Looker 26.22 is expected to include the following changes, features, and fixes. Fixed An issue has been fixed where table column options menus and search boxes appeared behind drill dialogs, which prevented users from interacting with them. This feature now performs as expected. Fixed An issue has been fixed where configuring a LookML model could trigger unnecessary derived table rebuilds. This feature now performs as expected. Fixed An issue has been fixed where the **Show filters** option was displayed on dashboard tiles that failed to load data in view mode. This feature now performs as expected. Fixed An issue has been fixed where drilling into results that were filtered by string dimensions that contained backslashes returned zero rows. This feature now performs as expected. Fixed An issue has been fixed where pivoted queries in SQL Runner could fail to render or re-pivot unexpectedly. This feature now performs as expected. Fixed An issue has been fixed where the **View (Expanded / Full Screen)** option appeared in the tile action menu on embedded dashboards in view mode. This feature now performs as expected. Fixed An issue has been fixed where custom visualization tiles were truncated in dashboard PDF exports when the **Expand tables to show all rows** option was enabled. This feature now performs as expected. Fixed Table row group subtotals are now displayed only for sum and count measures. For other measure types (such as `averages` and `count distinct`) and table calculations, subtotals are now left blank rather than displaying an inaccurate summed value. Fixed The System Activity `query_metrics` Explore now records connection acquisition time (`acquire_connection`) for queries that are canceled while waiting in the connection pool. Fixed Conversational Analytics `DELETE` endpoints now return `HTTP 404 Not Found` instead of `HTTP 204 No Content` when you attempt to delete nonexistent resources. Fixed The System Activity `query_metrics` Explore has been updated to accurately record model initialization time for models that are loaded from cache. Fixed An issue has been fixed where adding a new series to a categorical chart, such as adding a new pivot value, could cause category bars to appear ungrouped. This feature now performs as expected. Fixed An issue has been fixed in the TypeScript and JavaScript SDKs where calling methods that have only optional parameters without passing an empty object could result in compilation or runtime errors. This feature now performs as expected. ## October 21, 2026 **Apigee X** Announcement **Apigee Emulator** ### Apigee Emulator v2.0.2 On October 21, 2026, we released Apigee Emulator version 2.0.2. This release upgrades the Apigee Emulator runtime to Java 21 (Eclipse Temurin JRE 21) to align local proxy development and policy execution with the production Apigee runtime, while keeping the embedded Apache Cassandra datastore pinned to Java 8. It also addresses 46 security vulnerabilities across Netty, Jackson, Apache Log4j, BouncyCastle, Apache CXF, Eclipse Jetty, and the embedded Cassandra Go standard library health-check binary. The emulator image is available at [Artifact Registry](https://console.cloud.google.com/artifacts/docker/apigee-release/us/gcr.io/hybrid%2Fapigee-emulator). To upgrade, update the emulator version in your Cloud Code for VS Code settings to `2.0.2`. See [Manage the Apigee Emulator](https://docs.cloud.google.com/apigee/docs/api-platform/local-development/vscode/manage-apigee-emulator.md.txt#choose_the_emulator_version) for details. Feature **Apigee Emulator** #### Changed in this release - Upgraded the Apigee Emulator runtime JVM to Eclipse Temurin JRE 21 (`21.0.12.1.0+1-0`, from JRE 11 `11.0.31+11`), adding JVM 21 compatibility flags (`-Djava.security.manager=allow` and `--add-opens` module flags) for `JavaCallout`, JavaScript (Rhino), and Python (Jython) policies while keeping the embedded Apache Cassandra `4.0.19` datastore pinned to Eclipse Temurin JRE 8. - Upgraded Netty to `4.1.137.Final` (from `4.1.135.Final`) and updated `netty-tcnative-boringssl-static` and `netty-tcnative-classes` to `2.0.81.Final` (from `2.0.77.Final`). - Upgraded Jackson (`jackson-core`, `jackson-databind`, and `jackson-dataformat-yaml`) to `2.21.7` (from `2.18.6` and `2.19.2`) and `jackson-annotations` to `2.21`. - Upgraded shaded Apache Log4j (`log4j-api` and `log4j-core`) in `ConfigUtil.jar` to `2.25.5` (from `2.17.1` and `2.25.4`). - Upgraded BouncyCastle (`bcprov-jdk18on`, `bcpkix-jdk18on`, and `bcutil-jdk18on`) to `1.85` (from `1.84`). - Upgraded Apache CXF (`cxf-*`) to `3.6.12` (from `3.5.11`). - Upgraded gRPC to `1.82.3` (from `1.62.2`), Protobuf (`protobuf-java` and `protobuf-java-util`) to `4.33.6` (from `3.25.5`), and Guava to `33.5.0-jre` (from `33.4.8-jre`). - Removed unused `org.eclipse.jetty:jetty-*` (`9.4.58.v20250814`) and `commons-collections:commons-collections` (`3.2.2`) JARs from the emulator distribution. - Refreshed the Cassandra base image to pick up Go standard library `1.27.0` (from `1.25.11`) in the embedded `/opt/apigee/ready` health-check binary. Security **Apigee Emulator** #### Security This release addresses 46 security vulnerabilities across Netty, the embedded Go standard library, Jackson, Apache Log4j, Eclipse Jetty, BouncyCastle, and Apache CXF: | CVE / Advisory | Component | |---|---| | [CVE-2026-75595](https://nvd.nist.gov/vuln/detail/CVE-2026-75595) | Netty (`netty-handler`) | | [CVE-2026-75596](https://nvd.nist.gov/vuln/detail/CVE-2026-75596) | Netty (`netty-handler`) | | [CVE-2026-59901](https://nvd.nist.gov/vuln/detail/CVE-2026-59901) | Netty (`netty-codec`) | | [CVE-2026-55831](https://nvd.nist.gov/vuln/detail/CVE-2026-55831) | Netty (`netty-codec-http`) | | [CVE-2026-55833](https://nvd.nist.gov/vuln/detail/CVE-2026-55833) | Netty (`netty-codec-http`) | | [CVE-2026-56745](https://nvd.nist.gov/vuln/detail/CVE-2026-56745) | Netty (`netty-codec-http`) | | [CVE-2026-56746](https://nvd.nist.gov/vuln/detail/CVE-2026-56746) | Netty (`netty-codec-http`) | | [CVE-2026-59898](https://nvd.nist.gov/vuln/detail/CVE-2026-59898) | Netty (`netty-codec-http`) | | [CVE-2026-59899](https://nvd.nist.gov/vuln/detail/CVE-2026-59899) | Netty (`netty-codec-http`) | | [CVE-2026-59903](https://nvd.nist.gov/vuln/detail/CVE-2026-59903) | Netty (`netty-codec-http`) | | [CVE-2026-59921](https://nvd.nist.gov/vuln/detail/CVE-2026-59921) | Netty (`netty-codec-http`) | | [CVE-2026-56819](https://nvd.nist.gov/vuln/detail/CVE-2026-56819) | Netty (`netty-codec-http2`) | | [CVE-2026-59900](https://nvd.nist.gov/vuln/detail/CVE-2026-59900) | Netty (`netty-codec-http2`) | | [CVE-2026-73508](https://nvd.nist.gov/vuln/detail/CVE-2026-73508) | Netty (`netty-codec-dns`) | | [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) | Go standard library | | [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) | Go standard library | | [CVE-2026-39822](https://nvd.nist.gov/vuln/detail/CVE-2026-39822) | Go standard library | | [CVE-2026-42505](https://nvd.nist.gov/vuln/detail/CVE-2026-42505) | Go standard library | | [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) | Go standard library | | [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) | Go standard library | | [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) | Go standard library | | [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) | Go standard library | | [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) | Go standard library | | [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) | Go standard library | | [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) | Go standard library | | [CVE-2026-68494](https://nvd.nist.gov/vuln/detail/CVE-2026-68494) | Jackson (`jackson-core`) | | [CVE-2026-18401](https://nvd.nist.gov/vuln/detail/CVE-2026-18401) | Jackson (`jackson-core`) | | [CVE-2026-54512](https://nvd.nist.gov/vuln/detail/CVE-2026-54512) | Jackson (`jackson-databind`) | | [CVE-2026-54513](https://nvd.nist.gov/vuln/detail/CVE-2026-54513) | Jackson (`jackson-databind`) | | [CVE-2026-54514](https://nvd.nist.gov/vuln/detail/CVE-2026-54514) | Jackson (`jackson-databind`) | | [CVE-2026-54515](https://nvd.nist.gov/vuln/detail/CVE-2026-54515) | Jackson (`jackson-databind`) | | [CVE-2026-59888](https://nvd.nist.gov/vuln/detail/CVE-2026-59888) | Jackson (`jackson-databind`) | | [CVE-2026-59889](https://nvd.nist.gov/vuln/detail/CVE-2026-59889) | Jackson (`jackson-databind`) | | [CVE-2026-77310](https://nvd.nist.gov/vuln/detail/CVE-2026-77310) | Jackson (`jackson-databind`) | | [GHSA-mhm7-754m-9p8w](https://github.com/advisories/GHSA-mhm7-754m-9p8w) | Jackson (`jackson-databind`) | | [CVE-2025-68161](https://nvd.nist.gov/vuln/detail/CVE-2025-68161) | Apache Log4j (`log4j-core`) | | [CVE-2026-34477](https://nvd.nist.gov/vuln/detail/CVE-2026-34477) | Apache Log4j (`log4j-core`) | | [CVE-2026-34480](https://nvd.nist.gov/vuln/detail/CVE-2026-34480) | Apache Log4j (`log4j-core`) | | [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) | Apache Log4j (`log4j-api`) | | [CVE-2026-10050](https://nvd.nist.gov/vuln/detail/CVE-2026-10050) | Eclipse Jetty (`jetty-security`) | | [CVE-2026-2332](https://nvd.nist.gov/vuln/detail/CVE-2026-2332) | Eclipse Jetty (`jetty-http`) | | [CVE-2024-6763](https://nvd.nist.gov/vuln/detail/CVE-2024-6763) | Eclipse Jetty (`jetty-http`) | | [CVE-2026-6790](https://nvd.nist.gov/vuln/detail/CVE-2026-6790) | Eclipse Jetty (`jetty-server`) | | [CVE-2026-8763](https://nvd.nist.gov/vuln/detail/CVE-2026-8763) | BouncyCastle (`bcprov-jdk18on`) | | [CVE-2026-13506](https://nvd.nist.gov/vuln/detail/CVE-2026-13506) | BouncyCastle (`bcprov-jdk18on`) | | [CVE-2026-50645](https://nvd.nist.gov/vuln/detail/CVE-2026-50645) | Apache CXF (`cxf-core`) | **Apigee hybrid** Announcement ### v1.15.9 On October 21, 2026 we released an updated version of the Apigee hybrid software, v1.15.9. - For information on upgrading, see [Upgrading Apigee hybrid to version v1.15.9](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/upgrade.md.txt). - For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/big-picture.md.txt). > [!NOTE] > **Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images). Fixed #### Fixed in this release | Bug ID | Description | |---|---| | **573622417** | **Fixed an issue where `apigee-ingressgateway` forwarded the `x-envoy-decorator-operation` header to upstream runtime and target backends.** | | **571378258** | **The `apigee-redis` container now uses the Valkey engine (version 8.1.10). The RESP2 wire protocol and `redis-server` and `redis-cli` binary names are unchanged.** | | **568860869** | **Fixed an issue in the `RegularExpressionProtection` policy where patterns starting and ending with `.*` whose middle section contained regular expression syntax were matched as literal text instead of regular expressions.** | | **565072374** | **Fixed an issue where `VerifyJWT` policies using a JWKS `uriRef` could return `steps.jwt.NoMatchingPublicKey` on the first request after the 5-minute JWKS cache TTL expired when the identity provider rotated keys. The cache now refreshes synchronously upon expiration.** | | **535395491** | **Extension Processor (`ext_proc`) denials now return the status and body that the policy or FaultRule produced, instead of always returning HTTP `500`.** | | **524115876** | **Fixed an intermittent HTTP `400` error in the `OASValidation` policy's strict parameter validation that rejected valid requests under load.** | | **519729209** | **Fixed a SAML XML Signature Wrapping vulnerability in the `ValidateSAMLAssertion` policy.** | | **502231886** | **Fixed an issue where the `SanitizeUserPrompt` and `SanitizeModelResponse` policies failed to extract content using default source templates when the `` element was omitted and `` was set to `false`.** | | **449228485** | **Fixed an issue where `podDisruptionBudget` overrides set through Helm had no effect because the `apigee-operator` chart CRDs didn't include the `podDisruptionBudget` field. These overrides now take effect.** | | **432315283** | **Fixed an issue where changes to a multi-certificate truststore's trust anchors required a Message Processor restart when `features.truststore.multi_cert_bundle.enabled` was toggled at runtime; the outbound `SSLContext` now rebuilds automatically.** | | **428750492** | **Removed the `required` validation constraint on the `strategy` and `stages` fields in the `ApigeeDeployment` CRD.** | Security | Bug ID | Description | |---|---| | **N/A** | **Security fixes for `apigee-asm-ingress`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) | | **N/A** | **Security fixes for `apigee-asm-istiod`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) | | **N/A** | **Security fixes for `apigee-connect-agent`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) | | **N/A** | **Security fixes for `apigee-fluent-bit`.** This addresses the following vulnerabilities: - [CVE-2026-35189](https://nvd.nist.gov/vuln/detail/CVE-2026-35189) - [CVE-2026-35191](https://nvd.nist.gov/vuln/detail/CVE-2026-35191) - [CVE-2026-42772](https://nvd.nist.gov/vuln/detail/CVE-2026-42772) - [CVE-2026-5450](https://nvd.nist.gov/vuln/detail/CVE-2026-5450) - [CVE-2026-54872](https://nvd.nist.gov/vuln/detail/CVE-2026-54872) - [CVE-2026-54873](https://nvd.nist.gov/vuln/detail/CVE-2026-54873) - [CVE-2026-54875](https://nvd.nist.gov/vuln/detail/CVE-2026-54875) - [CVE-2026-58050](https://nvd.nist.gov/vuln/detail/CVE-2026-58050) - [CVE-2026-58051](https://nvd.nist.gov/vuln/detail/CVE-2026-58051) - [CVE-2026-5928](https://nvd.nist.gov/vuln/detail/CVE-2026-5928) - [CVE-2026-66032](https://nvd.nist.gov/vuln/detail/CVE-2026-66032) - [CVE-2026-66033](https://nvd.nist.gov/vuln/detail/CVE-2026-66033) - [CVE-2026-66034](https://nvd.nist.gov/vuln/detail/CVE-2026-66034) - [CVE-2026-66035](https://nvd.nist.gov/vuln/detail/CVE-2026-66035) - [CVE-2026-72897](https://nvd.nist.gov/vuln/detail/CVE-2026-72897) - [CVE-2026-75804](https://nvd.nist.gov/vuln/detail/CVE-2026-75804) - [CVE-2026-75805](https://nvd.nist.gov/vuln/detail/CVE-2026-75805) - [CVE-2026-75806](https://nvd.nist.gov/vuln/detail/CVE-2026-75806) - [CVE-2026-77696](https://nvd.nist.gov/vuln/detail/CVE-2026-77696) - [CVE-2026-84782](https://nvd.nist.gov/vuln/detail/CVE-2026-84782) - [CVE-2026-84784](https://nvd.nist.gov/vuln/detail/CVE-2026-84784) | | **N/A** | **Security fixes for `apigee-hybrid-cassandra-client`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) | | **N/A** | **Security fixes for `apigee-kube-rbac-proxy`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) | | **N/A** | **Security fixes for `apigee-mart-server`.** This addresses the following vulnerabilities: - [CVE-2024-6763](https://nvd.nist.gov/vuln/detail/CVE-2024-6763) - [CVE-2025-46392](https://nvd.nist.gov/vuln/detail/CVE-2025-46392) - [CVE-2026-10050](https://nvd.nist.gov/vuln/detail/CVE-2026-10050) - [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) - [CVE-2026-2332](https://nvd.nist.gov/vuln/detail/CVE-2026-2332) - [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) - [CVE-2026-50645](https://nvd.nist.gov/vuln/detail/CVE-2026-50645) - [CVE-2026-6790](https://nvd.nist.gov/vuln/detail/CVE-2026-6790) - [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) - [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) - [CVE-2026-89407](https://nvd.nist.gov/vuln/detail/CVE-2026-89407) - [CVE-2026-89425](https://nvd.nist.gov/vuln/detail/CVE-2026-89425) - [CVE-2026-91776](https://nvd.nist.gov/vuln/detail/CVE-2026-91776) - [CVE-2026-91777](https://nvd.nist.gov/vuln/detail/CVE-2026-91777) | | **N/A** | **Security fixes for `apigee-mint-task-scheduler`.** This addresses the following vulnerabilities: - [CVE-2024-6763](https://nvd.nist.gov/vuln/detail/CVE-2024-6763) - [CVE-2025-46392](https://nvd.nist.gov/vuln/detail/CVE-2025-46392) - [CVE-2026-10050](https://nvd.nist.gov/vuln/detail/CVE-2026-10050) - [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) - [CVE-2026-2332](https://nvd.nist.gov/vuln/detail/CVE-2026-2332) - [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) - [CVE-2026-50645](https://nvd.nist.gov/vuln/detail/CVE-2026-50645) - [CVE-2026-6790](https://nvd.nist.gov/vuln/detail/CVE-2026-6790) - [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) - [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) - [CVE-2026-89407](https://nvd.nist.gov/vuln/detail/CVE-2026-89407) - [CVE-2026-89425](https://nvd.nist.gov/vuln/detail/CVE-2026-89425) - [CVE-2026-91776](https://nvd.nist.gov/vuln/detail/CVE-2026-91776) - [CVE-2026-91777](https://nvd.nist.gov/vuln/detail/CVE-2026-91777) | | **N/A** | **Security fixes for `apigee-operators`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) | | **N/A** | **Security fixes for `apigee-prom-prometheus`.** This addresses the following vulnerabilities: - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) | | **N/A** | **Security fixes for `apigee-prometheus-adapter`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) | | **N/A** | **Security fixes for `apigee-redis`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) | | **N/A** | **Security fixes for `apigee-runtime`.** This addresses the following vulnerabilities: - [CVE-2025-46392](https://nvd.nist.gov/vuln/detail/CVE-2025-46392) - [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) - [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) - [CVE-2026-50645](https://nvd.nist.gov/vuln/detail/CVE-2026-50645) - [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) - [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) - [CVE-2026-89407](https://nvd.nist.gov/vuln/detail/CVE-2026-89407) - [CVE-2026-89425](https://nvd.nist.gov/vuln/detail/CVE-2026-89425) - [CVE-2026-91776](https://nvd.nist.gov/vuln/detail/CVE-2026-91776) - [CVE-2026-91777](https://nvd.nist.gov/vuln/detail/CVE-2026-91777) | | **N/A** | **Security fixes for `apigee-synchronizer`.** This addresses the following vulnerabilities: - [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) - [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) - [CVE-2026-50645](https://nvd.nist.gov/vuln/detail/CVE-2026-50645) - [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) - [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) - [CVE-2026-89407](https://nvd.nist.gov/vuln/detail/CVE-2026-89407) - [CVE-2026-89425](https://nvd.nist.gov/vuln/detail/CVE-2026-89425) - [CVE-2026-91776](https://nvd.nist.gov/vuln/detail/CVE-2026-91776) - [CVE-2026-91777](https://nvd.nist.gov/vuln/detail/CVE-2026-91777) | | **N/A** | **Security fixes for `apigee-udca`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) | | **N/A** | **Security fixes for `apigee-watcher`.** This addresses the following vulnerabilities: - [CVE-2026-56857](https://nvd.nist.gov/vuln/detail/CVE-2026-56857) - [CVE-2026-56866](https://nvd.nist.gov/vuln/detail/CVE-2026-56866) - [CVE-2026-78659](https://nvd.nist.gov/vuln/detail/CVE-2026-78659) - [CVE-2026-78660](https://nvd.nist.gov/vuln/detail/CVE-2026-78660) - [CVE-2026-78663](https://nvd.nist.gov/vuln/detail/CVE-2026-78663) - [CVE-2026-78667](https://nvd.nist.gov/vuln/detail/CVE-2026-78667) - [CVE-2026-78669](https://nvd.nist.gov/vuln/detail/CVE-2026-78669) - [CVE-2026-94439](https://nvd.nist.gov/vuln/detail/CVE-2026-94439) - [CVE-2026-94440](https://nvd.nist.gov/vuln/detail/CVE-2026-94440) - [CVE-2026-94444](https://nvd.nist.gov/vuln/detail/CVE-2026-94444) - [CVE-2026-94447](https://nvd.nist.gov/vuln/detail/CVE-2026-94447) - [CVE-2026-94448](https://nvd.nist.gov/vuln/detail/CVE-2026-94448) - [CVE-2026-97030](https://nvd.nist.gov/vuln/detail/CVE-2026-97030) - [CVE-2026-97031](https://nvd.nist.gov/vuln/detail/CVE-2026-97031) - [CVE-2026-97032](https://nvd.nist.gov/vuln/detail/CVE-2026-97032) | **App Engine flexible environment PHP** Security This note is incorrect; follow guidance in the entry for [October 22, 2026](https://docs.cloud.google.com/release-notes.md.txt#October_22_2026). Patch updates to [supported PHP runtimes](https://docs.cloud.google.com/appengine/docs/flexible/lifecycle/support-schedule.md.txt#php) are available with deployments from source: `8.5.12`, `8.4.27`, `8.3.36`, and `8.2.35`. Take immediate action to protect your PHP workloads by redeploying your workloads with updated dependencies. If you use [custom runtimes](https://docs.cloud.google.com/appengine/docs/flexible/custom-runtimes), update your dependencies and redeploy. See [Responding to core PHP vulnerabilities](https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619) for more information. **App Engine standard environment PHP** Security This note is incorrect; follow guidance in the entry for [October 22, 2026](https://docs.cloud.google.com/release-notes.md.txt#October_22_2026). Patch updates to [supported PHP runtimes](https://docs.cloud.google.com/appengine/docs/standard/lifecycle/support-schedule.md.txt#php) are available with deployments from source: `8.5.12`, `8.4.27`, `8.3.36`, and `8.2.35`. PHP workloads have automatically been patched. See [Responding to core PHP vulnerabilities](https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619) for more information. **BigQuery** Feature The [`AI.CHUNK_DOCUMENT` function](https://docs.cloud.google.com/bigquery/docs/reference/standard-sql/bigqueryml-syntax-ai-chunk-document.md.txt) is a table-valued function that splits unstructured documents into semantically coherent text chunks optimized for vector embeddings and Retrieval-Augmented Generation (RAG) workflows. This function is [generally available](https://cloud.google.com/products#product-launch-stages) (GA). **Buildpacks** Feature Patch updates to [PHP runtimes](https://docs.cloud.google.com/appengine/docs/flexible/lifecycle/support-schedule.md.txt#php) are available on `google-22` and `google-24` tags: `8.5.12`, `8.4.27`, `8.3.36`, and `8.2.35`. Take immediate action to protect your PHP workloads by rebuilding your workloads with updated dependencies. See [Responding to core PHP vulnerabilities](https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619) for more information. **Cloud Asset Inventory** Feature The following resource type is publicly available through the [SearchAllResources](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/searchAllResources.md.txt) and [SearchAllIamPolicies](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/searchAllIamPolicies.md.txt) APIs. - Cloud TPU API - `tpu.googleapis.com/QueuedResource` Feature The following resource type is publicly available through the [SearchAllResources](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/searchAllResources.md.txt) and [SearchAllIamPolicies](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/searchAllIamPolicies.md.txt) APIs. - Network Management API - `networkmanagement.googleapis.com/VpcFlowLogsConfig` **Cloud Billing** Feature **SKU attributes and granular usage units in pricing data export (Preview)** SKU attributes and granular usage units are now available in [Preview](https://cloud.google.com/products#product-launch-stages) in the Cloud Billing [pricing data export to BigQuery](https://docs.cloud.google.com/billing/docs/how-to/export-data-bigquery-tables/pricing-data.md.txt). - **SKU attributes** : SKU attributes are key-value pairs that describe the SKU. For example, *Key* : `model_name`, *Value* : `gemini_2_5_flash`. - **Granular usage units** : Granular usage units are the usage unit of the SKU, such as `tokens`. For more information about these dimensions, see the following: - [SKU attributes](https://docs.cloud.google.com/billing/docs/how-to/export-data-bigquery-tables/pricing-data.md.txt#sku_attributes) - [Granular usage units](https://docs.cloud.google.com/billing/docs/how-to/export-data-bigquery-tables/pricing-data.md.txt#sku_granular_usage_units) **Cloud Run** Security This note is incorrect; follow guidance in the entry for [October 22, 2026](https://docs.cloud.google.com/release-notes.md.txt#October_22_2026). Patch updates to [supported PHP runtimes](https://docs.cloud.google.com/run/docs/runtime-support.md.txt#php) are available for Cloud Run resources [deployed from source code](https://docs.cloud.google.com/run/docs/deploying-source-code.md.txt): `8.5.12`, `8.4.27`, `8.3.36`, and `8.2.35`. Take immediate action to protect your workloads by redeploying your Cloud Run resources with updated dependencies. Cloud Run resources with [automatic base image updates](https://docs.cloud.google.com/run/docs/configuring/services/automatic-base-image-updates.md.txt) enabled have already been patched. See [Responding to core PHP vulnerabilities](https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619) for more information. **Cloud Run functions** Security This note is incorrect; follow guidance in the entry for [October 22, 2026](https://docs.cloud.google.com/release-notes.md.txt#October_22_2026). Patch updates to [supported PHP runtimes](https://docs.cloud.google.com/functions/docs/runtime-support.md.txt#php) are available with deployments from source: `8.5.12`, `8.4.27`, `8.3.36`, and `8.2.35`. Functions with automatic base image updates enabled have already been patched. If you have disabled automatic base image updates, take immediate action to protect your workloads by redeploying your workloads with updated dependencies and redeploying. See [Responding to core PHP vulnerabilities](https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619) for more information. **Dataflow** Feature Dataflow now supports streaming high availability for [Streaming Engine](https://docs.cloud.google.com/dataflow/docs/streaming-engine.md.txt) jobs ([Preview](https://cloud.google.com/products#product-launch-stages)). When you enable the `requires_high_availability` service option, Dataflow replicates backend state across multiple zones in a region to protect your job from single-zone failures. For more information, see [Streaming high availability](https://docs.cloud.google.com/dataflow/docs/guides/streaming-high-availability.md.txt). **Gemini Enterprise Agent Platform** Fixed **CodeMender updates (v0.16.0)** This release introduces updates to CodeMender: - **Deep scan by default (`cm find`)** : `cm find` now runs a concurrent file-by-file deep scan (`--deep`) by default for higher vulnerability recall across repositories. To run a single-session quick scan instead, pass the `--quick` flag (`cm find --quick`). `cm stats` now breaks down scan usage by mode (`--deep`, `--quick`, and `--diff`). - **Pre-flight health checks (`cm health`)** : Added the `cm health` command (with `--json`, `--strict`, and `--timeout` flags) to verify credentials, configuration, endpoint reachability, and project authorization before running scans. - **Expanded file discovery** : `cm find` now scans `.hh`, `.hxx`, `.inl`, and `.ipp` C++ headers, extensionless scripts with supported language shebangs (`python`, `node`, `ruby`, and `php`), nested `build/`, `target/`, `obj/`, and `bin/` source directories, and production code under `spec/`, `locale/`, and `i18n/`. - **Bug fixes** : - Restricted `cm verify` file writes to `.exploit/` inside the project root and skipped missing or out-of-scope session artifacts during workspace restore. - Capped single-turn file reads at 256 KiB with pagination hints, bounded unified diff generation on large files, and raised `run_command` default and maximum timeouts to 120 seconds and 300 seconds. - Fixed an issue where sandboxed sessions could not write tool call entries to `~/.codemender/audit.log`. - Updated multi-file `--deep` and `--diff` scans to report `INCOMPLETE` status when one or more file scans fail. For more information, see the [CodeMender documentation](https://docs.cloud.google.com/gemini-enterprise-agent-platform/agents/codemender.md.txt). **Google Distributed Cloud (software only) for VMware** Announcement Google Distributed Cloud (software only) for VMware 1.36.200-gke.118 is now available for download. To upgrade, see [Upgrade clusters](https://docs.cloud.google.com/kubernetes-engine/distributed-cloud/vmware/docs/how-to/upgrading.md.txt). Google Distributed Cloud 1.36.200-gke.118 runs on Kubernetes v1.36.4-gke.100. If you use a third-party storage vendor, check the listing of our previously-qualified [storage partners](https://docs.cloud.google.com/kubernetes-engine/enterprise/docs/resources/partner-storage.md.txt). After a release, it takes approximately 7 to 14 days for the version to become available for use with GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform. Fixed The following issues were fixed in 1.36.200-gke.118: - Fixed vulnerabilities listed in [Vulnerability fixes](https://docs.cloud.google.com/kubernetes-engine/distributed-cloud/vmware/docs/vulnerabilities.md.txt). **Google Distributed Cloud (software only) for bare metal** Announcement Google Distributed Cloud (software only) for bare metal 1.36.200-gke.118 is now available for download. To upgrade, see [Upgrade clusters](https://docs.cloud.google.com/release-notes/how-to/upgrade). Google Distributed Cloud for bare metal 1.36.200-gke.118 runs on Kubernetes v1.36.4-gke.100. After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform. If you use a third-party storage vendor, check the listing of our previously-qualified [storage partners](https://docs.cloud.google.com/kubernetes-engine/enterprise/docs/resources/partner-storage.md.txt). Feature The following changes were added in 1.36.200-gke.118: - Fixed an issue in clusters using bundled BGP load balancing where control plane upgrades or configuration updates could cause up to 20 seconds of API server connection failures while a control plane node restarted. After the fix, failover to a healthy control plane node completes in approximately 4 seconds. - Fixed an issue where node drain in maintenance mode did not wait for attached storage volumes to detach. Fixed The following issues were fixed in 1.36.200-gke.118: - Fixed vulnerabilities listed in [Vulnerability fixes](https://docs.cloud.google.com/kubernetes-engine/distributed-cloud/bare-metal/docs/vulnerabilities.md.txt). - Fixed `BareMetalMachine` conditions during maintenance mode transitions. **Google SecOps Marketplace** Feature **Google Threat Intelligence**: Version 22.0 - The following new connector has been added: - **Google Threat Intelligence - GTI Alerts Connector** Change **Siemplify**: Version 114.0 - Added support for lazy case loading so that case data is no longer attached to the remote agent task when enabled by the platform in the following action: - **Run Remote** Change **Palo Alto Cortex XDR**: Version 34.0 - Added the **Entities To Ignore** parameter to exclude alerts containing specified IP addresses, CIDR ranges, domains, file hashes, hostnames, or usernames in the following connector: - **Palo Alto Cortex XDR - Incidents Connector** Change **Google Threat Intelligence**: Version 22.0 - Improved private submission handling when retrieving comments in the following action: - **Submit File** **Looker** Feature [Automated cataloging and ingestion of Looker (Google Cloud core) metadata with Knowledge Catalog](https://docs.cloud.google.com/looker/docs/looker-core-dataplex.md.txt) is now generally available (GA). This includes support for additional granular metadata (including dimension/measure definitions, default queries, and relationships) and new asset types: LookML dashboards, LookML dashboard elements, and agents. The [data lineage integration](https://docs.cloud.google.com/looker/docs/looker-core-lineage.md.txt) remains in Preview. **Model Armor** Feature You can use custom organization policies to ensure that all new or updated Model Armor `Template` resources enforce required filters, like responsible AI or prompt injection and jailbreak detection. This feature is generally available ([GA](https://cloud.google.com/products#product-launch-stages)). For more information, see [Use custom organization policies](https://docs.cloud.google.com/model-armor/access-control/custom-constraints). ## October 20, 2026 **Agent Platform Workbench** Change ### M154 Release Change Installed latest packages from upstream dependencies. Fixed Fixed dataset and table search in the BigQuery panel, which sometimes failed to return results. Root cause is due to Datacatalog API being sunsetted in favor of Dataplex API. **Apigee X** Announcement On October 20th, 2026, we began maintenance updates of Apigee instances [configured for maintenance windows](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/maintenance-windows.md.txt). If you set a preferred window for maintenance for your instance, and your instance version is below **1-18-0-apigee-6** , your instance will be updated to **1-18-0-apigee-6** within the next seven to 21 days. A notification containing the expected date of upgrade will be sent within the next two business days. > [!NOTE] > Note: Instances that meet either of the following two criteria will **not** be updated: > > - Your instance has a DNS misconfiguration, as described in [Known Issue 445936920](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt). > - Your instance uses an Apigee Java Library that has been removed, as described in [Apigee release notes dated October 16, 2025](https://docs.cloud.google.com/apigee/docs/release/release-notes.md.txt#October_16_2025). For more information on participating in scheduled maintenance windows, see [Maintenance overview](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/maintenance.md.txt) and [Manage Apigee instance maintenance windows](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/maintenance-windows.md.txt). **Cloud Workstations** Feature Cloud Workstations supports automatic failover for [boost configurations](https://docs.cloud.google.com/workstations/docs/boost-workstation.md.txt#automatic-failover) in [Preview](https://cloud.google.com/products#product-launch-stages). When you enable automatic failover, Cloud Workstations automatically provisions a workstation VM using the boost configuration if Compute Engine lacks capacity for the default machine type during startup. **Gemini Enterprise** Feature **Gemini Enterprise: Antigravity Enterprise Gateway support** Antigravity Enterprise Gateway lets organizations route model inference requests from the Antigravity app, Antigravity CLI, and Antigravity for IDEs through a centralized enterprise gateway before forwarding them to Google Cloud. This deployment enables organizations to inspect and audit model traffic, enforce custom security and network egress policies, and authenticate developers through a gateway API key without requiring individual Google Account sign-in. Requests routed through Antigravity Enterprise Gateway use a centralized Google Cloud service account and are billed on a pay-as-you-go (PAYG) consumption basis through the Gemini Enterprise Agent Platform. This deployment model doesn't use your Gemini Enterprise seat-based subscription quotas (such as included Standard or Plus monthly allowances). You can't use a gateway and sign in with a Google Account at the same time. If you want to use your included subscription quota instead, disable the enterprise gateway and sign in with your Google Account. This feature is generally available (GA). For more information, see: - [Deploy Antigravity Enterprise Gateway](https://docs.cloud.google.com/gemini/enterprise/docs/ai-developer-tools/deploy-enterprise-gateway) - [Connect Antigravity to an Enterprise Gateway](https://docs.cloud.google.com/gemini/enterprise/docs/ai-developer-tools/connect-enterprise-gateway). Breaking **Gemini Enterprise: Gemini 2.5 Pro discontinued in Canada and Japan** Gemini 2.5 Pro has been discontinued for in-country Gemini Enterprise app deployments in Canada and Japan. Agents and chat sessions in these regions that previously used Gemini 2.5 Pro automatically switch to in-country Gemini 3.5 Flash. Gemini 2.5 Pro remains available in the `global`, `us`, and `eu` regions. For more information, see [Data residency for Gemini Enterprise](https://docs.cloud.google.com/gemini/enterprise/docs/locations) and [Manage web app features](https://docs.cloud.google.com/gemini/enterprise/docs/manage-web-app-features). **Google Kubernetes Engine** Fixed A security issue in GKE fleet management that could have allowed unauthorized configuration changes to clusters registered to a fleet has been resolved. The fixes are rolled out to all regions, and no action is required. Fixed This is an update to the release note regarding the Cloud Storage FUSE CSI driver issue published on [October 2, 2026](https://docs.cloud.google.com/kubernetes-engine/docs/release-notes.md.txt#October_02_2026). This issue has been resolved. You can upgrade your cluster control plane to the following versions to fix the issue for `ubuntu_containerd` and older `cos_containerd` node pools: - 1.36.5-gke.1032000 or later - 1.37.1-gke.1552000 or later - Specific 1.36.4 mitigation patches: 1.36.4-gke.1247001, 1.36.4-gke.1247002, 1.36.4-gke.1391001, 1.36.4-gke.1391003, 1.36.4-gke.1495001, 1.36.4-gke.1495003, 1.36.4-gke.2046001, 1.36.4-gke.2202002 **Looker** Announcement The latest versions in the Looker (Google Cloud core) [release channels](https://docs.cloud.google.com/looker/docs/looker-core-release-process.md.txt#release_channels) are beginning deployment as follows: - Latest version in the Regular channel: **Looker 26.18** The latest version in the Rapid and No Channel channels remains **Looker 26.20**. **Note:** This item was added on October 23, 2026. **Note:** This item was updated on October 29, 2026, to correct the latest version in the Regular channel to Looker 26.18. **Managed Service for Apache Airflow** Feature [Upgrade rollbacks](https://docs.cloud.google.com/composer/docs/composer-3/upgrade-environments.md.txt#rollback) are available in Managed Airflow (Gen 3). You can roll back an environment upgrade if you encounter degraded performance, Airflow bugs, or compatibility issues with your DAGs, plugins, or dependencies. This feature is gradually rolling out over several releases. In this release, it's available in the following regions: africa-south1, asia-northeast2, asia-south2, australia-southeast2, europe-north2, europe-southwest1, europe-west10, europe-west12, europe-west8, me-central1, me-central2, me-west1, northamerica-northeast2, northamerica-south1, southamerica-west1, us-south1, asia-east1, asia-northeast3, asia-southeast2, europe-central2, europe-west4, europe-west6, europe-west9, northamerica-northeast1, southamerica-east1, us-east5, us-west3, us-west4, asia-east2, asia-southeast3. Change Improved Airflow worker health checks to detect task queue connection issues more quickly. Change New [Airflow builds](https://docs.cloud.google.com/composer/docs/composer-versions.md.txt#images-composer-3) are available in Managed Airflow (Gen 3): - [composer-3-airflow-3.3.1-build.5](https://docs.cloud.google.com/composer/docs/versions-packages.md.txt#composer-3-airflow-3-3-1-build-5) - [composer-3-airflow-3.2.2-build.9](https://docs.cloud.google.com/composer/docs/versions-packages.md.txt#composer-3-airflow-3-2-2-build-9) - [composer-3-airflow-2.11.1-build.22](https://docs.cloud.google.com/composer/docs/versions-packages.md.txt#composer-3-airflow-2-11-1-build-22) (default) Change New [images](https://docs.cloud.google.com/composer/docs/composer-versions.md.txt#images-composer-2) are available in Managed Airflow (Gen 2): - [composer-2.17.16-airflow-2.11.1](https://docs.cloud.google.com/composer/docs/versions-packages.md.txt#composer-2-17-16-airflow-2-11-1) (default) **Spanner** Feature Spanner supports approximate aggregate functions for both GoogleSQL and PostgreSQL dialects. These functions produce statistical estimates of distinct counts, allowing you to compute results faster and save resources on large datasets compared to exact aggregation. For more information, see approximate aggregate functions ([GoogleSQL](https://docs.cloud.google.com/spanner/docs/reference/standard-sql/approximate_aggregate_functions.md.txt) and [PostgreSQL](https://docs.cloud.google.com/spanner/docs/reference/postgresql/functions.md.txt#approximate-aggregate)), [HyperLogLog++ functions](https://docs.cloud.google.com/spanner/docs/reference/standard-sql/hll_functions.md.txt), and [Sketches](https://docs.cloud.google.com/spanner/docs/reference/standard-sql/sketches.md.txt). ## October 19, 2026 **Agent Platform Workbench** Change ### 20261018.00_p0 Release Change Installed latest packages from upstream dependencies. Fixed Fixed an issue where Jupyter Server terminal configuration could overwrite the Dataproc plugin server extension setting or fail to apply the terminal disable setting on container startup. Change ### 20261018.00_p0 Release Change Installed latest packages from upstream dependencies. Fixed Fixed an issue where Jupyter Server terminal configuration could overwrite the Dataproc plugin server extension setting or fail to apply the terminal disable setting on container startup. **AlloyDB for PostgreSQL** Feature Lakehouse federation in AlloyDB is generally available ([GA](https://cloud.google.com/products#product-launch-stages)). This feature lets you query live data in BigQuery directly from AlloyDB using the `bigquery_fdw` extension without moving or duplicating the data. For more information, see [Access to real-time data in BigQuery overview](https://docs.cloud.google.com/alloydb/docs/access-real-time-data-overview.md.txt) and [Configure access to real-time data in BigQuery](https://docs.cloud.google.com/alloydb/docs/configure-access-real-time-data.md.txt). **Bigtable** Libraries ### Python #### [2.50.1](https://github.com/googleapis/google-cloud-python/compare/google-cloud-bigtable-v2.50.0...google-cloud-bigtable-v2.50.1) (2026-10-15) ##### Bug Fixes - **bigtable:** avoid hang when batcher not closed on process exit ([#18610](https://github.com/googleapis/google-cloud-python/issues/18610)) ([7674c91](https://github.com/googleapis/google-cloud-python/commit/7674c91a81a984e01166f72a8895cb18c8a8216b)) - **bigtable:** fix authentication scopes for metrics exporter ([#18609](https://github.com/googleapis/google-cloud-python/issues/18609)) ([722d34e](https://github.com/googleapis/google-cloud-python/commit/722d34e519dbb8305c4a48ac83790078f5ff9d57)) **Cloud Asset Inventory** Feature The following resource types are publicly available through the [ExportAssets](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/exportAssets.md.txt), [ListAssets](https://docs.cloud.google.com/asset-inventory/docs/listing-assets), [BatchGetAssetsHistory](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/batchGetAssetsHistory.md.txt), [QueryAssets](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/queryAssets.md.txt), [Feed](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/feeds.md.txt), and Search ([SearchAllResources](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/searchAllResources.md.txt), [SearchAllIamPolicies](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/searchAllIamPolicies.md.txt)) APIs. - Fault Injection Testing - `faulttesting.googleapis.com/Experiment` - `faulttesting.googleapis.com/ExperimentTemplate` - `faulttesting.googleapis.com/Validation` - Firebase Storage - `firebasestorage.googleapis.com/Bucket` - `firebasestorage.googleapis.com/DefaultBucket` - Privileged Access Manager - `privilegedaccessmanager.googleapis.com/Entitlement` **Cloud Healthcare API** Feature **General availability:** Redacting burnt-in text in DICOM images using custom regular expressions (`customRegexes` in [`ImageConfig`](https://docs.cloud.google.com/healthcare-api/docs/reference/rest/v1/projects.locations.datasets.fhirStores.md.txt#ImageConfig)) is now generally available (GA) in Cloud Healthcare API `v1`. You can specify custom regular expression patterns (`pattern`) and optional capturing group indexes (`groupIndexes`, a maximum of three for each pattern) in [`projects.locations.datasets.deidentify`](https://docs.cloud.google.com/healthcare-api/docs/reference/rest/v1/projects.locations.datasets/deidentify.md.txt) and [`projects.locations.datasets.dicomStores.deidentify`](https://docs.cloud.google.com/healthcare-api/docs/reference/rest/v1/projects.locations.datasets.dicomStores/deidentify.md.txt) when `textRedactionMode` is set to `REDACT_SENSITIVE_TEXT`. For more information, see [Redacting burnt-in text using custom regular expressions](https://docs.cloud.google.com/healthcare-api/docs/how-tos/dicom-deidentify.md.txt#redacting-burnt-in-text-using-custom-regular-expressions). **Cloud Service Mesh** Announcement In-cluster Cloud Service Mesh 1.28 is no longer supported. For more information and to view the earliest end-of-life dates for other versions, see [Supported versions](https://docs.cloud.google.com/service-mesh/docs/supported-features-in-cluster.md.txt#supported_versions). Announcement **1.31.1-asm.19 is now available for in-cluster Cloud Service Mesh.** For details on upgrading Cloud Service Mesh, see [Upgrade Cloud Service Mesh](https://docs.cloud.google.com/service-mesh/docs/upgrade/upgrade.md.txt). Cloud Service Mesh 1.31.1-asm.19 uses Envoy v1.39.3. This release resolves the security vulnerabilities listed in Security Bulletin [GCP-2026-069](https://cloud.google.com/service-mesh/docs/security-bulletins#gcp-2026-069) ([ISTIO-SECURITY-2026-007](https://istio.io/latest/news/security/istio-security-2026-007/)). Fixed Patch 1.31.1-asm.19 contains the fix for the following platform CVEs: | CVE | Proxy | Control Plane | Distroless | CNI | Severity | |---|---|---|---|---|---| | [GHSA-gcjh-h69q-9w9g](https://github.com/advisories/GHSA-gcjh-h69q-9w9g) | No | Yes | Yes | No | Medium (0.0) | Announcement **1.30.5-asm.11 is now available for in-cluster Cloud Service Mesh.** For details on upgrading Cloud Service Mesh, see [Upgrade Cloud Service Mesh](https://docs.cloud.google.com/service-mesh/docs/upgrade/upgrade.md.txt). Cloud Service Mesh 1.30.5-asm.11 uses Envoy v1.38.7-dev. This release resolves the security vulnerabilities listed in Security Bulletin [GCP-2026-069](https://cloud.google.com/service-mesh/docs/security-bulletins#gcp-2026-069) ([ISTIO-SECURITY-2026-007](https://istio.io/latest/news/security/istio-security-2026-007/)). Announcement **1.29.8-asm.11 is now available for in-cluster Cloud Service Mesh.** For details on upgrading Cloud Service Mesh, see [Upgrade Cloud Service Mesh](https://docs.cloud.google.com/service-mesh/v1.29/docs/upgrade/upgrade.md.txt). Cloud Service Mesh 1.29.8-asm.11 uses Envoy v1.37.9-dev. This release resolves the security vulnerabilities listed in Security Bulletin [GCP-2026-069](https://cloud.google.com/service-mesh/docs/security-bulletins#gcp-2026-069) ([ISTIO-SECURITY-2026-007](https://istio.io/latest/news/security/istio-security-2026-007/)). Announcement **1.28.10-asm.52 is now available for in-cluster Cloud Service Mesh.** For details on upgrading Cloud Service Mesh, see [Upgrade Cloud Service Mesh](https://docs.cloud.google.com/service-mesh/v1.28/docs/upgrade/upgrade.md.txt). Cloud Service Mesh 1.28.10-asm.52 uses Envoy v1.36.10-dev. This release resolves the security vulnerability listed in Security Bulletin [GCP-2026-069](https://cloud.google.com/service-mesh/docs/security-bulletins#gcp-2026-069) ([ISTIO-SECURITY-2026-007](https://istio.io/latest/news/security/istio-security-2026-007/)). Security The following images are now rolling out for managed Cloud Service Mesh: - Sidecar version 1.21.6-asm.93 is rolling out to the rapid release channel. - Sidecar version 1.20.8-asm.143 is rolling out to the regular release channel. - Sidecar version 1.19.10-asm.132 is rolling out to the stable release channel. Managed Cloud Service Mesh will start using proxy version `csm_mesh_proxy.20261014_RC00` for Gateway API on GKE clusters. This proxy version maps closest to Envoy version 1.40. This change is rolling out to all release channels and contains the fix for the managed Cloud Service Mesh security vulnerabilities listed in These patch releases contain the fixes for the vulnerabilities listed in [GCP-2026-069](https://docs.cloud.google.com/service-mesh/docs/security-bulletins.md.txt#gcp-2026-069) as well as fixes for the following platform CVEs: ### Rapid (1.21.6-asm.93) | CVE | Proxy | MDPC | CNI | Cloud Run | Severity | |---|---|---|---|---|---| | [CVE-2026-19931](https://ubuntu.com/security/CVE-2026-19931) | Yes | Yes | - | - | 9.8 | | [CVE-2026-81870](https://ubuntu.com/security/CVE-2026-81870) | Yes | Yes | Yes | Yes | 2.0 | | [CVE-2026-82474](https://ubuntu.com/security/CVE-2026-82474) | Yes | Yes | - | - | 8.5 | | [CVE-2026-84303](https://ubuntu.com/security/CVE-2026-84303) | Yes | Yes | Yes | Yes | 6.3 | | [CVE-2026-84304](https://ubuntu.com/security/CVE-2026-84304) | Yes | Yes | Yes | Yes | 8.7 | | [CVE-2026-84445](https://ubuntu.com/security/CVE-2026-84445) | Yes | Yes | - | Yes | 8.7 | ### Regular (1.20.8-asm.143) | CVE | Proxy | MDPC | CNI | Cloud Run | Severity | |---|---|---|---|---|---| | [CVE-2024-2236](https://ubuntu.com/security/CVE-2024-2236) | Yes | - | - | - | 5.9 | | [CVE-2025-5278](https://ubuntu.com/security/CVE-2025-5278) | Yes | Yes | - | - | 4.4 | | [CVE-2025-6141](https://ubuntu.com/security/CVE-2025-6141) | Yes | Yes | - | - | 4.8 | | [CVE-2026-0799](https://ubuntu.com/security/CVE-2026-0799) | Yes | Yes | - | - | 0.0 | | [CVE-2026-10722](https://ubuntu.com/security/CVE-2026-10722) | - | - | Yes | - | 5.5 | | [CVE-2026-11856](https://ubuntu.com/security/CVE-2026-11856) | Yes | - | - | - | 9.8 | | [CVE-2026-12087](https://ubuntu.com/security/CVE-2026-12087) | Yes | Yes | - | - | 9.1 | | [CVE-2026-13221](https://ubuntu.com/security/CVE-2026-13221) | Yes | Yes | - | - | 9.1 | | [CVE-2026-13595](https://ubuntu.com/security/CVE-2026-13595) | Yes | Yes | Yes | - | 5.3 | | [CVE-2026-13757](https://ubuntu.com/security/CVE-2026-13757) | Yes | Yes | Yes | - | 6.2 | | [CVE-2026-15534](https://ubuntu.com/security/CVE-2026-15534) | Yes | Yes | Yes | - | 5.7 | | [CVE-2026-18924](https://ubuntu.com/security/CVE-2026-18924) | Yes | Yes | - | - | 9.1 | | [CVE-2026-18938](https://ubuntu.com/security/CVE-2026-18938) | Yes | Yes | Yes | - | 6.2 | | [CVE-2026-19487](https://ubuntu.com/security/CVE-2026-19487) | Yes | Yes | Yes | - | 5.3 | | [CVE-2026-19542](https://ubuntu.com/security/CVE-2026-19542) | Yes | Yes | Yes | - | 0.0 | | [CVE-2026-19931](https://ubuntu.com/security/CVE-2026-19931) | Yes | Yes | Yes | - | 9.8 | | [CVE-2026-27456](https://ubuntu.com/security/CVE-2026-27456) | Yes | Yes | Yes | - | 4.7 | | [CVE-2026-42250](https://ubuntu.com/security/CVE-2026-42250) | Yes | Yes | Yes | - | 0.0 | | [CVE-2026-53613](https://ubuntu.com/security/CVE-2026-53613) | Yes | Yes | Yes | - | 0.0 | | [CVE-2026-53615](https://ubuntu.com/security/CVE-2026-53615) | Yes | Yes | Yes | - | 0.0 | | [CVE-2026-53910](https://ubuntu.com/security/CVE-2026-53910) | Yes | Yes | Yes | - | 0.0 | | [CVE-2026-54371](https://ubuntu.com/security/CVE-2026-54371) | Yes | Yes | Yes | - | 8.4 | | [CVE-2026-54874](https://ubuntu.com/security/CVE-2026-54874) | Yes | Yes | Yes | - | 7.5 | | [CVE-2026-57432](https://ubuntu.com/security/CVE-2026-57432) | Yes | Yes | Yes | - | 8.4 | | [CVE-2026-57433](https://ubuntu.com/security/CVE-2026-57433) | Yes | Yes | Yes | - | 9.8 | | [CVE-2026-59843](https://ubuntu.com/security/CVE-2026-59843) | Yes | Yes | Yes | - | 6.5 | | [CVE-2026-59845](https://ubuntu.com/security/CVE-2026-59845) | Yes | Yes | Yes | - | 5.9 | | [CVE-2026-59846](https://ubuntu.com/security/CVE-2026-59846) | Yes | Yes | Yes | - | 3.9 | | [CVE-2026-59847](https://ubuntu.com/security/CVE-2026-59847) | Yes | Yes | Yes | - | 7.5 | | [CVE-2026-59848](https://ubuntu.com/security/CVE-2026-59848) | Yes | Yes | Yes | - | 5.3 | | [CVE-2026-59850](https://ubuntu.com/security/CVE-2026-59850) | Yes | Yes | Yes | - | 7.5 | | [CVE-2026-63072](https://ubuntu.com/security/CVE-2026-63072) | Yes | Yes | - | - | 7.5 | | [CVE-2026-63074](https://ubuntu.com/security/CVE-2026-63074) | Yes | Yes | - | - | 5.9 | | [CVE-2026-63076](https://ubuntu.com/security/CVE-2026-63076) | Yes | Yes | - | - | 7.5 | | [CVE-2026-6368](https://ubuntu.com/security/CVE-2026-6368) | Yes | Yes | - | - | 0.0 | | [CVE-2026-6791](https://ubuntu.com/security/CVE-2026-6791) | Yes | Yes | - | - | 0.0 | | [CVE-2026-75803](https://ubuntu.com/security/CVE-2026-75803) | Yes | Yes | - | - | 9.1 | | [CVE-2026-77117](https://ubuntu.com/security/CVE-2026-77117) | Yes | Yes | - | - | 0.0 | | [CVE-2026-80230](https://ubuntu.com/security/CVE-2026-80230) | Yes | Yes | - | - | 7.5 | | [CVE-2026-80489](https://ubuntu.com/security/CVE-2026-80489) | Yes | Yes | - | - | 0.0 | | [CVE-2026-81870](https://ubuntu.com/security/CVE-2026-81870) | Yes | Yes | - | Yes | 2.0 | | [CVE-2026-82209](https://ubuntu.com/security/CVE-2026-82209) | Yes | Yes | - | - | 8.2 | | [CVE-2026-82474](https://ubuntu.com/security/CVE-2026-82474) | Yes | Yes | - | - | 8.5 | | [CVE-2026-84303](https://ubuntu.com/security/CVE-2026-84303) | Yes | Yes | Yes | Yes | 6.3 | | [CVE-2026-84304](https://ubuntu.com/security/CVE-2026-84304) | Yes | Yes | - | Yes | 8.7 | | [CVE-2026-84445](https://ubuntu.com/security/CVE-2026-84445) | Yes | Yes | - | Yes | 8.7 | | [CVE-2026-8932](https://ubuntu.com/security/CVE-2026-8932) | Yes | Yes | Yes | - | 7.5 | ### Stable (1.19.10-asm.132) | CVE | Proxy | MDPC | CNI | Cloud Run | Severity | |---|---|---|---|---|---| | [CVE-2026-10722](https://ubuntu.com/security/CVE-2026-10722) | - | - | Yes | - | 5.5 | | [CVE-2026-19931](https://ubuntu.com/security/CVE-2026-19931) | Yes | Yes | Yes | - | 9.8 | | [CVE-2026-81870](https://ubuntu.com/security/CVE-2026-81870) | Yes | Yes | Yes | Yes | 2.0 | | [CVE-2026-82474](https://ubuntu.com/security/CVE-2026-82474) | Yes | Yes | Yes | - | 8.5 | | [CVE-2026-84303](https://ubuntu.com/security/CVE-2026-84303) | Yes | Yes | Yes | Yes | 6.3 | | [CVE-2026-84304](https://ubuntu.com/security/CVE-2026-84304) | Yes | Yes | Yes | Yes | 8.7 | | [CVE-2026-84445](https://ubuntu.com/security/CVE-2026-84445) | Yes | Yes | Yes | Yes | 8.7 | **Cloud Tasks** Change Cloud Tasks is available in the following [locations](https://docs.cloud.google.com/tasks/docs/locations.md.txt): - `asia-south2` (Delhi, India) - `northamerica-northeast2` (Toronto, Canada) **Cluster Toolkit** Feature Cluster Toolkit v1.107.0 is available. This release adds the `random_name_suffix` variable to the [`resource-policy` module](https://docs.cloud.google.com/cluster-toolkit/docs/modules/resource-policy.md.txt) so that you can optionally omit the random hexadecimal suffix from the names of resource policies. This release also upgrades Slurm to version 26.05.4 and updates image families to include CUDA 13.2.2 and NVIDIA driver version 595 for H4D, A3 Ultra, A4, and A4X blueprints. Additionally, this release enforces context timeouts to prevent unresponsive commands in the [`gcluster` CLI](https://docs.cloud.google.com/cluster-toolkit/docs/reference/gcluster.md.txt), and pins `kubectl` calls and the dynamic client to the configured `kubeconfig` context for operations on GKE. This update also resolves slice shorthands for Cloud TPU, unifies placement policies across GPU and TPU machine types when you [submit jobs](https://docs.cloud.google.com/cluster-toolkit/docs/reference/gcluster-job-submit.md.txt), and waits for Pods to start before the [`gcluster job logs` command](https://docs.cloud.google.com/cluster-toolkit/docs/reference/gcluster-job-logs.md.txt) fetches logs. For more information, see the [release announcement on GitHub](https://github.com/GoogleCloudPlatform/cluster-toolkit/discussions/6516). **Compute Engine** Feature **Generally available** : To prevent data loss or corruption when you stop or delete a Compute Engine instance, you can enable graceful shutdown. This setting gives the guest OS up to six hours to finish running tasks. For more information, see [About graceful shutdown](https://docs.cloud.google.com/compute/docs/instances/graceful-shutdown-overview.md.txt). **Confidential Space** Announcement A new Confidential Space image (261000) is available. **Container Optimized OS** Change ### cos-129-19506-549-22 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.12.112](https://cos.googlesource.com/third_party/kernel/+/f4481ae514bfb44391addf1ce0dc85a372e5023f) | v27.5.1 | v2.2.7 | [See List](https://storage.googleapis.com/cos-tools/19506.549.22/lakitu/gpu_driver_versions.textproto) | Fixed Added support for loading the pci-pf-stub module. Fixed Fix docker cp failure when copying to/from containers with nested bind mounts. Fixed Upgraded app-editors/vim to v9.2.1152, Upgraded app-editors/vim-core to v9.2.1152. Security Fix CVE-2026-19445 by upgrading to python 3.11.17. Security Fix CVE-2026-82474 on app-admin/sudo Security Fixed CVE-2026-5435 in sys-libs/glibc. Security Fixed CVE-2026-99999 in the Linux kernel. Security Upgraded dev-lang/python to v3.11.16. This fixes CVE-2026-6100. Change ### cos-125-19216-739-16 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.12.112](https://cos.googlesource.com/third_party/kernel/+/d70e5f8042c76c3a2b0c640806692e13ddae3ecf) | v27.5.1 | v2.2.7 | [See List](https://storage.googleapis.com/cos-tools/19216.739.16/lakitu/gpu_driver_versions.textproto) | Fixed Added support for loading the pci-pf-stub module. Fixed Fix docker cp failure when copying to/from containers with nested bind mounts. Fixed Upgraded app-editors/vim to v9.2.1125, Upgraded app-editors/vim-core to v9.2.1125. Security Fix CVE-2026-19445 by upgrading to python 3.11.17. Security Fixed CVE-2026-5435 in sys-libs/glibc. Security Fixed CVE-2026-99999 in the Linux kernel. Change Runtime sysctl changes: - Changed: fs.epoll.max_user_watches: 1808517 -\> 1808562 - Changed: fs.fanotify.max_user_marks: 68412 -\> 68416 - Changed: fs.inotify.max_user_watches: 64189 -\> 64192 - Changed: kernel.threads-max: 63178 -\> 63183 - Changed: net.ipv4.tcp_mem: 94017 125357 188034 -\> 94020 125361 188040 - Changed: net.ipv4.udp_mem: 188034 250715 376068 -\> 188040 250722 376080 - Changed: user.max_cgroup_namespaces: 31589 -\> 31591 - Changed: user.max_fanotify_marks: 68412 -\> 68416 - Changed: user.max_inotify_watches: 64189 -\> 64192 - Changed: user.max_ipc_namespaces: 31589 -\> 31591 - Changed: user.max_mnt_namespaces: 31589 -\> 31591 - Changed: user.max_net_namespaces: 31589 -\> 31591 - Changed: user.max_pid_namespaces: 31589 -\> 31591 - Changed: user.max_time_namespaces: 31589 -\> 31591 - Changed: user.max_user_namespaces: 31589 -\> 31591 - Changed: user.max_uts_namespaces: 31589 -\> 31591
Change ### cos-121-18867-638-13 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.6.158](https://cos.googlesource.com/third_party/kernel/+/3220615da162e0194ca698feb342f7985fdc2709) | v27.5.1 | v2.0.10 | [See List](https://storage.googleapis.com/cos-tools/18867.638.13/lakitu/gpu_driver_versions.textproto) | Fixed Fix docker cp failure when copying to/from containers with nested bind mounts. Fixed Upgraded app-editors/vim to v9.2.1152, Upgraded app-editors/vim-core to v9.2.1152. Security Fixed CVE-2026-5435 in sys-libs/glibc. Security Fixed CVE-2026-82474 in app-admin/sudo. Security Fixed CVE-2026-99999 in the Linux kernel. Security Upgraded dev-lang/python to v3.11.17. This fixes CVE-2026-19445. Change Runtime sysctl changes: - Changed: fs.epoll.max_user_watches: 1809007 -\> 1809051 - Changed: kernel.threads-max: 63199 -\> 63204 - Changed: net.ipv4.tcp_mem: 94041 125391 188082 -\> 94044 125395 188088 - Changed: net.ipv4.udp_mem: 188085 250783 376170 -\> 188091 250790 376182 - Changed: user.max_cgroup_namespaces: 31599 -\> 31602 - Changed: user.max_ipc_namespaces: 31599 -\> 31602 - Changed: user.max_mnt_namespaces: 31599 -\> 31602 - Changed: user.max_net_namespaces: 31599 -\> 31602 - Changed: user.max_pid_namespaces: 31599 -\> 31602 - Changed: user.max_time_namespaces: 31599 -\> 31602 - Changed: user.max_user_namespaces: 31599 -\> 31602 - Changed: user.max_uts_namespaces: 31599 -\> 31602
**Dialogflow** Feature **Dialogflow CX** : You can set the `telephony_disable_voice_processing` session parameter to `true` to turn off speech recognition and accept only DTMF input for the rest of the session. This helps in noisy environments, where speech recognition can transcribe background noise as end-user input. See [Turn off speech recognition for telephony](https://docs.cloud.google.com/dialogflow/cx/docs/concept/parameter.md.txt#session-disable-voice). **Firestore** Feature [Text search](https://docs.cloud.google.com/firestore/native/docs/text-search.md.txt) and [Geospatial search](https://docs.cloud.google.com/firestore/native/docs/geospatial-search) are generally available ([GA](https://cloud.google.com/products#product-launch-stages)). **Firestore with MongoDB compatibility** Feature [Text search](https://docs.cloud.google.com/firestore/mongodb-compatibility/docs/text-query) and [Geospatial search](https://docs.cloud.google.com/firestore/mongodb-compatibility/docs/geo-query.md.txt) are generally available ([GA](https://cloud.google.com/products#product-launch-stages)). **Gemini Enterprise Agent Platform** Feature **Supervised fine-tuning for Gemini 3 models is available in General Availability** [Supervised fine-tuning](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/tuning/supervised-tuning.md.txt) for Gemini 3 models is available in [General Availability (GA)](https://cloud.google.com/products#product-launch-stages). Key updates include the following: - **Gemini 3.5 Flash Lite support** : Supervised fine-tuning is now supported for [Gemini 3.5 Flash Lite](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/gemini/3-5-flash-lite.md.txt) (`gemini-3.5-flash-lite`), in addition to Gemini 3.5 Flash (`gemini-3.5-flash`) and Gemini 3.1 Flash Lite (`gemini-3.1-flash-lite`). - **Supported regions** : Model tuning jobs and tuned model serving for Gemini 3 models are supported on the `us` and `eu` multi-region endpoints. - **Customer-managed encryption keys (CMEK)** : [Customer-managed encryption keys (CMEK)](https://docs.cloud.google.com/gemini-enterprise-agent-platform/machine-learning/general/cmek.md.txt) are supported for protecting tuning job resources and tuned models. For more information, see [About supervised fine-tuning for Gemini models](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/tuning/supervised-tuning.md.txt) and [Tune Gemini models by using supervised fine-tuning](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/tuning/supervised-tuning/use.md.txt). **Google Cloud Armor** Security Security fixes and enhancements to Cloud Armor preconfigured WAF `v33-stable` rulesets. For more information, see [Tuning Google Cloud Armor WAF rules](https://docs.cloud.google.com/armor/docs/rule-tuning). The following rulesets have been updated: - `sqli-v33-stable` - `xss-v33-stable` - `lfi-v33-stable` - `rfi-v33-stable` - `rce-v33-stable` - `methodenforcement-v33-stable` - `scannerdetection-v33-stable` - `protocolattack-v33-stable` - `php-v33-stable` - `sessionfixation-v33-stable` - `java-v33-stable` - `nodejs-v33-stable` Security Security fixes and enhancements to Cloud Armor preconfigured WAF `stable` rulesets for v3.0. For more information, see [Tuning Google Cloud Armor WAF rules](https://docs.cloud.google.com/armor/docs/rule-tuning). The following rulesets have been updated: - `sqli-stable` - `xss-stable` - `lfi-stable` - `rfi-stable` - `rce-stable` - `methodenforcement-stable` - `scannerdetection-stable` - `protocolattack-stable` - `php-stable` - `sessionfixation-stable` **Google Cloud Contact Center as a Service** Announcement **Google Cloud CCaaS 6.22** We've released version 6.22 of Google Cloud CCaaS. The timing of the update to your instance depends on the deployment schedule that you have chosen. For more information, see [Deployment schedules](https://docs.cloud.google.com/contact-center/ccai-platform/docs/deployment-schedules). Feature **Transcript separation for chat** You can now configure Google Cloud CCaaS to deliver a separate transcript file for each participant segment in a chat, instead of one combined transcript per session. Under **Settings \> Chat \> Chat Transcript** , select **Per Segment** in **Transcript Separation** to generate individual transcript files for each agent, virtual agent, or supervisor who joins the chat---helpful for identifying which participant handled each part of a transferred or escalated conversation. Your consumers still receive a single, full-chat transcript regardless of this setting. For more information, see [Chat transcripts and chat history](https://docs.cloud.google.com/contact-center/ccai-platform/docs/chat-transcripts-and-chat-history). By default, this capability is inactive. Contact Google Cloud Support to turn it on for your instance. Feature **Campaign-based scheduled callbacks** Agents can now schedule a callback during an outbound campaign call. The callback belongs to the campaign, not to an individual agent, and the dialer calls the consumer back in the time slot they chose. Administrators set slot length, capacity, booking window, and expiry for each campaign, and supervisors can track upcoming, completed, and expired callbacks from the campaign list. For more information, see [Campaign management](https://docs.cloud.google.com/contact-center/ccai-platform/docs/campaign-management). Fixed This release addresses the following issues: - Fixed an issue where direct access point (DAP) greeting messages played twice when a call was deflected to an internal phone number due to queue overcapacity. - Fixed an issue where session metadata for top-level menu paths and selected menus was incorrectly displayed in English instead of the user's configured language. - Fixed an issue where a failed Salesforce lookup was incorrectly treated as having no matches, which resulted in the creation of duplicate records. - Fixed an issue where inbound transfer restrictions remained in force even after being hidden in the administrator interface, causing queues to become silently unreachable for transfers. - Fixed an issue where hold music continued to play throughout a call recording after a warm transfer was completed. - Fixed an issue where outbound virtual agent audio was prematurely truncated during multi-message turns. - Fixed an issue where the **Real-time Monitoring Queues** report didn't accurately count skill-matched agents for skills-based queues, often displaying zero available agents despite their availability. - Fixed an issue where calls deflected to an external phone number after entering a queue were incorrectly recorded as abandoned by the customer. - Fixed an issue where the credit card tokenizer was missing from the **SmartActions** menu during outbound callback calls. - Fixed an issue where mandatory call dispositions were discarded if an agent's voice connection dropped but their session remained active. - Fixed an issue where the text resize menu in the chat widget wasn't scrollable at 400% browser zoom, which prevented users from accessing all available text size options. - Fixed an issue where the system incorrectly prevented saving automatic call redirection settings when the target was a virtual agent-operated queue. - Fixed an issue where duplicate call records were created for a single inbound call, causing incorrect wait times to appear in the real-time queue view. - Fixed an issue where empty data attributes caused an error in the agent interface during call connections. - Fixed an issue where the **Transfer Restrictions** destination picker provided no feedback when a queue was ineligible, making it indistinguishable from a typo or search error. - Fixed an issue where incoming calls were rejected with a SIP 603 error due to high database latency and connection timeouts. - Fixed an issue where the documentation for the Apps API and call session metadata schema didn't define the top-level `parentId` and `finishReason` fields. - Fixed an issue where certain inbound call failures were incorrectly reported as a busy signal. - Fixed an issue where the event processor service crashed during scaling or rebalancing of the system. - Fixed an issue where the conversation ID was missing from chat events during active sessions. - Fixed an issue where report exports didn't download or remained stuck in a processing state indefinitely. - Fixed an issue where agents could transfer calls to queues that were already closed if their transfer list was loaded while the queue was still open. - Fixed an issue where queued chats were assigned to agents after the end-user had become unresponsive without being prompted to check in. - Fixed an issue where voice calls cold-transferred to an over-capacity queue generated duplicate reporting records and incorrect queue wait times if the callback leg failed. - Fixed an issue where direct inbound calls deflected to voicemail during after-hours played three separate audio prompts sequentially. - Fixed an issue where a single call was simultaneously assigned to two different agents if the pickup coincided with the cascade timer expiry. - Fixed an issue where direct inbound calls weren't projected to agents in a breakthrough-enabled status if another call was already waiting in their queue. - Fixed an issue where a gray empty area appeared below the chat container in the agent adapter when the iframe width was narrower than 449px. - Fixed an issue where several Kubernetes and Google Cloud service accounts were granted overly broad permissions, which could have allowed for unauthorized privilege escalation. - Fixed an issue where an agent's status sequence was recorded in the incorrect order following a brief connection loss during an active chat. - Fixed an issue where selecting a contact during a native campaign call didn't automatically open the corresponding record in the CRM. - Fixed an issue where AI-generated Smart Disposition suggestions were inconsistently displayed for outbound calls during the wrap-up period. - Fixed an issue where call recordings became distorted or garbled when multiple holds were placed during a call. - Fixed an issue where audio uploads were accepted based on the file extension rather than the actual file content, which caused call disconnections when incompatible formats were played. - Fixed an issue where the call duration timer in the external call adapter didn't match the **In-call** status timer in the agent desktop for inbound calls. - Fixed an issue where the sentiment score was incorrectly displayed in the call adapter for calls escalated from a virtual agent, even when the **Sentiment Analysis** setting was disabled. - Fixed an issue where duplicate reporting rows were generated for call and wrap-up durations due to concurrent system events. - Fixed an issue where agents couldn't sign in or refresh their status if their account was linked to a deleted or unknown status. - Fixed an issue where the Manager API documentation for agent activity logs omitted 17 chat routing and activity values, leading to incomplete reporting data for customers. - Fixed an issue where IVR custom callback numbers for certain international regions, including Norway and Denmark, were incorrectly dialed with a +1 prefix. - Fixed an issue where metadata for calls deflected between virtual agent assignment and connection wasn't exported to the Cloud Storage bucket. - Fixed an issue where virtual agent to human chat escalations experienced delays of up to 300 seconds during agent assignment. - Fixed an issue where the **Answer** button didn't appear for dial-by-extension calls when other calls were already waiting in an agent's queue. - Fixed an issue where a supervisor's name didn't appear in the chat widget when joining a conversation using the monitor then barge workflow. - Fixed an issue where ending a chat session in one browser tab didn't automatically close the chat widget in other open tabs. **Google Kubernetes Engine** Feature You can now provision GKE nodes from storage-optimized [Z4M machine series](https://docs.cloud.google.com/compute/docs/storage-optimized-machines.md.txt#z4m_series): - Manually: starting from GKE version 1.36.3-gke.1767000 and later. - Using compute classes, cluster autoscaler, node pool auto-creation and in Autopilot clusters: starting from GKE version 1.37.0-gke.4713000 and later. Z4M machine series are suited for large parallel file systems to support AI/ML workloads and for I/O intensive workloads such as databases. GKE does not support Z4M bare metal instances at this time. See [Machine support with GKE](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/machine-support.md.txt#machine-support). **Security Command Center** Feature You can view issues created by Correlated Threats and security graph rules at the folder or project level. On the **Issues** page, you can filter all issues by service type, project number, and folder ID. For more information, see [Issues overview](https://docs.cloud.google.com/security-command-center/docs/issues-overview.md.txt). This feature is in [Preview](https://cloud.google.com/products#product-launch-stages). **Virtual Private Cloud** Feature **General Availability**: VPC Flow Logs adds the following metadata annotations and packet drop reasons for Cloud NAT: - Metadata annotations: `connection.nat_ip`, `connection.nat_port`, and `nat_gateway_details` - Drop reasons: `NAT_ENDPOINT_INDEPENDENT_CONFLICT`, `NAT_OUT_OF_CONNECTIONS`, and `NAT_OUT_OF_PORTS` For more information, see [Record format](https://docs.cloud.google.com/vpc/docs/about-flow-logs-records.md.txt#record_format) and [Packet drop reasons](https://docs.cloud.google.com/vpc/docs/about-flow-logs-records.md.txt#drop-reason). ## October 18, 2026 **Google SecOps** Feature **Specify whether to reopen closed cases when the grouping is by Source Grouping Identifier** You can now specify whether Google SecOps reopens closed cases when grouping SOAR alerts by **Source Grouping Identifier** . When the option is enabled and a new alert is received with a source grouping identifier of a case that was previously closed in Google SecOps, then Google SecOps reopens the case. For more information, see [Configure alert grouping](https://docs.cloud.google.com/chronicle/docs/soar/investigate/working-with-alerts/alert-grouping-mechanism-admin.md.txt). **Google SecOps SOAR** Announcement Release 6.3.103 is being rolled out to the first phase of regions as listed [here](https://docs.cloud.google.com/chronicle/docs/soar/overview-and-introduction/soar-gradual-release.md.txt). Feature **Specify whether to reopen closed cases when the grouping is by Source Grouping Identifier** You can now specify whether Google SecOps reopens closed cases when grouping alerts by **Source Grouping Identifier** . When the option is enabled and a new alert is received with a source grouping identifier of a case that was previously closed in Google SecOps, then Google SecOps reopens the case. For more information, see [Configure alert grouping](https://docs.cloud.google.com/chronicle/docs/soar/investigate/working-with-alerts/alert-grouping-mechanism-admin.md.txt). Deprecated **Deprecation of the ListCaseEvents API endpoint** Effective October 12, 2026, the ListCaseEvents API endpoint is deprecated. You should use the [ListCaseEvidenceData](https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.cases.caseEvidenceDatas/list.md.txt) API endpoint instead. ## October 17, 2026 **Google SecOps SOAR** Announcement [Release 6.3.102](https://docs.cloud.google.com/chronicle/docs/soar/release-notes.md.txt#October_11_2026) is now available for all regions. ## October 16, 2026 **Access Approval** Feature Service connectivity automation is generally available ([GA](https://cloud.google.com/products#product-launch-stages)). **Access Transparency** Feature Service connectivity automation is generally available ([GA](https://cloud.google.com/products#product-launch-stages)). **BigQuery** Feature [Conversational analytics in BigQuery](https://docs.cloud.google.com/bigquery/docs/conversational-analytics.md.txt) is now available in the following locations: - `northamerica-northeast1` (Montréal) - `northamerica-northeast2` (Toronto) For more information, see [Locations](https://docs.cloud.google.com/bigquery/docs/conversational-analytics.md.txt#locations). **Cloud SQL for PostgreSQL** Change Cloud SQL for PostgreSQL now supports enabling [Managed Connection Pooling](https://docs.cloud.google.com/sql/docs/postgres/managed-connection-pooling.md.txt) on existing [Private Service Connect](https://docs.cloud.google.com/sql/docs/postgres/about-private-service-connect.md.txt) instances. Previously, Cloud SQL supported enabling Managed Connection Pooling only on new instances using Private Service Connect. For more information, see [Managed Connection Pooling overview](https://docs.cloud.google.com/sql/docs/postgres/managed-connection-pooling.md.txt) and [Configure Managed Connection Pooling](https://docs.cloud.google.com/sql/docs/postgres/configure-mcp.md.txt). **Dialogflow** Feature `gemini-3.5-flash-lite` has become generally available (GA). See [Generative quotas](https://docs.cloud.google.com/dialogflow/quotas.md.txt#generative) for how to request quota for Gemini 3 and later models. **Gemini Enterprise** Feature **Gemini Enterprise: Configure citations for custom MCP data stores** You can configure the `citation_mappings` parameter for custom Model Context Protocol (MCP) data stores using the REST API to display source citation chips when Gemini Enterprise answers questions using tools on your custom MCP server. This feature is generally available (GA). For more information, see [Configure citations for custom MCP data stores](https://docs.cloud.google.com/gemini/enterprise/docs/connectors/custom-mcp-server/configure-citations-for-custom-mcp-data-stores). Feature **Gemini Enterprise: Connect workflows in Workflow Builder to Confluence Data Center and Jira Data Center** You can connect workflows in Workflow Builder to Confluence Data Center and Jira Data Center to search data and automate actions across these third-party apps. For more information, see [Workflows overview](https://docs.cloud.google.com/gemini/enterprise/docs/workflow-builder/workflows). **Google Cloud Contact Center as a Service** Announcement **Advanced reporting dashboards prerelease notes 6.16** Here are the pre-release notes for updates to the advanced reporting dashboards and other reporting in CCAI Platform. When we release these updates, we expect the new capabilities to be as shown here. > [!IMPORTANT] > **Important:** The next version of the advanced reporting dashboards could be greater than 6.16. Fixed This release addresses the following issues: - Fixed an issue where the **Agent Performance** tile on the **Real-time Agent Monitoring** dashboard executed redundant database queries during auto-refreshes. - Updated advanced reporting filter prompts so they behave consistently across all dashboards and display the complete list of configured values: - List-backed filters now open directly into a searchable list on the first click. - Dropdowns that previously returned empty or partial lists now display the full configured list, including **Agent Name** , **Agent Email** , **Agent Custom ID** , **Agent Teams** , **Location** , **Language** , **Answered By** , and **Projection Result**. - **Disposition Codes** and **Disposition List** filters now display the codes configured for your instance. - **Agent Teams** and **Team Name** filters now match agents in any of their assigned teams. - Configuration renames (**Queue Group** , **Queue** , **Agent Team** , **Disposition Code** , **Location** , **Role** , and **Skill**) now appear in filter dropdowns within 30 minutes instead of up to six hours. - The **Projecting** filter on the live **Queued** dashboards is now clearable, so you can reset it to show all queued interactions, and offers only **Yes**. - Fields without a predefined list of values (such as consumer phone numbers and ID fields) now display a plain text box with an operator so you can type a value directly. - **Call Status** and **Deflection Type** filters now display values that existed in the data but were previously missing from the list. - **Channel** now reports a value on the live **Voice** and **Chat** dashboards, and on historical **Chat** dashboards, for interaction types that previously appeared blank (including internal, API-initiated, campaign, UCaaS, callback, and extension calls). - On the **Agent Audit** dashboard, the **Change Details** table now displays its timestamp column and sorts it correctly. - Consumer phone number filters now accept a single value instead of multiple values. Saved filters or links that pass multiple numbers apply only one. - On the **Missed Interactions** dashboards, the **Activity Status** column and filter are renamed to **Projection Result**. - Actor values describing who answered, ended, or disconnected an interaction are now standardized as **Human Agent** , **Virtual Agent** , **End User** , and **System**. Saved filters, Looks, and schedules that used the previous wording must be reselected. **Google Kubernetes Engine** Change For GKE Standard CPU node pools, GKE can now upgrade nodes by updating the existing Compute Engine VM in place, instead of deleting the VM and creating a new one. Because the node keeps its underlying VM, it also keeps its compute capacity during the upgrade. This lowers the risk that a node upgrade fails or stalls because resources aren't available. To enable this type of upgrade, use [surge upgrades with the `maxUnavailable` field](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/node-pool-upgrade-strategies.md.txt#max-unavailable) set to a value greater than 0. For more details about when GKE reuses the same Compute Engine instance, including exceptions, see [maxUnavailable: GKE makes an existing node unavailable to recreate it](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/node-pool-upgrade-strategies.md.txt#max-unavailable). This change applies to all GKE versions. To opt out, contact [Cloud Customer Care](https://docs.cloud.google.com/kubernetes-engine/docs/getting-support.md.txt). **Vertex AI Search** Change **Agent Search: Update to the stable model** The `stable` model for answer generation is updated to `gemini-3.5-flash/answer_gen/v1` from `gemini-2.5-flash/answer_gen/v1`. For more information, see [Answer generation model versions and lifecycle](https://docs.cloud.google.com/generative-ai-app-builder/docs/answer-generation-models). ## October 15, 2026 **Apigee Edge for Private Cloud** Announcement Released Apigee Edge for Private Cloud 4.54.00. Designated Apigee Edge for Private Cloud 4.54.00.00 a long-term support (LTS) release: 18 months of full support ending April 2028, then 18 months of maintenance ending October 2029. After October 2029, 4.54.00.00 receives no software updates, security mitigations, or technical support. Installing a later 4.54 minor release or patch does not change those dates. To extend the support lifecycle, upgrade to the next LTS release. For the support lifecycle phases, release cadences, and version numbering, see [Apigee Edge for Private Cloud release and lifecycle policy](https://docs.apigee.com/release/private-cloud-release-lifecycle-policy). Announcement This release replaces Java 8 with Java 17 and Java 21, removes the Classic UI and the `apigee-sso` component, and updates the bundled Cassandra, Postgres, OpenLDAP, ZooKeeper, Qpid Broker-J, Nginx, and Consul versions. These changes are not backward-compatible. For the 4.54.00 versions and the 4.53.01 versions they replace, see [Supported software and supported versions](https://docs.apigee.com/release/supported-software). Before upgrading, read [Changes in Edge for Private Cloud 4.54.00](https://docs.apigee.com/private-cloud/v4.54.00/changes-privatecloud-45400), then [Update Apigee Edge 4.53.00 or 4.53.01 to 4.54.00](https://docs.apigee.com/private-cloud/v4.54.00/update-apigee-edge-4530x-45400) or [New installation overview](https://docs.apigee.com/private-cloud/v4.54.00/installation-overview). For known issues, see [Known issues with Edge for Private Cloud](https://docs.apigee.com/release/known-issues#private-cloud-known-issues). Announcement Replaced the Classic UI (`edge-ui`) with the [New Edge UI](https://docs.apigee.com/private-cloud/v4.54.00/new-edge-ui) (`edge-management-ui`). The New Edge UI is the only management UI in 4.54.00 and is installed by default. Deployments running the Classic UI must transition to it before upgrading. Custom Classic UI properties do not carry over automatically. The default port also changes from `9000` to `3001`, configurable with `conf_uebe_port`, so firewall rules and load balancer target ports that point at `9000` fail until they are updated. For the migration steps and the supported feature list, see [Migrate to the New Edge UI](https://docs.apigee.com/private-cloud/v4.54.00/migrate-ui) and [What features are supported?](https://docs.apigee.com/private-cloud/v4.54.00/new-edge-ui#features). Breaking In deployments with Apigee SSO enabled, an integrated OIDC identity broker in `apigee-openldap` replaces the standalone `apigee-sso` component and Apache Tomcat 9.0.x. Before upgrading, take a complete and validated LDAP backup; existing `apigee-sso` configurations do not migrate automatically. Deployments not using Apigee SSO require no action. For migration prerequisites, validation checks, and rollback constraints, see [Option 2: Upgrade UI (with Apigee SSO)](https://docs.apigee.com/private-cloud/v4.54.00/update-apigee-edge-4530x-45400#upgrade-ui-with-apigee-sso). Breaking 4.54.00 runs Java in mixed mode: Java 17 for Cassandra and ZooKeeper, Java 21 for the Management Server, Message Processor, Router, and Qpid Broker-J. Both Oracle JDK and OpenJDK are supported at those versions. Oracle JDK 8 and OpenJDK 8 are no longer supported. API proxies with custom JavaCallout policies or custom resource JARs can break on Java 21. For details, see [Changes in Edge for Private Cloud 4.54.00](https://docs.apigee.com/private-cloud/v4.54.00/changes-privatecloud-45400). Change Upgraded Nginx on the Edge Router to 1.30.0. If you are upgrading from Nginx 1.20.x, see [Nginx 1.30 changes in Apigee Edge 4.54.00](https://docs.apigee.com/private-cloud/v4.54.00/nginx-45400) for the full list of changes. Change Changed the TLS defaults on Message Processors to the Java 21 cryptographic baseline. Message Processors run on Java 21, which enables TLS 1.3 by default ([JEP 332](https://openjdk.org/jeps/332)) and prefers it for outbound backend connections, falling back to TLS 1.2. No configuration change is required if your target servers and load balancers negotiate TLS 1.3, or negotiate TLS 1.2 with forward-secret (ECDHE) cipher suites. Java 21 also disables the non-forward-secret static RSA key-exchange suites (`TLS_RSA_*`). If you have overridden `conf_http_HTTPTransport.ssl.cipher.suites.whitelist` or `conf_message-processor-communication_local.http.ssl.ciphers` with static RSA suites only, backend calls fail with `no cipher suites in common` and the Router cannot complete a TLS handshake with the Message Processor. Replace the `TLS_RSA_*` entries with modern cipher suites and restart the Message Processor. For the remediation path, see [Legacy backend requirements and remediation](https://docs.apigee.com/private-cloud/v4.54.00/changes-privatecloud-45400#legacy-tls-remediation). Feature Added Basic authentication to the New Edge UI, which lets you sign in without configuring an identity provider. The [New Edge UI](https://docs.apigee.com/private-cloud/v4.54.00/new-edge-ui) supports Basic authentication without additional configuration. You can also configure Apigee SSO, or an external identity provider such as SAML or OIDC. This feature is generally available in 4.54.00. Feature Added automated pre-flight validation checks to `apigee-setup` and `apigee-service`, which surface environment configuration problems before a component is installed. This feature is generally available in 4.54.00. Security Fixed multiple security vulnerabilities in Apigee Edge for Private Cloud 4.54.00. These fixes ship as part of the component upgrades in this release; see [Changes in Edge for Private Cloud 4.54.00](https://docs.apigee.com/private-cloud/v4.54.00/changes-privatecloud-45400). Change Changed the default garbage collector on Message Processors to the Garbage-First garbage collector. Message Processors set `useG1GC=true` and `useStringDeduplication=true` by default in 4.54.00. In 4.53.01 neither was set by default. To configure garbage collection, see [Configure the garbage collector for Message Processors](https://docs.apigee.com/private-cloud/v4.54.00/configuring-gc-message-processors-4.54). **Apigee Edge for Public Cloud** Announcement On October 15, 2026, we began releasing Single Sign-On (SSO) updates for Apigee Edge for Public Cloud. Fixed | Bug ID | Component | Description | |---|---|---| | **560310696** | SSO | Fixed an issue where the Portal SSO endpoint inadvertently accepted deprecated TLS 1.1 connections. The endpoint now strictly enforces TLS 1.2+. | **Apigee Integrated Portal** Announcement On October 15, 2026, we released a new version of the Apigee integrated portal. Fixed | Bug ID | Description | |---|---| | **560310696** | Fixed an issue where the Portal SSO endpoint inadvertently accepted deprecated TLS 1.1 connections. The endpoint now strictly enforces TLS 1.2+. | **Apigee X** Fixed | Bug ID | Description | |---|---| | **466116259** | Updated the startup script for the managed instance group (MIG) that routes external traffic to Apigee. `net.ipv4.ip_forward` is now written to `/etc/sysctl.d/`, so an instance no longer stops forwarding traffic when a reboot or an OS update resets it. The script does not change unrelated `iptables` NAT rules. Instances pick up the change the next time they are restarted or recreated. | **BigQuery** Feature You can [copy tables across regions](https://docs.cloud.google.com/bigquery/docs/managing-tables#copy_tables_across_regions). This feature is now [generally available](https://cloud.google.com/products/#product-launch-stages) (GA). Feature You can now use [reusable column aliases](https://docs.cloud.google.com/bigquery/docs/column-aliases.md.txt) in GoogleSQL. This feature lets you define an alias for an expression in the `SELECT` clause of a SQL query and immediately reference that alias within the same `SELECT` list or in the `WHERE` clause of the same query block. Reusable column aliases also streamline the migration of workloads from other data warehouses such as Snowflake and Teradata, by supporting their syntax. This feature is [generally available](https://cloud.google.com/products#product-launch-stages), and is opt-in only. To use reusable column aliases, you must first [enable the feature](https://docs.cloud.google.com/bigquery/docs/column-aliases#enabling_column_aliases). Feature You can [export a conversational analytics agent's answer](https://docs.cloud.google.com/bigquery/docs/create-conversations.md.txt#export-answer), including text, visualizations, tables, and citations, to a PDF or CSV file. This feature is [generally available](https://cloud.google.com/products#product-launch-stages) (GA). **Cloud Vision** Deprecated **Face detection model update** The emotion label response for face detection (`FACE_DETECTION`) in the Cloud Vision API is deprecated. Effective October 15, 2026, the `joyLikelihood`, `sorrowLikelihood`, `angerLikelihood`, and `surpriseLikelihood` fields in [`FaceAnnotation`](https://docs.cloud.google.com/vision/docs/reference/rest/v1/AnnotateImageResponse.md.txt#FaceAnnotation) return `UNKNOWN` for new projects and projects without recent Face Detection usage. Beginning January 14, 2027, these fields will permanently return `UNKNOWN` for all projects. **Compute Engine** Feature **Preview**: You can create regional disks, including Hyperdisk Balanced High Availability volumes, by cloning a zonal boot disk. For more information, see [Duplicate a disk with clones](https://docs.cloud.google.com/compute/docs/disks/clone-duplicate-disks.md.txt). Change If you try to create an on-demand reservation or increase the number of reserved Compute Engine instances in a reservation when the zone has reached its reservation capacity limit for your requested machine family, then the request fails with a `RESERVATION_CAPACITY_LIMIT_EXCEEDED` error. For more information, see [Reservation capacity limit exceeded](https://docs.cloud.google.com/compute/docs/troubleshooting/troubleshooting-reservation-creation.md.txt#reservation-capacity-limit-exceeded). Feature **Generally available**: The storage-optimized Z4M machine series is generally available for Compute Engine. Powered by fifth generation Intel Emerald Rapids Xeon Scalable processors and Titanium offload processors, Z4M instances are purpose-built for workloads that require larger storage capacity, such as: - Parallel file systems to support AI/ML workloads - I/O intensive workloads such as SQL, NoSQL, and vector databases - AI/ML training and inference workloads such as checkpointing and distributed Key-Value (KV) cache The Z4M machine series delivers up to 1,536 GB of memory and 168,000 GiB of local Titanium SSD capacity. Z4M also supports up to 400 Gbps of network bandwidth using two physical NICs. Z4M instances use Titanium and Cloud RDMA to help enable higher levels of networking performance, isolation, and security. For more information, see [Storage-optimized machine family](https://docs.cloud.google.com/compute/docs/storage-optimized-machines.md.txt#z4m_series). **Dataflow** Feature Dataflow Auto VM Selection now supports 4th generation Compute Engine machine series. When Auto VM Selection is enabled, the service prioritizes these newer generation VMs for improved performance. If 4th generation VMs are unavailable at startup, the service automatically falls back to widely available 2nd generation machine families to ensure that your jobs can start without unnecessary delays. For more information, see [Auto VM Selection](https://docs.cloud.google.com/dataflow/docs/guides/auto-vm-selection.md.txt). **Gemini Enterprise** Feature **Gemini Enterprise: Anthropic models are available in the Gemini Enterprise app** Administrators can make Anthropic models---Claude Opus 5.5 and Claude Sonnet 5.5---available to users in the Gemini Enterprise app. After an administrator turns on a model in the **Enable third-party models** section of the **Feature Management** tab, users can select the model in the model selector. Claude models are available in the `global` location and the `us` and `eu` multi-regions, and are charged on a pay-as-you-go basis. This feature is generally available. For more information, see [Enable third-party models](https://docs.cloud.google.com/gemini/enterprise/docs/manage-web-app-features#enable-third-party-models). **Looker** Announcement The latest versions in the Looker (Google Cloud core) [release channels](https://docs.cloud.google.com/looker/docs/looker-core-release-process.md.txt#release_channels) are beginning deployment as follows: - Latest version in the Rapid channel: **Looker 26.20** - Latest version in the No Channel channel: **Looker 26.20** The latest version in the Regular channel remains **Looker 26.18**. **Note:** This item was added on October 23, 2026. Feature The [Looker 26.18 features](https://docs.cloud.google.com/release-notes.md.txt#October_09_2026) have begun to be enabled for Looker (Google Cloud core) instances. **NetApp Volumes** Announcement Google Cloud NetApp Volumes now supports the Flex Unified service level, including custom performance, in the following region: - europe-west8 (Milan) For more information about available regions, see [Supported regions](https://docs.cloud.google.com/netapp/volumes/docs/discover/service-levels.md.txt#supported_regions). **Security Command Center** Feature To increase the precision of attack path analysis and provide attack exposure scores that help you prioritize confirmed internet exposures, Risk Engine attack path simulations support the `EXTERNALLY_EXPOSED_VM_INSTANCE` [External Exposure finding category](https://docs.cloud.google.com/security-command-center/docs/concepts-vulnerabilities-findings.md.txt#external-exposure-findings) ([Preview](https://cloud.google.com/products/#product-launch-stages)). This finding category identifies Compute Engine or Google Kubernetes Engine (GKE) resources with a direct public IP address that allows host OS access. For more information, see [Detect exposed resources](https://docs.cloud.google.com/security-command-center/docs/detect-external-exposure), [Risk Engine feature support](https://docs.cloud.google.com/security-command-center/docs/attack-exposure-supported-features#external-exposure-aes-support), and [Overview of attack exposure scores and attack paths](https://docs.cloud.google.com/security-command-center/docs/attack-exposure-learn). **Video Intelligence API** Deprecated We are deprecating the emotion label response in the API. Going forward, the API will return `UNKNOWN` for all emotion related labels. ## October 14, 2026 **Anti Money Laundering AI** Announcement New minor engine version released for the commercial line of business within the `v004.011` version line (`aml-commercial.default.v004.011.202610-000`). This version extends support for the major engine version and includes no significant changes compared to the previous minor version. **Apigee hybrid** Announcement ### v1.16.11 On October 14, 2026 we released an updated version of the Apigee hybrid software, v1.16.11. - For information on upgrading, see [Upgrading Apigee hybrid to version v1.16.11](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/upgrade.md.txt). - For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/big-picture.md.txt). > [!NOTE] > **Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images). Fixed #### Fixed in this release | Bug ID | Description | |---|---| | **565072374** | **Fixed an issue where `VerifyJWT` policies using a JWKS `uriRef` could return `steps.jwt.NoMatchingPublicKey` on the first request after the 5-minute JWKS cache TTL expired when the identity provider rotated keys. The cache now refreshes synchronously upon expiration.** | | **556680325** | **Fixed a server-side request forgery (SSRF) vulnerability in URL host validation for the `SemanticCacheLookup` policy.** | | **535395491** | **Extension Processor (`ext_proc`) denials now return the status and body that the policy or FaultRule produced, instead of always returning HTTP `500`.** | | **513032450** | **Fixed an issue where `apigee-connect-agent` control-plane connections could hang for up to 2 hours when silently dropped by a network intermediary by restoring a 15-second TCP keep-alive.** | | **502540992** | **Fixed an issue where the `SemanticCacheLookup` policy was incompatible with Vertex AI Vector Search Private Service Connect (PSC) endpoints by adding gRPC transport support via ``.** | | **492042425** | **Fixed an issue in the `LLMTokenQuota` policy where operation-level token quota values configured on an API product were not applied at runtime, causing product-level quota values to be enforced instead.** | | **449228485** | **Fixed an issue where `podDisruptionBudget` overrides set through Helm had no effect because the `apigee-operator` chart CRDs didn't include the `podDisruptionBudget` field. These overrides now take effect.** | Security | Bug ID | Description | |---|---| | **N/A** | **Security fixes for `apigee-fluent-bit`.** This addresses the following vulnerabilities: - [CVE-2026-35189](https://nvd.nist.gov/vuln/detail/CVE-2026-35189) - [CVE-2026-35191](https://nvd.nist.gov/vuln/detail/CVE-2026-35191) - [CVE-2026-42772](https://nvd.nist.gov/vuln/detail/CVE-2026-42772) - [CVE-2026-5450](https://nvd.nist.gov/vuln/detail/CVE-2026-5450) - [CVE-2026-54872](https://nvd.nist.gov/vuln/detail/CVE-2026-54872) - [CVE-2026-54873](https://nvd.nist.gov/vuln/detail/CVE-2026-54873) - [CVE-2026-54875](https://nvd.nist.gov/vuln/detail/CVE-2026-54875) - [CVE-2026-58050](https://nvd.nist.gov/vuln/detail/CVE-2026-58050) - [CVE-2026-58051](https://nvd.nist.gov/vuln/detail/CVE-2026-58051) - [CVE-2026-5928](https://nvd.nist.gov/vuln/detail/CVE-2026-5928) - [CVE-2026-66032](https://nvd.nist.gov/vuln/detail/CVE-2026-66032) - [CVE-2026-66033](https://nvd.nist.gov/vuln/detail/CVE-2026-66033) - [CVE-2026-66034](https://nvd.nist.gov/vuln/detail/CVE-2026-66034) - [CVE-2026-66035](https://nvd.nist.gov/vuln/detail/CVE-2026-66035) - [CVE-2026-72897](https://nvd.nist.gov/vuln/detail/CVE-2026-72897) - [CVE-2026-75804](https://nvd.nist.gov/vuln/detail/CVE-2026-75804) - [CVE-2026-75805](https://nvd.nist.gov/vuln/detail/CVE-2026-75805) - [CVE-2026-75806](https://nvd.nist.gov/vuln/detail/CVE-2026-75806) - [CVE-2026-77696](https://nvd.nist.gov/vuln/detail/CVE-2026-77696) - [CVE-2026-84782](https://nvd.nist.gov/vuln/detail/CVE-2026-84782) - [CVE-2026-84784](https://nvd.nist.gov/vuln/detail/CVE-2026-84784) | | **N/A** | **Security fixes for `apigee-hybrid-cassandra-client`.** This addresses the following vulnerability: - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) | | **N/A** | **Security fixes for `apigee-kube-rbac-proxy`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) | | **N/A** | **Security fixes for `apigee-mart-server`.** This addresses the following vulnerabilities: - [CVE-2024-6763](https://nvd.nist.gov/vuln/detail/CVE-2024-6763) - [CVE-2025-46392](https://nvd.nist.gov/vuln/detail/CVE-2025-46392) - [CVE-2026-10050](https://nvd.nist.gov/vuln/detail/CVE-2026-10050) - [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) - [CVE-2026-2332](https://nvd.nist.gov/vuln/detail/CVE-2026-2332) - [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) - [CVE-2026-6790](https://nvd.nist.gov/vuln/detail/CVE-2026-6790) - [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) - [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) | | **N/A** | **Security fixes for `apigee-mint-task-scheduler`.** This addresses the following vulnerabilities: - [CVE-2024-6763](https://nvd.nist.gov/vuln/detail/CVE-2024-6763) - [CVE-2025-46392](https://nvd.nist.gov/vuln/detail/CVE-2025-46392) - [CVE-2026-10050](https://nvd.nist.gov/vuln/detail/CVE-2026-10050) - [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) - [CVE-2026-2332](https://nvd.nist.gov/vuln/detail/CVE-2026-2332) - [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) - [CVE-2026-6790](https://nvd.nist.gov/vuln/detail/CVE-2026-6790) - [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) - [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) | | **N/A** | **Security fixes for `apigee-prom-prometheus`.** This addresses the following vulnerabilities: - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) | | **N/A** | **Security fixes for `apigee-prometheus-adapter`.** This addresses the following vulnerability: - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) | | **N/A** | **Security fixes for `apigee-runtime`.** This addresses the following vulnerabilities: - [CVE-2025-46392](https://nvd.nist.gov/vuln/detail/CVE-2025-46392) - [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) - [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) - [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) - [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) | | **N/A** | **Security fixes for `apigee-synchronizer`.** This addresses the following vulnerabilities: - [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) - [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) - [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) - [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) | **Application Integration** Security An Incorrect Authorization vulnerability in the `AuthConfig` validation and integration execution runtime in Application Integration versions prior to August 27, 2026. For more information, see the [GCP-2026-068](https://docs.cloud.google.com/application-integration/docs/security-bulletins.md.txt#gcp-2026-068) security bulletin. **BigQuery** Feature The Apache Hive catalog endpoint in the Lakehouse runtime catalog is now [generally available](https://cloud.google.com/products#product-launch-stages) (GA). This integration lets you use the metastore as a serverless, central metadata layer, enabling seamless data sharing and unified querying across Apache Spark, Apache Hive, and BigQuery. For more information, see [About the Hive catalog endpoint](https://docs.cloud.google.com/lakehouse/docs/about-spark-hive-metastore) and [Set up Spark and Hive with the Lakehouse runtime catalog](https://docs.cloud.google.com/lakehouse/docs/use-spark-hive-metastore). Feature Metadata migration from Dataproc Metastore to Lakehouse is now [generally available](https://cloud.google.com/products#product-launch-stages) (GA). You can perform a one-time backfill migration or dry run to migrate metadata from a Dataproc Metastore service to an Apache Iceberg REST catalog endpoint or a Hive catalog endpoint using the Google Cloud console, the gcloud CLI, or the REST API. For more information, see [Migrate metadata from Dataproc Metastore to Lakehouse](https://docs.cloud.google.com/lakehouse/docs/migrate-dataproc-metastore). Feature Conversational analytics now lets you [create a conversation](https://docs.cloud.google.com/bigquery/docs/create-conversations.md.txt#converse_with_a_data_source_using_the_agents_page) with all of the data sources in multiple projects, or create a conversation with a [dataset](https://docs.cloud.google.com/bigquery/docs/create-conversations.md.txt#datasets). These features are [generally available](https://cloud.google.com/products#product-launch-stages) (GA). Feature You can publish a [BigQuery Conversational Analytics agent in Gemini Enterprise](https://docs.cloud.google.com/bigquery/docs/create-data-agents#publish-agent-gemini-enterprise). This feature is now [generally available](https://cloud.google.com/products/#product-launch-stages) (GA). Feature The [`AI.AGG` function](https://docs.cloud.google.com/bigquery/docs/reference/standard-sql/bigqueryml-syntax-ai-agg.md.txt) now supports the `output_schema` argument, which lets you specify the schema of the function output as a comma-separated list of fields. This feature is [generally available](https://cloud.google.com/products#product-launch-stages) (GA). **Certificate Manager** Change Google-managed public SSL certificates signed by [Google Public CA](https://docs.cloud.google.com/certificate-manager/docs/public-ca) (pki.goog) are gradually transitioning from a 90-day validity period to a 45-day validity period to improve security. To align with modern industry-wide security standards and promote shorter certificate lifespans, Google-managed public certificates now rotate more frequently. This proactive rotation enhances the overall security posture of load balancers. The transition requires no manual intervention or configuration changes as Certificate Manager automatically manages both issuance and renewal. For more information, see [Google-managed certificates](https://docs.cloud.google.com/certificate-manager/docs/core-components#google-managed-certificates) and [Use Google-managed certificates](https://docs.cloud.google.com/certificate-manager/docs/certificate-manager-best-practices#use_google_managed_certificates). **Cloud Load Balancing** Change Google-managed public SSL certificates signed by [Public Certificate Authority](https://docs.cloud.google.com/certificate-manager/docs/public-ca.md.txt) (`pki.goog`) are gradually transitioning from a 90-day validity period to a 45-day validity period to improve security. To align with modern industry-wide security standards and promote shorter certificate lifespans, Google-managed public certificates signed by Public Certificate Authority now rotate more frequently. This proactive rotation enhances the overall security posture of load balancers. Transition requires no manual intervention or configuration changes as Google Cloud automatically manages issuance and renewal for both Certificate Manager and Compute Engine SSL certificates. For more information, see [Renew a Google-managed SSL certificate](https://docs.cloud.google.com/load-balancing/docs/ssl-certificates/google-managed-certs.md.txt#renewal). Feature Service rate limiting policies are now available in **Preview** for regional internal Application Load Balancers and Secure Web Proxies. Service rate limiting policies let you maintain service availability among trusted clients that might consume an inordinate amount of resources. For more information, see the [Service rate limiting overview](https://docs.cloud.google.com/load-balancing/docs/srl-policy/service-rate-limiting-overview.md.txt). **Cloud SQL for MySQL** Issue When you enable the [Knowledge Catalog (formerly Dataplex Universal Catalog)](https://docs.cloud.google.com/sql/docs/mysql/dataplex-catalog-integration.md.txt) integration on a Cloud SQL for MySQL instance created before April 18, 2026, the integration defaults to once a day instead of near real-time. Near real-time updates upon Knowledge Catalog enablement aren't yet available for all existing instances. A new announcement will be published when this feature becomes available. **Cloud SQL for PostgreSQL** Issue When you enable the [Knowledge Catalog (formerly Dataplex Universal Catalog)](https://docs.cloud.google.com/sql/docs/postgres/dataplex-catalog-integration.md.txt) integration on a Cloud SQL for PostgreSQL instance created before April 18, 2026, the integration defaults to once a day instead of near real-time. Near real-time updates upon Knowledge Catalog enablement aren't yet available for all existing instances. A new announcement will be published when this feature becomes available. **Compute Engine** Feature **Generally available** : When you reserve capacity by using future reservation requests, you can specify that Compute Engine delivers your reserved capacity as specifically targeted reservations. Specifically targeted reservations help you track and control which Compute Engine instances consume your reserved capacity. For more information, see [About future reservation requests](https://docs.cloud.google.com/compute/docs/instances/future-reservations-overview.md.txt). Feature **Generally available**: You can increase the size of a Google Cloud Hyperdisk volume that's in multi-writer mode while the volume is attached to multiple instances. Previously, you had to detach the volume from all instances before you could resize it. For more information, see [Share disks between instances](https://docs.cloud.google.com/compute/docs/disks/sharing-disks-between-vms.md.txt) and [Change the size or provisioned performance of a Hyperdisk volume](https://docs.cloud.google.com/compute/docs/disks/modify-hyperdisks.md.txt). **Dataform** Feature You can automatically preserve BigQuery data policies and data governance tags (Preview) applied to tables across Dataform executions by enabling the `preserveGovernanceControls` option in your table or workflow configuration. For more information, see [Preserve access controls metadata](https://docs.cloud.google.com/dataform/docs/create-tables.md.txt#preserve-access-controls). This feature is [generally available](https://cloud.google.com/products#product-launch-stages) (GA). **Gemini Enterprise** Feature **Gemini Enterprise: Gemini 3.8 Flash regional availability in the United Kingdom** Gemini 3.8 Flash is generally available (GA) in the United Kingdom. - **Location availability** : Supported in the UK (`europe-west2`) in-country region with in-region at-rest data residency (DRZ) and machine learning processing (MLP). - **App availability** : Turned on by default in the web app for the UK region. Administrators can manage access with the **Gemini 3.8 Flash** toggle under **Model availability**. For more information, see [Data residency for Gemini Enterprise](https://docs.cloud.google.com/gemini/enterprise/docs/locations). Feature **Gemini Enterprise: Gemini 4 Argon available in Workflow Builder** Gemini 4 Argon is generally available (GA) for Workflow Builder. Gemini 4 Argon is also available in Workflow Builder workflow agents. Updates take up to a day to appear in workflow agents. - **Location availability** : Supported in `global`, `us`, and `eu` multi-regions, with data residency and ML processing support in `us` and `eu`. For more information, see [Data residency for Gemini Enterprise](https://docs.cloud.google.com/gemini/enterprise/docs/locations). - **App availability** : Turned off by default. The toggle defaults to on beginning October 27, 2026. For instructions to turn on the model, see [Manage features on the web app](https://docs.cloud.google.com/gemini/enterprise/docs/manage-web-app-features). For more information, see [Workflow Builder](https://docs.cloud.google.com/gemini/enterprise/docs/workflow-builder). **Gemini Enterprise Agent Platform** Feature **Priority PayGo support for Gemini Nano Banana 2.1** [Priority Pay-as-you-go (PayGo)](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/priority-paygo.md.txt) is available in [General Availability (GA)](https://cloud.google.com/products#product-launch-stages) for [Gemini Nano Banana 2.1](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/gemini/nano-banana-2-1.md.txt) (`gemini-nano-banana-2.1`) on the `global` endpoint. Fixed **CodeMender updates (v0.15.0)** This release introduces updates to CodeMender: - **Enhanced SARIF 2.1.0 reporting** : Updated `cm report` SARIF output with standardized rule descriptors, severity properties, and repository-relative artifact locations for improved GitHub Code Scanning compatibility. - **Model invocation metrics** : Added model invocation tracking to `cm stats --json`, providing total, per-session, and per-turn invocation counts. - **Bug fixes** : - Fixed an issue where token usage from completed turns was omitted from session logs during error or cancellation exit paths. For more information, see the [CodeMender documentation](https://docs.cloud.google.com/gemini-enterprise-agent-platform/codemender). Feature **DeepSeek-V4.1-Flash is available in Public Preview** DeepSeek-V4.1-Flash from DeepSeek is available as a fully managed model (MaaS) in Model Garden. The model accepts text and image input, targets agentic and coding tasks, and supports a context window of up to 1M tokens. For more information, see [DeepSeek-V4.1-Flash](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/maas/deepseek/deepseek-v41-flash.md.txt). **Google Cloud Armor** Feature Cloud Armor supports service rate limiting. For more information, see [Cloud Armor and service rate limiting](https://docs.cloud.google.com/armor/docs/integrating-cloud-armor#service-rate-limiting). This feature is available in Preview. **Google Cloud Managed Service for Apache Kafka** Feature Performance of the [Cloud Storage Sink connector](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/connect-cluster/create-cloud-storage-connector.md.txt) has been improved. The improvements include reduced out-of-memory errors, higher maximum throughput, and avoiding creating a large number of small files. **Google Kubernetes Engine** Change #### (2026-R44) Version updates GKE cluster versions have been updated. **New versions available for upgrades and new clusters.** The following versions are now available for new GKE clusters, and for manual control plane upgrades and node upgrades for existing clusters. For more information about versioning and upgrades, see [GKE versioning and support](https://cloud.google.com/kubernetes-engine/versioning) and [About GKE cluster upgrades](https://cloud.google.com/kubernetes-engine/upgrades). ### Rapid channel > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.37.1-gke.1552000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-1552000) is now the default version for cluster creation in the Rapid channel. - The following versions are now available in the Rapid channel: - [1.34.12-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1209000) - [1.35.8-gke.1975000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1975000) - [1.36.4-gke.2377000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2377000) - [1.37.1-gke.1697000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-1697000) - [Alpha version](https://cloud.google.com/kubernetes-engine/versioning#alpha-versions) 1.38.0-gke.2884000+preview is now available for GKE alpha clusters in the Rapid channel. - The following versions are no longer available in the Rapid channel: - 1.34.12-gke.1011000 - 1.35.8-gke.1796000 - 1.36.4-gke.2046002 - 1.36.4-gke.2202002 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Rapid channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.2304000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Rapid channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.37.0-gke.3503000 - Alpha version 1.38.0-gke.1002000+preview is no longer available in the Rapid channel. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.12-gke.1153000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1153000) - 1.34 to [1.35.8-gke.1919000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1919000) - 1.35 to [1.36.4-gke.2326000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2326000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.12-gke.1153000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1153000) - 1.35 to [1.35.8-gke.1919000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1919000) - 1.36 to [1.36.4-gke.2326000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2326000) - 1.37 to [1.37.1-gke.1552000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-1552000) ### Regular channel > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.36.4-gke.1495002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495002) is now the default version for cluster creation in the Regular channel. - The following versions are now available in the Regular channel: - [1.34.12-gke.1011000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1011000) - [1.35.8-gke.1796000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1796000) - [1.36.4-gke.1495003](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495003) - [1.36.4-gke.2046002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046002) - [1.36.4-gke.2046003](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046003) - The following versions are no longer available in the Regular channel: - 1.34.11-gke.1102000 - 1.35.8-gke.1439001 - 1.36.4-gke.1391002 - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.11-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1209000) - 1.34 to [1.35.8-gke.1626001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1626001) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.11-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1209000) - 1.35 to [1.35.8-gke.1626001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1626001) - 1.36 to [1.36.4-gke.1495003](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495003) ### Stable channel > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - The following versions are now available in the Stable channel: - [1.34.11-gke.1102000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1102000) - [1.35.8-gke.1439001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1439001) - Version 1.34.9-gke.1655001 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Stable channel. This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.11-gke.1056000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1056000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.11-gke.1056000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1056000) ### Extended channel > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.36.4-gke.1495002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495002) is now the default version for cluster creation in the Extended channel. - The following versions are now available in the Extended channel: - [1.31.14-gke.2825000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2825000) - [1.31.14-gke.2963000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2963000) - [1.32.13-gke.2567000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2567000) - [1.32.13-gke.2701000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2701000) - [1.33.13-gke.1815000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1815000) - [1.33.13-gke.1952000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1952000) - [1.34.12-gke.1011000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1011000) - [1.35.8-gke.1796000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1796000) - [1.36.4-gke.1495003](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495003) - [1.36.4-gke.2046002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046002) - [1.36.4-gke.2046003](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046003) - The following versions are no longer available in the Extended channel: - 1.31.14-gke.2704000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.31.14-gke.2925000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.32.13-gke.2427000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.32.13-gke.2662000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.33.13-gke.1647000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.33.13-gke.1915000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.34.11-gke.1102000 - 1.35.8-gke.1439001 - 1.36.4-gke.1391002 - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or deprecated APIs, preventing upgrades: - 1.30 to [1.31.14-gke.2759000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2759000) - 1.31 to [1.32.13-gke.2504000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2504000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or other factors preventing minor version upgrades: - 1.31 to [1.31.14-gke.2759000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2759000) - 1.32 to [1.32.13-gke.2504000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2504000) - 1.33 to [1.33.13-gke.1721000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1721000) - 1.34 to [1.34.11-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1209000) - 1.35 to [1.35.8-gke.1626001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1626001) - 1.36 to [1.36.4-gke.1495003](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495003) ### No channel (deprecated) > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.36.4-gke.1495002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495002) is now the default version for cluster creation. - The following versions are now available: - [1.34.12-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1209000) - [1.35.8-gke.1975000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1975000) - [1.36.4-gke.1495003](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495003) - [1.36.4-gke.2046003](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046003) - [1.36.4-gke.2377000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2377000) - The following node versions are now available: - [1.31.14-gke.2963000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2963000) - [1.32.13-gke.2701000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2701000) - [1.33.13-gke.1952000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1952000) - [1.34.12-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1209000) - [1.35.8-gke.1975000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1975000) - [1.36.4-gke.1495003](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495003) - [1.36.4-gke.2046003](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046003) - [1.36.4-gke.2377000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2377000) - The following versions are no longer available: - 1.34.9-gke.1655001 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.35.8-gke.1225000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.1495000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.2202002 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.2304000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.11-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1209000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.11-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1209000) - 1.36 to [1.36.4-gke.1495002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495002) Security #### (2026-R44) Security updates This release includes new GKE versions that use updated Container-Optimized OS images. These updated images are cumulative, incorporating security fixes from all Container-Optimized OS versions released since the previous GKE release. To identify the specific vulnerabilities that were resolved in each updated Container-Optimized OS image, see the **Security** release notes for that image. The following table includes links to the release notes for each updated Container-Optimized OS image: | GKE version | Container-Optimized OS version | Details | |---|---|---| | 1.31.14-gke.2963000 | cos-121-18867-624-8 | [cos-121-18867-624-8 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m121.md.txt#cos-121-18867-624-8_) | | 1.35.8-gke.1975000 | cos-125-19216-700-23 | [cos-125-19216-700-23 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m125.md.txt#cos-125-19216-700-23_) | | 1.37.1-gke.1697000 | cos-133-19999-44-85 | [cos-133-19999-44-85 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m133.md.txt#cos-133-19999-44-85_) | | 1.38.0-gke.2884000+preview | cos-133-19999-44-85 | [cos-133-19999-44-85 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m133.md.txt#cos-133-19999-44-85_) |
Fixed Fixed an issue in GKE Sandbox where Pods using the Cloud Storage FUSE CSI driver could become indefinitely stuck in a `Terminating` state. To resolve this issue, upgrade your node pools to GKE version 1.37.1-gke.1552000 or later and add the `dev.gvisor.fuse.abort-on-teardown: "true"` annotation to your Pod or Deployment metadata. For more information, see [About Cloud Storage FUSE CSI driver for GKE](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/cloud-storage-fuse-csi-driver.md.txt) and [GKE Known Issues](https://docs.cloud.google.com/kubernetes-engine/docs/troubleshooting/known-issues.md.txt). Change #### (2026-R44) Version updates > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - The following versions are now available in the Stable channel: - [1.34.11-gke.1102000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1102000) - [1.35.8-gke.1439001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1439001) - Version 1.34.9-gke.1655001 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Stable channel. This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.11-gke.1056000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1056000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.11-gke.1056000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1056000) Change #### (2026-R44) Version updates > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.36.4-gke.1495002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495002) is now the default version for cluster creation in the Regular channel. - The following versions are now available in the Regular channel: - [1.34.12-gke.1011000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1011000) - [1.35.8-gke.1796000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1796000) - [1.36.4-gke.1495003](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495003) - [1.36.4-gke.2046002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046002) - [1.36.4-gke.2046003](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046003) - The following versions are no longer available in the Regular channel: - 1.34.11-gke.1102000 - 1.35.8-gke.1439001 - 1.36.4-gke.1391002 - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.11-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1209000) - 1.34 to [1.35.8-gke.1626001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1626001) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.11-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1209000) - 1.35 to [1.35.8-gke.1626001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1626001) - 1.36 to [1.36.4-gke.1495003](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495003) Change #### (2026-R44) Version updates > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.37.1-gke.1552000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-1552000) is now the default version for cluster creation in the Rapid channel. - The following versions are now available in the Rapid channel: - [1.34.12-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1209000) - [1.35.8-gke.1975000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1975000) - [1.36.4-gke.2377000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2377000) - [1.37.1-gke.1697000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-1697000) - [Alpha version](https://cloud.google.com/kubernetes-engine/versioning#alpha-versions) 1.38.0-gke.2884000+preview is now available for GKE alpha clusters in the Rapid channel. - The following versions are no longer available in the Rapid channel: - 1.34.12-gke.1011000 - 1.35.8-gke.1796000 - 1.36.4-gke.2046002 - 1.36.4-gke.2202002 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Rapid channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.2304000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Rapid channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.37.0-gke.3503000 - Alpha version 1.38.0-gke.1002000+preview is no longer available in the Rapid channel. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.12-gke.1153000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1153000) - 1.34 to [1.35.8-gke.1919000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1919000) - 1.35 to [1.36.4-gke.2326000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2326000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.12-gke.1153000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1153000) - 1.35 to [1.35.8-gke.1919000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1919000) - 1.36 to [1.36.4-gke.2326000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2326000) - 1.37 to [1.37.1-gke.1552000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-1552000) Change #### (2026-R44) Version updates > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.36.4-gke.1495002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495002) is now the default version for cluster creation. - The following versions are now available: - [1.34.12-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1209000) - [1.35.8-gke.1975000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1975000) - [1.36.4-gke.1495003](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495003) - [1.36.4-gke.2046003](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046003) - [1.36.4-gke.2377000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2377000) - The following node versions are now available: - [1.31.14-gke.2963000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2963000) - [1.32.13-gke.2701000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2701000) - [1.33.13-gke.1952000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1952000) - [1.34.12-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1209000) - [1.35.8-gke.1975000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1975000) - [1.36.4-gke.1495003](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495003) - [1.36.4-gke.2046003](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046003) - [1.36.4-gke.2377000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2377000) - The following versions are no longer available: - 1.34.9-gke.1655001 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.35.8-gke.1225000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.1495000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.2202002 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.2304000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.11-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1209000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.11-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1209000) - 1.36 to [1.36.4-gke.1495002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495002) Change #### (2026-R44) Version updates > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.36.4-gke.1495002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495002) is now the default version for cluster creation in the Extended channel. - The following versions are now available in the Extended channel: - [1.31.14-gke.2825000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2825000) - [1.31.14-gke.2963000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2963000) - [1.32.13-gke.2567000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2567000) - [1.32.13-gke.2701000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2701000) - [1.33.13-gke.1815000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1815000) - [1.33.13-gke.1952000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1952000) - [1.34.12-gke.1011000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1011000) - [1.35.8-gke.1796000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1796000) - [1.36.4-gke.1495003](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495003) - [1.36.4-gke.2046002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046002) - [1.36.4-gke.2046003](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046003) - The following versions are no longer available in the Extended channel: - 1.31.14-gke.2704000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.31.14-gke.2925000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.32.13-gke.2427000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.32.13-gke.2662000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.33.13-gke.1647000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.33.13-gke.1915000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.34.11-gke.1102000 - 1.35.8-gke.1439001 - 1.36.4-gke.1391002 - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or deprecated APIs, preventing upgrades: - 1.30 to [1.31.14-gke.2759000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2759000) - 1.31 to [1.32.13-gke.2504000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2504000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions) or other factors preventing minor version upgrades: - 1.31 to [1.31.14-gke.2759000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2759000) - 1.32 to [1.32.13-gke.2504000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2504000) - 1.33 to [1.33.13-gke.1721000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1721000) - 1.34 to [1.34.11-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1209000) - 1.35 to [1.35.8-gke.1626001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1626001) - 1.36 to [1.36.4-gke.1495003](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495003) **Google SecOps** Fixed **Email Utilities power-up: Entity creation in Parse Case Wall Email** There was an issue where the **Parse Case Wall Email** action in the Email Utilities power-up didn't create entities when the **Create Observed Entities** parameter was configured for specific entity types. This issue has been fixed in version 54.0 of the Email Utilities power-up. For more information, see [Email Utilities](https://docs.cloud.google.com/chronicle/docs/soar/marketplace/power-ups/email-utilities.md.txt). **Google SecOps Marketplace** Change **SentinelOneV2**: Version 52.0 - Fixed an issue to properly handle merged cases during threat synchronization in the following job: - **SentinelOne V2 - Sync Threats Job** Change **Microsoft Graph Mail Delegated**: Version 26.0 - Updated the **Folder Name** parameter to be optional, allowing searches across the entire mailbox when no folder is specified in the following action: - **Search Emails** - Improved S/MIME processing to support multi-layered encrypted, clear-signed, and opaque-signed messages, and resolved an issue where the **Bypass Signature Verification** parameter didn't bypass verification for malformed or unsupported S/MIME signatures in the following connector: - **Microsoft Graph Mail Delegated Connector** Change **Okta**: Version 18.0 - Fixed a pagination issue to retrieve all available roles and user groups in the following actions: - **List Roles** - **List User Groups** Change **Microsoft Graph Mail**: Version 49.0 - Updated the **Folder Name** parameter to be optional, allowing searches across the entire mailbox when no folder is specified in the following action: - **Search Emails** - Improved S/MIME processing to support multi-layered encrypted, clear-signed, and opaque-signed messages, and resolved an issue where the **Bypass Signature Verification** parameter didn't bypass verification for malformed or unsupported S/MIME signatures in the following connector: - **Microsoft Graph Mail Connector** Change **Splunk**: Version 68.0 - Added the **Alert Start Time Field** parameter to specify a custom field for determining the alert start time in the following connector: - **Splunk Query Connector** Change **Google Chronicle**: Version 98.0 - Added the **Use Cache** and **Cache TTL** parameters to enable caching of data table responses in the following actions: - **Get Data Tables** - **Is Value In Data Table** - **Is Value In Data Table Async** - Fixed an issue where environment extraction only checked the first event in multi-event alerts in the following connector: - **Chronicle Alerts Connector** Change **Email Utilities**: Version 17.0 - Resolved an issue causing entities to not be created when **Create Observed Entities** was configured for specific entity types in the following action: - **Parse Case Wall Email** Change **Google Threat Intelligence**: Version 21.0 - Improved issue ingestion to adaptively scan the configured **Max Hours Backwards** time range and skip periods without new issues in the following connector: - **Google Threat Intelligence - ASM Issues Connector** - Added the **Anonymize Credential** parameter to optionally mask compromised passwords with asterisks in ingested alerts and events in the following connector: - **Google Threat Intelligence - DTM Alerts Connector** **Managed Service for Apache Airflow** Announcement All Managed Airflow environment's GKE clusters will be set up with maintenance exclusions from November 16, 2026 to December 2, 2026. For more information, see [Maintenance exclusions](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#exclusions). **NetApp Volumes** Feature Google Cloud NetApp Volumes now lets you test Active Directory policy connections for the Flex Unified service level in [Preview](https://cloud.google.com/products#product-launch-stages). You can use the Google Cloud console to verify that a policy is properly connected to the Active Directory service and troubleshoot configuration errors. For more information, see [Test the Active Directory policy connection](https://docs.cloud.google.com/netapp/volumes/docs/configure-and-use/active-directory/test-ad-policy-connection.md.txt). **Secure Web Proxy** Feature Secure Web Proxy supports [service rate limiting policies](https://docs.cloud.google.com/secure-web-proxy/docs/policies-and-rules-overview#rate-limiting-policies). Use these policies to protect external destinations from traffic overloads and manage the costs of your outbound web traffic. You can attach a service rate limiting policy to your Secure Web Proxy gateways, whether they use an [authorization policy](https://docs.cloud.google.com/secure-web-proxy/docs/policies-and-rules-overview#authorization-policies) or a [gateway security policy](https://docs.cloud.google.com/secure-web-proxy/docs/create-a-policy#gateway-security-policies). For more information, see [Configure service rate limiting policies](https://docs.cloud.google.com/secure-web-proxy/docs/configure-service-rate-limiting-policies). This feature is available in [Preview](https://cloud.google.com/products#product-launch-stages). **VPC Service Controls** Feature **VPC Service Controls feature (Status: [Preview](https://cloud.google.com/products#product-launch-stages))**: Support for using Workload Identity Federation for GKE in ingress and egress rules to allow access to resources protected by a service perimeter is available in Preview. You can specify the following Workload Identity Federation for GKE principals in ingress and egress rules: - All GKE Pods that use a Kubernetes service account (by service account name or ID) - All GKE Pods in a Kubernetes namespace - All GKE Pods in a cluster For more information, see [Configure identity groups and third-party identities in ingress and egress rules](https://docs.cloud.google.com/vpc-service-controls/docs/configure-identity-groups) and [Supported identities for ingress and egress rules](https://docs.cloud.google.com/vpc-service-controls/docs/supported-identities). ## October 13, 2026 **Agent Platform Workbench** Change ### 20261013-2230-rc0 Release Change ### 20261013-2230-rc0 Release Change Installed latest packages from upstream dependencies. Change Installed latest packages from upstream dependencies. **Application Design Center** Feature You can import existing multi-product Google Cloud Terraform configurations into an Application Design Center application template as is, without splitting them into components or publishing them to a catalog first. From a template revision, you can create, assess, and deploy applications directly, or publish the revision to your catalog to reuse it in other templates ([Preview](https://cloud.google.com/products#product-launch-stages)). For more information, see [Import existing Terraform](https://docs.cloud.google.com/application-design-center/docs/import-terraform.md.txt). **BigQuery** Feature The [`AI.AGG` function](https://docs.cloud.google.com/bigquery/docs/reference/standard-sql/bigqueryml-syntax-ai-agg.md.txt) is [generally available](https://cloud.google.com/products#product-launch-stages) (GA). You can use this function to semantically aggregate unstructured input data based on natural language instructions. Feature BigQuery [generative AI functions](https://docs.cloud.google.com/bigquery/docs/generative-ai-overview.md.txt#locations) now support the `gemini-4-argon` model. This model is [generally available](https://cloud.google.com/products#product-launch-stages). **Cloud Asset Inventory** Feature The following resource types are publicly available through the [ExportAssets](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/exportAssets.md.txt), [ListAssets](https://docs.cloud.google.com/asset-inventory/docs/listing-assets), [BatchGetAssetsHistory](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/batchGetAssetsHistory.md.txt), [QueryAssets](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/queryAssets.md.txt), [Feed](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/feeds.md.txt), and Search ([SearchAllResources](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/searchAllResources.md.txt), [SearchAllIamPolicies](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/searchAllIamPolicies.md.txt)) APIs. - Cloud Service Mesh: `networkservices.googleapis.com/AgentGateway` **Cloud Billing** Feature **Spend cap budgets are now generally available for a limited set of services** For [eligible services](https://docs.cloud.google.com/billing/docs/how-to/budgets-spend-caps.md.txt#eligible-services), you can configure a **spend cap budget** to automatically pause usage when your estimated spend exceeds the budget amount you set. You can manage spend cap budgets in the [Budgets page in the Google Cloud console](https://docs.cloud.google.com/billing/docs/how-to/budgets-spend-caps.md.txt) and using the [Cloud Billing Budget API](https://docs.cloud.google.com/billing/docs/how-to/budget-api-spend-cap.md.txt). Spend caps are a cost control mechanism. A spend cap is enforced when usage costs exceed your budget target amount. When enforced, any new request to the eligible services, within the specified project, are paused and no further usage costs are accrued until the spend cap is lifted. You can manually lift an enforced spend cap, or wait until the start of the next month when the spend cap is automatically lifted. Spend caps use *gross, estimated costs* to trigger the alerts and caps, enforcing a cap much faster than the *actual costs* are processed and appear on billing reports. Even though faster than reports, the enforcement of spend caps isn't instant and any cost overages are billed as normal. **More information about spend cap budgets** For managing spend cap budgets in the Google Cloud console, see: - [How spend cap budgets work to help you control spend](https://docs.cloud.google.com/billing/docs/how-to/budgets-spend-caps.md.txt#how-spend-cap-budgets-work) - [Limitations of spend cap budgets](https://docs.cloud.google.com/billing/docs/how-to/budgets-spend-caps.md.txt#limitations) - [Configure a spend cap budget](https://docs.cloud.google.com/billing/docs/how-to/budgets-spend-caps.md.txt#configure-spend-cap) - [Lift an enforced spend cap](https://docs.cloud.google.com/billing/docs/how-to/budgets-spend-caps.md.txt#lift-spend-cap) For managing spend cap budgets using the Cloud Billing Budget API, see: - [Using the Cloud Billing Budget API for spend cap budgets](https://docs.cloud.google.com/billing/docs/how-to/budget-api-spend-cap.md.txt) - [Spend cap budget concepts and limitations](https://docs.cloud.google.com/billing/docs/how-to/budget-api-spend-cap.md.txt#concepts-limitations) - [Create a spend cap budget](https://docs.cloud.google.com/billing/docs/how-to/budget-api-spend-cap.md.txt#create) - [Lift an enforced spend cap](https://docs.cloud.google.com/billing/docs/how-to/budget-api-spend-cap.md.txt#lift) - [Cloud Billing Budget API REST reference](https://docs.cloud.google.com/billing/docs/reference/budget/rest/v1/billingAccounts.budgets.md.txt) **Cloud SQL for MySQL** Feature [Private Service Connect](https://docs.cloud.google.com/sql/docs/mysql/about-private-service-connect.md.txt) is now the default private IP connectivity option when you create a Cloud SQL for MySQL instance in a new Google Cloud project. Private Service Connect lets you connect to your instance from multiple Virtual Private Cloud (VPC) networks across different groups, projects, or organizations, and supports automatic endpoint and DNS record provisioning. When you configure private IP for an instance, you can still choose to use private services access or both connectivity options. For more information, see [Private IP configuration options](https://docs.cloud.google.com/sql/docs/mysql/private-ip.md.txt) and [Configure Private Service Connect](https://docs.cloud.google.com/sql/docs/mysql/configure-private-service-connect.md.txt). **Cloud SQL for PostgreSQL** Feature [Private Service Connect](https://docs.cloud.google.com/sql/docs/postgres/about-private-service-connect.md.txt) is now the default private IP connectivity option when you create a Cloud SQL for PostgreSQL instance in a new Google Cloud project. Private Service Connect lets you connect to your instance from multiple Virtual Private Cloud (VPC) networks across different groups, projects, or organizations, and supports automatic endpoint and DNS record provisioning. When you configure private IP for an instance, you can still choose to use private services access or both connectivity options. For more information, see [Private IP configuration options](https://docs.cloud.google.com/sql/docs/postgres/private-ip.md.txt) and [Configure Private Service Connect](https://docs.cloud.google.com/sql/docs/postgres/configure-private-service-connect.md.txt). **Cloud SQL for SQL Server** Feature [Private Service Connect](https://docs.cloud.google.com/sql/docs/sqlserver/about-private-service-connect.md.txt) is now the default private IP connectivity option when you create a Cloud SQL for SQL Server instance in a new Google Cloud project. Private Service Connect lets you connect to your instance from multiple Virtual Private Cloud (VPC) networks across different groups, projects, or organizations, and supports automatic endpoint and DNS record provisioning. When you configure private IP for an instance, you can still choose to use private services access or both connectivity options. For more information, see [Private IP configuration options](https://docs.cloud.google.com/sql/docs/sqlserver/private-ip.md.txt) and [Configure Private Service Connect](https://docs.cloud.google.com/sql/docs/sqlserver/configure-private-service-connect.md.txt). **Cloud Storage** Feature Object enrichments is now available in [Preview](https://cloud.google.com/products#product-launch-stages). When you configure object enrichments, Cloud Storage applies Google's pre-trained machine learning models to eligible images and PDF documents in your buckets and attaches the resulting metadata to your objects as [object contexts](https://docs.cloud.google.com/storage/docs/object-contexts.md.txt). You can inspect enrichments on individual objects or query them at scale in BigQuery by using [Storage Insights datasets](https://docs.cloud.google.com/storage/docs/insights/dataset-tables-and-schemas.md.txt#object-contexts-catalog-schema). For more information, see [About object enrichments](https://docs.cloud.google.com/storage/docs/object-enrichments/overview.md.txt) and [Configure object enrichments](https://docs.cloud.google.com/storage/docs/object-enrichments/configure-object-enrichments.md.txt). Feature Object contexts with [extended data](https://docs.cloud.google.com/storage/docs/object-contexts.md.txt#extended-data) are available in [Preview](https://cloud.google.com/products#product-launch-stages). Google services attach these contexts to your objects during automated analysis, such as machine learning labeling. To retrieve a context and its extended data, use the [`viewFullContext`](https://docs.cloud.google.com/storage/docs/json_api/v1/objects/viewFullContext.md.txt) JSON API method. Feature Storage Insights datasets include the Object Contexts Catalog view (`object_contexts_catalog_view`), which you can use to analyze object contexts in BigQuery. For more information, see [Object contexts catalog](https://docs.cloud.google.com/storage/docs/insights/dataset-tables-and-schemas.md.txt#object-contexts-catalog-schema) and [Analyze object contexts](https://docs.cloud.google.com/storage/docs/insights/configure-datasets.md.txt#analyze-object-contexts). **Cluster Toolkit** Feature Cluster Toolkit v1.106.0 is available. This release adds support for flexible managed instance groups on [static compute nodes](https://docs.cloud.google.com/cluster-toolkit/docs/slurm/manage-static-nodes), multiple network interfaces (multi-NIC) for Google Cloud Managed Lustre instances, and parallelism controls for Terraform to accelerate cluster deployment and teardown. This release also introduces the `cloud-build` community module to build container images with Cloud Build. Additionally, this release adds preflight checks for storage profiles when you [submit jobs](https://docs.cloud.google.com/cluster-toolkit/docs/reference/gcluster-job-submit.md.txt) and cleans up gateways when you [cancel jobs](https://docs.cloud.google.com/cluster-toolkit/docs/reference/gcluster-job-cancel.md.txt). This update also scopes the `--main-only` flag in the [`gcluster job logs` command](https://docs.cloud.google.com/cluster-toolkit/docs/reference/gcluster-job-logs.md.txt) to the main Pod and its default container. For more information, see the [release announcement on GitHub](https://github.com/GoogleCloudPlatform/cluster-toolkit/discussions/6467). **Compute Engine** Feature **Generally available** : You can query regional views of global Compute Engine project and OS image resources by using the regional read-only `projectViews` and `imageViews` endpoints. Querying regional views isolates your control-plane read requests to a specific region, helping your workloads stay available during global API disruptions. For more information, see [Use regional views for resilient control-plane reads](https://docs.cloud.google.com/compute/docs/architecture/regional-views-global-resources) and [Access global resources regionally for high availability](https://docs.cloud.google.com/compute/docs/architecture/access-global-resources-regionally). **Config Connector** Announcement Config Connector version 1.159.0 is now available. Feature New Alpha Resources (Direct Reconciler): - `AIPlatformReasoningEngine` - Manage [Gemini Enterprise Agent Platform reasoning engines](https://docs.cloud.google.com/gemini-enterprise-agent-platform/reference/rest/v1/projects.locations.reasoningEngines.md.txt) to deploy and run customized reasoning applications. - `CloudDeployCustomTargetType` - Manage [Cloud Deploy custom target types](https://docs.cloud.google.com/deploy/docs/api/reference/rest/v1/projects.locations.customTargetTypes.md.txt) to define custom deployment targets and rendering actions. - `EventarcPipeline` - Manage [Eventarc pipelines](https://docs.cloud.google.com/eventarc/docs/reference/rest/v1/projects.locations.pipelines.md.txt) to transform and route events across Google Cloud services. - `LiveStreamChannel` - Manage [Live Stream channels](https://docs.cloud.google.com/livestream/docs/reference/rest/v1/projects.locations.channels.md.txt) to ingest, encode, and distribute live video streams. - `LiveStreamInput` - Manage [Live Stream inputs](https://docs.cloud.google.com/livestream/docs/reference/rest/v1/projects.locations.inputs.md.txt) to configure video ingestion endpoints. - `MapManagementStyleConfig` - Manage [Map Management API style configurations](https://developers.google.com/maps/documentation/mapmanagement/reference/rest/v2/projects.styleConfigs) to define custom map styles. - `NetworkSecurityDNSThreatDetector` - Manage [Network Security DNS threat detectors](https://docs.cloud.google.com/dns/docs/reference/dns-armor/rest/v1/projects.locations.dnsThreatDetectors.md.txt) to monitor and mitigate DNS-based threats. Feature New Fields: - [`ArtifactRegistryRepository`](https://cloud.google.com/config-connector/docs/reference/resource-docs/artifactregistry/artifactregistryrepository) - Added support for `spec.remoteRepositoryConfig.commonRepository`. - [`ComposerEnvironment`](https://cloud.google.com/config-connector/docs/reference/resource-docs/composer/composerenvironment) - Added support for updating `spec.config.workloadsConfig.dagProcessor` in Cloud Composer 3 environments. - [`ContainerCluster`](https://cloud.google.com/config-connector/docs/reference/resource-docs/container/containercluster) - Added support for `spec.privilegedAdmissionConfig` to configure privileged admission in Autopilot clusters. - [`SQLInstance`](https://cloud.google.com/config-connector/docs/reference/resource-docs/sql/sqlinstance) - Added support for disaster recovery observed state fields under `status.observedState.replicationCluster` (`failoverDRReplicaName`, `drReplica`, `psaWriteEndpoint`) and `status.observedState.masterInstanceName`. Feature New Features: - Added support for Cloud SQL Enterprise Plus edition disaster recovery (DR) pair setup and drift suppression for `SQLInstance` by using the `cnrm.cloud.google.com/sqlinstance-advanced-dr: "enabled"` annotation. - Manager Pods now restart automatically when `resourceSettings` changes in the operator configuration. - Added [a guide for managing Config Connector by using GitOps tools](https://github.com/GoogleCloudPlatform/k8s-config-connector/blob/master/docs/guides/gitops-argocd.md) (such as Argo CD). Fixed Bug Fixes: - [`BigQueryDataset`](https://cloud.google.com/config-connector/docs/reference/resource-docs/bigquery/bigquerydataset) ([#13352](https://github.com/GoogleCloudPlatform/k8s-config-connector/pull/13352)) - Fixed false-positive diffs for access entries and avoided redundant `PATCH` requests when the resource is already up to date. - [`ComputeRouterNAT`](https://cloud.google.com/config-connector/docs/reference/resource-docs/compute/computerouternat) ([#13472](https://github.com/GoogleCloudPlatform/k8s-config-connector/pull/13472)) - Fixed false drift and steady-state reconciliation issues during direct controller takeover. - [`MonitoringDashboard`](https://cloud.google.com/config-connector/docs/reference/resource-docs/monitoring/monitoringdashboard) ([#13574](https://github.com/GoogleCloudPlatform/k8s-config-connector/pull/13574)) - Fixed reconciliation errors caused by unrecognized enum values by migrating the direct controller to the Google REST client. **Dataform** Feature You can use Developer Connect to [connect Dataform repositories to Secure Source Manager repositories](https://docs.cloud.google.com/dataform/docs/connect-repository.md.txt#dev-connect). This feature is in [Preview](https://cloud.google.com/products#product-launch-stages). **Gemini** Other ### Bug fixes in IntelliJ Various bug fixes and minor product enhancements. **Gemini Enterprise** Feature **Gemini Enterprise: Gemini 4 Argon available in web app, mobile app, and AI developer tools** Gemini 4 Argon is generally available (GA) for the Gemini Enterprise web app, mobile app, and AI developer tools. - **Location availability** : Supported in `global`, `us`, and `eu` multi-regions, with data residency and ML processing support in `us` and `eu`. For more information, see [Data residency for Gemini Enterprise](https://docs.cloud.google.com/gemini/enterprise/docs/locations). - **App availability** : Turned off by default. The toggle defaults to on beginning October 27, 2026. Gemini 4 Argon is supported in the web app and mobile app. For more information about turning on the model, see [Manage features on the web app](https://docs.cloud.google.com/gemini/enterprise/docs/manage-web-app-features). - **AI developer tools** : Enabled by default for licensed users when **Antigravity authorized models** uses the default selection. If your organization specifies a custom model list, an administrator must manually select Gemini 4 Argon. For more information, see [Configure AI developer tools settings](https://docs.cloud.google.com/gemini/enterprise/docs/ai-developer-tools-settings). Feature **Gemini Enterprise: Connect workflows in Workflow Builder to Microsoft Teams, Notion, and Salesforce** You can connect workflows in Workflow Builder to Microsoft Teams, Notion, and Salesforce to search data and automate actions across these third-party apps. For more information, see [Workflows overview](https://docs.cloud.google.com/gemini/enterprise/docs/workflow-builder/workflows). Feature **Gemini Enterprise: Gemini 4 Argon is available in AlphaEvolve** AlphaEvolve experiments can generate candidate programs with Gemini 4 Argon in the `global`, `us`, and `eu` regions. To use it, specify `gemini-4-argon` in the `models` field of `generationSettings`. Gemini 3.8 Flash remains the default model. For more information, see [Supported models](https://docs.cloud.google.com/gemini/enterprise/docs/alphaevolve/reference-guide/api-reference#supported-models) and [AlphaEvolve limitations](https://docs.cloud.google.com/gemini/enterprise/docs/locations#alphaevolve-limitations). **Gemini Enterprise Agent Platform** Feature **Gemini 4 Argon in CodeMender (Preview)** CodeMender now supports Gemini 4 Argon. To use it, pass `--model gemini-4-argon` to `cm find`, `cm verify`, or `cm fix`. Gemini 3.8 Flash remains the default model. For more information, see [Specifying the model](https://docs.cloud.google.com/gemini-enterprise-agent-platform/agents/codemender.md.txt#specifying-the-model). Feature **Gemini 4 Argon and Gemini 4 Argon Cyber Permissive** [Gemini 4 Argon](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/gemini/4-argon.md.txt) (`gemini-4-argon`) is available in [General Availability (GA)](https://cloud.google.com/products#product-launch-stages). Gemini 4 Argon is Google's frontier model that excels at deep work in complex, real-world tasks across domains including coding, finance, legal, cybersecurity, and science. It supports a unified 1,048,576-token input and output limit, configurable thinking levels (`LOW`, `MEDIUM`, `HIGH`), [long decodes](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/guides/gemini-4-argon.md.txt#long-decodes) up to 1,048,576 tokens using continuation tokens on the `GenerateContent` API, and [agentic video understanding](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/capabilities/video-understanding.md.txt#agentic-video-processing) in GA. [Gemini 4 Argon Cyber Permissive](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/gemini/4-argon.md.txt#cyber) (`gemini-4-argon-cyber-permissive`), a version of Gemini 4 Argon for defensive cybersecurity use cases, is also available in GA behind the [Fairwind Program](https://deepmind.google/fairwind-program/) allowlist. - **Known issue (long decodes)** : Long decoding (`continuation_token`) on the `GenerateContent` API (`generateContent` and `streamGenerateContent`) is supported only in the `v1beta1` API (not `v1`). The Google Gen AI SDK uses `v1beta1` by default unless `api_version='v1'` is specified in `http_options`; for direct REST calls, use the `v1beta1` endpoint path. For more information, see [Get started with Gemini 4](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/start/get-started-with-gemini-4.md.txt) and the [developer's guide to Gemini 4 Argon](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/guides/gemini-4-argon.md.txt). **Google Distributed Cloud (software only) for VMware** Announcement Google Distributed Cloud (software only) for VMware 1.35.600-gke.141 is now available for download. To upgrade, see [Upgrade clusters](https://docs.cloud.google.com/kubernetes-engine/distributed-cloud/vmware/docs/how-to/upgrading.md.txt). Google Distributed Cloud 1.35.600-gke.141 runs on Kubernetes v1.35.8-gke.100. If you use a third-party storage vendor, check the listing of our previously-qualified [storage partners](https://docs.cloud.google.com/kubernetes-engine/enterprise/docs/resources/partner-storage.md.txt). After a release, it takes approximately 7 to 14 days for the version to become available for use with GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform. Fixed The following issues were fixed in 1.35.600-gke.141: - Fixed vulnerabilities listed in [Vulnerability fixes](https://docs.cloud.google.com/kubernetes-engine/distributed-cloud/vmware/docs/vulnerabilities.md.txt). **Google Distributed Cloud (software only) for bare metal** Announcement Google Distributed Cloud (software only) for bare metal 1.35.600-gke.141 is now available for download. To upgrade, see [Upgrade clusters](https://docs.cloud.google.com/release-notes/how-to/upgrade). Google Distributed Cloud for bare metal 1.35.600-gke.141 runs on Kubernetes v1.35.8-gke.100. After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform. If you use a third-party storage vendor, check the listing of our previously-qualified [storage partners](https://docs.cloud.google.com/kubernetes-engine/enterprise/docs/resources/partner-storage.md.txt). Fixed The following issues were fixed in 1.35.600-gke.141: - Fixed vulnerabilities listed in [Vulnerability fixes](https://docs.cloud.google.com/kubernetes-engine/distributed-cloud/bare-metal/docs/vulnerabilities.md.txt). **Managed Service for Apache Airflow** Feature [Development mode environments](https://docs.cloud.google.com/composer/docs/composer-3/create-environments.md.txt#development-mode) and [Environment hibernation](https://docs.cloud.google.com/composer/docs/composer-3/hibernate-environments.md.txt) are now generally available (GA). You can now create Managed Airflow (Gen 3) environments with Airflow 3 in development mode to test and develop DAGs before publishing them to production. You can hibernate development mode environments when you no longer need them. Hibernation reduces most environment costs to zero. Feature [Upgrade rollbacks](https://docs.cloud.google.com/composer/docs/composer-3/upgrade-environments.md.txt#rollback) are available in Managed Airflow (Gen 3). You can roll back an environment upgrade if you encounter degraded performance, Airflow bugs, or compatibility issues with your DAGs, plugins, or dependencies. This feature is gradually rolling out over several releases. In this release, it's available in the following regions: europe-north1, europe-west3, us-east1, and us-west2. Feature New Managed Airflow (Gen 3) environments created while the Restrict Endpoint Usage (`constraints/gcp.restrictEndpointUsage`) organization policy is active now use regional endpoints for services like Cloud Storage, Cloud Logging, Pub/Sub, and Data Lineage. Feature *(Managed Airflow Gen 3)* Added the scheduler loop duration metric: - `composer.googleapis.com/workload/scheduler/loop_duration`: time spent running one Scheduler loop. Feature [Database retention](https://docs.cloud.google.com/composer/docs/composer-3/configure-db-retention.md.txt) in Managed Airflow (Gen 3) now includes new Airflow 3 metadata tables, and updated retention logs to report the exact number of removed rows. This feature is gradually rolling out over several releases. In this release, it's available in the following regions: europe-north1, europe-west3, us-east1, and us-west2. Fixed Managed Airflow (Gen 3) environments now report Airflow workloads startup failure logs for issues such as internal quota limits, insufficient capacity, or internal errors (excluding failures related to KubernetesPodOperator or KubernetesExecutor). This fix is available without an upgrade and will gradually roll out to all Managed Airflow Gen 3 environments. You can upgrade your environment to receive this update immediately. Fixed Fixed an issue where a redundant `image-version` property set in the API request body could sometimes cause a long-running operation to fail. Fixed *(Managed Airflow Gen 2)* Fixed an issue where the `airflow-monitoring` pod could run out of memory (`OOMKilled`) when calculating scheduled snapshot metrics in environments with a large number of files in their environment's bucket. Change The `apache-airflow-providers-google` package was upgraded to version 22.6.0. For more information about changes, see the [apache-airflow-providers-google changelog](https://airflow.apache.org/docs/apache-airflow-providers-google/stable/changelog.html). Deprecated The following Managed Airflow versions and builds have reached their [end of support period](https://docs.cloud.google.com/composer/docs/composer-versioning-overview.md.txt#version-deprecation-and-support): composer-3-airflow-2.9.3-build.35, composer-3-airflow-2.10.5-build.15, composer-3-airflow-2.9.3-build.36, composer-3-airflow-2.10.5-build.16, composer-2.14.3-airflow-2.9.3, composer-2.14.3-airflow-2.10.5, composer-2.14.4-airflow-2.9.3, and composer-2.14.4-airflow-2.10.5. Change The `apache-airflow-providers-cncf-kubernetes` package was [upgraded to version 10.23.0](https://airflow.apache.org/docs/apache-airflow-providers-cncf-kubernetes/stable/changelog.html). For changes in other packages, see the [preinstalled packages changelog](https://cloud.google.com/composer/docs/versions-packages). Change New [images](https://docs.cloud.google.com/composer/docs/composer-versions.md.txt#images-composer-2) are available in Managed Airflow (Gen 2): - [composer-2.17.15-airflow-2.11.1](https://docs.cloud.google.com/composer/docs/versions-packages.md.txt#composer-2-17-15-airflow-2-11-1) (default) Change New [Airflow builds](https://docs.cloud.google.com/composer/docs/composer-versions.md.txt#images-composer-3) are available in Managed Airflow (Gen 3): - [composer-3-airflow-3.3.1-build.4](https://docs.cloud.google.com/composer/docs/versions-packages.md.txt#composer-3-airflow-3-3-1-build-4) - [composer-3-airflow-3.2.2-build.8](https://docs.cloud.google.com/composer/docs/versions-packages.md.txt#composer-3-airflow-3-2-2-build-8) - [composer-3-airflow-2.11.1-build.21](https://docs.cloud.google.com/composer/docs/versions-packages.md.txt#composer-3-airflow-2-11-1-build-21) (default) **Policy Controller** Change Policy Controller version 1.24.2 is now available. ## October 12, 2026 **Agent Assist** Feature [Gemini transcribe live](https://docs.cloud.google.com/gemini-enterprise-cx/agent-assist/gemini-transcribe-live.md.txt) is generally available. Live transcription converts streaming audio to text in real time to deliver quick, reliable intermediate transcriptions for live conversations. The `model_id` field in `GeminiAsrConfig` remains in preview. Leave `model_id` unset to use the default Gemini transcribe live model. **Agent Platform Workbench** Change ### 20261011.00_p0 Release Change Installed latest packages from upstream dependencies. Fixed Fixed an issue where gcloud and gsutil failed to load with an AttributeError in OpenSSL.crypto due to a version mismatch between pyOpenSSL and cryptography. Change ### 20261011.00_p0 Release Change Installed latest packages from upstream dependencies. Fixed Fixed an issue where gcloud and gsutil failed to load with an AttributeError in OpenSSL.crypto due to a version mismatch between pyOpenSSL and cryptography. **Application Integration** Announcement Starting October 15, 2026, Application Integration enforces security fixes for IAM, run-as service accounts, and `iam.serviceAccounts.actAs` checks, requiring the correct permissions for the test feature and any new integrations. For more information, see the [GCP-2026-068](https://docs.cloud.google.com/application-integration/docs/security-bulletins.md.txt#gcp-2026-068) security bulletin and [Prepare for upcoming authorization changes](https://docs.cloud.google.com/application-integration/docs/prepare-for-authorization-changes.md.txt). **Assured Workloads** Feature The [Data Boundary for ITAR](https://docs.cloud.google.com/assured-workloads/docs/control-packages/itar.md.txt) supports the following products: - Looker (Google Cloud core) **Backup for GKE** Change Backup for GKE is now available in the following region: `asia-southeast3` (Bangkok, Thailand). For more information, see [Backup for GKE locations](https://docs.cloud.google.com/kubernetes-engine/docs/add-on/backup-for-gke/concepts/about-locations.md.txt). **BigQuery** Feature Incremental data transfers for the BigQuery Data Transfer Service for [PostgreSQL](https://docs.cloud.google.com/bigquery/docs/postgresql-transfer-intro.md.txt#full-incremental-transfers) and [ServiceNow](https://docs.cloud.google.com/bigquery/docs/servicenow-transfer.md.txt#full_or_incremental_transfers) are now [generally available](https://cloud.google.com/products#product-launch-stages) (GA). **Bigtable** Libraries ### Node.js #### [7.4.0](https://github.com/googleapis/google-cloud-node/compare/bigtable-v7.3.0...bigtable-v7.4.0) (2026-10-07) ##### Features - **tools:** Add individual CLI flags for Bun monkey patches ([#9533](https://github.com/googleapis/google-cloud-node/issues/9533)) ([a5eec89](https://github.com/googleapis/google-cloud-node/commit/a5eec894b054e0605fd8e79591a88393bb2697c6)) ### Python #### [2.50.0](https://github.com/googleapis/google-cloud-python/compare/google-cloud-bigtable-v2.49.0...google-cloud-bigtable-v2.50.0) (2026-10-08) ##### Features - update API sources and regenerate ([#18593](https://github.com/googleapis/google-cloud-python/issues/18593)) ([d0505e8](https://github.com/googleapis/google-cloud-python/commit/d0505e8bc7615f2c649d3e25ebc7e3ccca45f22b)) ### Node.js #### [7.5.0](https://github.com/googleapis/google-cloud-node/compare/bigtable-v7.4.0...bigtable-v7.5.0) (2026-10-08) ##### Features - Update API sources and regenerate ([#9554](https://github.com/googleapis/google-cloud-node/issues/9554)) ([8b6837a](https://github.com/googleapis/google-cloud-node/commit/8b6837a9757cc8bb281e0611b173cb19b58d4ac5)) **Cloud Build** Announcement You can now choose the [release channel](https://docs.cloud.google.com/build/docs/release-channels.md.txt) for your build config or private pool. The release channel determines how frequently the underlying versions of Debian and Docker are updated. **Cloud DNS** Feature Outbound endpoints for Cloud DNS are available in [Preview](https://cloud.google.com/products#product-launch-stages). Attach outbound endpoints to forwarding zones or server policies to enable direct DNS query forwarding from VPC networks to external and on-premises DNS resolvers using private IP addresses. For more information, see [Outbound endpoints overview](https://docs.cloud.google.com/dns/docs/outbound-endpoints-overview.md.txt). **Cloud Load Balancing** Feature Regular expression matchers in host and route rules in URL maps are now **generally available** (GA). You can now use regular expressions (regex) matchers to configure more flexible and precise traffic routing rules within URL maps for Application Load Balancers. This feature allows you to leverage the power of RE2 syntax for matching on: - **URL Paths:** Using the `regexMatch` field within `routeRules`. - **HTTP Headers:** Using the `regexMatch` field within `headerMatches` in `routeRules`. - **HTTP Query Parameters:** Using the `regexMatch` field within `queryParameterMatches` in `routeRules`. This feature is available in: - Global external Application Load Balancers - Regional internal Application Load Balancers - Cross-region internal Application Load Balancers - Regional external Application Load Balancers For more information, see [URL map concepts: Regular expressions matchers in host and route rules](https://docs.cloud.google.com/load-balancing/docs/url-map-concepts.md.txt#regex-support). **Cloud Run** Feature Support for [Budget spend caps](https://docs.cloud.google.com/run/docs/configuring/billing-settings.md.txt#spend-caps) to pause your Cloud Run workloads is in [General Availability (GA)](https://cloud.google.com/products#product-launch-stages). **Cloud Service Mesh** Announcement **1.31.1-asm.16 is now available for in-cluster Cloud Service Mesh.** You can now download 1.31.1-asm.16 for in-cluster Cloud Service Mesh. It includes the features of [Istio 1.31.1](https://istio.io/latest/news/releases/1.31.x/announcing-1.31/) subject to the list of [supported features](https://docs.cloud.google.com/service-mesh/docs/supported-features-in-cluster.md.txt). The following are not supported: - `PILOT_NODE_UNTAINT_CONTROLLERS_TAINT_NAME` - `prefix_rewrite` field in `HTTPRedirect` - `ALLOW_ANY_DYNAMIC_DNS` in `outboundTrafficPolicy` - `connectionSettings` in `ProxyConfig` - `defaultTrafficPolicy` in `MeshConfig` - `zoneAwareLbSetting` in `DestinationRule` and `MeshConfig` - `trustDomains` and `notTrustDomains` fields in `source` field of `AuthorizationPolicy` - `fips-140-3` for the `COMPLIANCE_POLICY` - `PILOT_ENABLE_REMOTE_CREDENTIALS_CONTROLLER` - External SDS provider for gateways - `PILOT_AGENT_MERGE_ENVOY_STATS` - `prometheus.istio.io/scrape-targets` - `ENVOY_SECURE_METRICS_PORT` and `ENVOY_SECURE_MERGED_METRICS_PORT` - `istioctl manifest generate` with `-o/--output` For details on upgrading Cloud Service Mesh, see [Upgrade Cloud Service Mesh](https://docs.cloud.google.com/service-mesh/docs/upgrade/upgrade.md.txt). Cloud Service Mesh version 1.31.1-asm.16 uses Envoy v1.39.3. Announcement **1.30.5-asm.8 is now available for in-cluster Cloud Service Mesh.** For details on upgrading Cloud Service Mesh, see [Upgrade Cloud Service Mesh](https://docs.cloud.google.com/service-mesh/docs/upgrade/upgrade.md.txt). Cloud Service Mesh 1.30.5-asm.8 uses Envoy v1.38.7-dev. This release resolves the security vulnerability listed in Security Bulletin [GCP-2026-067](https://cloud.google.com/service-mesh/docs/security-bulletins#gcp-2026-067). Fixed Patch 1.30.5-asm.8 contains the fix for the following platform CVEs: | CVE | Proxy | Control Plane | Distroless | CNI | Severity | |---|---|---|---|---|---| | [CVE-2026-18924](https://nvd.nist.gov/vuln/detail/CVE-2026-18924) | Yes | Yes | No | Yes | Medium (9.1) | | [CVE-2026-82474](https://nvd.nist.gov/vuln/detail/CVE-2026-82474) | Yes | Yes | No | Yes | Medium (8.5) | | [CVE-2026-82209](https://nvd.nist.gov/vuln/detail/CVE-2026-82209) | Yes | Yes | No | Yes | Medium (8.2) | | [CVE-2026-84782](https://nvd.nist.gov/vuln/detail/CVE-2026-84782) | Yes | Yes | No | Yes | High (8.2) | | [CVE-2026-96512](https://nvd.nist.gov/vuln/detail/CVE-2026-96512) | Yes | Yes | No | Yes | Medium (7.8) | | [CVE-2026-80230](https://nvd.nist.gov/vuln/detail/CVE-2026-80230) | Yes | Yes | No | Yes | Medium (7.5) | | [CVE-2026-13608](https://nvd.nist.gov/vuln/detail/CVE-2026-13608) | Yes | Yes | No | Yes | Medium (7.4) | | [CVE-2026-15534](https://nvd.nist.gov/vuln/detail/CVE-2026-15534) | Yes | Yes | No | Yes | Medium (5.7) | | [CVE-2026-19487](https://nvd.nist.gov/vuln/detail/CVE-2026-19487) | Yes | Yes | No | Yes | Medium (5.3) | | [CVE-2026-35189](https://nvd.nist.gov/vuln/detail/CVE-2026-35189) | Yes | Yes | No | Yes | Low (5.3) | | [CVE-2026-75805](https://nvd.nist.gov/vuln/detail/CVE-2026-75805) | Yes | Yes | No | Yes | Low (5.3) | | [CVE-2026-75806](https://nvd.nist.gov/vuln/detail/CVE-2026-75806) | Yes | Yes | No | Yes | Low (5.3) | | [CVE-2026-54872](https://nvd.nist.gov/vuln/detail/CVE-2026-54872) | Yes | Yes | No | Yes | Low (3.7) | | [CVE-2026-77696](https://nvd.nist.gov/vuln/detail/CVE-2026-77696) | Yes | Yes | No | Yes | Low (3.7) | | [CVE-2026-0799](https://nvd.nist.gov/vuln/detail/CVE-2026-0799) | Yes | Yes | No | Yes | Medium (0.0) | Announcement **1.29.8-asm.8 is now available for in-cluster Cloud Service Mesh.** For details on upgrading Cloud Service Mesh, see [Upgrade Cloud Service Mesh](https://docs.cloud.google.com/service-mesh/v1.29/docs/upgrade/upgrade.md.txt). Cloud Service Mesh 1.29.8-asm.8 uses Envoy v1.37.9-dev. This release resolves the security vulnerability listed in Security Bulletin [GCP-2026-067](https://cloud.google.com/service-mesh/docs/security-bulletins#gcp-2026-067). Fixed Patch 1.29.8-asm.8 contains the fix for the following platform CVEs: | CVE | Proxy | Control Plane | Distroless | CNI | Severity | |---|---|---|---|---|---| | [CVE-2026-18924](https://nvd.nist.gov/vuln/detail/CVE-2026-18924) | Yes | Yes | No | Yes | Medium (9.1) | | [CVE-2026-82474](https://nvd.nist.gov/vuln/detail/CVE-2026-82474) | Yes | Yes | No | Yes | Medium (8.5) | | [CVE-2026-82209](https://nvd.nist.gov/vuln/detail/CVE-2026-82209) | Yes | Yes | No | Yes | Medium (8.2) | | [CVE-2026-84782](https://nvd.nist.gov/vuln/detail/CVE-2026-84782) | Yes | Yes | No | Yes | High (8.2) | | [CVE-2026-96512](https://nvd.nist.gov/vuln/detail/CVE-2026-96512) | Yes | Yes | No | Yes | Medium (7.8) | | [CVE-2026-80230](https://nvd.nist.gov/vuln/detail/CVE-2026-80230) | Yes | Yes | No | Yes | Medium (7.5) | | [CVE-2026-13608](https://nvd.nist.gov/vuln/detail/CVE-2026-13608) | Yes | Yes | No | Yes | Medium (7.4) | | [CVE-2026-15534](https://nvd.nist.gov/vuln/detail/CVE-2026-15534) | Yes | Yes | No | Yes | Medium (5.7) | | [CVE-2026-19487](https://nvd.nist.gov/vuln/detail/CVE-2026-19487) | Yes | Yes | No | Yes | Medium (5.3) | | [CVE-2026-35189](https://nvd.nist.gov/vuln/detail/CVE-2026-35189) | Yes | Yes | No | Yes | Low (5.3) | | [CVE-2026-75805](https://nvd.nist.gov/vuln/detail/CVE-2026-75805) | Yes | Yes | No | Yes | Low (5.3) | | [CVE-2026-75806](https://nvd.nist.gov/vuln/detail/CVE-2026-75806) | Yes | Yes | No | Yes | Low (5.3) | | [CVE-2026-54872](https://nvd.nist.gov/vuln/detail/CVE-2026-54872) | Yes | Yes | No | Yes | Low (3.7) | | [CVE-2026-77696](https://nvd.nist.gov/vuln/detail/CVE-2026-77696) | Yes | Yes | No | Yes | Low (3.7) | | [CVE-2026-0799](https://nvd.nist.gov/vuln/detail/CVE-2026-0799) | Yes | Yes | No | Yes | Medium (0.0) | Announcement **1.28.10-asm.49 is now available for in-cluster Cloud Service Mesh.** For details on upgrading Cloud Service Mesh, see [Upgrade Cloud Service Mesh](https://docs.cloud.google.com/service-mesh/v1.28/docs/upgrade/upgrade.md.txt). Cloud Service Mesh 1.28.10-asm.49 uses Envoy v1.36.10-dev. Fixed Patch 1.28.10-asm.49 contains the fix for the following platform CVEs: | CVE | Proxy | Control Plane | Distroless | CNI | Severity | |---|---|---|---|---|---| | [CVE-2026-18924](https://nvd.nist.gov/vuln/detail/CVE-2026-18924) | Yes | Yes | No | Yes | Medium (9.1) | | [CVE-2026-82474](https://nvd.nist.gov/vuln/detail/CVE-2026-82474) | Yes | Yes | No | Yes | Medium (8.5) | | [CVE-2026-82209](https://nvd.nist.gov/vuln/detail/CVE-2026-82209) | Yes | Yes | No | Yes | Medium (8.2) | | [CVE-2026-84782](https://nvd.nist.gov/vuln/detail/CVE-2026-84782) | Yes | Yes | No | Yes | High (8.2) | | [CVE-2026-96512](https://nvd.nist.gov/vuln/detail/CVE-2026-96512) | Yes | Yes | No | Yes | Medium (7.8) | | [CVE-2026-80230](https://nvd.nist.gov/vuln/detail/CVE-2026-80230) | Yes | Yes | No | Yes | Medium (7.5) | | [CVE-2026-13608](https://nvd.nist.gov/vuln/detail/CVE-2026-13608) | Yes | Yes | No | Yes | Medium (7.4) | | [CVE-2026-15534](https://nvd.nist.gov/vuln/detail/CVE-2026-15534) | Yes | Yes | No | Yes | Medium (5.7) | | [CVE-2026-19487](https://nvd.nist.gov/vuln/detail/CVE-2026-19487) | Yes | Yes | No | Yes | Medium (5.3) | | [CVE-2026-35189](https://nvd.nist.gov/vuln/detail/CVE-2026-35189) | Yes | Yes | No | Yes | Low (5.3) | | [CVE-2026-75805](https://nvd.nist.gov/vuln/detail/CVE-2026-75805) | Yes | Yes | No | Yes | Low (5.3) | | [CVE-2026-75806](https://nvd.nist.gov/vuln/detail/CVE-2026-75806) | Yes | Yes | No | Yes | Low (5.3) | | [CVE-2026-54872](https://nvd.nist.gov/vuln/detail/CVE-2026-54872) | Yes | Yes | No | Yes | Low (3.7) | | [CVE-2026-77696](https://nvd.nist.gov/vuln/detail/CVE-2026-77696) | Yes | Yes | No | Yes | Low (3.7) | | [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) | Yes | Yes | Yes | Yes | Low (2.0) | | [CVE-2026-0799](https://nvd.nist.gov/vuln/detail/CVE-2026-0799) | Yes | Yes | No | Yes | Medium (0.0) | **Compute Engine** Feature **Generally available**: The network-optimized C4N machine types with 375 GiB to 12,000 GiB of attached Titanium SSD are now generally available. For more information, see [C4N machine series](https://docs.cloud.google.com/compute/docs/network-optimized-machines.md.txt#c4n_series) and [About Local SSD disks](https://docs.cloud.google.com/compute/docs/disks/local-ssd.md.txt). **Container Optimized OS** Change ### cos-dev-138-20198-0-0 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.18.55](https://cos.googlesource.com/third_party/kernel/+/bdbde7078cc46500653d60b76e7490df2fdbbee5) | v29.4.3 | v2.4.1 | [See List](https://storage.googleapis.com/cos-tools/20198.0.0/lakitu/gpu_driver_versions.textproto) | Change Updated default cos-gpu-installer version to v2.7.9. It installs ucodes firmwares for VR200. Change Updated the Linux kernel to v6.18.55. Feature Enabled CONFIG_ARM_CCA_GUEST in the Linux kernel for ARM64 to support guest attestation on Arm CCA Confidential VMs. Feature Security: Disable Magic SysRq for gmec-tdx-kernel-host Fixed Added support for net-fs/lustre-client-drivers v2.14.0_p262-r1 Fixed Added support for net-fs/lustre-client-drivers v2.14.0_p262. Fixed Added the "watchdog_timeout" module parameter to the idpf driver. Fixed Updated app-admin/google-guest-configs to v20260928.00. Fixed Upgraded app-admin/google-guest-configs to v20260928.00. Fixed Upgraded app-admin/oslogin to v20260924.00. Fixed Upgraded app-containers/runc to v1.5.2, Upgraded app-containers/runc-test to v1.5.2. Fixed Upgraded dev-libs/expat to v2.8.5. Fixed Upgraded dev-libs/libgcrypt to v1.12.4. Fixed Upgraded dev-libs/libpcre2 to v10.49. Fixed Upgraded dev-python/oauthlib to v4.0.0. Fixed Upgraded sys-apps/pv to v1.12.0. Fixed Upgraded sys-apps/xemu to v0.0.11. Security Fixed CVE-2026-18220 in sys-libs/binutils-libs. Security Fixed CVE-2026-5450 in sys-libs/glibc. Change ### cos-133-19999-44-126 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.18.55](https://cos.googlesource.com/third_party/kernel/+/e4cb133e82a5c21d80531e07527d018402f04630) | v29.4.3 | v2.4.1 | [See List](https://storage.googleapis.com/cos-tools/19999.44.126/lakitu/gpu_driver_versions.textproto) | Change Fixed an issue where openssl 3.2 was being incorrectly installed. Openssl is now on version 3.5.7. Change Updated dev-libs/openssl to v3.5.9. Fixed Upgraded app-admin/oslogin to v20261006.00. Fixed Upgraded app-arch/gzip to v1.15. Fixed Upgraded dev-libs/expat to v2.9.0. Fixed Upgraded dev-libs/xxhash to v0.8.3-r2. Fixed Upgraded net-misc/openssh to v10.4_p1-r1. Fixed Upgraded sys-apps/less to v710. Security Fixed CVE-2026-18220 in sys-libs/binutils-libs. Security Fixed CVE-2026-5450 in sys-libs/glibc. Security Patch CVE-2026-49264, CVE-2026-49265 on dev-python/oauthlib. Change Runtime sysctl changes: - Changed: kernel.threads-max: 63444 -\> 63443 - Changed: net.ipv4.udp_mem: 187941 250591 375882 -\> 187941 250590 375882 - Changed: user.max_cgroup_namespaces: 31722 -\> 31721 - Changed: user.max_ipc_namespaces: 31722 -\> 31721 - Changed: user.max_mnt_namespaces: 31722 -\> 31721 - Changed: user.max_net_namespaces: 31722 -\> 31721 - Changed: user.max_pid_namespaces: 31722 -\> 31721 - Changed: user.max_time_namespaces: 31722 -\> 31721 - Changed: user.max_user_namespaces: 31722 -\> 31721 - Changed: user.max_uts_namespaces: 31722 -\> 31721
Change ### cos-121-18867-638-5 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.6.158](https://cos.googlesource.com/third_party/kernel/+/ed1f77ef4535cd613776d78cf046773a9d90789b) | v27.5.1 | v2.0.10 | [See List](https://storage.googleapis.com/cos-tools/18867.638.5/lakitu/gpu_driver_versions.textproto) | Announcement This is an [LTS Refresh release.](https://docs.cloud.google.com/container-optimized-os/docs/concepts/versioning.md.txt#lts_refresh_releases) Fixed Added support for net-fs/lustre-client-drivers v2.14.0_p262-r1 Fixed Added support for net-fs/lustre-client-drivers v2.14.0_p262. Security Fixed CVE-2026-18220 in sys-libs/binutils-libs. Security Fixed CVE-2026-5450 in sys-libs/glibc. Security Patch CVE-2026-49264, CVE-2026-49265 on dev-python/oauthlib. Change ### cos-129-19506-549-7 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.12.112](https://cos.googlesource.com/third_party/kernel/+/e0eda3654b9ec529967ef7a996ea61b8f133bb95) | v27.5.1 | v2.2.7 | [See List](https://storage.googleapis.com/cos-tools/19506.549.7/lakitu/gpu_driver_versions.textproto) | Announcement This is an [LTS Refresh release.](https://docs.cloud.google.com/container-optimized-os/docs/concepts/versioning.md.txt#lts_refresh_releases) Fixed Added support for lustre v2.14.0_p262-r1 Security Fixed CVE-2026-18220 in sys-libs/binutils-libs. Security Fixed CVE-2026-5450 in sys-libs/glibc. Security Patch CVE-2026-49264, CVE-2026-49265 on dev-python/oauthlib. Change ### cos-125-19216-739-5 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.12.112](https://cos.googlesource.com/third_party/kernel/+/91e56902b9c6999dabbff541fd5baf20aee3108b) | v27.5.1 | v2.2.7 | [See List](https://storage.googleapis.com/cos-tools/19216.739.5/lakitu/gpu_driver_versions.textproto) | Announcement This is an [LTS Refresh release.](https://docs.cloud.google.com/container-optimized-os/docs/concepts/versioning.md.txt#lts_refresh_releases) Fixed Added support for lustre v2.14.0_p262-r1 Security Fixed CVE-2026-18220 in sys-libs/binutils-libs. Security Fixed CVE-2026-5450 in sys-libs/glibc. Security Patch CVE-2026-49264, CVE-2026-49265 on dev-python/oauthlib. **Firestore with MongoDB compatibility** Feature Firestore with MongoDB compatibility now supports QueryData, which you can use to build data agents that interact with the data in your database using conversational language. For more information, see [QueryData overview](https://docs.cloud.google.com/gemini/data-agents/querydata/firestore-mongodb-compatibility/data-agent-overview.md.txt). This feature is available in [Preview](https://cloud.google.com/products#product-launch-stages). **Gemini Enterprise Agent Platform** Fixed **CodeMender updates (v0.14.0)** This release introduces updates to CodeMender: - **Better pull request scans** : `cm find --diff` now catches removed security controls and gives large files more time (configurable with `--diff-job-timeout`). - **Unified sessions** : `--deep` and `--diff` scans now appear as a single session in `cm session list`, `cm report`, and `cm stats`. - **Moved code in `cm verify`** : `cm verify` now finds code that moved since `cm find` and updates the finding's location. - **Guided activation** : `cm` now opens the activation page and waits for activation instead of exiting. - **New `cm find` flags** : `--deep-max-turns` limits exploratory steps per file in `--deep` scans, and `--enable-bash` allows shell commands during scans. - **Improved detection**: More distinct findings per file and more precise CWE classification for weak hashing and randomness. - **Bug fixes** : - Fixed scans of repositories reached through nested symbolic links. - Fixed findings for nonexistent files and over-merged findings. - Shell scripts created by `cm verify` are now executable. For more information, see the [CodeMender documentation](https://docs.cloud.google.com/gemini-enterprise-agent-platform/agents/codemender.md.txt). **Google Cloud Managed Service for Apache Kafka** Announcement The Service Level Agreement (SLA) for Managed Service for Apache Kafka now covers the Produce API. For more information, see [Managed Service for Apache Kafka Service Level Agreement](https://cloud.google.com/terms/managed-service-for-apache-kafka/sla). **Google Distributed Cloud (software only) for VMware** Announcement Google Distributed Cloud (software only) for VMware 1.35.600-gke.140 is now available for download. To upgrade, see [Upgrade clusters](https://docs.cloud.google.com/kubernetes-engine/distributed-cloud/vmware/docs/how-to/upgrading.md.txt). Google Distributed Cloud 1.35.600-gke.140 runs on Kubernetes v1.35.8-gke.100. If you use a third-party storage vendor, check the listing of our previously-qualified [storage partners](https://docs.cloud.google.com/kubernetes-engine/enterprise/docs/resources/partner-storage.md.txt). After a release, it takes approximately 7 to 14 days for the version to become available for use with GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform. Fixed The following issues were fixed in 1.35.600-gke.140: - Fixed vulnerabilities listed in [Vulnerability fixes](https://docs.cloud.google.com/kubernetes-engine/distributed-cloud/vmware/docs/vulnerabilities.md.txt). - Fixed an issue where `audit-proxy` retried audit log exports indefinitely on permanent errors, generating excessive audit logging traffic. - Fixed an issue where the Kubernetes preflight health check scanned all namespaces in the admin cluster instead of the target cluster's namespace, causing cluster upgrades to fail if an unrelated cluster had stale reconciling resources. - Fixed an issue where user clusters repeatedly alternated between `reconciling` and `running` states if the management cluster configured a different pod density configuration than the user cluster. **Google Distributed Cloud (software only) for bare metal** Announcement Google Distributed Cloud (software only) for bare metal 1.35.600-gke.140 is now available for download. To upgrade, see [Upgrade clusters](https://docs.cloud.google.com/release-notes/how-to/upgrade). Google Distributed Cloud for bare metal 1.35.600-gke.140 runs on Kubernetes v1.35.8-gke.100. After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform. If you use a third-party storage vendor, check the listing of our previously-qualified [storage partners](https://docs.cloud.google.com/kubernetes-engine/enterprise/docs/resources/partner-storage.md.txt). Fixed The following issues were fixed in 1.35.600-gke.140: - Fixed vulnerabilities listed in [Vulnerability fixes](https://docs.cloud.google.com/kubernetes-engine/distributed-cloud/bare-metal/docs/vulnerabilities.md.txt). - Improved `containerd` resilience against state corruption if a node reboots while unpacking container images. - Fixed an issue where the periodic configuration drift health check failed with a `version not supported` error while a cluster upgrade or rollback was in progress. - Fixed an issue where `audit-proxy` retried audit log exports indefinitely on permanent errors, generating excessive audit logging traffic. - Fixed an issue where the Kubernetes preflight health check scanned all namespaces in the admin cluster instead of the target cluster's namespace, causing cluster upgrades to fail if an unrelated cluster had stale reconciling resources. - Fixed an issue where upgrading or recreating a node during maintenance mode could proceed before storage volumes finished detaching, resulting in orphaned CSI `VolumeAttachment` resources or I/O errors. After the fix, node drain verifies that `kubelet` unmounts all host volumes and that CSI `VolumeAttachment` resources detach before completing the drain. - Fixed an issue where Certificate Authority (CA) rotation failed for self-managing clusters (admin, hybrid, and standalone). The failure occurs during the final phase of the rotation when attempting to move management resources back from the temporary bootstrap cluster to the self-managing cluster, which can leave the cluster in an unmanageable state. You must upgrade your clusters to version 1.35.600-gke.140 before you rotate your CAs. - Fixed an issue where `BareMetalMachine` status conditions prematurely reported nodes as ready and available during maintenance mode transitions. - Fixed an issue in clusters using bundled BGP load balancing where control plane upgrades or configuration updates could cause up to 20 seconds of API server connection failures while a control plane node restarted. After the fix, failover to a healthy control plane node completes in approximately 4 seconds. - Fixed an issue where user clusters repeatedly alternated between `reconciling` and `running` states if the management cluster configured a different pod density configuration than the user cluster. **Google SecOps** Feature **Applied Threat Intelligence curated rules now use the GTI_IOC feed** As a follow-up to the release of the `GTI_IOC` feed and the deprecation of the legacy `MANDIANT_ACTIVE_BREACH_IOC`, `MANDIANT_FUSION_IOC`, and `OPEN_SOURCE_INTEL_IOC` feeds, the Applied Threat Intelligence (ATI) curated detection rules are being updated to match against the `GTI_IOC` feed. You don't need to take any action for curated rules. Updated rules continue to match only on reviewed, stable indicators. If you have custom rules that still reference the legacy feeds, update them to use the `GTI_IOC` feed. For more information, see [Migrate to GTI_IOC](https://docs.cloud.google.com/chronicle/docs/detection/ati-fusion-feed.md.txt#migrateToGTI). The update follows the standard Google SecOps rollout schedule. It starts on Monday, October 12, 2026 and rolls out to all regions during the week. Change Google SecOps has updated the list of [supported default parsers](https://docs.cloud.google.com/chronicle/docs/ingestion/parser-list/supported-default-parsers.md.txt). Parsers are updated gradually, so it might take one to four days before you see the changes reflected in your region. The following supported default parsers have been updated. Each parser is listed by product name and `log_type` value, where applicable. This list includes both released default parsers and pending parser updates. - AIX system (`AIX_SYSTEM`) - Apache (`APACHE`) - AppOmni (`APPOMNI`) - Armis Activities (`ARMIS_ACTIVITIES`) - Atlassian Cloud Admin Audit (`ATLASSIAN_AUDIT`) - Atlassian Bitbucket (`ATLASSIAN_BITBUCKET`) - Linux Auditing System (AuditD) (`AUDITD`) - AWS Cloudtrail (`AWS_CLOUDTRAIL`) - AWS Inspector (`AWS_INSPECTOR`) - AWS RDS (`AWS_RDS`) - Microsoft Azure Activity (`AZURE_ACTIVITY`) - Azure AD Directory Audit (`AZURE_AD_AUDIT`) - Azure AD Organizational Context (`AZURE_AD_CONTEXT`) - Azure AD Sign-In (`AZURE_AD_SIGNIN`) - Azure App Service (`AZURE_APP_SERVICE`) - Azure Firewall (`AZURE_FIREWALL`) - Azure Application Gateway (`AZURE_GATEWAY`) - Azure Key Vault logging (`AZURE_KEYVAULT_AUDIT`) - Bitdefender (`BITDEFENDER`) - Blue Coat Proxy (`BLUECOAT_WEBPROXY`) - Box (`BOX`) - Zeek JSON (`BRO_JSON`) - Check Point Sandblast (`CHECKPOINT_EDR`) - Chrome Management (`CHROME_MANAGEMENT`) - CipherTrust Manager (`CIPHERTRUST_MANAGER`) - Cisco ACS (`CISCO_ACS`) - Cisco ASA (`CISCO_ASA_FIREWALL`) - Cisco Email Security (`CISCO_EMAIL_SECURITY`) - Cisco Firepower NGFW (`CISCO_FIREPOWER_FIREWALL`) - Cisco FireSIGHT Management Center (`CISCO_FIRESIGHT`) - Cisco IronPort (`CISCO_IRONPORT`) - Cisco Meraki (`CISCO_MERAKI`) - Cisco Umbrella Audit (`CISCO_UMBRELLA_AUDIT`) - Cisco WLC/WCS (`CISCO_WIRELESS`) - Citrix Netscaler (`CITRIX_NETSCALER`) - Claroty Xdome (`CLAROTY_XDOME`) - Claude Compliance Logs (`CLAUDE_COMPLIANCE_LOGS`) - Cloudflare Audit (`CLOUDFLARE_AUDIT`) - Corelight (`CORELIGHT`) - Palo Alto Cortex XDR Alerts (`CORTEX_XDR`) - CrowdStrike Alerts API (`CS_ALERTS`) - CrowdStrike Falcon (`CS_EDR`) - CrowdStrike Falcon Stream (`CS_STREAM`) - CyberArk (`CYBERARK`) - CyberArk Privileged Access Manager (PAM) (`CYBERARK_PAM`) - Darktrace (`DARKTRACE`) - F5 Advanced Firewall Management (`F5_AFM`) - F5 BIGIP LTM (`F5_BIGIP_LTM`) - F5 VPN (`F5_VPN`) - FireEye HX (`FIREEYE_HX`) - FireEye NX (`FIREEYE_NX`) - Forcepoint DLP (`FORCEPOINT_DLP`) - Fortinet FortiAnalyzer (`FORTINET_FORTIANALYZER`) - Fortinet Fortimanager (`FORTINET_FORTIMANAGER`) - Fortinet FortiSandbox (`FORTINET_SANDBOX`) - Fortinet Switch (`FORTINET_SWITCH`) - Fortinet Proxy (`FORTINET_WEBPROXY`) - Apigee (`GCP_APIGEE_X`) - GCP Cloud Audit (`GCP_CLOUDAUDIT`) - Cloud DNS (`GCP_DNS`) - Security Command Center Threat (`GCP_SECURITYCENTER_THREAT`) - GCP Secure Web Proxy (`GCP_SWP`) - VPC Flow Logs (`GCP_VPC_FLOW`) - Gemini Code Assist (`GEMINI_CODE_ASSIST`) - Gitlab (`GITLAB`) - AWS GuardDuty (`GUARDDUTY`) - Huawei Switches (`HUAWEI_SWITCH`) - IBM AS/400 (`IBM_AS400`) - Microsoft IIS (`IIS`) - Illumio Core (`ILLUMIO_CORE`) - Imperva SecureSphere Management (`IMPERVA_SECURESPHERE`) - Infoblox (`INFOBLOX`) - Jenkins (`JENKINS`) - JFrog Artifactory (`JFROG_ARTIFACTORY`) - Journald (`JOURNALD`) - Juniper (`JUNIPER_FIREWALL`) - Juniper Junos (`JUNIPER_JUNOS`) - Kiteworks (`KITEWORKS`) - Kubernetes Node (`KUBERNETES_NODE`) - McAfee IPS (`MCAFEE_IPS`) - Microsoft Defender for Endpoint (`MICROSOFT_DEFENDER_ENDPOINT`) - Microsoft Defender for Identity (`MICROSOFT_DEFENDER_IDENTITY`) - Microsoft Defender for Office 365 (`MICROSOFT_DEFENDER_MAIL`) - Microsoft Sentinel (`MICROSOFT_SENTINEL`) - Microsoft SQL Server (`MICROSOFT_SQL`) - Netskope CASB (`NETSKOPE_CASB`) - Netskope Web Proxy (`NETSKOPE_WEBPROXY`) - Netwrix (`NETWRIX`) - NGINX (`NGINX`) - Unix system (`NIX_SYSTEM`) - Nutanix Prism (`NUTANIX_PRISM`) - Office 365 (`OFFICE_365`) - Okta (`OKTA`) - Okta User Context (`OKTA_USER_CONTEXT`) - Onapsis (`ONAPSIS`) - Oracle (`ORACLE_DB`) - Palo Alto Networks Firewall (`PAN_FIREWALL`) - Palo Alto Panorama (`PAN_PANORAMA`) - Palo Alto Prisma Cloud Alert payload (`PAN_PRISMA_CA`) - Ping One (`PING_ONE`) - Microsoft PowerShell (`POWERSHELL`) - Proofpoint Tap Alerts (`PROOFPOINT_MAIL`) - Pure Storage (`PURE_STORAGE`) - Red Hat OpenShift (`REDHAT_OPENSHIFT`) - RSA NetWitness (`RSA_NETWITNESS`) - SailPoint IAM (`SAILPOINT_IAM`) - Salesforce (`SALESFORCE`) - Sangfor Next Generation Firewall (`SANGFOR_NGAF`) - Sap Business Technology Platform (`SAP_BTP`) - SAP Change Document (`SAP_CHANGE_DOCUMENT`) - SecureLink (`SECURELINK`) - Sentinelone Alerts (`SENTINELONE_ALERT`) - Slack Audit (`SLACK_AUDIT`) - Sourcefire (`SOURCEFIRE_IDS`) - Squid Web Proxy (`SQUID_WEBPROXY`) - STIX Threat Intelligence (`STIX`) - Sublime Security (`SUBLIMESECURITY`) - Symantec Event export (`SYMANTEC_EVENT_EXPORT`) - Synology (`SYNOLOGY`) - Sysdig (`SYSDIG`) - Tableau (`TABLEAU`) - Tanium Stream (`TANIUM_TH`) - TCPWave DDI (`TCPWAVE_DDI`) - Teleport Access Plane (`TELEPORT_ACCESS_PLANE`) - Tenable Security Center (`TENABLE_SC`) - Trellix HX Alerts (`TRELLIX_HX_ALERTS`) - Trellix HX Audit Events (`TRELLIX_HX_AUDIT`) - Trellix HX Event Streamer (`TRELLIX_HX_ES`) - TrendMicro Apex Central (`TRENDMICRO_APEX_CENTRAL`) - Trend Micro Email Security Advanced (`TRENDMICRO_EMAIL_SECURITY`) - Trend Micro Vision One Audit (`TRENDMICRO_VISION_ONE_AUDIT`) - Trend Micro Vision One (`TRENDMICRO_VISION_ONE`) - Trend Micro Vision One Observerd Attack Techniques (`TRENDMICRO_VISION_ONE_OBSERVERD_ATTACK_TECHNIQUES`) - Trend Micro Vision One Workbench (`TRENDMICRO_VISION_ONE_WORKBENCH`) - Ubiquiti UniFi Switch (`UBIQUITI_SWITCH`) - Uptycs EDR (`UPTYCS_EDR`) - Upwind (`UPWIND`) - Venafi ZTPKI (`VENAFI_ZTPKI`) - Veritas NetBackup (`VERITAS_NETBACKUP`) - Vmware Avinetworks iWAF (`VMWARE_AVINETWORKS_IWAF`) - VMware ESXi (`VMWARE_ESX`) - VMware vCenter (`VMWARE_VCENTER`) - VMware vRealize Suite (VMware Aria) (`VMWARE_VREALIZE`) - Wallix Bastion (`WALLIX_BASTION`) - Microsoft AD (`WINDOWS_AD`) - Windows Defender AV (`WINDOWS_DEFENDER_AV`) - Windows DHCP (`WINDOWS_DHCP`) - Windows DNS (`WINDOWS_DNS`) - Windows Sysmon (`WINDOWS_SYSMON`) - Windows Event (`WINEVTLOG`) - Windows Event (XML) (`WINEVTLOG_XML`) - wiz.io (`WIZ_IO`) - Workspace Activities (`WORKSPACE_ACTIVITY`) - Zoom Operation Logs (`ZOOM_OPERATION_LOGS`) The following log types were added without a default parser. Each parser is listed by product name and `log_type` value, where applicable. - Amazon Bedrock Model Invocation Logging (`AMAZON_BEDROCK_MODEL_INVOCATION_LOGGING`) - AppTrana Web Application Firewall (`AWS_APPTRANA`) - Azure Machine Learning (`AZURE_MACHINE_LEARNING`) - Bitstamp (`BITSTAMP`) - Cloud 9 (`CLOUD9`) - Cloudflare Brand Protection (`CLOUDFLARE_BRAND_PROTECTION`) - Cloudflare Browser Isolation (`CLOUDFLARE_BROWSER_ISOLATION`) - Delinea Cloud Platform (`DELINEA_CLOUD_PLATFORM`) - Honeywell Cyber Proactive Defense (`HONEYWELL_CPD`) - Huntress EDR (`HUNTRESS_EDR`) - IBM Cloud Alert Notification (`IBM_CLOUD_ALERT_NOTIFICATION`) - Meter Firewall NIDS (`METER_FIREWALL_NIDS`) - OutSystems Cloud (`OUTSYSTEMS_CLOUD`) - Staffbase Audit (`STAFFBASE_AUDIT`) - Statsig (`STATSIG`) - Temporal Cloud Audit Logs (`TEMPORAL_CLOUD_AUDIT_LOGS`) - Twilio Segment (`TWILIO_SEGMENT`) Feature **\[Spotlight Feature\] Monitor response and playbook health with the Response Health Hub** Google SecOps now includes the **Response Health Hub** curated dashboard, a central location for monitoring playbook performance, execution latency, automation effectiveness, and integration health across environments. Key capabilities include: - **Volume and adoption tracking**: Monitor total playbook execution volume, daily trends, completion success rates, and queued playbook backlogs. - **Attachment and rerun insights**: Track average and maximum playbooks attached per case or alert, and identify playbooks with high rerun counts. - **Execution latency diagnostics**: Compare end-to-end playbook execution time against active action execution time, and drill down into the 30 slowest playbook and action runs. - **Playbook and integration health monitoring**: Investigate the latest failed playbook runs, highest failure-rate and terminated playbooks, and integration action error reasons. - **Automation effectiveness metrics**: Compare automated versus manual case closure rates and Mean Time to Resolve (MTTR). For more information, see [Monitor response and playbook health](https://docs.cloud.google.com/chronicle/docs/reports/response-health-monitoring-and-troubleshooting-dashboard.md.txt). Announcement The deadline for the migration of SOAR APIs to the Chronicle API has been extended from November 30, 2026 until March 31, 2027. For more information, refer to [SOAR Migration overview](https://docs.cloud.google.com/chronicle/docs/soar/admin-tasks/advanced/migrate-to-gcp.md.txt) **Google SecOps SIEM** Feature **Applied Threat Intelligence curated rules now use the GTI_IOC feed** As a follow-up to the release of the `GTI_IOC` feed and the deprecation of the legacy `MANDIANT_ACTIVE_BREACH_IOC`, `MANDIANT_FUSION_IOC`, and `OPEN_SOURCE_INTEL_IOC` feeds, the Applied Threat Intelligence (ATI) curated detection rules are being updated to match against the `GTI_IOC` feed. You don't need to take any action for curated rules. Updated rules continue to match only on reviewed, stable indicators. If you have custom rules that still reference the legacy feeds, update them to use the `GTI_IOC` feed. For more information, see [Migrate to GTI_IOC](https://docs.cloud.google.com/chronicle/docs/detection/ati-fusion-feed.md.txt#migrateToGTI). The update follows the standard Google SecOps rollout schedule. It starts on Monday, October 12, 2026 and rolls out to all regions during the week. **Google SecOps SOAR** Announcement The deadline for the migration of SOAR APIs to the Chronicle API has been extended from November 30, 2026 until March 31, 2027. For more information, refer to [SOAR Migration overview](https://docs.cloud.google.com/chronicle/docs/soar/admin-tasks/advanced/migrate-to-gcp.md.txt) **Looker** Feature Looker (Google Cloud core) now supports [Workforce Identity Federation](https://docs.cloud.google.com/looker/docs/looker-core-workforce-identity.md.txt) in [preview](https://cloud.google.com/products#product-launch-stages) for instances that use Looker 26.18 and later. Workforce Identity Federation allows users to authenticate by using external identity providers without the need to manage individual Google Accounts. Administrators can select Workforce Identity as the primary authentication method when they create or edit an instance and, optionally, enable secondary Google OAuth for secure backup access. **Managed Service for Apache Spark** Announcement New [**Managed Service for Apache Spark** (formerly Dataproc on Compute Engine) subminor cluster image versions](https://docs.cloud.google.com/managed-spark/docs/concepts/versioning/image-version-lists.md.txt#supported-dataproc-image-versions): - 2.1.120-debian11, 2.1.120-rocky8, 2.1.120-ubuntu20, 2.1.120-ubuntu20-arm Fixed **Managed Service for Apache Spark** (formerly Dataproc on Compute Engine): A bug has been fixed to add-back py4j library in image version 2.1.120. **Network Connectivity Center** Fixed The technical issue causing incorrect billing for [producer VPC spokes](https://docs.cloud.google.com/network-connectivity/docs/network-connectivity-center/concepts/producer-vpc-spokes-overview.md.txt) has been fixed. Starting today, projects with producer VPC spokes linked to Network Connectivity Center hubs will reflect hourly usage fees. Charges on your future billing invoices are based on [Network Connectivity Center pricing](https://docs.cloud.google.com/network-connectivity/docs/network-connectivity-center/pricing#ncc-pricing). ## October 11, 2026 **Agent Platform Workbench** Change ### 20261011-2230-rc0 Release Change ### 20261011-2230-rc0 Release Change Installed latest packages from upstream dependencies. Change Installed latest packages from upstream dependencies. Fixed Fixed an issue where gcloud and gsutil failed to load with an AttributeError in OpenSSL.crypto due to a version mismatch between pyOpenSSL and cryptography. Fixed Fixed an issue where gcloud and gsutil failed to load with an AttributeError in OpenSSL.crypto due to a version mismatch between pyOpenSSL and cryptography. Change ### 20261011-2130-rc0 Release Change Installed latest packages from upstream dependencies. **Google SecOps SOAR** Announcement Release 6.3.102 is being rolled out to the first phase of regions as listed [here](https://docs.cloud.google.com/chronicle/docs/soar/overview-and-introduction/soar-gradual-release.md.txt). This release contains internal and customer bug fixes. ## October 10, 2026 **Cloud SQL for MySQL** Change MySQL 8.0.46 is now the [default minor version](https://docs.cloud.google.com/sql/docs/mysql/db-versions.md.txt#database-version-support) for Cloud SQL for MySQL 8.0. For more information about minor version support in Cloud SQL for MySQL, see [MySQL 8.0](https://docs.cloud.google.com/sql/docs/mysql/db-versions.md.txt#mysql-8.0). **Google SecOps SOAR** Announcement [Release 6.3.101](https://docs.cloud.google.com/chronicle/docs/soar/release-notes.md.txt#September_27_2026) is now available for all regions. ## October 09, 2026 **Access Approval** Feature Database Migration Service is generally available ([GA](https://cloud.google.com/products#product-launch-stages)). **Access Transparency** Feature Database Migration Service is generally available ([GA](https://cloud.google.com/products#product-launch-stages)). **BigQuery** Feature The [BigQuery Data Engineering Agent](https://docs.cloud.google.com/gemini/data-agents/data-engineering-agent/agent-overview.md.txt) is now available in the `asia-northeast1` (Tokyo) regional endpoint and supports the gemini-3.5-flash model. For more information, see [Where Gemini in BigQuery processes your data](https://docs.cloud.google.com/bigquery/docs/gemini-locations.md.txt#bigquery-data-engineering-agent). This feature is [Generally Available](https://cloud.google.com/products#product-launch-stages) (GA). Feature Lakehouse now supports change data capture (CDC) ingestion from Delta Lake and Apache Iceberg tables ([Preview](https://cloud.google.com/products#product-launch-stages)). You can now synchronize CDC transaction logs (inserts, updates, deletes) from Delta Lake and Apache Iceberg tables into Lakehouse Apache Iceberg tables using Dataflow batch jobs (for Delta Lake) or batch and streaming jobs (for Apache Iceberg). For more information, see [Migrate Delta Lake CDC data into Lakehouse using Dataflow](https://docs.cloud.google.com/lakehouse/docs/migrate-delta-lake-cdc) and [Migrate Apache Iceberg CDC data into Lakehouse using Dataflow](https://docs.cloud.google.com/lakehouse/docs/migrate-iceberg-cdc). **Cloud SQL for MySQL** Feature > [!NOTE] > **Note:** Near real-time sync upon Knowledge Catalog (KC) enablement isn't available for existing instances created before April 18, 2026. For more information, see the [release note from October 14, 2026](https://docs.cloud.google.com/release-notes.md.txt#October_14_2026). When you enable [Knowledge Catalog (formerly Dataplex Universal Catalog)](https://docs.cloud.google.com/sql/docs/mysql/dataplex-catalog-integration.md.txt) integration on an eligible Cloud SQL for MySQL instance created before April 18, 2026 where the integration is currently turned off, the instance now syncs schema and metadata updates to Knowledge Catalog in near real-time instead of once a day (instances created on or after April 18, 2026 have near real-time sync enabled by default). This feature is available for instances running MySQL version 8.0 or later on the [new network architecture](https://docs.cloud.google.com/sql/docs/mysql/upgrade-cloud-sql-instance-new-network-architecture.md.txt#overview). If Knowledge Catalog integration is already enabled on the instance with once-a-day updates, you can [deactivate](https://docs.cloud.google.com/sql/docs/mysql/dataplex-catalog-integration.md.txt#deactivate-dataplex-catalog) and re-enable the integration to switch to near real-time updates. For more information, see [Enable the integration of Knowledge Catalog on an existing Cloud SQL instance](https://docs.cloud.google.com/sql/docs/mysql/dataplex-catalog-integration.md.txt#enable-dataplex-catalog). **Cloud SQL for PostgreSQL** Feature > [!NOTE] > **Note:** Near real-time sync upon Knowledge Catalog (KC) enablement isn't available for existing instances created before April 18, 2026. For more information, see the [release note from October 14, 2026](https://docs.cloud.google.com/release-notes.md.txt#October_14_2026). When you enable [Knowledge Catalog (formerly Dataplex Universal Catalog)](https://docs.cloud.google.com/sql/docs/postgres/dataplex-catalog-integration.md.txt) integration on an eligible Cloud SQL for PostgreSQL instance created before April 18, 2026 where the integration is currently turned off, the instance now syncs schema and metadata updates to Knowledge Catalog in near real-time instead of once a day (instances created on or after April 18, 2026 have near real-time sync enabled by default). This feature is available for instances running PostgreSQL version 14.0 or later on the [new network architecture](https://docs.cloud.google.com/sql/docs/postgres/upgrade-cloud-sql-instance-new-network-architecture.md.txt#overview). If Knowledge Catalog integration is already enabled on the instance with once-a-day updates, you can [deactivate](https://docs.cloud.google.com/sql/docs/postgres/dataplex-catalog-integration.md.txt#deactivate-dataplex-catalog) and re-enable the integration to switch to near real-time updates. For more information, see [Enable the integration of Knowledge Catalog on an existing Cloud SQL instance](https://docs.cloud.google.com/sql/docs/postgres/dataplex-catalog-integration.md.txt#enable-dataplex-catalog). **Datastream** Feature Datastream now supports replicating SQL Server `GEOMETRY` and `GEOGRAPHY` spatial data types. For more information, see the following: - [Map SQL Server data types to Datastream unified types](https://docs.cloud.google.com/datastream/docs/unified-types#map-sqlserver) - [Data type mappings in BigQuery](https://docs.cloud.google.com/datastream/docs/bq-map-data-types.md.txt) **Gemini** Announcement Sale of Gemini Code Assist subscriptions is ending. Starting October 9, 2026, new Gemini Code Assist Standard and Enterprise subscriptions can no longer be purchased. Existing subscriptions will continue to auto-renew through the rest of 2026, but auto-renewal will end in 2027. For more information, see [Gemini Code Assist Standard and Enterprise subscriptions](https://docs.cloud.google.com/gemini/docs/codeassist/sunset). For alternative AI developer tools, use Antigravity, which is available through eligible [Gemini Enterprise subscriptions](https://docs.cloud.google.com/gemini/enterprise/docs/ai-developer-tools-overview.md.txt) and through [Gemini Enterprise Agent Platform](https://antigravity.google/docs/enterprise/#gemini-enterprise-agent-platform-api-setup). Announcement Sale of Gemini Code Assist subscriptions is ending. Starting October 9, 2026, new Gemini Code Assist Standard and Enterprise subscriptions can no longer be purchased. Existing subscriptions will continue to auto-renew through the rest of 2026, but auto-renewal will end in 2027. For more information, see [Gemini Code Assist Standard and Enterprise subscriptions](https://docs.cloud.google.com/gemini/docs/codeassist/sunset). For alternative AI developer tools, use Antigravity, which is available through eligible [Gemini Enterprise subscriptions](https://docs.cloud.google.com/gemini/enterprise/docs/ai-developer-tools-overview.md.txt) and through [Gemini Enterprise Agent Platform](https://antigravity.google/docs/enterprise/#gemini-enterprise-agent-platform-api-setup). **Google Cloud Managed Service for Apache Kafka** Change The format for bootstrap addresses and broker URLs has changed for new Managed Service for Apache Kafka clusters. To learn how to get a cluster's bootstrap address, see [View a Managed Service for Apache Kafka cluster](https://docs.cloud.google.com/managed-service-for-apache-kafka/docs/view-cluster.md.txt#view-bootstrap-address). **Looker** Announcement Beginning October 5, 2026, the following features will be automatically enabled for Looker (original) instances running Looker 26.18. Feature enablement for Looker (Google Cloud core) will be announced separately. Feature Looker now includes built-in support for the **Dremio 26.0+ (Arrow Flight SQL)** dialect. The **Dremio 26.0+ (Arrow Flight SQL)** uses the bundled Apache Arrow Flight SQL JDBC driver, so that you don't have to install unpackaged custom JDBC driver JAR files. See the [Dremio](https://docs.cloud.google.com/looker/docs/db-config-dremio.md.txt) documentation page for more information. Feature The **AI-Assisted Quick Starts** feature, called [**Starter questions**](https://docs.cloud.google.com/looker/docs/gemini-quick-starts.md.txt) in the new Explore experience, is now generally available. Feature The new [**Diagnose \& Repair** tool](https://docs.cloud.google.com/looker/docs/diagnosing-and-repairing-git-projects.md.txt) evaluates your LookML project repository across eight diagnostic test checks in either your personal development environment or the shared production environment. When issues are found, Looker can automatically perform repairs (such as removing stale lock files, fixing file permissions, or repairing corrupted object indexes) or rebuild damaged repositories while safeguarding uncommitted changes on a dedicated recovery branch. Feature [Looker Continuous Integration (CI)](https://docs.cloud.google.com/looker/docs/continuous-integration.md.txt) now includes the [Style Validator](https://docs.cloud.google.com/looker/docs/ci-style-validator.md.txt), which enforces LookML coding standards, naming conventions, and structural best practices across your LookML project. You can run the Style Validator with the default built-in ruleset or customize rule severities, file exclusions, path overrides, and custom rules by adding an `lkmlstyle.yaml` configuration file to your project repository. Feature Now available in [preview](https://cloud.google.com/products#product-launch-stages), [Conversational Analytics agentic workflows](https://docs.cloud.google.com/looker/docs/conversational-analytics-agentic-workflows-overview.md.txt) support [scheduled agentic workflows](https://docs.cloud.google.com/looker/docs/conversational-analytics-scheduled-agentic-workflows.md.txt) in addition to [triggered agentic workflows](https://docs.cloud.google.com/looker/docs/conversational-analytics-triggered-agentic-workflows.md.txt). You can use scheduled agentic workflows to schedule recurring deliveries of AI-generated insights summaries, data tables, visualizations, and PDF reports to email or Slack by using natural language. Recipients can select **Investigate** in a workflow notification to open a private, persistent conversation with the data agent. Users and admins can manage workflows on the updated [**Manage Workflows** user page](https://docs.cloud.google.com/looker/docs/user-workflows.md.txt) and [**Manage Workflows** admin page](https://docs.cloud.google.com/looker/docs/admin-panel-alerts-and-schedules-workflows.md.txt), respectively, and Looker admins can monitor scheduled workflow runs and troubleshoot errors on the new [**Workflow Executions** admin page](https://docs.cloud.google.com/looker/docs/admin-panel-alerts-and-schedules-workflow-executions.md.txt). Workflows that were created in versions earlier than Looker 26.14 appear on the **Legacy Workflows** tab and must be recreated. Feature Now available in preview, [Looker **Data Apps**](https://docs.cloud.google.com/looker/docs/data-apps.md.txt) are freeform canvas dashboards that are built by local AI coding agents, such as Gemini CLI, Claude Code, or Cursor, from natural-language prompts. **Data Apps** give you complete visual layout control (including absolute positioning, overlapping elements, and custom web components) while remaining bound to Looker's governed LookML semantic layer and user permissions. Change In Conversational Analytics, the default [question mode](https://docs.cloud.google.com/looker/docs/conversational-analytics-looker-data.md.txt#ca-question-mode) is now **Fast** rather than **Thinking** . **Fast** mode is intended for answering quickly, and it directly maps your query to underlying LookML definitions without generating reasoning steps. You can still select **Thinking** mode from the question mode drop-down menu when asking complex, multi-step analytical questions about [Explores](https://docs.cloud.google.com/looker/docs/conversational-analytics-looker-data.md.txt#ca-question-mode) or [dashboards](https://docs.cloud.google.com/looker/docs/conversational-analytics-looker-data-agents-dashboards.md.txt#ca-question-mode). Change The [**Modern User Interface** preview feature](https://docs.cloud.google.com/looker/docs/admin-panel-general-preview-features.md.txt#modern_user_interface) toggle now defaults to **ON**. Change The [Modern visualization theme](https://docs.cloud.google.com/looker/docs/modern-ui.md.txt#modern_visualizations) now supports map charts (static map points and regions), word cloud charts, and donut multiples. While support for donut multiples was previously documented, it is now officially available with this release. These additions expand the range of visualization options that are available with the modern theme. Feature Looker now supports connections to the ClickHouse 26+ dialect. ClickHouse 26+ uses modernized JDBC drivers and introduces support for [symmetric aggregates](https://docs.cloud.google.com/looker/docs/reference/param-explore-symmetric-aggregates.md.txt). See the [ClickHouse](https://docs.cloud.google.com/looker/docs/db-config-clickhouse.md.txt) documentation page for more information. Feature Enhanced observability metrics, including user engagement and estimated token usage data on the [**Token usage** tab](https://docs.cloud.google.com/looker/docs/system-activity-dashboards.md.txt#ca-sa-token-usage) of the [Conversational Analytics System Activity dashboard](https://docs.cloud.google.com/looker/docs/system-activity-dashboards.md.txt#conversational-analytics), are now generally available ([GA](https://cloud.google.com/products#product-launch-stages)). This launch also adds a **Daily Token Utilization** visualization and supports token usage observability for [Conversational Analytics data agents that are published to Gemini Enterprise](https://docs.cloud.google.com/looker/docs/conversational-analytics-looker-data-agents.md.txt#publish-data-agents). (**Note**: This item was added on October 20, 2026.) **Model Armor** Feature Model Armor includes enhanced prompt injection and jailbreak protection for Workspace data. This capability improves detection accuracy and minimizes false positives when screening Workspace content, such as emails, documents, and files. This capability is available on multi-region endpoints in the US (`us`) and EU (`eu`) for templates and floor setting configured with [filter version](https://docs.cloud.google.com/model-armor/set-filter-version.md.txt) `v3` or later, including the `Stable` and `Latest` aliases. **Secure Web Proxy** Feature Secure Web Proxy supports [global access](https://docs.cloud.google.com/secure-web-proxy/docs/configure-global-access). You can enable this feature when creating a Secure Web Proxy instance to make sure that clients from any Google Cloud region can connect to your proxy. With global access, you can route your outbound traffic through specific regions to meet regulatory compliance or cost requirements. You can also use this option to simplify your network administration by managing outbound traffic from a centralized location. This feature is available in [Preview](https://cloud.google.com/products#product-launch-stages). **Security Command Center** Feature Using gcloud CLI, the `securitycenter` REST API, or client libraries, you can configure Pub/Sub and BigQuery continuous export to receive notifications when findings are deleted from Security Command Center due to data retention policies. For more information, see the following: - [Enable finding notifications for Pub/Sub](https://docs.cloud.google.com/security-command-center/docs/how-to-notifications.md.txt) - [Stream findings to BigQuery for analysis](https://docs.cloud.google.com/security-command-center/docs/how-to-analyze-findings-in-big-query.md.txt) - [Enable real-time notifications](https://docs.cloud.google.com/security-command-center/docs/how-to-enable-real-time-notifications.md.txt) - [Creating and managing Notification Configs](https://docs.cloud.google.com/security-command-center/docs/how-to-api-manage-notifications.md.txt) **Sensitive Data Protection** Change If you set `InfoType.version` to `legacy` when including the `MEDICAL_ID` infoType in your `InspectConfig`, Sensitive Data Protection now includes `MEDICAL_RECORD_NUMBER` findings as type `MEDICAL_ID` in the scan results. ## October 08, 2026 **Cloud SQL for MySQL** Feature Cloud SQL for MySQL now supports the `innodb_cloudsql_managed_buffer_pool_tuneup_pct` database flag. Managed buffer pool automatically adjusts the InnoDB buffer pool size to reduce out-of-memory events. When instance memory usage remains at or below 70% for 10 minutes or longer after prior reductions, Cloud SQL increases the buffer pool size. You can now use the `innodb_cloudsql_managed_buffer_pool_tuneup_pct` flag to change this 70% threshold to a different percentage. Increase the threshold to restore the InnoDB buffer pool size when baseline usage exceeds 70%, or decrease it to preserve additional RAM allocation for memory spikes. This flag requires the Cloud SQL maintenance version [*MYSQL_VERSION*.R20260726.00_05](https://docs.cloud.google.com/sql/docs/mysql/maintenance-changelog.md.txt) or later. For more information, see [Enable managed buffer pool](https://docs.cloud.google.com/sql/docs/mysql/optimize-high-memory-usage#enable-managed-buffer-pool). Feature Cloud SQL for MySQL supports blue-green deployments ([Preview](https://cloud.google.com/products#product-launch-stages)). Blue-green deployments let you update databases---such as performing major version upgrades from MySQL 8.0 to 8.4 and staging hardware or configuration modifications---while minimizing downtime. During a blue-green deployment, Cloud SQL creates a separate staging environment (green) that mirrors your existing production environment (blue) and maintains continuous logical replication from blue to green. You can test application compatibility and performance on the green environment without affecting production traffic, and then trigger a switchover to the green environment with minimal application downtime. For more information, see [About blue-green deployments in Cloud SQL](https://docs.cloud.google.com/sql/docs/mysql/about-blue-green-deployments). **Compute Engine** Feature **Generally available** : You can sync a Compute Engine VM's clock with its host server's clock by using `chrony` and `ptp_kvm` to achieve accuracy designed to be within 1 ms. Accurate time synchronization is supported in all standard public Google Cloud [regions and zones](https://docs.cloud.google.com/compute/docs/regions-zones.md.txt). For more information, see [Configure accurate time for Compute Engine VMs](https://docs.cloud.google.com/compute/docs/instances/time-synchronization/configure-time-sync.md.txt). **Gemini** Other ### Bug fixes in VS Code Various bug fixes and minor product enhancements. **Gemini Enterprise** Feature **Gemini Enterprise: Gemini 3.8 Flash regional availability in Singapore** Gemini 3.8 Flash is generally available (GA) in Singapore (`sg`) with in-region at-rest data residency (DRZ) and machine learning processing (MLP). For more information, see [Data residency for Gemini Enterprise Standard and Plus Editions and Gemini Notebook Enterprise](https://docs.cloud.google.com/gemini/enterprise/docs/locations). Feature **Gemini Enterprise: Anthropic Claude Opus 5.5 and Claude Sonnet 5.5 in AI developer tools** Administrators can enable Anthropic Claude Opus 5.5 (`claude-opus-5-5`) and Anthropic Claude Sonnet 5.5 (`claude-sonnet-5-5`) for AI developer tools (Antigravity 2.0, Antigravity CLI, and Antigravity for IDEs). Third-party models are turned off by default: - **In-console Terms of Service consent flow** : Administrators can opt in to Claude Opus 5.5 and Claude Sonnet 5.5 directly in **Gemini Enterprise \> Settings \> AI developer tools \> Antigravity authorized models** in the Google Cloud console without a separate Anthropic account or onboarding. For more information, see [Configure AI developer tools settings](https://docs.cloud.google.com/gemini/enterprise/docs/ai-developer-tools-settings#enable-third-party-models). - **Location availability** : Third-party model inference is available in the `global`, `us`, and `eu` locations (in-country regions aren't supported). For a list of countries and regions that can access the model, see [Anthropic's Supported countries and regions](https://www.anthropic.com/supported-countries). - **Consumption billing** : Third-party model usage is billed as consumption on your Cloud Billing account and counts toward your project's spend cap, which covers all models. Pay-as-you-go usage above quota must be turned on before you can enable a third-party model. For more information, see [Configure pay-as-you-go usage above quota](https://docs.cloud.google.com/gemini/enterprise/docs/configure-pay-as-you-go-usage-above-quota) and the Cloud Billing SKUs for [Anthropic Claude Opus 5.5](https://cloud.google.com/skus?filter=opus¤cy=USD&e=48754805) and [Anthropic Claude Sonnet 5.5](https://cloud.google.com/skus?filter=sonnet¤cy=USD&e=48754805). - **Thinking levels**: Developers sign in with their existing Gemini Enterprise license and select Claude Opus 5.5 or Claude Sonnet 5.5 in the model picker at a thinking level of Low, Medium, High, or Max (for example, Claude Opus 5.5 (High)). Medium is the default. **Google Cloud Contact Center as a Service** Announcement **Google Cloud CCaaS 6.19** We've released version 6.19 of Google Cloud CCaaS. The timing of the update to your instance depends on the deployment schedule that you have chosen. For more information, see [Deployment schedules](https://docs.cloud.google.com/contact-center/ccai-platform/docs/deployment-schedules). Fixed This release addresses the following issues: - Fixed an issue where agents could be assigned more concurrent chats than their configured maximum limit when multiple chat offers arrived almost simultaneously. - Fixed an issue where calls were unevenly distributed among available agents on skills-based queues. - Fixed an issue where supervisor-initiated sign-outs silently discarded mandatory interaction dispositions during an agent's wrap-up period. - Fixed an issue where an agent's corporate email address and internal ID were exposed in the browser's network metadata during a virtual agent to human escalation. - Fixed an issue where voice calls were incorrectly routed back to the virtual agent queue instead of the intended destination. - Fixed an issue where inbound callers experienced a 2-second delay when connecting to an agent. **Google Kubernetes Engine** Change #### (2026-R43) Version updates GKE cluster versions have been updated. **New versions available for upgrades and new clusters.** The following versions are now available for new GKE clusters, and for manual control plane upgrades and node upgrades for existing clusters. For more information about versioning and upgrades, see [GKE versioning and support](https://cloud.google.com/kubernetes-engine/versioning) and [About GKE cluster upgrades](https://cloud.google.com/kubernetes-engine/upgrades). ### Rapid channel > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.36.4-gke.2046002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046002) is now the default version for cluster creation in the Rapid channel. - The following versions are now available in the Rapid channel: - [1.34.12-gke.1153000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1153000) - [1.35.8-gke.1919000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1919000) - [1.36.4-gke.2046002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046002) - [1.36.4-gke.2202002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2202002) - [1.36.4-gke.2304000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2304000) - [1.36.4-gke.2326000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2326000) - [1.37.1-gke.1552000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-1552000) - [Alpha version](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#alpha-versions) 1.38.0-gke.2743000+preview is now available for GKE alpha clusters in the Rapid channel. - The following versions are no longer available in the Rapid channel: - 1.34.11-gke.1209000 - 1.35.8-gke.1626001 - 1.36.4-gke.1495000 - 1.36.4-gke.2046000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Rapid channel. This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.12-gke.1011000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1011000) - 1.34 to [1.35.8-gke.1796000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1796000) - 1.35 to [1.36.4-gke.2046002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046002) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.12-gke.1011000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1011000) - 1.35 to [1.35.8-gke.1796000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1796000) - 1.36 to [1.36.4-gke.2046002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046002) ### Regular channel > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.36.4-gke.1391002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391002) is now the default version for cluster creation in the Regular channel. - The following versions are now available in the Regular channel: - [1.34.11-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1209000) - [1.35.8-gke.1626001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1626001) - [1.36.4-gke.1391002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391002) - [1.36.4-gke.1495002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495002) - The following versions are no longer available in the Regular channel: - 1.34.11-gke.1056000 - 1.35.8-gke.1380001 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Regular channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.35.8-gke.1225000 - 1.36.4-gke.1247000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Regular channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.1391000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Regular channel. This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.11-gke.1102000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1102000) - 1.34 to [1.35.8-gke.1439001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1439001) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.11-gke.1102000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1102000) - 1.35 to [1.35.8-gke.1439001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1439001) - 1.36 to [1.36.4-gke.1391002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391002) ### Stable channel > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.34.11-gke.1056000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1056000) is now available in the Stable channel. - Version 1.34.11-gke.1044000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Stable channel. This version will be removed in 90 days, or at the end of support, if sooner. ### Extended channel > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.36.4-gke.1391002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391002) is now the default version for cluster creation in the Extended channel. - The following versions are now available in the Extended channel: - [1.31.14-gke.2759000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2759000) - [1.31.14-gke.2925000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2925000) - [1.32.13-gke.2504000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2504000) - [1.32.13-gke.2662000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2662000) - [1.33.13-gke.1721000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1721000) - [1.33.13-gke.1915000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1915000) - [1.34.11-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1209000) - [1.35.8-gke.1626001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1626001) - [1.36.4-gke.1391002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391002) - [1.36.4-gke.1495002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495002) - The following versions are no longer available in the Extended channel: - 1.31.14-gke.2689000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.31.14-gke.2825000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.32.13-gke.2411000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.32.13-gke.2567000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.33.13-gke.1636000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.33.13-gke.1815000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.34.11-gke.1056000 - 1.35.8-gke.1380001 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.1247000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.1391000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or deprecated APIs, preventing upgrades: - 1.30 to [1.31.14-gke.2704000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2704000) - 1.31 to [1.32.13-gke.2427000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2427000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or other factors preventing minor version upgrades: - 1.31 to [1.31.14-gke.2704000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2704000) - 1.32 to [1.32.13-gke.2427000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2427000) - 1.33 to [1.33.13-gke.1647000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1647000) - 1.34 to [1.34.11-gke.1102000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1102000) - 1.35 to [1.35.8-gke.1439001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1439001) - 1.36 to [1.36.4-gke.1391002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391002) ### No channel (deprecated) > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.36.4-gke.1391002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391002) is now the default version for cluster creation. - The following versions are now available: - [1.34.12-gke.1153000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1153000) - [1.35.8-gke.1919000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1919000) - [1.36.4-gke.1391002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391002) - [1.36.4-gke.1495002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495002) - [1.36.4-gke.2046002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046002) - [1.36.4-gke.2202002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2202002) - [1.36.4-gke.2304000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2304000) - [1.36.4-gke.2326000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2326000) - The following node versions are now available: - [1.31.14-gke.2925000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2925000) - [1.32.13-gke.2662000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2662000) - [1.33.13-gke.1915000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1915000) - [1.34.12-gke.1153000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1153000) - [1.35.8-gke.1919000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1919000) - [1.36.4-gke.1391002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391002) - [1.36.4-gke.1495002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495002) - [1.36.4-gke.2046002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046002) - [1.36.4-gke.2202002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2202002) - [1.36.4-gke.2304000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2304000) - [1.36.4-gke.2326000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2326000) - The following versions are no longer available: - 1.34.11-gke.1044000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.35.8-gke.1036000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.35.8-gke.1380001 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.1247000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.1391000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.2046000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.11-gke.1102000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1102000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.11-gke.1102000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1102000) - 1.36 to [1.36.4-gke.1391002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391002) Security #### (2026-R43) Security updates This release includes new GKE versions that use updated Container-Optimized OS images. These updated images are cumulative, incorporating security fixes from all Container-Optimized OS versions released since the previous GKE release. To identify the specific vulnerabilities that were resolved in each updated Container-Optimized OS image, see the **Security** release notes for that image. The following table includes links to the release notes for each updated Container-Optimized OS image: | GKE version | Container-Optimized OS version | Details | |---|---|---| | 1.31.14-gke.2925000 | cos-121-18867-624-2 | [cos-121-18867-624-2 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m121.md.txt#cos-121-18867-624-2_) | | 1.32.13-gke.2662000 | cos-121-18867-624-2 | [cos-121-18867-624-2 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m121.md.txt#cos-121-18867-624-2_) | | 1.33.13-gke.1915000 | cos-121-18867-624-2 | [cos-121-18867-624-2 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m121.md.txt#cos-121-18867-624-2_) | | 1.34.12-gke.1153000 | cos-125-19216-700-7 | [cos-125-19216-700-7 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m125.md.txt#cos-125-19216-700-7_) | | 1.35.8-gke.1919000 | cos-125-19216-700-7 | [cos-125-19216-700-7 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m125.md.txt#cos-125-19216-700-7_) | | 1.36.4-gke.2202002 | cos-129-19506-505-8 | [cos-129-19506-505-8 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m129.md.txt#cos-129-19506-505-8_) | | 1.37.1-gke.1552000 | cos-133-19999-44-85 | [cos-133-19999-44-85 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m133.md.txt#cos-133-19999-44-85_) | | 1.38.0-gke.2743000+preview | cos-133-19999-44-85 | [cos-133-19999-44-85 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m133.md.txt#cos-133-19999-44-85_) |
Change #### (2026-R43) Version updates > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.34.11-gke.1056000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1056000) is now available in the Stable channel. - Version 1.34.11-gke.1044000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Stable channel. This version will be removed in 90 days, or at the end of support, if sooner. Change #### (2026-R43) Version updates > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.36.4-gke.1391002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391002) is now the default version for cluster creation in the Regular channel. - The following versions are now available in the Regular channel: - [1.34.11-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1209000) - [1.35.8-gke.1626001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1626001) - [1.36.4-gke.1391002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391002) - [1.36.4-gke.1495002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495002) - The following versions are no longer available in the Regular channel: - 1.34.11-gke.1056000 - 1.35.8-gke.1380001 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Regular channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.35.8-gke.1225000 - 1.36.4-gke.1247000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Regular channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.1391000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Regular channel. This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.11-gke.1102000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1102000) - 1.34 to [1.35.8-gke.1439001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1439001) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.11-gke.1102000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1102000) - 1.35 to [1.35.8-gke.1439001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1439001) - 1.36 to [1.36.4-gke.1391002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391002) Change #### (2026-R43) Version updates > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.36.4-gke.2046002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046002) is now the default version for cluster creation in the Rapid channel. - The following versions are now available in the Rapid channel: - [1.34.12-gke.1153000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1153000) - [1.35.8-gke.1919000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1919000) - [1.36.4-gke.2046002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046002) - [1.36.4-gke.2202002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2202002) - [1.36.4-gke.2304000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2304000) - [1.36.4-gke.2326000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2326000) - [1.37.1-gke.1552000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-1-gke-1552000) - [Alpha version](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#alpha-versions) 1.38.0-gke.2743000+preview is now available for GKE alpha clusters in the Rapid channel. - The following versions are no longer available in the Rapid channel: - 1.34.11-gke.1209000 - 1.35.8-gke.1626001 - 1.36.4-gke.1495000 - 1.36.4-gke.2046000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Rapid channel. This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.12-gke.1011000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1011000) - 1.34 to [1.35.8-gke.1796000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1796000) - 1.35 to [1.36.4-gke.2046002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046002) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.12-gke.1011000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1011000) - 1.35 to [1.35.8-gke.1796000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1796000) - 1.36 to [1.36.4-gke.2046002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046002) Change #### (2026-R43) Version updates > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.36.4-gke.1391002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391002) is now the default version for cluster creation. - The following versions are now available: - [1.34.12-gke.1153000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1153000) - [1.35.8-gke.1919000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1919000) - [1.36.4-gke.1391002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391002) - [1.36.4-gke.1495002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495002) - [1.36.4-gke.2046002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046002) - [1.36.4-gke.2202002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2202002) - [1.36.4-gke.2304000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2304000) - [1.36.4-gke.2326000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2326000) - The following node versions are now available: - [1.31.14-gke.2925000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2925000) - [1.32.13-gke.2662000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2662000) - [1.33.13-gke.1915000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1915000) - [1.34.12-gke.1153000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1153000) - [1.35.8-gke.1919000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1919000) - [1.36.4-gke.1391002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391002) - [1.36.4-gke.1495002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495002) - [1.36.4-gke.2046002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046002) - [1.36.4-gke.2202002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2202002) - [1.36.4-gke.2304000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2304000) - [1.36.4-gke.2326000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2326000) - The following versions are no longer available: - 1.34.11-gke.1044000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.35.8-gke.1036000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.35.8-gke.1380001 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.1247000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.1391000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.2046000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.11-gke.1102000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1102000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.11-gke.1102000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1102000) - 1.36 to [1.36.4-gke.1391002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391002) Change #### (2026-R43) Version updates > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.36.4-gke.1391002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391002) is now the default version for cluster creation in the Extended channel. - The following versions are now available in the Extended channel: - [1.31.14-gke.2759000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2759000) - [1.31.14-gke.2925000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2925000) - [1.32.13-gke.2504000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2504000) - [1.32.13-gke.2662000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2662000) - [1.33.13-gke.1721000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1721000) - [1.33.13-gke.1915000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1915000) - [1.34.11-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1209000) - [1.35.8-gke.1626001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1626001) - [1.36.4-gke.1391002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391002) - [1.36.4-gke.1495002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495002) - The following versions are no longer available in the Extended channel: - 1.31.14-gke.2689000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.31.14-gke.2825000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.32.13-gke.2411000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.32.13-gke.2567000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.33.13-gke.1636000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.33.13-gke.1815000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.34.11-gke.1056000 - 1.35.8-gke.1380001 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.1247000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.1391000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or deprecated APIs, preventing upgrades: - 1.30 to [1.31.14-gke.2704000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2704000) - 1.31 to [1.32.13-gke.2427000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2427000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or other factors preventing minor version upgrades: - 1.31 to [1.31.14-gke.2704000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2704000) - 1.32 to [1.32.13-gke.2427000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2427000) - 1.33 to [1.33.13-gke.1647000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1647000) - 1.34 to [1.34.11-gke.1102000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1102000) - 1.35 to [1.35.8-gke.1439001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1439001) - 1.36 to [1.36.4-gke.1391002](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391002) **Google SecOps SIEM** Change Google SecOps has updated the list of [supported default parsers](https://docs.cloud.google.com/chronicle/docs/ingestion/parser-list/supported-default-parsers.md.txt). Parsers are updated gradually, so it might take one to four days before you see the changes reflected in your region. The following supported default parsers have been updated. Each parser is listed by product name and `log_type` value, where applicable. This list includes both released default parsers and pending parser updates. - AIX system (`AIX_SYSTEM`) - Apache (`APACHE`) - AppOmni (`APPOMNI`) - Armis Activities (`ARMIS_ACTIVITIES`) - Atlassian Cloud Admin Audit (`ATLASSIAN_AUDIT`) - Atlassian Bitbucket (`ATLASSIAN_BITBUCKET`) - Linux Auditing System (AuditD) (`AUDITD`) - AWS Cloudtrail (`AWS_CLOUDTRAIL`) - AWS Inspector (`AWS_INSPECTOR`) - AWS RDS (`AWS_RDS`) - Microsoft Azure Activity (`AZURE_ACTIVITY`) - Azure AD Directory Audit (`AZURE_AD_AUDIT`) - Azure AD Organizational Context (`AZURE_AD_CONTEXT`) - Azure AD Sign-In (`AZURE_AD_SIGNIN`) - Azure App Service (`AZURE_APP_SERVICE`) - Azure Firewall (`AZURE_FIREWALL`) - Azure Application Gateway (`AZURE_GATEWAY`) - Azure Key Vault logging (`AZURE_KEYVAULT_AUDIT`) - Bitdefender (`BITDEFENDER`) - Blue Coat Proxy (`BLUECOAT_WEBPROXY`) - Box (`BOX`) - Zeek JSON (`BRO_JSON`) - Check Point Sandblast (`CHECKPOINT_EDR`) - Chrome Management (`CHROME_MANAGEMENT`) - CipherTrust Manager (`CIPHERTRUST_MANAGER`) - Cisco ACS (`CISCO_ACS`) - Cisco ASA (`CISCO_ASA_FIREWALL`) - Cisco Email Security (`CISCO_EMAIL_SECURITY`) - Cisco Firepower NGFW (`CISCO_FIREPOWER_FIREWALL`) - Cisco FireSIGHT Management Center (`CISCO_FIRESIGHT`) - Cisco IronPort (`CISCO_IRONPORT`) - Cisco Meraki (`CISCO_MERAKI`) - Cisco Umbrella Audit (`CISCO_UMBRELLA_AUDIT`) - Cisco WLC/WCS (`CISCO_WIRELESS`) - Citrix Netscaler (`CITRIX_NETSCALER`) - Claroty Xdome (`CLAROTY_XDOME`) - Claude Compliance Logs (`CLAUDE_COMPLIANCE_LOGS`) - Cloudflare Audit (`CLOUDFLARE_AUDIT`) - Corelight (`CORELIGHT`) - Palo Alto Cortex XDR Alerts (`CORTEX_XDR`) - CrowdStrike Alerts API (`CS_ALERTS`) - CrowdStrike Falcon (`CS_EDR`) - CrowdStrike Falcon Stream (`CS_STREAM`) - CyberArk (`CYBERARK`) - CyberArk Privileged Access Manager (PAM) (`CYBERARK_PAM`) - Darktrace (`DARKTRACE`) - F5 Advanced Firewall Management (`F5_AFM`) - F5 BIGIP LTM (`F5_BIGIP_LTM`) - F5 VPN (`F5_VPN`) - FireEye HX (`FIREEYE_HX`) - FireEye NX (`FIREEYE_NX`) - Forcepoint DLP (`FORCEPOINT_DLP`) - Fortinet FortiAnalyzer (`FORTINET_FORTIANALYZER`) - Fortinet Fortimanager (`FORTINET_FORTIMANAGER`) - Fortinet FortiSandbox (`FORTINET_SANDBOX`) - Fortinet Switch (`FORTINET_SWITCH`) - Fortinet Proxy (`FORTINET_WEBPROXY`) - Apigee (`GCP_APIGEE_X`) - GCP Cloud Audit (`GCP_CLOUDAUDIT`) - Cloud DNS (`GCP_DNS`) - Security Command Center Threat (`GCP_SECURITYCENTER_THREAT`) - GCP Secure Web Proxy (`GCP_SWP`) - VPC Flow Logs (`GCP_VPC_FLOW`) - Gemini Code Assist (`GEMINI_CODE_ASSIST`) - Gitlab (`GITLAB`) - AWS GuardDuty (`GUARDDUTY`) - Huawei Switches (`HUAWEI_SWITCH`) - IBM AS/400 (`IBM_AS400`) - Microsoft IIS (`IIS`) - Illumio Core (`ILLUMIO_CORE`) - Imperva SecureSphere Management (`IMPERVA_SECURESPHERE`) - Infoblox (`INFOBLOX`) - Jenkins (`JENKINS`) - JFrog Artifactory (`JFROG_ARTIFACTORY`) - Journald (`JOURNALD`) - Juniper (`JUNIPER_FIREWALL`) - Juniper Junos (`JUNIPER_JUNOS`) - Kiteworks (`KITEWORKS`) - Kubernetes Node (`KUBERNETES_NODE`) - McAfee IPS (`MCAFEE_IPS`) - Microsoft Defender for Endpoint (`MICROSOFT_DEFENDER_ENDPOINT`) - Microsoft Defender for Identity (`MICROSOFT_DEFENDER_IDENTITY`) - Microsoft Defender for Office 365 (`MICROSOFT_DEFENDER_MAIL`) - Microsoft Sentinel (`MICROSOFT_SENTINEL`) - Microsoft SQL Server (`MICROSOFT_SQL`) - Netskope CASB (`NETSKOPE_CASB`) - Netskope Web Proxy (`NETSKOPE_WEBPROXY`) - Netwrix (`NETWRIX`) - NGINX (`NGINX`) - Unix system (`NIX_SYSTEM`) - Nutanix Prism (`NUTANIX_PRISM`) - Office 365 (`OFFICE_365`) - Okta (`OKTA`) - Okta User Context (`OKTA_USER_CONTEXT`) - Onapsis (`ONAPSIS`) - Oracle (`ORACLE_DB`) - Palo Alto Networks Firewall (`PAN_FIREWALL`) - Palo Alto Panorama (`PAN_PANORAMA`) - Palo Alto Prisma Cloud Alert payload (`PAN_PRISMA_CA`) - Ping One (`PING_ONE`) - Microsoft PowerShell (`POWERSHELL`) - Proofpoint Tap Alerts (`PROOFPOINT_MAIL`) - Pure Storage (`PURE_STORAGE`) - Red Hat OpenShift (`REDHAT_OPENSHIFT`) - RSA NetWitness (`RSA_NETWITNESS`) - SailPoint IAM (`SAILPOINT_IAM`) - Salesforce (`SALESFORCE`) - Sangfor Next Generation Firewall (`SANGFOR_NGAF`) - Sap Business Technology Platform (`SAP_BTP`) - SAP Change Document (`SAP_CHANGE_DOCUMENT`) - SecureLink (`SECURELINK`) - Sentinelone Alerts (`SENTINELONE_ALERT`) - Slack Audit (`SLACK_AUDIT`) - Sourcefire (`SOURCEFIRE_IDS`) - Squid Web Proxy (`SQUID_WEBPROXY`) - STIX Threat Intelligence (`STIX`) - Sublime Security (`SUBLIMESECURITY`) - Symantec Event export (`SYMANTEC_EVENT_EXPORT`) - Synology (`SYNOLOGY`) - Sysdig (`SYSDIG`) - Tableau (`TABLEAU`) - Tanium Stream (`TANIUM_TH`) - TCPWave DDI (`TCPWAVE_DDI`) - Teleport Access Plane (`TELEPORT_ACCESS_PLANE`) - Tenable Security Center (`TENABLE_SC`) - Trellix HX Alerts (`TRELLIX_HX_ALERTS`) - Trellix HX Audit Events (`TRELLIX_HX_AUDIT`) - Trellix HX Event Streamer (`TRELLIX_HX_ES`) - TrendMicro Apex Central (`TRENDMICRO_APEX_CENTRAL`) - Trend Micro Email Security Advanced (`TRENDMICRO_EMAIL_SECURITY`) - Trend Micro Vision One Audit (`TRENDMICRO_VISION_ONE_AUDIT`) - Trend Micro Vision One (`TRENDMICRO_VISION_ONE`) - Trend Micro Vision One Observerd Attack Techniques (`TRENDMICRO_VISION_ONE_OBSERVERD_ATTACK_TECHNIQUES`) - Trend Micro Vision One Workbench (`TRENDMICRO_VISION_ONE_WORKBENCH`) - Ubiquiti UniFi Switch (`UBIQUITI_SWITCH`) - Uptycs EDR (`UPTYCS_EDR`) - Upwind (`UPWIND`) - Venafi ZTPKI (`VENAFI_ZTPKI`) - Veritas NetBackup (`VERITAS_NETBACKUP`) - Vmware Avinetworks iWAF (`VMWARE_AVINETWORKS_IWAF`) - VMware ESXi (`VMWARE_ESX`) - VMware vCenter (`VMWARE_VCENTER`) - VMware vRealize Suite (VMware Aria) (`VMWARE_VREALIZE`) - Wallix Bastion (`WALLIX_BASTION`) - Microsoft AD (`WINDOWS_AD`) - Windows Defender AV (`WINDOWS_DEFENDER_AV`) - Windows DHCP (`WINDOWS_DHCP`) - Windows DNS (`WINDOWS_DNS`) - Windows Sysmon (`WINDOWS_SYSMON`) - Windows Event (`WINEVTLOG`) - Windows Event (XML) (`WINEVTLOG_XML`) - wiz.io (`WIZ_IO`) - Workspace Activities (`WORKSPACE_ACTIVITY`) - Zoom Operation Logs (`ZOOM_OPERATION_LOGS`) The following log types were added without a default parser. Each parser is listed by product name and `log_type` value, where applicable. - Amazon Bedrock Model Invocation Logging (`AMAZON_BEDROCK_MODEL_INVOCATION_LOGGING`) - AppTrana Web Application Firewall (`AWS_APPTRANA`) - Azure Machine Learning (`AZURE_MACHINE_LEARNING`) - Bitstamp (`BITSTAMP`) - Cloud 9 (`CLOUD9`) - Cloudflare Brand Protection (`CLOUDFLARE_BRAND_PROTECTION`) - Cloudflare Browser Isolation (`CLOUDFLARE_BROWSER_ISOLATION`) - Delinea Cloud Platform (`DELINEA_CLOUD_PLATFORM`) - Honeywell Cyber Proactive Defense (`HONEYWELL_CPD`) - Huntress EDR (`HUNTRESS_EDR`) - IBM Cloud Alert Notification (`IBM_CLOUD_ALERT_NOTIFICATION`) - Meter Firewall NIDS (`METER_FIREWALL_NIDS`) - OutSystems Cloud (`OUTSYSTEMS_CLOUD`) - Staffbase Audit (`STAFFBASE_AUDIT`) - Statsig (`STATSIG`) - Temporal Cloud Audit Logs (`TEMPORAL_CLOUD_AUDIT_LOGS`) - Twilio Segment (`TWILIO_SEGMENT`) **Looker** Announcement **Looker 26.20** will roll out to Looker (original) and Looker (Google Cloud core) instances on the following schedule: - Expected deployment start: **Monday, October 12, 2026** - Expected final deployment and download available: **Sunday, October 25, 2026** Looker 26.20 is expected to include the following changes, features, and fixes. Breaking Custom TopoJSON URL validation is updated to improve security. This change is isolated to Google Maps rendering in preview. Existing dashboards and Looks with the [Google Maps Enhancements preview feature](https://docs.cloud.google.com/looker/docs/admin-panel-general-preview-features.md.txt#google-maps-enhancements) enabled that use custom TopoJSON files may be impacted. Feature The **Gemini in Looker** admin page has been restructured to allow Looker admins to selectively enable Conversational Analytics features and capabilities. Enablement for generally available Conversational Analytics features is now organized under the follow settings: - **Conversational Analytics (Conversations page)** : Enables access to the [**Conversations** page](https://docs.cloud.google.com/looker/docs/conversational-analytics-looker-data.md.txt) for data agents with Explores and direct chats with an Explore. - **Dashboard agents** : Enables [default data agents](https://docs.cloud.google.com/looker/docs/glossary.md.txt#default-agent) on [user-defined and LookML dashboards](https://docs.cloud.google.com/looker/docs/conversational-analytics-looker-data-agents-dashboards.md.txt). - **Additional options** : Allows Conversational Analytics data agent creators to enable the [**Advanced Analytics** feature](https://docs.cloud.google.com/looker/docs/conversational-analytics-looker-advanced-analytics.md.txt) for all conversations with their data agent. To use Advanced Analytics, you must also enable whichever Conversational Analytics toggle corresponds to the content that you are querying (**Conversational Analytics (Conversations page)** or **Dashboard agents** ). If both the **Conversational Analytics (Conversations page)** and **Dashboard agents** toggles are turned off, then **Advanced Analytics** cannot be enabled. If either **Conversational Analytics (Conversations page)** or **Dashboard agents** is enabled, **Advanced Analytics** can be enabled, but it is turned off by default. The **Conversational Analytics (Conversations page)** and **Dashboard agents** settings inherit the enablement state of the **Conversational Analytics** setting in previous versions of Looker. Conversational Analytics preview features can still be enabled selectively under the **Enable Trusted Tester Features** setting. (**Note**: This item was added on October 14, 2026.) Feature Conversational Analytics data agents for both [user-defined dashboards](https://docs.cloud.google.com/looker/docs/conversational-analytics-looker-data-agents-dashboards.md.txt) and [LookML dashboards](https://docs.cloud.google.com/looker/docs/conversational-analytics-looker-data-agents-lookml-dashboards.md.txt) are now generally available. (**Note**: This item was added on October 14, 2026.) Feature You can now apply [themes](https://docs.cloud.google.com/looker/docs/themes-for-internal-dashboards.md.txt) to Looks in addition to internal dashboards. Fixed An issue has been fixed where duplicating a scheduled plan could fail to retain the custom message value. This feature now performs as expected. Fixed Table visualizations now proportionally scale left-pinned columns during automatic sizing, which prevents unnecessary horizontal scrollbars. This feature now performs as expected. Fixed An issue has been fixed where enabling subtotals on table visualizations did not automatically disable the **Cell Visualizations** option. This feature now performs as expected. Fixed An issue has been fixed where previews for Looker charts in Slack integrations could fail to be displayed. This feature now performs as expected. Fixed An issue has been fixed where editing and saving a dashboard could cause the dashboard to reload indefinitely, forcing users to refresh the page. This feature now performs as expected. Fixed An issue has been fixed where table cell visualizations that included both positive and negative values could display unwanted scrollbars and hide value labels. This feature now performs as expected. Fixed An issue has been fixed where the BigQuery JDBC driver could fail to properly parse certain data types, such as `BYTES`, `STRUCT/RECORD`, and nested `ARRAY` structures. This feature now performs as expected. Fixed An issue has been fixed where linked filters on a dashboard could fail to display autocomplete suggestions even when a parent filter is selected. This feature now performs as expected. Fixed The System Activity `query_metrics` Explore has been updated to ensure that phase timings (such as connection acquisitions, execution runtimes, and optimistic pivot fallback retry loops) are successfully captured for queries that fail or time out. This feature now performs as expected. Fixed The System Activity **Dashboard Diagnostics** dashboard has been updated to fully support statistics, tile run counts, and performance recommendations for LookML dashboards. This feature now performs as expected. Fixed An issue has been fixed where the color palette popover in visualization settings failed to dynamically reposition when it expanded, causing controls to overlap or truncate. This feature now performs as expected. Breaking When you set up a connection, self-service modeling will now be available only if a role that grants `create_self_service_from_table` also selects it through that role's model set. Fixed The opacity for the comparison bar in short KPI visualizations has been reduced to increase legibility. **Memorystore for Redis** Feature To help protect your data and provide a baseline level of persistence, Redis Database (RDB) snapshots are enabled by default when you [create an instance](https://docs.cloud.google.com/memorystore/docs/redis/manage-rdb-snapshots.md.txt) using the Google Cloud console. This feature is [generally available (GA)](https://docs.cloud.google.com/products#product-launch-stages). **VPC Service Controls** Feature [General availability](https://cloud.google.com/products#product-launch-stages) support for the following integration: - [Cloud Storage for Firebase](https://docs.cloud.google.com/vpc-service-controls/docs/supported-products.md.txt#table_firebase_cloud_storage) Feature **VPC Service Controls feature (Status: [Preview](https://cloud.google.com/products#product-launch-stages))**: Support for automated remediation suggestions is available in the VPC Service Controls violation analyzer. Remediation suggestions analyze access denial events and generate actionable, narrowly scoped configuration changes to resolve perimeter denials and adhere to the principle of least privilege. The remediation engine can automatically propose ingress rules, egress rules, VPC accessible services updates, and existing or new context-aware access levels. For more information, see [Resolve access denials with remediation suggestions](https://docs.cloud.google.com/vpc-service-controls/docs/remediation-suggestions.md.txt). ## October 07, 2026 **Anti Money Laundering AI** Announcement New minor engine version released for the commercial line of business within the `v004.005` version line (`aml-commercial.default.v004.005.202609-000`). This version extends support for the major engine version and includes no significant changes compared to the previous minor version. **Apigee hybrid** Announcement ### v1.14.9 On October 7, 2026 we released an updated version of the Apigee hybrid software, v1.14.9. - For information on upgrading, see [Upgrading Apigee hybrid to version v1.14.9](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/upgrade.md.txt). - For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.14/big-picture.md.txt). > [!NOTE] > **Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images). Fixed #### Fixed in this release | Bug ID | Description | |---|---| | **565072374** | **Fixed an issue where `VerifyJWT` policies using a JWKS `uriRef` could return `steps.jwt.NoMatchingPublicKey` on the first request after the 5-minute JWKS cache TTL expired when the identity provider rotated keys. The cache now refreshes synchronously upon expiration.** | | **564969400** | **Fixed an issue where variables initialized from an empty `` element in `AssignMessage` (`AssignVariable`) were not treated as empty strings when referenced in message template functions such as `replaceAll`.** | | **558888960** | **Fixed an issue in distributed tracing where the target URL was omitted from outbound target request span attributes after a request-flow policy step executed.** | | **554114419** | **Apigee hybrid now allows policies to modify HTTP/2 request pseudo-headers (`:path` and `:authority`) when communicating over HTTP/2.** | | **548763108** | **Hardened Message Processor outbound HTTP validation to block requests to internal Kubernetes cluster hostnames (`*.svc.cluster.local`).** | | **513032450** | **Fixed an issue where `apigee-connect-agent` control-plane connections could hang for up to 2 hours when silently dropped by a network intermediary by restoring a 15-second TCP keep-alive.** | Security | Bug ID | Description | |---|---| | **N/A** | **Security fixes for `apigee-asm-ingress`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) | | **N/A** | **Security fixes for `apigee-asm-istiod`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) | | **N/A** | **Security fixes for `apigee-connect-agent`.** This addresses the following vulnerabilities: - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) | | **N/A** | **Security fixes for `apigee-fluent-bit`.** This addresses the following vulnerabilities: - [CVE-2026-14456](https://nvd.nist.gov/vuln/detail/CVE-2026-14456) - [CVE-2026-14457](https://nvd.nist.gov/vuln/detail/CVE-2026-14457) - [CVE-2026-18798](https://nvd.nist.gov/vuln/detail/CVE-2026-18798) - [CVE-2026-54874](https://nvd.nist.gov/vuln/detail/CVE-2026-54874) - [CVE-2026-63072](https://nvd.nist.gov/vuln/detail/CVE-2026-63072) - [CVE-2026-63073](https://nvd.nist.gov/vuln/detail/CVE-2026-63073) - [CVE-2026-63074](https://nvd.nist.gov/vuln/detail/CVE-2026-63074) - [CVE-2026-63075](https://nvd.nist.gov/vuln/detail/CVE-2026-63075) - [CVE-2026-63076](https://nvd.nist.gov/vuln/detail/CVE-2026-63076) - [CVE-2026-75803](https://nvd.nist.gov/vuln/detail/CVE-2026-75803) | | **N/A** | **Security fixes for `apigee-hybrid-cassandra-client`.** This addresses the following vulnerabilities: - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) | | **N/A** | **Security fixes for `apigee-kube-rbac-proxy`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) | | **N/A** | **Security fixes for `apigee-mart-server`.** This addresses the following vulnerabilities: - [CVE-2025-46392](https://nvd.nist.gov/vuln/detail/CVE-2025-46392) - [CVE-2026-13506](https://nvd.nist.gov/vuln/detail/CVE-2026-13506) - [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) - [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) - [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) - [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) - [CVE-2026-8763](https://nvd.nist.gov/vuln/detail/CVE-2026-8763) | | **N/A** | **Security fixes for `apigee-mint-task-scheduler`.** This addresses the following vulnerabilities: - [CVE-2025-46392](https://nvd.nist.gov/vuln/detail/CVE-2025-46392) - [CVE-2026-13506](https://nvd.nist.gov/vuln/detail/CVE-2026-13506) - [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) - [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) - [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) - [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) - [CVE-2026-8763](https://nvd.nist.gov/vuln/detail/CVE-2026-8763) | | **N/A** | **Security fixes for `apigee-open-telemetry-collector`.** This addresses the following vulnerabilities: - [CVE-2026-43871](https://nvd.nist.gov/vuln/detail/CVE-2026-43871) - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-81871](https://nvd.nist.gov/vuln/detail/CVE-2026-81871) - [CVE-2026-81872](https://nvd.nist.gov/vuln/detail/CVE-2026-81872) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) | | **N/A** | **Security fixes for `apigee-operators`.** This addresses the following vulnerabilities: - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) | | **N/A** | **Security fixes for `apigee-prom-prometheus`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) | | **N/A** | **Security fixes for `apigee-prometheus-adapter`.** This addresses the following vulnerabilities: - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) | | **N/A** | **Security fixes for `apigee-runtime`.** This addresses the following vulnerabilities: - [CVE-2025-46392](https://nvd.nist.gov/vuln/detail/CVE-2025-46392) - [CVE-2026-13506](https://nvd.nist.gov/vuln/detail/CVE-2026-13506) - [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) - [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) - [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) - [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) - [CVE-2026-8763](https://nvd.nist.gov/vuln/detail/CVE-2026-8763) | | **N/A** | **Security fixes for `apigee-synchronizer`.** This addresses the following vulnerabilities: - [CVE-2026-13506](https://nvd.nist.gov/vuln/detail/CVE-2026-13506) - [CVE-2026-19032](https://nvd.nist.gov/vuln/detail/CVE-2026-19032) - [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) - [CVE-2026-68497](https://nvd.nist.gov/vuln/detail/CVE-2026-68497) - [CVE-2026-83557](https://nvd.nist.gov/vuln/detail/CVE-2026-83557) - [CVE-2026-8763](https://nvd.nist.gov/vuln/detail/CVE-2026-8763) | | **N/A** | **Security fixes for `apigee-udca`.** This addresses the following vulnerabilities: - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) | | **N/A** | **Security fixes for `apigee-watcher`.** This addresses the following vulnerabilities: - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) | **App Optimize API** Feature The App Optimize API remote MCP server is in [Preview](https://cloud.google.com/products#product-launch-stages). For more information see [Use the App Optimize API remote MCP server](https://docs.cloud.google.com/app-optimize/use-app-optimize-mcp.md.txt). **BigQuery** Feature BigQuery offers [`TimesFM 3.0`](https://research.google/blog/timesfm-3-a-zero-shot-foundation-model-for-multivariate-forecasting/), a built-in time series forecasting model that implements Google Research's open source TimesFM model. You can use `TimesFM 3.0` with the following functions: - Use [`AI.FORECAST`](https://docs.cloud.google.com/bigquery/docs/reference/standard-sql/bigqueryml-syntax-ai-forecast.md.txt) to perform time series forecasting. In addition to univariate forecasting, you can now perform multivariate forecasting that predicts values for multiple time series based on historical values and additional covariates. - Use [`AI.EVALUATE`](https://docs.cloud.google.com/bigquery/docs/reference/standard-sql/bigqueryml-syntax-ai-evaluate.md.txt) to perform univariate time series evaluation. - Use [`AI.DETECT_ANOMALIES`](https://docs.cloud.google.com/bigquery/docs/reference/standard-sql/bigqueryml-syntax-ai-detect-anomalies.md.txt) to perform univariate time series anomaly detection. [Conversational analytics in BigQuery](https://docs.cloud.google.com/bigquery/docs/conversational-analytics.md.txt#bigquery-ml-support) also supports using `TimesFM 3.0` with these functions. To try using the `TimesFM 3.0` model for multivariate forecasting with the `AI.FORECAST` function, see [Forecast a single time series with a TimesFM multivariate model](https://docs.cloud.google.com/bigquery/docs/timesfm-multivariate-single-time-series-forecasting-tutorial.md.txt) and [Forecast multiple time series with a TimesFM multivariate model](https://docs.cloud.google.com/bigquery/docs/timesfm-multivariate-multi-time-series-forecasting-tutorial.md.txt). The `TimesFM 3.0` model is in [Preview](https://cloud.google.com/products/#product-launch-stages). **Cloud Run** Feature [SSH for Cloud Run services and instances](https://docs.cloud.google.com/run/docs/troubleshooting/ssh.md.txt) is in [Preview](https://cloud.google.com/products#product-launch-stages). Use this feature to establish a secure, interactive shell connection to your running instances. **Gemini Enterprise** Feature **Gemini Enterprise: Pay-as-you-go usage above quota enabled for Frontline, EDU, and Emerging Market editions** You can enable pay-as-you-go usage above quota for additional Gemini Enterprise license-based editions: - **Frontline editions**: Frontline Starter and Frontline Worker - **EDU editions**: EDU and EDU Pro - **Emerging Market editions**: Standard Emerging Market, EDU Emerging, EDU Pro Emerging, and EDU Gov Emerging When you enable Pay-as-you-go usage on an invoiced Cloud Billing account with an active subscription, users can continue using features at pay-as-you-go rates after reaching their pooled quota limits. For more information, see the following resources: - [Quotas and pay-as-you-go usage](https://docs.cloud.google.com/gemini/enterprise/docs/quotas-and-pay-as-you-go-usage.md.txt#pay-as-you-go-usage-above-quota) - [Configure pay-as-you-go usage above quota](https://docs.cloud.google.com/gemini/enterprise/docs/configure-pay-as-you-go-usage-above-quota.md.txt) - [Overview of pay-as-you-go usage above quota and spend controls](https://docs.cloud.google.com/gemini/enterprise/docs/manage-costs-overview.md.txt) **Gemini Enterprise Agent Platform** Feature **Anthropic's Claude Haiku 5.5** [Claude Haiku 5.5](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/partner-models/claude/haiku-5-5.md.txt) is available in Model Garden. Fixed **CodeMender updates (v0.13.0)** This release introduces updates to CodeMender: - **Consistent finding deduplication** : Improved finding deduplication consistency across repeated `cm find`, `--deep`, `--diff`, and `--parallel` scans. - **Bug fixes** : - Fixed an issue where deduplicated findings could appear in `cm report --status DISMISSED`. - Improved local state reliability during concurrent `cm find --diff` and `cm find --deep` scans. - Updated streaming error handling so non-retryable errors fail immediately instead of retrying. - Ensured local session state and logs are saved cleanly when a session is interrupted (`Ctrl+C`). For more information, see the [CodeMender documentation](https://docs.cloud.google.com/gemini-enterprise-agent-platform/agents/codemender.md.txt). **Google Distributed Cloud (software only) for VMware** Announcement Google Distributed Cloud (software only) for VMware 1.36.100-gke.144 is now available for download. To upgrade, see [Upgrade a cluster](https://docs.cloud.google.com/kubernetes-engine/distributed-cloud/vmware/docs/how-to/upgrading.md.txt). Google Distributed Cloud 1.36.100-gke.144 runs on Kubernetes v1.36.4-gke.100. If you use a third-party storage vendor, check the listing of our previously-qualified [storage partners](https://docs.cloud.google.com/kubernetes-engine/enterprise/docs/resources/partner-storage.md.txt). After a release, it takes approximately 7 to 14 days for the version to become available for use with GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform. Fixed The following issues were fixed in 1.36.100-gke.144: - Link to [Vulnerability fixes](https://docs.cloud.google.com/kubernetes-engine/distributed-cloud/vmware/docs/vulnerabilities.md.txt) for the list of security vulnerabilities addressed in this release. - Fixed an issue where user clusters repeatedly alternated between `reconciling` and `running` states if the management cluster had a different pod density configuration than the user cluster. - Updated `etcd` to `v3.5.33-0-gke.3` to address security vulnerabilities CVE-2026-46595 and CVE-2026-39821. - Fixed an issue where cluster diagnostics (`gkectl diagnose`) and pre-upgrade validations failed with false-positive `datastore '' not found` errors. After the fix, validation correctly resolves datastores across all configured vSphere data centers in split-data center architectures where control plane nodes reside in the admin datacenter. - Fixed an issue where deleting a cluster could stall indefinitely in the `terminating` state due to orphaned machine resources. **Google Distributed Cloud (software only) for bare metal** Announcement Google Distributed Cloud (software only) for bare metal 1.36.100-gke.144 is now available for download. To upgrade, see [Upgrade clusters](https://docs.cloud.google.com/release-notes/how-to/upgrade). Google Distributed Cloud for bare metal 1.36.100-gke.144 runs on Kubernetes v1.36.4-gke.100. After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform. If you use a third-party storage vendor, check the listing of our previously-qualified [storage partners](https://docs.cloud.google.com/kubernetes-engine/enterprise/docs/resources/partner-storage.md.txt). Feature The following changes were added in 1.36.100-gke.144: - Extended the validity period for new certificates generated for GKE Identity Service from 5 years to 10 years. - Fixed an issue in clusters using bundled BGP load balancing where control plane upgrades or configuration updates could cause up to 20 seconds of API server connection failures while a control plane node restarted. After the fix, failover to a healthy control plane node completes in approximately 4 seconds. - Fixed an issue where node drain in maintenance mode did not wait for attached storage volumes to detach. - Added support in `bgpadvertiser` for advertising IPv6 addresses in addition to IPv4 addresses for bundled BGP control plane load balancing. Fixed The following issues were fixed in 1.36.100-gke.144: - Link to [Vulnerability fixes](https://docs.cloud.google.com/kubernetes-engine/distributed-cloud/bare-metal/docs/vulnerabilities.md.txt) for the list of security vulnerabilities addressed in this release. - Fixed an issue where user clusters repeatedly alternated between `reconciling` and `running` states if the management cluster had a different pod density configuration than the user cluster. - Updated `etcd` to `v3.5.33-0-gke.3` to address security vulnerabilities CVE-2026-46595 and CVE-2026-39821. - Fixed an issue where updating control plane configurations could cause transient Kubernetes API server downtime. After the fix, the update process strictly verifies that each API server is healthy before restarting subsequent control plane nodes. - Fixed an issue where deleting a cluster could stall indefinitely in the `terminating` state due to orphaned machine resources. - Fixed an issue where worker node pool creation could stall during provisioning in environments with strict network firewall policies. The node pool controller no longer waits for all inventory machines to be ready before declaring the node pool, eliminating a provisioning deadlock. - Fixed an issue where `BareMetalMachine` status conditions prematurely reported nodes as ready and available during maintenance mode transitions. **Google Kubernetes Engine** Feature The microVM sandbox type is now Generally Available (GA) with GKE Sandbox in clusters that run version 1.37.0-gke.4713000 and later. MicroVM sandboxes provide hardware virtualization and isolation for untrusted workloads, AI agent runtimes, and multi-tenant environments. GKE microVM sandboxes use Kata Containers and Cloud Hypervisor to provide this isolation while maintaining a full Linux kernel that includes standard Linux features For more information, see the [GKE Sandbox](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/sandbox-pods.md.txt) documentation. **Google SecOps Marketplace** Change **Google Chronicle**: Version 97.0 - Updated the alert synchronization logic in the following job: - **Google Chronicle Sync Job** Change **GitSync**: Version 53.0 - (REGRESSIVE) **Integration**: Updated to support the latest Chronicle API. > [!IMPORTANT] > **Important:** **Rolled back in version 54.0.** Due to known synchronization issues in version 53.0, do not use version 53.0. Roll back to **version 52.0** or update to **version 54.0** , which restores the stable version 52.0 baseline. > > For instructions, see [Version 53.0 rollback and version 52.0 / 54.0 compatibility](https://docs.cloud.google.com/chronicle/docs/soar/marketplace/power-ups/gitsync.md.txt#version-54-rollback-guidance). **Virtual Private Cloud** Feature **General Availability** : VPC Flow Logs supports [TCP connection logging](https://docs.cloud.google.com/vpc/docs/flow-logs.md.txt#connection-logging) for VM instances and serverless endpoints. Connection logging captures outbound TCP connection attempts and acknowledged inbound TCP connections. You can enable this feature in a VPC Flow Logs configuration for a [subnet](https://docs.cloud.google.com/vpc/docs/using-flow-logs.md.txt#network-management) (through the Network Management API), a [VPC network](https://docs.cloud.google.com/vpc/docs/using-flow-logs.md.txt#enable-network), or an [organization](https://docs.cloud.google.com/vpc/docs/using-flow-logs.md.txt#enable-organization). Feature Service producers can let service consumers establish more connections to a Private Service Connect endpoint or backend by [configuring the target published service (service attachment) to use an additional NAT IP address](https://docs.cloud.google.com/vpc/docs/manage-private-service-connect-services#update-nat-ips-per-endpoint). For more information, see [Maximum connections](https://docs.cloud.google.com/vpc/docs/about-vpc-hosted-services.md.txt#max-connections). ## October 06, 2026 **AI Hypercomputer** Feature **Generally available** : When you reserve compute resources for creating GPU instances through your account team, you can include a Hyperdisk pool in the same request or in a subsequent request. This option helps ensure that your artificial intelligence (AI) and machine learning (ML) workloads have the storage resources that they require close to your GPU instances. For more information, see [Reserve capacity through your account team](https://docs.cloud.google.com/ai-hypercomputer/docs/reserve-capacity.md.txt). **Agent Platform Workbench** Change ### M153 Release Change Installed latest packages from upstream dependencies. **BigQuery** Feature [Conversational analytics in BigQuery](https://docs.cloud.google.com/bigquery/docs/conversational-analytics.md.txt#bigquery-ml-support) now supports the [`AI.CAUSAL_EFFECT` function](https://docs.cloud.google.com/bigquery/docs/reference/standard-sql/bigqueryml-syntax-causal-effect.md.txt) to quantify the impact of specific interventions on time series data. This feature is in [Preview](https://cloud.google.com/products#product-launch-stages). **Cloud Monitoring** Feature Bulk registration of discovered services and workloads to an App Hub application is [generally available (GA)](https://docs.cloud.google.com/products#product-launch-stages). For more information, see [Register one or more discovered services or workloads](https://docs.cloud.google.com/monitoring/docs/application-monitoring.md.txt#register). **Cloud SQL for MySQL** Change Cloud SQL for MySQL now supports up to 100,000 concurrent connections for Private Service Connect enabled instances created on or after September 30, 2026 with 16 or more vCPUs. For more information, see [Configure Private Service Connect](https://docs.cloud.google.com/sql/docs/mysql/configure-private-service-connect.md.txt#limitations). **Cloud SQL for PostgreSQL** Change Cloud SQL for PostgreSQL now supports up to 129,024 concurrent connections for Private Service Connect enabled instances created on or after September 30, 2026 with 16 or more vCPUs. For more information, see [Configure Private Service Connect](https://docs.cloud.google.com/sql/docs/postgres/configure-private-service-connect.md.txt#limitations). **Compute Engine** Feature **Generally available** : When you reserve compute resources for H4D instances through your account team, you can include a Hyperdisk pool in the same request or in a subsequent request. This option helps ensure that your high performance computing (HPC) workloads have the storage resources that they require close to your compute instances. For more information, see [Reserve capacity through your account team](https://docs.cloud.google.com/compute/docs/hpc/reserve-capacity-account-team.md.txt). **Config Connector** Announcement Config Connector version 1.158.0 is now available. Feature New Alpha Resources (Direct Reconciler): - `AgentRegistryBinding` - Manage [Agent Registry bindings](https://docs.cloud.google.com/agent-registry/reference/rest/v1/projects.locations.bindings.md.txt) to connect agent tools and authentication configurations. - `AIPlatformPersistentResource` - Manage [Gemini Enterprise Agent Platform persistent resources](https://docs.cloud.google.com/gemini-enterprise-agent-platform/reference/rest/v1/projects.locations.persistentResources.md.txt) for cluster computing and training jobs. - `AssuredWorkloadsWorkload` - Manage [Assured Workloads](https://cloud.google.com/assured-workloads/docs/reference/rest/v1/organizations.locations.workloads) to enforce security and compliance controls for regulated workloads. - `BigtableSchemaBundle` - Manage [Bigtable schema bundles](https://cloud.google.com/bigtable/docs/reference/admin/rest/v2/projects.instances.tables.schemaBundles) for storing protocol buffer (protobuf) schemas in Bigtable. - `CloudNumberRegistryRegistryBook` - Manage [Cloud Number Registry registry books](https://docs.cloud.google.com/number-registry/reference/rest/v1alpha/projects.locations.registryBooks.md.txt) to organize IP address management (IPAM) information and discovered IP address ranges. - `EventarcMessageBus` - Manage [Eventarc message buses](https://cloud.google.com/eventarc/docs/reference/rest/v1/projects.locations.messageBuses) to route events from publishers to subscribers. - `ModelArmorFloorSetting` - Manage [Model Armor floor settings](https://docs.cloud.google.com/model-armor/reference/rest/v1/FloorSetting.md.txt) at project, folder, or organization scope to enforce baseline safety and security filters for LLMs. Feature New Fields: - [`BackupDRBackupPlanAssociation`](https://cloud.google.com/config-connector/docs/reference/resource-docs/backupdr/backupdrbackupplanassociation) - Added `spec.resource.sqlInstanceRef` field to support backing up Cloud SQL instances. - `ComputeNetworkFirewallPolicyRule` - Added `spec.match.srcNetworkContext` and `spec.match.destNetworkContext` fields. - [`ComputeRegionNetworkEndpointGroup`](https://cloud.google.com/config-connector/docs/reference/resource-docs/compute/computeregionnetworkendpointgroup) - Added `INTERNET_IP_PORT`, `INTERNET_FQDN_PORT`, and `GCE_VM_IP_PORTMAP` values for `spec.networkEndpointType`. - [`RedisCluster`](https://cloud.google.com/config-connector/docs/reference/resource-docs/redis/rediscluster) - Added `spec.clusterEndpoints` and `status.clusterEndpoints` fields. - Added `spec.gcsSource` field. - Added `spec.managedBackupSource` field. - [`SQLInstance`](https://cloud.google.com/config-connector/docs/reference/resource-docs/sql/sqlinstance) - Added `spec.settings.databaseReplicationEnabled` field. Feature New Features: - Added support for pausing and unpausing actuation at the individual resource level by using the `cnrm.cloud.google.com/actuation-mode` annotation. Change Reconciliation Improvements: Added support for direct reconciliation to more resources, with opt-in behavior. The API is unchanged. To use the direct reconciler, add the `alpha.cnrm.cloud.google.com/reconciler: direct` annotation to the corresponding Config Connector object. The following resources now have direct reconciliation support: - [`FilestoreInstance`](https://cloud.google.com/config-connector/docs/reference/resource-docs/filestore/filestoreinstance) - Added support for direct reconciliation (opt-in). Fixed Bug Fixes: - [`BigQueryDataset`](https://cloud.google.com/config-connector/docs/reference/resource-docs/bigquery/bigquerydataset) ([#12383](https://github.com/GoogleCloudPlatform/k8s-config-connector/pull/12383)) - Fixed a reconciliation failure in projects with a project ID that contains a colon (such as domain-scoped projects `example.com:my-project`), where creation previously failed with an invalid ID format error and `resourceID` and `selfLink` were not populated. - [`ComposerEnvironment`](https://cloud.google.com/config-connector/docs/reference/resource-docs/composer/composerenvironment) ([#12795](https://github.com/GoogleCloudPlatform/k8s-config-connector/pull/12795)) - Fixed infinite reconciliation loops, false drift, and HTTP 400 errors when using empty map fields (`envVariables: {}`, `labels: {}`), partial `workloadsConfig` blocks, or disabling `scheduledSnapshotsConfig`. - [`ComputeRouterNAT`](https://cloud.google.com/config-connector/docs/reference/resource-docs/compute/computerouternat) ([#12813](https://github.com/GoogleCloudPlatform/k8s-config-connector/pull/12813)) - Fixed reference validation and resolution in the direct controller so that `spec.routerRef` accepts both short router names and canonical long paths. - Removed empty `status.observedState` fields from `v1alpha1` CRDs to align with Kubernetes structural schema requirements ([#12627](https://github.com/GoogleCloudPlatform/k8s-config-connector/pull/12627)). **Container Optimized OS** Change ### cos-129-19506-505-25 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.12.110](https://cos.googlesource.com/third_party/kernel/+/e8aea8a5b77baffbe8202925d0d4857248041049) | v27.5.1 | v2.2.7 | [See List](https://storage.googleapis.com/cos-tools/19506.505.25/lakitu/gpu_driver_versions.textproto) | Change Updated dev-libs/openssl to v3.5.9. Fixed Added support for NVIDIA driver v595.91.07. Fixed Added support for net-fs/lustre-client-drivers v2.14.0_p262. Fixed Added the "watchdog_timeout" module parameter to the idpf driver. Fixed Rebuilt Go binaries with Go 1.25.14. Fixed Upgraded app-admin/google-guest-configs to v20260928.00. Fixed Upgraded dev-libs/expat to v2.8.5. Fixed Upgraded sys-apps/xemu to v0.0.11. Fixed Upgraded sys-libs/timezone-data to v2026e. Fixed Upgraded sys-process/lsof to v4.99.7. Security Fixed CVE-2026-5928 in sys-libs/glibc. Security Upgraded dev-libs/libxml2 to v2.15.4. This fixes CVE-2026-86140. Change ### cos-125-19216-700-23 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.12.110](https://cos.googlesource.com/third_party/kernel/+/016be3984fda059a05c980c7133651fec7536d1c) | v27.5.1 | v2.2.7 | [See List](https://storage.googleapis.com/cos-tools/19216.700.23/lakitu/gpu_driver_versions.textproto) | Change Updated dev-libs/openssl to v3.5.9. Fixed Added support for net-fs/lustre-client-drivers v2.14.0_p262. Fixed Added the "watchdog_timeout" module parameter to the idpf driver. Fixed Upgraded app-admin/google-guest-configs to v20260928.00. Fixed Upgraded dev-libs/expat to v2.8.5. Fixed Upgraded sys-apps/xemu to v0.0.11. Fixed Upgraded sys-process/lsof to v4.99.7. Security Fixed CVE-2026-5928 in sys-libs/glibc. Security Upgraded dev-libs/libxml2 to v2.15.4. This fixes CVE-2026-86140. Change Runtime sysctl changes: - Changed: net.ipv4.udp_mem: 188034 250714 376068 -\> 188034 250715 376068
Change ### cos-133-19999-44-106 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.18.53](https://cos.googlesource.com/third_party/kernel/+/b72635466157d63e31f9ccfb6ae86ca6683ba729) | v29.4.3 | v2.4.1 | [See List](https://storage.googleapis.com/cos-tools/19999.44.106/lakitu/gpu_driver_versions.textproto) | Change Updated default cos-gpu-installer version to v2.7.9. It installs ucodes firmwares for VR200. Fixed Updated app-admin/google-guest-configs to v20260928.00. Fixed Upgraded app-admin/oslogin to v20260924.00. Fixed Upgraded sys-apps/xemu to v0.0.11. Change Runtime sysctl changes: - Changed: kernel.threads-max: 63443 -\> 63444 - Changed: net.ipv4.udp_mem: 187941 250590 375882 -\> 187941 250591 375882 - Changed: user.max_cgroup_namespaces: 31721 -\> 31722 - Changed: user.max_ipc_namespaces: 31721 -\> 31722 - Changed: user.max_mnt_namespaces: 31721 -\> 31722 - Changed: user.max_net_namespaces: 31721 -\> 31722 - Changed: user.max_pid_namespaces: 31721 -\> 31722 - Changed: user.max_time_namespaces: 31721 -\> 31722 - Changed: user.max_user_namespaces: 31721 -\> 31722 - Changed: user.max_uts_namespaces: 31721 -\> 31722
Change ### cos-121-18867-624-8 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.6.157](https://cos.googlesource.com/third_party/kernel/+/d3eba511730ad022ab42709e5700ada54b787344) | v27.5.1 | v2.0.10 | [See List](https://storage.googleapis.com/cos-tools/18867.624.8/lakitu/gpu_driver_versions.textproto) | Change Ensure time sync prior to TLS handshake. Fixed Updated app-admin/google-guest-configs to v20260928.00. Fixed Upgraded sys-apps/xemu to v0.0.11. Security Upgraded dev-libs/libxml2 to v2.15.4. This fixes CVE-2026-86140. **Gemini Enterprise** Feature **Gemini Enterprise: Updates to pay-as-you-go usage above quota controls** In the Google Cloud console, the **Overages** setting has been updated to **Pay-as-you-go usage above quota** . The **Usage \& Spending** page provides per-tier controls, allowing administrators to configure pay-as-you-go usage above quota individually for each subscription tier. For more information, see [Configure pay-as-you-go usage above quota](https://docs.cloud.google.com/gemini/enterprise/docs/configure-pay-as-you-go-usage-above-quota.md.txt) and [Quotas and pay-as-you-go usage](https://docs.cloud.google.com/gemini/enterprise/docs/quotas-and-pay-as-you-go-usage.md.txt#pay-as-you-go-usage-above-quota). Feature **Gemini Enterprise: Control access to Antigravity features** Administrators can control whether users in their organization have access to the following Google Antigravity features: - **Boost** : Uses a tiered multi-agent hierarchy to solve complex algorithmic challenges and deep debugging tasks with the `/boost` command. This feature is generally available (GA) in Antigravity. - **Teamwork** : Deploys a coordinated framework of autonomous subagents to execute large-scale, long-horizon projects using the `/teamwork-preview` command. This feature is in Preview in Antigravity. These settings are generally available (GA) for administrators in Gemini Enterprise. For more information, see [Configure feature settings](https://docs.cloud.google.com/gemini/enterprise/docs/ai-developer-tools-settings.md.txt#configure-feature-settings). **Gemini Enterprise Agent Platform** Feature **Gemini Nano Banana 2.1** [Gemini Nano Banana 2.1](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/gemini/nano-banana-2-1.md.txt) (`gemini-nano-banana-2.1`) is available in [General Availability (GA)](https://cloud.google.com/products#product-launch-stages). Gemini Nano Banana 2.1 is optimized for high-speed multimodal image generation and editing, offering improved visual quality, prompt adherence, and text rendering across `1K`, `2K`, and `4K` output resolutions. **Google Kubernetes Engine** Issue Starting with GKE version 1.36, the default engine for kube-dns is [CoreDNS](https://coredns.io/). For Pod IP DNS queries in the `..pod.cluster.local` format, CoreDNS returns NXDOMAIN if the specified `` does not exist. The legacy `kubernetes/dns` implementation skipped checking the existence of the namespace provided in the `` segment in these queries. Queries in the `..pod.cluster.local` format are not part of the [Kubernetes DNS specification](https://github.com/kubernetes/dns/blob/master/docs/specification.md). We can't guarantee that uses outside of those specified in the DNS spec will remain consistent across releases. Mitigation: - **Recommended** : Migrate to supported headless Service DNS records (`...svc.cluster.local`). - **Workaround** : Ensure the `` specified in the DNS query exists in the cluster. **Identity and Access Management** Feature Revoking active sessions and short-lived credentials for Workforce Identity Federation users (principals) across all clients is [generally available](https://cloud.google.com/products#product-launch-stages). You can revoke workforce user sessions by using the gcloud CLI or the REST API. For more information, see [Revoke Workforce Identity Federation user sessions](https://docs.cloud.google.com/iam/docs/workforce-revoke-sessions.md.txt). **Security Command Center** Deprecated Artifact guard with CI/CD integration is deprecated. It will be shut down on October 30, 2026. ## October 05, 2026 **Agent Platform Workbench** Change ### 20261004.00_p0 Release Change Installed latest packages from upstream dependencies. Change The BigQuery JupyterLab plugin is now enabled independently of the Dataproc plugin: it is enabled by default and can be turned off with the new disable-bigquery instance metadata key, while disable-mixer now controls only the Dataproc plugin. Change ### 20261004.00_p0 Release Change Installed latest packages from upstream dependencies. **Apigee Edge for Public Cloud** Security **Security fixes for the integrated portal and API specs in the Apigee Edge management UIs.** The Apigee Edge UIs for managing integrated portals and API specs were updated to patch vulnerabilities in underlying libraries and serving components. Functionality is unchanged, but some pages might show minor styling differences. **Application Design Center** Feature Use the [`recommendeIAMroles`](https://docs.cloud.google.com/application-design-center/docs/reference/rest/v1/projects.locations.spaces.applications/recommendIAMRoles.md.txt) API to identify a list of required APIs and Identity and Access Management (IAM) roles that you must configure before you deploy your application. **BigQuery** Feature [Iceberg external tables](https://docs.cloud.google.com/bigquery/docs/iceberg-external-tables.md.txt) and [Iceberg managed tables](https://docs.cloud.google.com/bigquery/docs/iceberg-tables) now support [flexible column names](https://docs.cloud.google.com/bigquery/docs/schemas.md.txt#flexible-column-names) by default. This feature is [generally available](https://cloud.google.com/products#product-launch-stages) (GA). Feature The `gemini-embedding-2` model works well for embedding long strings, including multilingual and unstructured data. It supports a mix of text, images, audio, video, and PDF files. You can use this model in the [`AI.EMBED`](https://docs.cloud.google.com/bigquery/docs/reference/standard-sql/bigqueryml-syntax-ai-embed.md.txt), [`AI.SIMILARITY`](https://docs.cloud.google.com/bigquery/docs/reference/standard-sql/bigqueryml-syntax-ai-similarity.md.txt), and [`AI.GENERATE_EMBEDDING`](https://docs.cloud.google.com/bigquery/docs/reference/standard-sql/bigqueryml-syntax-ai-generate-embedding.md.txt) functions. This model is [generally available](https://cloud.google.com/products#product-launch-stages). **Bigtable** Libraries ### Python #### [2.48.0](https://github.com/googleapis/google-cloud-python/compare/google-cloud-bigtable-v2.47.0...google-cloud-bigtable-v2.48.0) (2026-09-29) ##### Features - **bigtable:** Reroute Mutations Batcher to use data client ([#18200](https://github.com/googleapis/google-cloud-python/issues/18200)) ([0b488a3](https://github.com/googleapis/google-cloud-python/commit/0b488a395542e9c76f535e82a7298fabaee8f4af)) - declare Python3.15 support ([05b0c34](https://github.com/googleapis/google-cloud-python/commit/05b0c342683b2b0e1b8dccd201ec86ec89612edc)) ### Python #### [2.49.0](https://github.com/googleapis/google-cloud-python/compare/google-cloud-bigtable-v2.48.0...google-cloud-bigtable-v2.49.0) (2026-10-01) ##### Features - declare Python3.15 support ([8775794](https://github.com/googleapis/google-cloud-python/commit/8775794508e17150023c8e7152543410014458bf)) - update API sources and regenerate ([#18513](https://github.com/googleapis/google-cloud-python/issues/18513)) ([7d7adca](https://github.com/googleapis/google-cloud-python/commit/7d7adcaee688603077ea53abec678130045c20ed)) **Cloud Load Balancing** Feature External IPv6 addresses are now supported for [Standard Tier](https://docs.cloud.google.com/network-tiers/docs/overview.md.txt#standard_tier). For more information, see [IPv6 subnet ranges](https://docs.cloud.google.com/vpc/docs/subnets.md.txt#ipv6-ranges). This feature is in **Preview**. **Cloud Workstations** Feature Cloud Workstations supports [Assured Workloads](https://docs.cloud.google.com/assured-workloads/docs/overview.md.txt) control packages to help you meet regulatory, data residency, and data sovereignty requirements. Specifically, the Cloud Workstations API (`v1`, `v1beta`, and `v1alpha`) supports the following [Assured Workloads control packages](https://docs.cloud.google.com/assured-workloads/docs/control-packages.md.txt): - [Data Boundary for FedRAMP High](https://docs.cloud.google.com/assured-workloads/docs/control-packages.md.txt#fedramp-high) - [Data Boundary for FedRAMP Moderate](https://docs.cloud.google.com/assured-workloads/docs/control-packages.md.txt#fedramp-moderate) - [Data Boundary for Impact Level 2 (IL2)](https://docs.cloud.google.com/assured-workloads/docs/control-packages/il2.md.txt) - [Data Boundary for Impact Level 4 (IL4)](https://docs.cloud.google.com/assured-workloads/docs/control-packages/il4.md.txt) - [Data Boundary for Impact Level 5 (IL5)](https://docs.cloud.google.com/assured-workloads/docs/control-packages/il5.md.txt) - [US Data Boundary and Support](https://docs.cloud.google.com/assured-workloads/docs/control-packages/us-data-boundary-support.md.txt) (AW Regional Controls - Premium) - [EU Data Boundary with Access Justifications](https://docs.cloud.google.com/assured-workloads/docs/control-packages/eu-data-boundary-access-justifications.md.txt) For more information about compliance-supported regions for each control package and API fields that aren't intended for sensitive data, see [Regulatory support in Cloud Workstations](https://docs.cloud.google.com/workstations/docs/workstations-regulatory-compliance.md.txt). **Compute Engine** Feature **Generally available**: Z3 machine types that have 8 to 44 vCPUs can use Hyperdisk Balanced High Availability volumes to synchronously replicate data across two zones. For more information, see [About Hyperdisk Balanced High Availability](https://docs.cloud.google.com/compute/docs/disks/hd-types/hyperdisk-balanced-ha.md.txt). Feature **Preview** : External IPv6 addresses are now supported for [Standard Tier](https://docs.cloud.google.com/network-tiers/docs/overview.md.txt#standard_tier). For more information, see [IPv6 subnet ranges](https://docs.cloud.google.com/vpc/docs/subnets.md.txt#ipv6-ranges). **Confidential Space** Announcement A new Confidential Space image (260900) is available. **Gemini Enterprise Agent Platform** Fixed **CodeMender updates (v0.12.0)** This release introduces updates to CodeMender: - **Hidden file scanning** : Added the `--include-hidden` flag to `cm find` (or `include_hidden` under `scan` in `config.yaml`) to include hidden directories and files, such as `.github/` and `.config/`, in vulnerability scans. - **Larger file support** : Raised the default file discovery size limit (`max_file_size_kb`) from 500 KB to 2 MiB so `cm find` no longer skips large source files. Existing configurations that use the previous 500 KB default are upgraded automatically, and `--deep` and `--diff` scans can now read beyond the inline preview of files larger than 64 KB. - **Report output for every scan mode** : `cm find --output` now writes the scan report for standard, `--deep`, `--parallel`, and `--diff` scans. - **Scoped fixes** : `cm fix` now prevents the agent from modifying CI/CD pipelines, static analysis configurations, build definitions, and repository configuration files that are outside the scope of the vulnerability being fixed. - **Accurate session token usage** : `cm` now reports the total token usage across all turns of a session, instead of only the final turn, so token counts in `cm stats` and session exports match billed usage. - **Bug fixes** : - Fixed duplicate findings in `cm report` and `cm stats`, and stopped merging distinct vulnerability types reported on the same line. - Fixed `database is locked` errors during `cm find --deep` scans with multiple workers. - Reduced false positives by requiring a concrete, viable exploit before reporting a finding with high confidence. - Included sessions from `cm find --deep` and `cm find --diff` workers in `cm stats`. - Fixed `cm verify` resolving relative finding and exploit artifact paths against the current working directory instead of the project root. For more information, see the [CodeMender documentation](https://docs.cloud.google.com/gemini-enterprise-agent-platform/agents/codemender.md.txt). **Google Kubernetes Engine** Deprecated Starting on July 1, 2026, Identity Service for GKE is deprecated in GKE version 1.36 and earlier. This feature is also unavailable in organizations that were created on or after July 1, 2025. GKE version 1.37 and later don't support Identity Service for GKE. Before you upgrade clusters to 1.37 and later, disable this feature and migrate to Workforce Identity Federation. For more information, see [Identity Service for GKE deprecation](https://docs.cloud.google.com/kubernetes-engine/docs/deprecations/identity-service.md.txt). Feature GKE support for using the `c4-standard-*` machine types (up to 192 vCPUs) as Confidential GKE Nodes with Intel TDX is generally available. For more information, see the following pages: - To use this feature with GKE , see [Encrypt workload data in-use with Confidential GKE Nodes](https://docs.cloud.google.com/kubernetes-engine/docs/how-to/confidential-gke-nodes). - To learn more about the feature from Compute Engine, see [Confidential VM overview](https://docs.cloud.google.com/confidential-computing/confidential-vm/docs/confidential-vm-overview). - To see supported configurations, including machine support, see [Supported configurations](https://docs.cloud.google.com/confidential-computing/confidential-vm/docs/supported-configurations) and its "Machine types, CPUs, and zones" section. **Google SecOps** Feature **\[Spotlight Feature\] Terraform and client libraries for multiple features using Chronicle API** Terraform providers and Google Cloud client libraries are now available for several Google SecOps features using Chronicle API including **Feeds, Parsers, Rules, Findings Refinements, Retrohunts, Dashboards, Data Tables, Watchlists, Custom Lists, Environments, Environment Groups, Data Export, SOAR Domains, and SOAR Networks** . For more information, see [Terraform reference](https://docs.cloud.google.com/chronicle/docs/terraform.md.txt). Terraform providers enable programmatic provisioning and management of Google SecOps resources as code, while Client Libraries enable developers to build custom integrations and automate Google SecOps workflows in their preferred programming languages. For more information, see [Client libraries](https://docs.cloud.google.com/chronicle/docs/libraries.md.txt). **Guest Environment** Feature Version `20260921.00` of the [guest agent](https://docs.cloud.google.com/compute/docs/images/guest-agent.md.txt) is now available for all supported operating systems. This version introduces the following features: - The managed workload identity certificate refresher is now a locally bundled extension. For more information, see [Managed workload identities overview](https://docs.cloud.google.com/iam/docs/managed-workload-identity.md.txt). - The guest telemetry extension is updated to version 1.1 and polls every 15 minutes instead of every 24 hours. However, it will only send data to the API every 24 hours, unless it detects a change in the system since the previous poll. The extension supports the following capabilities: - Running a command as the user associated with a discovered process. - Configuring regular expressions to match against the version command output. Fixed Version `20260921.00` of the [guest agent](https://docs.cloud.google.com/compute/docs/images/guest-agent.md.txt) is now available for all supported operating systems. This version introduces the following fixes: - The `NetworkManager` setup now no longer reloads the primary NIC when it applies changes to the network configuration of secondary NICs, unless necessary. - If the core plugin successfully rolls back any configurations, then it force-reloads the configurations to make sure that the instance re-obtains DHCP leases for secondary NICs. - The core plugin now respects the `address-manager` configuration flag and the corresponding metadata attribute. - The extensions manager now ignores install and remove requests from ACS for the core plugin and locally bundled extensions. - The extensions manager no longer logs that there are no local plugins to install when it's installing local plugins. - The metadata script runner now respects the `sysprep_specialize` configuration flag. **Knowledge Catalog** Feature Data products in Knowledge Catalog now support [Looker (Google Cloud core)](https://docs.cloud.google.com/looker/docs/looker-core-overview.md.txt) assets. You can package, govern, and share Looker (Google Cloud core) dashboards, dashboard elements, Looks, Explores, and LookML projects, models, and views in a data product using Google Group mirroring and IAM access controls. This feature is [generally available](https://cloud.google.com/products#product-launch-stages). For more information, see [About data products](https://docs.cloud.google.com/knowledge-catalog/docs/data-products-overview.md.txt#assets-supported) and [Create data products](https://docs.cloud.google.com/knowledge-catalog/docs/create-data-products.md.txt#configure-looker). **Managed Service for Apache Spark** Change **Managed Service for Apache Spark** (formerly Google Cloud Serverless for Apache Spark): Users may now specify short template names when creating a serverless session. **Network Intelligence Center** Feature [Flow Analyzer](https://docs.cloud.google.com/network-intelligence-center/docs/flow-analyzer/overview.md.txt) displays packet drops, allowing you to analyze packet loss in your traffic flows. For more information, see [Display flows in packet drop mode](https://docs.cloud.google.com/network-intelligence-center/docs/flow-analyzer/analyze-traffic-flows.md.txt#display-packet-drops). **Network Service Tiers** Feature External IPv6 addresses are now supported for [Standard Tier](https://docs.cloud.google.com/network-tiers/docs/overview.md.txt#standard_tier) in **Preview** . For more information, see [IPv6 subnet ranges](https://docs.cloud.google.com/vpc/docs/subnets.md.txt#ipv6-ranges). **Virtual Private Cloud** Feature **Preview** : External IPv6 addresses are now supported for [Standard Tier](https://docs.cloud.google.com/network-tiers/docs/overview.md.txt#standard_tier). For more information, see [IPv6 subnet ranges](https://docs.cloud.google.com/vpc/docs/subnets.md.txt#ipv6-ranges). ## October 04, 2026 **Agent Platform Workbench** Change ### 20261004-2230-rc0 Release Change ### 20261004-2230-rc0 Release Change Installed latest packages from upstream dependencies. Change Installed latest packages from upstream dependencies. Change The BigQuery JupyterLab plugin is now enabled independently of the Dataproc plugin: it is enabled by default and can be turned off with the new disable-bigquery instance metadata key, while disable-mixer now controls only the Dataproc plugin. Security Bulk security patch remediating Critical and High-severity CVEs in the Agent Platform Workbench custom container images. Security Bulk security patch remediating Critical and High-severity CVEs in the Agent Platform Workbench custom container images. Change ### 20261004-2157-rc0 Release Change Installed latest packages from upstream dependencies. Fixed Preinstall CUDA drivers for Pre-Turing GPUs such as V100s. Change The BigQuery JupyterLab plugin is now enabled independently of the Dataproc plugin: it is enabled by default and can be turned off with the new disable-bigquery instance metadata key, while disable-mixer now controls only the Dataproc plugin. Change ### M152 Release Change Installed latest packages from upstream dependencies. Change The BigQuery JupyterLab plugin is now enabled independently of the Dataproc plugin: it is enabled by default and can be turned off with the new disable-bigquery instance metadata key, while disable-mixer now controls only the Dataproc plugin. **Google SecOps SOAR** Announcement Release 6.3.101.2 is being rolled out to the first phase of regions as listed [here](https://docs.cloud.google.com/chronicle/docs/soar/overview-and-introduction/soar-gradual-release.md.txt). This release contains internal and customer bug fixes. ## October 03, 2026 **Google SecOps SOAR** Announcement Release 6.3.100.3 is now available for all regions. **Sensitive Data Protection** Change A new version with an updated name dictionary is available for the `PERSON_NAME` [infoType](https://docs.cloud.google.com/sensitive-data-protection/docs/infotypes-reference.md.txt) detector. You can try it out by setting `InfoType.version` to `latest` when including the `PERSON_NAME` infoType in your `InspectConfig`. You can still use the previous functionality by setting `InfoType.version` to `stable` or leaving it unset when using the `PERSON_NAME` infoType. In 30 days, the new version will be promoted to `stable`. ## October 02, 2026 **Apigee X** Announcement On October 2, 2026, we released an updated version of Apigee (1-18-0-apigee-6). > [!NOTE] > **Note:** Rollouts of this release began today and can take four or more business days to complete across all Google Cloud zones. Your instances might not have the features and fixes available until the rollout is complete. Security | Bug ID | Description | |---|---| | **564386425** | **Security fix for Apigee.** Upgraded the Apigee ingress gateway (ASM) to patch security vulnerabilities. | | **561666530** | **Security fix for Apigee.** Upgraded the Prometheus library to patch the following vulnerabilities:
- [CVE-2026-42151](https://nvd.nist.gov/vuln/detail/CVE-2026-42151) - [CVE-2026-42154](https://nvd.nist.gov/vuln/detail/CVE-2026-42154) - [CVE-2026-44903](https://nvd.nist.gov/vuln/detail/CVE-2026-44903) - [CVE-2026-40179](https://nvd.nist.gov/vuln/detail/CVE-2026-40179)
| | **N/A** | **Security fix for Apigee infrastructure.** | Fixed | Bug ID | Description | |---|---| | **432315283** | Fixed a multi-certificate truststore so that its trust anchors take effect without a Message Processor restart when `features.truststore.multi_cert_bundle.enabled` is toggled at runtime; the outbound SSL context is now rebuilt automatically on any trust-anchor change. | | **565072374** | VerifyJWT policies that use a JWKS `uriRef` no longer return `steps.jwt.NoMatchingPublicKey` on the first request after the JWKS cache TTL expires when the identity provider has rotated to a new key ID. The cache now re-fetches synchronously when its entry expires. | | **535395491** | Extension Processor (ext_proc) denials now return the status and body that the policy or FaultRule produced, instead of always returning HTTP 500. | | **558421499** | Apigee runtime runs on JRE 21. | | **517953321** | The `lookupcache..isEncrypted` and `responsecache..isEncrypted` flow variables now report the per-entry on-disk encryption state of the L2 cache, rather than approximating whether the cache-encryption key is loaded. L1 cache hits report `false`. Review any policy conditions that rely on these flow variables. | | **563557547** | Fixed EventFlow (Server-Sent Events) coalescing multiple events into a single policy invocation under burst load on the http-adaptor data path, which produced malformed SSE output to the client. | | **562740573** | Apigee Analytics now populates the `processing_mode` dimension, distinguishing proxy traffic from extension-processor traffic. This dimension is not populated in billing-only analytics mode. | | **357042873** | Stopped redirecting `apigee-cassandra-schema-readiness` init container logs to `/dev/null`, improving troubleshooting. Workloads undergo a rolling restart upon upgrade. | | **564969400** | Fixed an issue where variables initialized from an empty `` element in `AssignMessage` (`AssignVariable`) were not treated as empty strings when referenced in message template functions such as `replaceAll`. | | **N/A** | Updates to infrastructure and libraries. | **Assured Workloads** Feature The [Data Boundary for Impact Level 5 (IL5)](https://docs.cloud.google.com/assured-workloads/docs/control-packages/il5.md.txt) supports the following products: - Google Security Operations SIEM Feature The [Data Boundary for Impact Level 4 (IL4)](https://docs.cloud.google.com/assured-workloads/docs/control-packages/il4.md.txt) supports the following products: - Google Security Operations SIEM **BigQuery** Feature The [Rust SDK for BigQuery](https://docs.cloud.google.com/bigquery/docs/reference/libraries.md.txt) is now [generally available](https://cloud.google.com/products#product-launch-stages) (GA). Feature The [Data Engineering Agent](https://docs.cloud.google.com/gemini/data-agents/data-engineering-agent/agent-overview) now supports the `gemini-3.7-flash` model for the `us`, `eu`, and `global` multi-regional endpoints. **Cloud NAT** Feature **General Availability** : Cloud NAT gateways for Private NAT support IPv6 to IPv4 network address translation. For more information, see [NAT64 in Private NAT](https://docs.cloud.google.com/nat/docs/private-nat.md.txt#nat64). **Cluster Toolkit** Feature Cluster Toolkit v1.105.0 is available. This release adds support for Slurm on Cloud TPU 7x and optional support for managed instance groups (MIGs) on static compute nodes that use A4X machine types. This release also adds storage profiles and volume attributes for [Cloud Storage FUSE](https://docs.cloud.google.com/storage/docs/cloud-storage-fuse/overview.md.txt) in job submissions, and unifies Google Kubernetes Engine (GKE) blueprints for GPU and Cloud TPU workloads to support dynamic consumption options. Additionally, this release adds the `repository_name` variable to override repository names and fixes the output for the registry URL in the Artifact Registry module. This update also introduces the `pre-existing-project` community module and resolves an HTTP 400 error when Slurm checks the deletion status of virtual machines (VMs). For more information, see the [release announcement on GitHub](https://github.com/GoogleCloudPlatform/cluster-toolkit/discussions/6407). **Gemini Enterprise** Feature **Gemini Enterprise: Federated query mode for Data Cloud connectors and Knowledge Catalog integration (Preview)** Federated query mode is available in [Preview](https://cloud.google.com/products#product-launch-stages) for the following connectors: - [AlloyDB for PostgreSQL](https://docs.cloud.google.com/gemini/enterprise/docs/connectors/connect-alloydb.md.txt#federated-query) - [BigQuery](https://docs.cloud.google.com/gemini/enterprise/docs/connectors/connect-bigquery.md.txt#federated-query) - [Cloud SQL](https://docs.cloud.google.com/gemini/enterprise/docs/connectors/connect-cloud-sql.md.txt#federated-query) - [Spanner](https://docs.cloud.google.com/gemini/enterprise/docs/connectors/connect-spanner.md.txt#federated-query) Federated query mode allows Gemini Enterprise to query your operational and analytical data in place using the Model Context Protocol (MCP) and each user's own credentials, without copying or ingesting data into a data store. In addition, the [Knowledge Catalog](https://docs.cloud.google.com/gemini/enterprise/docs/connectors/connect-knowledge-catalog.md.txt) integration is available in Preview. When you attach a Data Cloud connector in federated query mode, Knowledge Catalog is automatically enabled on the **Assistant** tab of your app to give the assistant read-only tools to search for data that the user has access to and retrieve technical and business context. For more information, see the following resources: - [Connect to Data Cloud](https://docs.cloud.google.com/gemini/enterprise/docs/connectors/connect-data-cloud.md.txt) - [Best practices for Data Cloud connectors](https://docs.cloud.google.com/gemini/enterprise/docs/connectors/data-cloud-best-practices.md.txt) - [Secure Data Cloud connectors](https://docs.cloud.google.com/gemini/enterprise/docs/connectors/data-cloud-security.md.txt) **Google Cloud Contact Center as a Service** Announcement **Google Cloud CCaaS 6.17** We've released version 6.17 of Google Cloud CCaaS. The timing of the update to your instance depends on the deployment schedule that you have chosen. For more information, see [Deployment schedules](https://docs.cloud.google.com/contact-center/ccai-platform/docs/deployment-schedules). Feature **Warm transfers auto-resume** When an agent performs a warm transfer, the caller is now automatically taken off hold as soon as the transferring agent leaves the call, establishing two-way audio between the receiving agent and the caller without manual action. The caller stays on hold during the consultation between agents so that their conversation remains private. This applies to warm transfers routed through a queue and warm transfers sent directly to a specific agent. This change eliminates the silence that previously occurred when the caller remained on hold after the handoff. For more information, see [Warm transfers](https://docs.cloud.google.com/contact-center/ccai-platform/docs/call-adapter-transfer#warm-transfer). Fixed This release addresses the following issues: - Fixed an issue where the **Call ended** card in the session data feed incorrectly displayed a call length of `00:00` despite the actual duration being recorded correctly. - Fixed an issue where calls remained stuck on the live dashboard after a caller hung up during the transition from a virtual agent to a queue. - Fixed an issue where the **Virtual Agent Session Variables** section was missing from the call adapter after a successful credit card tokenization handback. - Fixed an issue where agents belonging to multiple teams were incorrectly granted access to all communication channels regardless of their team's specific availability settings. - Fixed an issue where emails containing specific formatting displayed a full-screen loading screen that prevented agents from viewing the message or interacting with the agent desktop. - Fixed an issue where the CCaaS portal displayed an incorrect **Off** or **Not Configured** status for Agent Assist after navigating between queues or refreshing the page. - Added a checkbox for Salesforce CRM integrations that, when selected, ignores ticket owner updates when an agent is assigned. - Fixed an issue where the automatic wrap-up timer didn't release agents when notes or disposition codes were configured as optional. - Fixed an issue where agents remained stuck in a busy **Wrap-up** status after the automatic wrap-up timer expired if they preselected **Wrap-up** as their next status. - Fixed an issue where calls escalated from a virtual agent to an available human agent were incorrectly deflected to the original queue's voicemail upon reaching a timeout. - Fixed an issue where callers were left on hold indefinitely during cold transfers to a direct agent extension when over-capacity deflection was enabled. - Fixed an issue where virtual agent interaction outcomes weren't fully mapped, leading to sessions being incorrectly categorized as "Undefined" or "Unknown". - Fixed an issue where Agent Assist message analysis background jobs failed and retried excessively for certain profiles. - Fixed an issue where transcript message updates caused excessive background processing load. - Fixed an issue where the microphone permission error was mistranslated as "Microphone désactivé!" instead of "Microphone turned off!" for agents using French (Canada) localization in the agent adapter. - Fixed an issue where calls meeting over-capacity deflection criteria didn't reach their destination queue, leaving callers connected without a route. - Fixed an issue where queue duration metrics weren't captured for scheduled callbacks escalating from a virtual agent to a human agent. - Fixed an issue where virtual agent conversations remained open after a call ended due to missing wrap-up events. - Fixed an issue where virtual agent voice sessions remained active after a caller disconnected, resulting in delayed error logs appearing 10 to 15 minutes after the call ended. - Fixed an issue where agents were incorrectly marked as **Unresponsive** because call offers were sent before their browser finished transitioning from a previous call. **Google Kubernetes Engine** Change #### (2026-R42) Version updates GKE cluster versions have been updated. **New versions available for upgrades and new clusters.** The following versions are now available for new GKE clusters, and for manual control plane upgrades and node upgrades for existing clusters. For more information about versioning and upgrades, see [GKE versioning and support](https://cloud.google.com/kubernetes-engine/versioning) and [About GKE cluster upgrades](https://cloud.google.com/kubernetes-engine/upgrades). ### Rapid channel > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.36.4-gke.1495000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495000) is now the default version for cluster creation in the Rapid channel. - The following versions are now available in the Rapid channel: - [1.34.12-gke.1011000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1011000) - [1.35.8-gke.1626001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1626001) - [1.35.8-gke.1796000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1796000) - [1.36.4-gke.2046000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046000) - [Alpha version](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#alpha-versions) 1.38.0-gke.2240000+preview is now available for GKE alpha clusters in the Rapid channel. - The following versions are no longer available in the Rapid channel: - 1.34.11-gke.1102000 - 1.35.8-gke.1439000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Rapid channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.35.8-gke.1626000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Rapid channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.1391000 - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.11-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1209000) - 1.34 to [1.35.8-gke.1626001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1626001) - 1.35 to [1.36.4-gke.1495000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.11-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1209000) - 1.35 to [1.35.8-gke.1626001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1626001) - 1.36 to [1.36.4-gke.1495000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495000) ### Regular channel > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - The following versions are now available in the Regular channel: - [1.34.11-gke.1102000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1102000) - [1.35.8-gke.1380001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1380001) - [1.35.8-gke.1439001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1439001) - [1.36.4-gke.1391000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391000) - The following versions are no longer available in the Regular channel: - 1.34.11-gke.1044000 - 1.35.8-gke.1380000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Regular channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.3-gke.1767000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Regular channel. This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.11-gke.1056000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1056000) - 1.34 to [1.35.8-gke.1380001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1380001) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.11-gke.1056000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1056000) - 1.35 to [1.35.8-gke.1380001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1380001) - 1.36 to [1.36.4-gke.1247000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1247000) ### Stable channel > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.35.6-gke.1250001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-6-gke-1250001) is now the default version for cluster creation in the Stable channel. - The following versions are now available in the Stable channel: - [1.34.11-gke.1044000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1044000) - [1.35.6-gke.1250001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-6-gke-1250001) - The following versions are no longer available in the Stable channel: - 1.34.10-gke.1328000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Stable channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.35.6-gke.1250000 - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or deprecated APIs, preventing upgrades: - 1.34 to [1.35.6-gke.1250001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-6-gke-1250001) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or other factors preventing minor version upgrades: - 1.35 to [1.35.6-gke.1250001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-6-gke-1250001) ### Extended channel > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.36.4-gke.1247000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1247000) is now the default version for cluster creation in the Extended channel. - The following versions are now available in the Extended channel: - [1.31.14-gke.2704000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2704000) - [1.31.14-gke.2825000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2825000) - [1.32.13-gke.2427000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2427000) - [1.32.13-gke.2567000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2567000) - [1.33.13-gke.1647000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1647000) - [1.33.13-gke.1815000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1815000) - [1.34.11-gke.1102000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1102000) - [1.35.8-gke.1380001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1380001) - [1.35.8-gke.1439001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1439001) - [1.36.4-gke.1391000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391000) - The following versions are no longer available in the Extended channel: - 1.31.14-gke.2667000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.31.14-gke.2759000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.32.13-gke.2393000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.32.13-gke.2504000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.33.13-gke.1613000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.33.13-gke.1721000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.34.11-gke.1044000 - 1.35.8-gke.1225000 - 1.35.8-gke.1380000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.3-gke.1767000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or deprecated APIs, preventing upgrades: - 1.30 to [1.31.14-gke.2689000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2689000) - 1.31 to [1.32.13-gke.2411000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2411000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or other factors preventing minor version upgrades: - 1.31 to [1.31.14-gke.2689000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2689000) - 1.32 to [1.32.13-gke.2411000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2411000) - 1.33 to [1.33.13-gke.1636000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1636000) - 1.34 to [1.34.11-gke.1056000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1056000) - 1.35 to [1.35.8-gke.1380001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1380001) - 1.36 to [1.36.4-gke.1247000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1247000) ### No channel (deprecated) > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - The following versions are now available: - [1.34.12-gke.1011000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1011000) - [1.35.6-gke.1250001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-6-gke-1250001) - [1.35.8-gke.1380001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1380001) - [1.35.8-gke.1439001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1439001) - [1.35.8-gke.1626001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1626001) - [1.35.8-gke.1796000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1796000) - [1.36.4-gke.2046000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046000) - The following node versions are now available: - [1.31.14-gke.2825000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2825000) - [1.32.13-gke.2567000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2567000) - [1.33.13-gke.1815000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1815000) - [1.34.12-gke.1011000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1011000) - [1.35.6-gke.1250001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-6-gke-1250001) - [1.35.8-gke.1380001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1380001) - [1.35.8-gke.1439001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1439001) - [1.35.8-gke.1626001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1626001) - [1.35.8-gke.1796000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1796000) - [1.36.4-gke.2046000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046000) - The following versions are no longer available: - 1.34.9-gke.1065000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.34.10-gke.1328000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.35.8-gke.1380000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.35.8-gke.1439000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.35.8-gke.1626000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.3-gke.1767000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.11-gke.1056000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1056000) - 1.34 to [1.35.6-gke.1250001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-6-gke-1250001) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.11-gke.1056000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1056000) - 1.35 to [1.35.6-gke.1250001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-6-gke-1250001) - 1.36 to [1.36.4-gke.1247000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1247000) Security #### (2026-R42) Security updates This release includes new GKE versions that use updated Container-Optimized OS images. These updated images are cumulative, incorporating security fixes from all Container-Optimized OS versions released since the previous GKE release. To identify the specific vulnerabilities that were resolved in each updated Container-Optimized OS image, see the **Security** release notes for that image. The following table includes links to the release notes for each updated Container-Optimized OS image: | GKE version | Container-Optimized OS version | Details | |---|---|---| | 1.31.14-gke.2825000 | cos-121-18867-584-32 | [cos-121-18867-584-32 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m121.md.txt#cos-121-18867-584-32_) | | 1.32.13-gke.2567000 | cos-121-18867-584-32 | [cos-121-18867-584-32 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m121.md.txt#cos-121-18867-584-32_) | | 1.33.13-gke.1815000 | cos-121-18867-584-32 | [cos-121-18867-584-32 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m121.md.txt#cos-121-18867-584-32_) | | 1.34.12-gke.1011000 | cos-125-19216-655-40 | [cos-125-19216-655-40 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m125.md.txt#cos-125-19216-655-40_) | | 1.35.8-gke.1796000 | cos-125-19216-655-40 | [cos-125-19216-655-40 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m125.md.txt#cos-125-19216-655-40_) | | 1.38.0-gke.2240000+preview | cos-beta-133-19999-44-28 | [cos-beta-133-19999-44-28 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m133.md.txt#cos-beta-133-19999-44-28_) |
Issue In GKE control plane versions 1.36.3-gke.1244000 and later, Cloud Storage FUSE CSI driver (`gcsfusecsi-node`) DaemonSet Pods fail to start on specific node pools. The Pods crash and log the following error: MountVolume.SetUp failed for volume "host-proc-sys-fs-fuse" : hostPath type check failed: /proc/sys/fs/fuse is not a directory. This issue occurs during a version skew when node pools run an older kernel lacking the required host path (earlier than 6.12.67 for Container-Optimized OS, or earlier than 6.13 for Ubuntu). Affected node pool configurations include: - All Ubuntu with containerd (`ubuntu_containerd`) node pools. - Container-Optimized OS with containerd (`cos_containerd`) node pools on GKE versions 1.33 and earlier, 1.34 versions earlier than 1.34.6-gke.1154000, and 1.35 versions earlier than 1.35.3-gke.1389000. **Workaround** : For `cos_containerd` node pools, upgrade the node pool to a version with the required kernel support (for example, 1.34.6-gke.1154000 or later, 1.35.3-gke.1389000 or later, or match the control plane). For `ubuntu_containerd` node pools, a fix is in progress. Alternatively, downgrade the control plane to a version earlier than 1.36.3-gke.1244000. Change #### (2026-R42) Version updates > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.35.6-gke.1250001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-6-gke-1250001) is now the default version for cluster creation in the Stable channel. - The following versions are now available in the Stable channel: - [1.34.11-gke.1044000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1044000) - [1.35.6-gke.1250001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-6-gke-1250001) - The following versions are no longer available in the Stable channel: - 1.34.10-gke.1328000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Stable channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.35.6-gke.1250000 - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or deprecated APIs, preventing upgrades: - 1.34 to [1.35.6-gke.1250001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-6-gke-1250001) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or other factors preventing minor version upgrades: - 1.35 to [1.35.6-gke.1250001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-6-gke-1250001) Change #### (2026-R42) Version updates > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - The following versions are now available in the Regular channel: - [1.34.11-gke.1102000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1102000) - [1.35.8-gke.1380001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1380001) - [1.35.8-gke.1439001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1439001) - [1.36.4-gke.1391000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391000) - The following versions are no longer available in the Regular channel: - 1.34.11-gke.1044000 - 1.35.8-gke.1380000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Regular channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.3-gke.1767000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Regular channel. This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.11-gke.1056000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1056000) - 1.34 to [1.35.8-gke.1380001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1380001) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.11-gke.1056000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1056000) - 1.35 to [1.35.8-gke.1380001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1380001) - 1.36 to [1.36.4-gke.1247000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1247000) Change #### (2026-R42) Version updates > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.36.4-gke.1495000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495000) is now the default version for cluster creation in the Rapid channel. - The following versions are now available in the Rapid channel: - [1.34.12-gke.1011000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1011000) - [1.35.8-gke.1626001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1626001) - [1.35.8-gke.1796000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1796000) - [1.36.4-gke.2046000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046000) - [Alpha version](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#alpha-versions) 1.38.0-gke.2240000+preview is now available for GKE alpha clusters in the Rapid channel. - The following versions are no longer available in the Rapid channel: - 1.34.11-gke.1102000 - 1.35.8-gke.1439000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Rapid channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.35.8-gke.1626000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Rapid channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.1391000 - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.11-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1209000) - 1.34 to [1.35.8-gke.1626001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1626001) - 1.35 to [1.36.4-gke.1495000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.11-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1209000) - 1.35 to [1.35.8-gke.1626001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1626001) - 1.36 to [1.36.4-gke.1495000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495000) Change #### (2026-R42) Version updates > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - The following versions are now available: - [1.34.12-gke.1011000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1011000) - [1.35.6-gke.1250001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-6-gke-1250001) - [1.35.8-gke.1380001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1380001) - [1.35.8-gke.1439001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1439001) - [1.35.8-gke.1626001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1626001) - [1.35.8-gke.1796000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1796000) - [1.36.4-gke.2046000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046000) - The following node versions are now available: - [1.31.14-gke.2825000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2825000) - [1.32.13-gke.2567000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2567000) - [1.33.13-gke.1815000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1815000) - [1.34.12-gke.1011000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-12-gke-1011000) - [1.35.6-gke.1250001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-6-gke-1250001) - [1.35.8-gke.1380001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1380001) - [1.35.8-gke.1439001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1439001) - [1.35.8-gke.1626001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1626001) - [1.35.8-gke.1796000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1796000) - [1.36.4-gke.2046000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-2046000) - The following versions are no longer available: - 1.34.9-gke.1065000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.34.10-gke.1328000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.35.8-gke.1380000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.35.8-gke.1439000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.35.8-gke.1626000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.3-gke.1767000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.11-gke.1056000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1056000) - 1.34 to [1.35.6-gke.1250001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-6-gke-1250001) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.11-gke.1056000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1056000) - 1.35 to [1.35.6-gke.1250001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-6-gke-1250001) - 1.36 to [1.36.4-gke.1247000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1247000) Feature You can use Vertical Pod Autoscaler (VPA) with Horizontal Pod Autoscaler (HPA) to automatically optimize container CPU requests for workloads that scale replicas based on CPU utilization. This feature is available in Public Preview on clusters running GKE version 1.36.3-gke.1630000 or later. For more information, see [Rightsize HPA workloads with VPA](https://docs.cloud.google.com/kubernetes-engine/docs/how-to/rightsize-hpa-workloads-with-vpa.md.txt). Change #### (2026-R42) Version updates > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.36.4-gke.1247000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1247000) is now the default version for cluster creation in the Extended channel. - The following versions are now available in the Extended channel: - [1.31.14-gke.2704000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2704000) - [1.31.14-gke.2825000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2825000) - [1.32.13-gke.2427000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2427000) - [1.32.13-gke.2567000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2567000) - [1.33.13-gke.1647000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1647000) - [1.33.13-gke.1815000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1815000) - [1.34.11-gke.1102000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1102000) - [1.35.8-gke.1380001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1380001) - [1.35.8-gke.1439001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1439001) - [1.36.4-gke.1391000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391000) - The following versions are no longer available in the Extended channel: - 1.31.14-gke.2667000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.31.14-gke.2759000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.32.13-gke.2393000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.32.13-gke.2504000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.33.13-gke.1613000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.33.13-gke.1721000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.34.11-gke.1044000 - 1.35.8-gke.1225000 - 1.35.8-gke.1380000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.3-gke.1767000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or deprecated APIs, preventing upgrades: - 1.30 to [1.31.14-gke.2689000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2689000) - 1.31 to [1.32.13-gke.2411000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2411000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or other factors preventing minor version upgrades: - 1.31 to [1.31.14-gke.2689000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2689000) - 1.32 to [1.32.13-gke.2411000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2411000) - 1.33 to [1.33.13-gke.1636000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1636000) - 1.34 to [1.34.11-gke.1056000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1056000) - 1.35 to [1.35.8-gke.1380001](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1380001) - 1.36 to [1.36.4-gke.1247000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1247000) **Network Connectivity Center** Feature Network Connectivity Center supports [site-to-site data transfer](https://docs.cloud.google.com/network-connectivity/docs/network-connectivity-center/concepts/locations.md.txt) in the following country: - Poland ## October 01, 2026 **BigQuery** Change An updated version of the [Simba JDBC driver for BigQuery](https://docs.cloud.google.com/bigquery/docs/reference/odbc-jdbc-drivers.md.txt#current_jdbc_driver) is now available. Feature [Chatting with graphs](https://docs.cloud.google.com/bigquery/docs/graph-chat.md.txt) in [conversational analytics](https://docs.cloud.google.com/bigquery/docs/conversational-analytics.md.txt#graphs) is now [generally available](https://cloud.google.com/products#product-launch-stages). You can use a combination of multiple graphs, tables, views, and UDFs as data sources. Feature BigQuery pipelines provides support for automated metadata enrichment and Knowledge Catalog data quality scorecard integration. In addition, the Data Engineering Agent can proactively generate semantic metadata for your pipeline assets. For more information, see [Metadata enrichment and data quality scorecard integration](https://docs.cloud.google.com/bigquery/docs/manage-pipelines.md.txt#metadata-scorecard). These features are [generally available](https://cloud.google.com/products#product-launch-stages). **Bigtable** Feature You can use [Google Cloud Data Agent Kit](https://docs.cloud.google.com/data-agent-kit/overview.md.txt) to browse Bigtable instances and tables, design schemas, and run GoogleSQL queries from your IDE or coding agent. This feature is [generally available (GA)](https://cloud.google.com/products#product-launch-stages). For more information, see [Data Agent Kit is now GA: Bring Google Data Cloud to any coding agent](https://cloud.google.com/blog/topics/developers-practitioners/data-agent-kit-is-now-ga-bring-google-data-cloud-to-any-coding-agent). **Cloud Healthcare API** Feature **Preview:** The FHIR bulk export Group POST feature is now available in [Preview](https://cloud.google.com/products#product-launch-stages) in Cloud Healthcare API `v1beta1`. You can invoke the `$export` operation on a FHIR `Group` by using the HTTP `POST` method (`projects.locations.datasets.fhirStores.bulk-export-group-post`) to supply export parameters in the request body rather than through URL query parameters. The request body allows filtering by a list of up to 1,000 patient references by using the `patient` parameter in addition to `_since` and `_type`. For more information about the specification, see the FHIR Bulk Data Access guide for [$export group of patients](https://build.fhir.org/ig/HL7/bulk-data/export.html#endpoint---group-of-patients). **Compute Engine** Feature **Generally available**: Expanded machine series support for sharing the same Hyperdisk volume between instances: - C3 bare metal instances support multi-writer mode for Hyperdisk Balanced volumes. - C4 instances created after May 1, 2026, support multi-writer mode for Hyperdisk Balanced, Hyperdisk Extreme, and Hyperdisk Balanced High Availability volumes. For more information, see [Sharing a disk between instances](https://docs.cloud.google.com/compute/docs/disks/sharing-disks-between-vms.md.txt). **Dataform** Feature Dataform provides support for automated metadata enrichment and Knowledge Catalog data quality scorecard integration for Dataform workflows and BigQuery pipelines. For more information, see [Add metadata for Knowledge Catalog](https://docs.cloud.google.com/dataform/docs/create-tables.md.txt#add-metadata). This feature is [generally available](https://cloud.google.com/products#product-launch-stages). **Gemini Enterprise** Announcement **Gemini Enterprise: Gemini 2.5 Pro removal in Canada and Japan on October 20, 2026** On October 20, 2026, Gemini 2.5 Pro will be removed from the Gemini Enterprise app in the Canada and Japan in-country regions. After this date, users in these regions can't select Gemini 2.5 Pro in the Gemini Enterprise app. Gemini 2.5 Pro remains available in the `global`, `us`, and `eu` regions. For more information, see [Data residency for Gemini Enterprise](https://docs.cloud.google.com/gemini/enterprise/docs/locations). Feature **Gemini Enterprise: Turn Gemini 2.5 Pro on or off in the web app** Administrators can turn Gemini 2.5 Pro on or off for the Gemini Enterprise web app in the `global`, `us`, and `eu` regions. Gemini 2.5 Pro remains turned on by default, so existing configurations aren't affected. For more information, see [Manage web app features](https://docs.cloud.google.com/gemini/enterprise/docs/manage-web-app-features). **Google Cloud VMware Engine** Feature **Generally available**: Bring Your Own License (BYOL) license management for Google Cloud VMware Engine is generally available (GA). BYOL license management lets you register and manage portable VMware Cloud Foundation (VCF) license keys in the Google Cloud console across projects associated with your Cloud Billing account. For more information, see [License management](https://docs.cloud.google.com/vmware-engine/docs/license-management.md.txt). **Network Intelligence Center** Announcement [Network Services Monitoring](https://docs.cloud.google.com/network-intelligence-center/docs/network-services-monitoring/overview.md.txt) is available in **Preview**. Network Services Monitoring visualizes communication paths and network metrics for Google Kubernetes Engine services and workloads with ambient networking enabled. Feature [Cloud Network Insights](https://docs.cloud.google.com/network-intelligence-center/docs/cloud-network-insights/overview.md.txt) supports using Google Cloud CLI commands to download [Microsoft Azure](https://docs.cloud.google.com/network-intelligence-center/docs/cloud-network-insights/deploy-azure-monitoring-points.md.txt) and [Amazon Web Services (AWS)](https://docs.cloud.google.com/network-intelligence-center/docs/cloud-network-insights/deploy-aws-monitoring-points.md.txt) Monitoring Point installation bundles. **Pub/Sub** Feature You can use Gemini Enterprise to generate code for user-defined function (UDF) single-message transforms (SMTs). For more information, see [Create a UDF SMT](https://docs.cloud.google.com/pubsub/docs/smts/udfs-overview.md.txt#create-udf-smt). ## September 30, 2026 **API Gateway** Feature **Authenticate MCP tool discovery with an API key** API key authentication is now supported for the Model Context Protocol (MCP) `tools/list` method. You can name an API key security scheme in `tools-list.security`, in addition to a JWT security scheme. For more information, see [Configure Model Context Protocol](https://docs.cloud.google.com/api-gateway/docs/mcp-configure.md.txt). **Agent Assist** Feature Agent Assist offers [companion agent](https://docs.cloud.google.com/gemini-enterprise-cx/agent-assist/companion-agent-overview.md.txt) in General Availability (GA). Companion agent unifies real-time agent assistance into a single interface that operates in both **proactive** and **on-demand** modes: - **Proactive guidance**: Monitors live customer conversations to surface context-aware next-best-action recommendations and follow configured instructions. - **On-demand assistant (`StreamingReactiveCompanionSuggestions`)**: Enables human agents to ask natural-language questions in an interactive panel and receive streamed, source-cited answers grounded in conversation context. - **Tool execution and grounding** : Connects to [data store tools, OpenAPI tools, custom tools, and Grounding with Google Search](https://docs.cloud.google.com/gemini-enterprise-cx/agent-assist/companion-agent-tools.md.txt) to retrieve live data and automate tasks, with built-in human-in-the-loop confirmation for state-modifying actions. Companion agent is available across supported Agent Assist [regions](https://docs.cloud.google.com/gemini-enterprise-cx/agent-assist/regionalization.md.txt) with default resource allocation and token [quotas](https://docs.cloud.google.com/gemini-enterprise-cx/agent-assist/quotas.md.txt#companion-agent). **Apigee API hub** Feature **Service type system attribute (GA)** API hub now includes **Service type** , a system attribute that classifies an API as `Code`, `Model`, `Agent`, or `Skill`. Service type describes what a service is. **API style** describes how you call it. Use Service type to find and govern your APIs, agents, models, and skills. Set Service type when you register or edit an API. To show only your agents, filter the API list by Service type, or select the new **Agent** chip. In the API, use the `service_type` field. This feature is [Generally Available (GA)](https://cloud.google.com/products#product-launch-stages). For more information, see [Supported system attributes](https://docs.cloud.google.com/apigee/docs/apihub/manage-attributes.md.txt#supported-system-attributes). Feature **AI performance and Tool performance dashboards in API insights** API insights in API hub now includes two dashboards for AI and agent traffic: - **AI performance** reports token usage and model latency for the large language models called through your gateways, with filters for model and provider. - **Tool performance** reports traffic, throughput, payload sizes, and latency for your Model Context Protocol (MCP) tools, with filters for MCP server, deployment, and tool name. For more information, see [API insights dashboards](https://docs.cloud.google.com/apigee/docs/apihub/api-insights-dashboard.md.txt). **Apigee hybrid** Announcement ### v1.17.1 On September 30, 2026 we released an updated version of the Apigee hybrid software, v1.17.1. - For information on upgrading, see [Upgrading Apigee hybrid to version v1.17.1](https://docs.cloud.google.com/apigee/docs/hybrid/v1.17/upgrade.md.txt). - For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.17/big-picture.md.txt). > [!NOTE] > **Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images). Feature **External Cassandra datastore support** Apigee hybrid v1.17.1 adds support for connecting an Apigee hybrid runtime to a Cassandra datastore that runs in a separate Kubernetes cluster (**external datastore** mode). In external datastore mode, the runtime cluster runs with `cassandra.replicaCount: 0` (no local Cassandra pods) and connects to the remote Cassandra ring using the [`cassandra.properties.externalHost`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.17/config-prop-ref.md.txt#cassandra) property (a comma-separated list of remote Cassandra IP addresses) and the optional [`cassandra.properties.externalEndpointsSync`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.17/config-prop-ref.md.txt#cassandra) property for dynamic endpoint synchronization. For more information, see [Use an external Cassandra datastore](https://docs.cloud.google.com/apigee/docs/hybrid/v1.17/cassandra-external.md.txt) and [Configuration property reference](https://docs.cloud.google.com/apigee/docs/hybrid/v1.17/config-prop-ref.md.txt#cassandra). Change **The Apigee operator's Kubernetes manager role now includes the core `endpoints` permission.** In v1.17.1, the Apigee operator's manager role is granted the core (`""` API group) [`endpoints`](https://kubernetes.io/docs/concepts/services-networking/service/#endpoints) resource, with the verbs `get`, `list`, `watch`, `create`, `update`, `patch`, and `delete`. This role is the namespaced `apigee-manager-role` Kubernetes `Role` created by default in the `apigee` namespace. The operator needs this permission for the external (cross-cluster) Cassandra datastore feature: when a datastore uses an external host, the operator directly manages the `Endpoints` object of the selectorless Kubernetes `Service` that fronts it. This permission is granted to **all** v1.17.1 installations, whether or not you use an external datastore. It is added to the operator's manager role and is not gated on any configuration property, so security teams that audit operator permissions should expect it after upgrading. Because the grant is on a namespaced `Role`, the new access is limited to the Apigee namespace and does not extend cluster-wide. Most installations require no action. The `apigee-operator` Helm chart defines this role, so running `helm upgrade` on the `apigee-operator` chart grants the permission automatically. If you self-manage the Apigee operator's Kubernetes RBAC, meaning you prevent Helm from creating or updating the operator's `Role` objects, add the `endpoints` resource to the existing core (`""`) API group rule of the `apigee-manager-role` `Role` in the Apigee namespace, or append the following rule: ```yaml - apiGroups: [""] resources: ["endpoints"] verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] ``` If you self-manage the operator's RBAC, add this permission before you upgrade to v1.17.1. If you have already upgraded without this permission, apply the update to your role configuration to ensure proper operator functionality. Without this permission, the operator cannot manage the `Endpoints` object of an external datastore, so the external datastore feature does not work. If you do not use an external datastore, the operator works without this permission. > [!NOTE] > **Note:** The [`ao.args.disableManagedClusterRoles`](https://docs.cloud.google.com/apigee/docs/hybrid/v1.17/config-prop-ref.md.txt#ao-args-disablemanagedclusterroles) property does not apply to this change. That property governs only `ClusterRole` and `ClusterRoleBinding` objects, whereas this permission is added to a namespaced `Role`. Fixed #### Fixed in this release | Bug ID | Description | |---|---| | **565753858** | **Fixed an issue where the `apigee-mcp-server` controller dropped pod-level volumes configured on the `mcpServer` component (such as `fwi-token` volumes when Federated Workload Identity is enabled), causing `ReplicaSet` creation to fail.** | | **565072374** | **Fixed an issue where `VerifyJWT` policies using a JWKS `uriRef` could return `steps.jwt.NoMatchingPublicKey` on the first request after the 5-minute JWKS cache TTL expired when the identity provider rotated keys. The cache now refreshes synchronously upon expiration.** | | **564969400** | **Fixed an issue where variables initialized from an empty `` element in `AssignMessage` (`AssignVariable`) were not treated as empty strings when referenced in message template functions such as `replaceAll`.** | | **563557547** | **Fixed an issue where EventFlow (Server-Sent Events) could coalesce multiple events into a single policy invocation under burst traffic on the `http-adaptor` datapath, producing malformed SSE responses.** | | **560372165** | **Fixed a synchronizer readiness-gate deadlock that could leave a Message Processor on an older contract revision and return `404 ApplicationNotFound` for newly deployed standard proxies.** | | **560130499** | **Fixed a security issue by hardening the `JavaCallout` policy sandbox.** | | **558888960** | **Fixed an issue in distributed tracing where the target URL was omitted from outbound target request span attributes after a request-flow policy step executed.** | | **556750755** | **Fixed an issue where EventFlow (Server-Sent Events) dropped or truncated events following a large (\>16 KB) event under load on the `http-adaptor` datapath.** | | **556680325** | **Fixed a server-side request forgery (SSRF) vulnerability in URL host validation for the `SemanticCacheLookup` policy.** | | **554114419** | **Apigee hybrid now allows policies to modify HTTP/2 request pseudo-headers (`:path` and `:authority`) when communicating over HTTP/2.** | | **548763108** | **Hardened Message Processor outbound HTTP validation to block requests to internal Kubernetes cluster hostnames (`*.svc.cluster.local`).** | | **547712217** | **Fixed an issue where EventFlow (Server-Sent Events) responses larger than 16 KB could be truncated or corrupted across socket reads.** | | **531783017** | **Fixed a security issue in the `MessageLogging` policy where syslog-over-TLS did not verify the server TLS certificate hostname when `true` was configured in ``.** | | **513032450** | **Fixed an issue where `apigee-connect-agent` control-plane connections could hang for up to 2 hours when silently dropped by a network intermediary by restoring a 15-second TCP keep-alive.** | | **432315283** | **Fixed an issue where only the first certificate in a multi-certificate PEM bundle uploaded to a single truststore alias was registered when the `features.truststore.multi_cert_bundle.enabled` environment property is set to `true`.** | | **357042873** | **Fixed an issue where `apigee-cassandra-schema-readiness` init container logs were redirected to `/dev/null`, improving troubleshooting visibility.** | Security | Bug ID | Description | |---|---| | **N/A** | **Security fixes for `apigee-connect-agent`.** This addresses the following vulnerability: - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) | | **N/A** | **Security fixes for `apigee-hybrid-cassandra`.** This addresses the following vulnerabilities: - [CVE-2022-42003](https://nvd.nist.gov/vuln/detail/CVE-2022-42003) - [CVE-2022-42004](https://nvd.nist.gov/vuln/detail/CVE-2022-42004) - [CVE-2024-45336](https://nvd.nist.gov/vuln/detail/CVE-2024-45336) - [CVE-2024-45341](https://nvd.nist.gov/vuln/detail/CVE-2024-45341) - [CVE-2024-47554](https://nvd.nist.gov/vuln/detail/CVE-2024-47554) - [CVE-2025-0913](https://nvd.nist.gov/vuln/detail/CVE-2025-0913) - [CVE-2025-22866](https://nvd.nist.gov/vuln/detail/CVE-2025-22866) - [CVE-2025-22870](https://nvd.nist.gov/vuln/detail/CVE-2025-22870) - [CVE-2025-22871](https://nvd.nist.gov/vuln/detail/CVE-2025-22871) - [CVE-2025-22873](https://nvd.nist.gov/vuln/detail/CVE-2025-22873) - [CVE-2025-4673](https://nvd.nist.gov/vuln/detail/CVE-2025-4673) - [CVE-2025-4674](https://nvd.nist.gov/vuln/detail/CVE-2025-4674) - [CVE-2025-47906](https://nvd.nist.gov/vuln/detail/CVE-2025-47906) - [CVE-2025-47907](https://nvd.nist.gov/vuln/detail/CVE-2025-47907) - [CVE-2025-47912](https://nvd.nist.gov/vuln/detail/CVE-2025-47912) - [CVE-2025-48924](https://nvd.nist.gov/vuln/detail/CVE-2025-48924) - [CVE-2025-52999](https://nvd.nist.gov/vuln/detail/CVE-2025-52999) - [CVE-2025-58183](https://nvd.nist.gov/vuln/detail/CVE-2025-58183) - [CVE-2025-58185](https://nvd.nist.gov/vuln/detail/CVE-2025-58185) - [CVE-2025-58186](https://nvd.nist.gov/vuln/detail/CVE-2025-58186) - [CVE-2025-58187](https://nvd.nist.gov/vuln/detail/CVE-2025-58187) - [CVE-2025-58188](https://nvd.nist.gov/vuln/detail/CVE-2025-58188) - [CVE-2025-58189](https://nvd.nist.gov/vuln/detail/CVE-2025-58189) - [CVE-2025-61723](https://nvd.nist.gov/vuln/detail/CVE-2025-61723) - [CVE-2025-61724](https://nvd.nist.gov/vuln/detail/CVE-2025-61724) - [CVE-2025-61725](https://nvd.nist.gov/vuln/detail/CVE-2025-61725) - [CVE-2025-61726](https://nvd.nist.gov/vuln/detail/CVE-2025-61726) - [CVE-2025-61727](https://nvd.nist.gov/vuln/detail/CVE-2025-61727) - [CVE-2025-61728](https://nvd.nist.gov/vuln/detail/CVE-2025-61728) - [CVE-2025-61729](https://nvd.nist.gov/vuln/detail/CVE-2025-61729) - [CVE-2025-61730](https://nvd.nist.gov/vuln/detail/CVE-2025-61730) - [CVE-2025-61731](https://nvd.nist.gov/vuln/detail/CVE-2025-61731) - [CVE-2025-61732](https://nvd.nist.gov/vuln/detail/CVE-2025-61732) - [CVE-2025-68121](https://nvd.nist.gov/vuln/detail/CVE-2025-68121) - [CVE-2025-68161](https://nvd.nist.gov/vuln/detail/CVE-2025-68161) - [CVE-2026-25679](https://nvd.nist.gov/vuln/detail/CVE-2026-25679) - [CVE-2026-27139](https://nvd.nist.gov/vuln/detail/CVE-2026-27139) - [CVE-2026-27140](https://nvd.nist.gov/vuln/detail/CVE-2026-27140) - [CVE-2026-27142](https://nvd.nist.gov/vuln/detail/CVE-2026-27142) - [CVE-2026-27143](https://nvd.nist.gov/vuln/detail/CVE-2026-27143) - [CVE-2026-27144](https://nvd.nist.gov/vuln/detail/CVE-2026-27144) - [CVE-2026-27145](https://nvd.nist.gov/vuln/detail/CVE-2026-27145) - [CVE-2026-32280](https://nvd.nist.gov/vuln/detail/CVE-2026-32280) - [CVE-2026-32281](https://nvd.nist.gov/vuln/detail/CVE-2026-32281) - [CVE-2026-32282](https://nvd.nist.gov/vuln/detail/CVE-2026-32282) - [CVE-2026-32283](https://nvd.nist.gov/vuln/detail/CVE-2026-32283) - [CVE-2026-32288](https://nvd.nist.gov/vuln/detail/CVE-2026-32288) - [CVE-2026-32289](https://nvd.nist.gov/vuln/detail/CVE-2026-32289) - [CVE-2026-33811](https://nvd.nist.gov/vuln/detail/CVE-2026-33811) - [CVE-2026-33814](https://nvd.nist.gov/vuln/detail/CVE-2026-33814) - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-34477](https://nvd.nist.gov/vuln/detail/CVE-2026-34477) - [CVE-2026-34480](https://nvd.nist.gov/vuln/detail/CVE-2026-34480) - [CVE-2026-39817](https://nvd.nist.gov/vuln/detail/CVE-2026-39817) - [CVE-2026-39819](https://nvd.nist.gov/vuln/detail/CVE-2026-39819) - [CVE-2026-39820](https://nvd.nist.gov/vuln/detail/CVE-2026-39820) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-39822](https://nvd.nist.gov/vuln/detail/CVE-2026-39822) - [CVE-2026-39823](https://nvd.nist.gov/vuln/detail/CVE-2026-39823) - [CVE-2026-39825](https://nvd.nist.gov/vuln/detail/CVE-2026-39825) - [CVE-2026-39826](https://nvd.nist.gov/vuln/detail/CVE-2026-39826) - [CVE-2026-39836](https://nvd.nist.gov/vuln/detail/CVE-2026-39836) - [CVE-2026-42499](https://nvd.nist.gov/vuln/detail/CVE-2026-42499) - [CVE-2026-42501](https://nvd.nist.gov/vuln/detail/CVE-2026-42501) - [CVE-2026-42504](https://nvd.nist.gov/vuln/detail/CVE-2026-42504) - [CVE-2026-42505](https://nvd.nist.gov/vuln/detail/CVE-2026-42505) - [CVE-2026-42507](https://nvd.nist.gov/vuln/detail/CVE-2026-42507) - [CVE-2026-50193](https://nvd.nist.gov/vuln/detail/CVE-2026-50193) - [CVE-2026-54512](https://nvd.nist.gov/vuln/detail/CVE-2026-54512) - [CVE-2026-54513](https://nvd.nist.gov/vuln/detail/CVE-2026-54513) - [CVE-2026-54514](https://nvd.nist.gov/vuln/detail/CVE-2026-54514) - [CVE-2026-54515](https://nvd.nist.gov/vuln/detail/CVE-2026-54515) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [GHSA-r7wm-3cxj-wff9](https://osv.dev/vulnerability/GHSA-r7wm-3cxj-wff9) | | **N/A** | **Security fixes for `apigee-hybrid-cassandra-client`.** This addresses the following vulnerabilities: - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) | | **N/A** | **Security fixes for `apigee-mart-server`.** This addresses the following vulnerabilities: - [CVE-2026-13506](https://nvd.nist.gov/vuln/detail/CVE-2026-13506) - [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) - [CVE-2026-50645](https://nvd.nist.gov/vuln/detail/CVE-2026-50645) - [CVE-2026-8763](https://nvd.nist.gov/vuln/detail/CVE-2026-8763) | | **N/A** | **Security fixes for `apigee-mint-task-scheduler`.** This addresses the following vulnerabilities: - [CVE-2026-13506](https://nvd.nist.gov/vuln/detail/CVE-2026-13506) - [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) - [CVE-2026-50645](https://nvd.nist.gov/vuln/detail/CVE-2026-50645) - [CVE-2026-8763](https://nvd.nist.gov/vuln/detail/CVE-2026-8763) | | **N/A** | **Security fixes for `apigee-operators`.** This addresses the following vulnerability: - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) | | **N/A** | **Security fixes for `apigee-prom-prometheus`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) | | **N/A** | **Security fixes for `apigee-prometheus-adapter`.** This addresses the following vulnerability: - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) | | **N/A** | **Security fixes for `apigee-runtime`.** This addresses the following vulnerabilities: - [CVE-2026-13506](https://nvd.nist.gov/vuln/detail/CVE-2026-13506) - [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) - [CVE-2026-50645](https://nvd.nist.gov/vuln/detail/CVE-2026-50645) - [CVE-2026-8763](https://nvd.nist.gov/vuln/detail/CVE-2026-8763) | | **N/A** | **Security fixes for `apigee-synchronizer`.** This addresses the following vulnerabilities: - [CVE-2026-13506](https://nvd.nist.gov/vuln/detail/CVE-2026-13506) - [CVE-2026-49844](https://nvd.nist.gov/vuln/detail/CVE-2026-49844) - [CVE-2026-50645](https://nvd.nist.gov/vuln/detail/CVE-2026-50645) - [CVE-2026-8763](https://nvd.nist.gov/vuln/detail/CVE-2026-8763) | | **N/A** | **Security fixes for `apigee-watcher`.** This addresses the following vulnerability: - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) | **Assured Workloads** Feature You can now acknowledge multiple compliance violations at once in the Google Cloud console to add violation exceptions in bulk, up to 100 organization policy violations and up to 400 resource violations in a single operation. For more information, see how to add violation exceptions when [monitoring a folder](https://docs.cloud.google.com/assured-workloads/docs/monitor-folder.md.txt#exception) or [monitoring frameworks](https://docs.cloud.google.com/assured-workloads/docs/monitor-frameworks.md.txt#exception). **Backup and DR** Deprecated Support for backing up and restoring workloads managed via the legacy appliance management console is deprecated. Key milestones for this deprecation include the following: - **End of Support for New Backups**: After September 30, 2027, you will no longer be able to run new backups using the legacy stack. - **End of Standard Restores**: Support for standard restores, exports, and migrations using the legacy appliance management console continues till March 31, 2028. For more information, see [Deprecations](https://docs.cloud.google.com/backup-disaster-recovery/docs/deprecations.md.txt). **BigQuery** Feature The BigQuery [Security center](https://docs.cloud.google.com/bigquery/docs/security-center-overview.md.txt) is now available in the Google Cloud console. You can use the Security center to analyze your data security profile, create and manage row- and column-level security policies, and configure and manage data governance and policy tags. This feature is [generally available](https://cloud.google.com/products#product-launch-stages) (GA). Feature BigQuery jobs explorer layout and filtering improvements, including status counts in the filter bar, [resource grouping](https://docs.cloud.google.com/bigquery/docs/admin-jobs-explorer.md.txt#group-jobs), and [timeline metric charts](https://docs.cloud.google.com/bigquery/docs/admin-jobs-explorer.md.txt#view-metric-chart), are [generally available](https://cloud.google.com/products#product-launch-stages) (GA). Feature You can now use the [`OBJ.LIST` function](https://docs.cloud.google.com/bigquery/docs/reference/standard-sql/objectref_functions.md.txt#objlist) to perform spontaneous discovery and analysis of unstructured data. The `OBJ.LIST` function returns a table of metadata and `ObjectRef` values for files stored in Cloud Storage, and does not require you to create a persistent object table. This feature is [generally available](https://cloud.google.com/products#product-launch-stages) (GA). Feature You can now view the [`UPDATE`, `DELETE`, `MERGE`](https://docs.cloud.google.com/bigquery/docs/query-plan-explanation.md.txt#dml_steps), and [`EXPORT`](https://docs.cloud.google.com/bigquery/docs/query-plan-explanation.md.txt#export_step) execution steps in your query plans. **Capacity Planner** Feature **Preview** : You can use Capacity Assist, which provides AI-powered assistance through Gemini in Capacity Planner, to help you understand and manage your resource usage and plan capacity ([Preview](https://cloud.google.com/products#product-launch-stages)). You can use natural-language prompts in Capacity Assist to do the following: - Analyze historical usage patterns across regions and resources. - Forecast capacity needs and identify quota risks early. - Simulate growth events to plan future capacity. - Get answers to your Capacity Planner questions. For more information, see [Plan capacity with Capacity Assist](https://docs.cloud.google.com/capacity-planner/docs/capacity-assist.md.txt). **Cloud Load Balancing** Feature A new quota system governing the configuration size of Application Load Balancers is now **generally available** . This update increases the individual URL map size limit from 64 KB and 128 KB to 1 MB. For more information, see [URL map size and quota units](https://docs.cloud.google.com/load-balancing/docs/url-map-size-quota). Key aspects of this feature include: - Complexity-based quota: *Quota units* reflect URL map complexity (number of rules, hostnames, and path matchers). - Scoped measurement: Quota is measured and enforced on a per-project, per-region, or per-VPC depending on Application Load Balancer type. - Active consumption: Only URL maps currently referenced by forwarding rules contribute to quota usage. - New URL map size limit: The new quota has a new URL map size limit increased to 1 MB for global and regional external and internal Application Load Balancers. Classic Application Load Balancers remain restricted to 64 KB. For more information on increasing your limit, please contact [Google Cloud Support](https://cloud.google.com/support). **Cloud Monitoring** Announcement The [application topology graph](https://docs.cloud.google.com/stackdriver/docs/observability/application-topology.md.txt) is now [generally available (GA)](https://docs.cloud.google.com/products#product-launch-stages). This graph helps you to understand relationships between applications, services, and workloads, and shows you traffic flow and incidents in the context of your applications. **Cloud Storage** Feature Cloud Storage client libraries now provide automated, end-to-end checksumming by default for object read and write operations to help maintain data integrity from client to storage. For more information, see [data validation](https://docs.cloud.google.com/storage/docs/data-validation.md.txt#client-validation-writes). **Cloud Tasks** Feature Cloud Tasks support for the following is generally available ([GA](https://cloud.google.com/products#product-launch-stages)): - [Set retry parameters when creating a task](https://docs.cloud.google.com/tasks/docs/configure-retry-task.md.txt) and override the queue-level retry configuration for the task. - [Create a batch of tasks](https://docs.cloud.google.com/tasks/docs/create-tasks.md.txt#create-batch-tasks) and add the batch to an existing queue. - [Delete a batch of tasks](https://docs.cloud.google.com/tasks/docs/manage-queues-and-tasks.md.txt#delete-batch-tasks) from a queue. **Compute Engine** Feature **Generally available** : You can specify a 120-second preemption notice duration while creating Spot VMs. Use this feature for workloads on Spot VMs where you want up to an additional 120 seconds for handling preemption. If you want to migrate existing Spot VMs workloads, make sure you update your workload to handle preemption outside of a shutdown script and test preemption. For more information, see [Spot VMs](https://docs.cloud.google.com/compute/docs/instances/spot.md.txt#preemption-notice-duration) and [Create and use Spot VMs](https://docs.cloud.google.com/compute/docs/instances/create-use-spot.md.txt). **Datastream** Feature Datastream now supports partial backfill for SQL Server, Spanner, Oracle, PostgreSQL, and MySQL sources. Partial backfill lets you load a specific subset of data from the source into the destination by providing a SQL `WHERE` clause as a custom filter. For more information, see [Initiate partial backfill](https://docs.cloud.google.com/datastream/docs/manage-backfill-for-the-objects-of-a-stream#initiatepartialbackfill). **Dialogflow** Fixed **Dialogflow CX** : An issue in Dialogflow CX was identified where sensitive authentication tokens stored in conversational session parameters could be returned in cleartext via `DetectIntent` API responses. A server-side fix has been applied to redact and sanitize authentication credentials from conversational API outputs. No customer configuration changes or updates are required. Deprecated **All generative features** : `gemini-2.5-flash` and `gemini-2.5-flash-lite` models will be deprecated by Dec 23, 2026. Upgrade to newer Gemini models such as `gemini-3.1-flash-lite` before the deprecation date. Feature [BidiStreamingAnalyzeContent](https://docs.cloud.google.com/dialogflow/es/docs/reference/rpc/google.cloud.dialogflow.v2.md.txt#participants) API has become generally available (GA). **Eventarc** Feature Eventarc support for [creating triggers](https://docs.cloud.google.com/eventarc/standard/docs/event-providers-targets.md.txt#triggers) for [direct events from Firebase Authentication](https://docs.cloud.google.com/eventarc/docs/reference/supported-events.md.txt#firebase-auth) is available in [Preview](https://cloud.google.com/products#product-launch-stages). **Gemini Enterprise Agent Platform** Feature **Cloud Trace integration with Agent Gateway (Preview)** Agent Gateway integrates with Cloud Trace in [Preview](https://cloud.google.com/products#product-launch-stages) to provide end-to-end request observability for agent workloads. Enabling Cloud Trace gives you visibility into how requests travel from your agents through the gateway and across Google Cloud services, tools, agents, and MCP servers. For more information, see [Use Cloud Trace](https://docs.cloud.google.com/gemini-enterprise-agent-platform/govern/gateways/monitor-agent-gateway.md.txt#use-cloud-trace). Feature **xAI's Grok 4.7** [Grok 4.7](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/partner-models/grok/grok-4-7.md.txt) is available in [Preview](https://cloud.google.com/products#product-launch-stages) in Model Garden. Fixed **CodeMender updates (v0.11.0)** This release introduces updates to CodeMender: - **Tiered location configuration** : Added support for configuring the service location using the `CM_LOCATION` environment variable or `location` in `config.yaml` (defaulting to `global`), replacing the `--location` command-line flag. - **CI gate severity validation** : Updated `cm find` to validate `--fail-on` severity values (`CRITICAL`, `HIGH`, `MEDIUM`, `LOW`, or `NONE`) up front instead of silently ignoring misspelled severities. - **Sandboxed VCS branching and hardening** : Enabled `vcs_branch` creation and candidate branch cleanup inside the default sandboxed worker for `--architecture` sessions, and hardened VCS template expansion against shell metacharacters and command injection. - **Bug fixes** : - Normalized vulnerability type casing and relative file paths during `cm find` and consensus runs to prevent duplicate findings. - Extended HTTP 429 retry backoff (`Retry-After` support and up to 60-second quota refill windows) and automatic stream reconnection to improve scan resilience under rate limiting. - Preserved standalone `cm find`, `cm verify`, and `cm fix` sessions on interrupt (`SIGINT`/`SIGTERM`) so interrupted runs can be resumed with `cm session resume`, while still canceling parallel consensus worker operations. For more information, see the [CodeMender documentation](https://docs.cloud.google.com/gemini-enterprise-agent-platform/codemender). Feature The App Topology API that provides agent topologies in Gemini Enterprise Agent Platform is now [generally available](https://cloud.google.com/products#product-launch-stages) This launch introduces the following changes: - A new query builder for customizing suggested quick queries or creating your own query on the **Topologies** page. Custom queries let you explore more data related to your agents, such as identity, alerts, vulnerabilities, and underlying infrastructure. For details, see [View topologies for a project](https://docs.cloud.google.com/gemini-enterprise-agent-platform/govern/topology/view-project-topology.md.txt). - A streamlined experience for the [single-agent topology](https://docs.cloud.google.com/gemini-enterprise-agent-platform/govern/topology/view-agent-registry-topology.md.txt) in Agent Registry. A topology with single-hop traffic to and from the agent automatically loads on the page. **Google Cloud Contact Center as a Service** Announcement **Headless mobile SDK** The headless mobile SDK, for Android and iOS, is now available. With this SDK, you can embed the capabilities of Google Cloud CCaaS into your mobile app while retaining full control over the UI. The headless mobile SDK supports calls (including scheduled calls), chats, and email. The following is a comparison of the headless mobile SDK and the mobile SDK v2. Headless mobile SDK: - Google Cloud CCaaS provides the core SDK engine: sessions, routing, channel logic, and more. - You build the UI using your own design and components. - Best for organizations that need brand consistency and full control over the look and feel of their mobile app. Mobile SDK v2: - Google Cloud CCaaS provides a pre-built UI with customization options. - Best for organizations that want faster product deployment with less design and engineering effort. For more information, see the following: - [Headless Mobile SDK v3 for iOS: Get started](https://docs.cloud.google.com/contact-center/ccai-platform/docs/headless-mobile-sdk-ios-getting-started) - [Headless Mobile SDK v3 for Android: Get started](https://docs.cloud.google.com/contact-center/ccai-platform/docs/headless-mobile-sdk-android-getting-started) **Google Kubernetes Engine** Feature GKE now automatically applies protection tier labels to TPU node pools created from Compute Engine reservations. Depending on your configuration, GKE adds: - Node pool resource label: `goog-gke-node-pool-protection-tier` (`standard` or `capacity_optimized`) - Kubernetes node label: `cloud.google.com/protection-tier` (`STANDARD` or `CAPACITY_OPTIMIZED`) To learn more, see [Automatically applied labels](https://docs.cloud.google.com/kubernetes-engine/docs/how-to/creating-managing-labels.md.txt#automatically-applied-labels). **Google SecOps** Feature **Expanded read-only permissions for Chronicle API Restricted Data Access Viewer** Google SecOps has updated the predefined **Chronicle API Restricted Data Access Viewer** (`roles/chronicle.restrictedDataAccessViewer`) IAM role to include all read-only permissions available in the **Chronicle API Viewer** (`roles/chronicle.viewer`) role, excluding global data access (`chronicle.globalDataAccessScopes.permit`). With this update, users assigned to `roles/chronicle.restrictedDataAccessViewer` IAM role will have read-only access across Google SecOps features---including SOAR cases and playbooks, investigations, threat collections, findings, security validation, and ingestion resources within their assigned data access scopes. For more information, see [Configure data RBAC for users](https://docs.cloud.google.com/chronicle/docs/administration/configure-datarbac-users.md.txt). **Google SecOps Marketplace** Feature **Akeyless Security**: Version 1.0 - New **Akeyless Security** integration. Change **Vertex AI**: Version 9.0 - **Integration**: Improved API error message parsing. Change **Microsoft Graph Mail**: Version 48.0 - Added support for message timezone in the following action: - **Send Thread Reply** Change **Cyberint**: Version 8.0 - Added the **Disable Overflow** parameter to the following connector: - **Cyberint - Alerts Connector** Change **Illusive Networks**: Version 11.0 - Fixed the endpoint for retrieving forensic data in the following action: - **Run Forensic Scan** Change **Microsoft 365 Defender**: Version 33.0 - Improved the case priority parsing mechanism to support protobuf format on remote agents and updated comment syncing logic to support multi-line closure comments in the following job: - **Sync Alerts** Change **CrowdStrike Falcon**: Version 83.0 - Updated comment syncing logic to support multi-line closure comments and sync comments from closed CrowdStrike alerts in the following action: - **Sync Alerts** Change **Microsoft Graph Mail Delegated**: Version 25.0 - Added support for message timezone in the following action: - **Send Thread Reply** Change **Jira**: Version 62.0 - Improved context properties processing logic in the following action: - **Create Issue** Change **Google Chronicle**: Version 96.0 - **Integration**: Removed dummy network socket initialization during multipart response parsing and updated the default API root to point to the Chronicle API. Change **SentinelOne Singularity Operations Center**: Version 2.0 - Updated event processing logic and ontology mapping in the following connector: - **SentinelOne Singularity Operations Center - Unified Alerts Connector** **Looker** Feature Enhanced observability metrics, including user engagement and estimated token usage data on the [**Token usage** tab](https://docs.cloud.google.com/looker/docs/system-activity-dashboards.md.txt#ca-sa-token-usage) of the [Conversational Analytics System Activity dashboard](https://docs.cloud.google.com/looker/docs/system-activity-dashboards.md.txt#conversational-analytics), are now generally available ([GA](https://cloud.google.com/products#product-launch-stages)) for Looker (original) instances that are on Looker 26.16 or later. This launch also adds a **Daily Token Utilization** visualization and supports token usage observability for [Conversational Analytics data agents that are published to Gemini Enterprise](https://docs.cloud.google.com/looker/docs/conversational-analytics-looker-data-agents.md.txt#publish-data-agents). (For Looker (Google Cloud core) instances, token usage observability remains in [Preview](https://cloud.google.com/products#product-launch-stages) when the [**Conversational Analytics Agent Token usage**](https://docs.cloud.google.com/looker/docs/admin-panel-general-preview-features.md.txt#ca-agent-token-usage) preview feature is enabled.) **Managed Service for Apache Spark** Announcement New [**Managed Service for Apache Spark** (formerly Dataproc on Compute Engine) subminor cluster image versions](https://docs.cloud.google.com/managed-spark/docs/concepts/versioning/image-version-lists.md.txt#supported-dataproc-image-versions): - 2.2.88-debian12, 2.2.88-rocky9, 2.2.88-ubuntu22, 2.2.88-ubuntu22-arm - 2.3.37-debian12, 2.3.37-ml-ubuntu22, 2.3.37-rocky9, 2.3.37-ubuntu22, 2.3.37-ubuntu22-arm - 3.0.3-debian13, 3.0.3-ml-ubuntu24, 3.0.3-rocky9, 3.0.3-ubuntu24 - **Security Notification (SPNEGO for YARN UI):** Please refer to the updated [June 22, 2026 release notes](https://docs.cloud.google.com/managed-spark/docs/release-notes.md.txt#June_22_2026) for important information regarding SPNEGO configuration for YARN UI on versions 2.1 and above. Breaking **Managed Service for Apache Spark** (formerly Dataproc on Compute Engine): - **End-to-End Encryption for Apache Ranger (HTTPS):** Ranger Admin, UserSync, and client plugins now enforce HTTPS on port 6182 for SSL-enabled clusters. Traffic routed through Apache Knox Component Gateway is encrypted end-to-end with multizone support, and direct access should target `https://:6182` instead of legacy HTTP port 6080. - **Affected Image versions:** 2.2.88+, 2.3.37+, 3.0.3+. **Memorystore for Valkey** Feature You can use [App Design Center](https://docs.cloud.google.com/application-design-center/docs/configure-memorystore-for-valkey.md.txt) to create instances. This feature is [generally available](https://docs.cloud.google.com/products#product-launch-stages). **VPC Service Controls** Feature **VPC Service Controls feature:** Support for using Google Cloud folders and organizations as resources in ingress and egress rules is [generally available](https://cloud.google.com/products#product-launch-stages). With this update, you can create rules that allow access to and from the resources protected by service perimeters and bypass common resource size limitations. For more information, see [Ingress and egress rules](https://docs.cloud.google.com/vpc-service-controls/docs/ingress-egress-rules.md.txt). Feature **VPC Service Controls feature** : Folder membership support in VPC Service Controls service perimeters is [generally available](https://cloud.google.com/products#product-launch-stages). You can configure Google Cloud folders as members in service perimeters to automatically protect all projects and subfolders within that folder hierarchy. For more information, see [Folder support in service perimeters](https://docs.cloud.google.com/vpc-service-controls/docs/folder-membership.md.txt) and [Configure folders in service perimeters](https://docs.cloud.google.com/vpc-service-controls/docs/configure-folder.md.txt). Feature [Preview stage](https://cloud.google.com/products#product-launch-stages) support for the following integration: - [Universal Ledger](https://docs.cloud.google.com/vpc-service-controls/docs/supported-products.md.txt#table_universal_ledger) ## September 29, 2026 **API Gateway** Feature **Configure streaming for LLM responses and other traffic** You can now create API Gateway gateways that stream requests and responses instead of buffering them. This Public Preview feature supports incremental response delivery over HTTP/2 or HTTP/1.1 chunked transfer encoding, Server-Sent Events (SSE), WebSockets, and gRPC bidirectional streaming. A common use is streaming token-by-token responses from a large language model (LLM). To enable streaming, create a gateway with the `--enable-streaming` flag. The streaming mode is fixed when you create the gateway and can't be changed later. For more information, see [Configure streaming for LLM responses and other traffic](https://docs.cloud.google.com/api-gateway/docs/streaming-configure.md.txt). **Access Approval** Feature Google Cloud Observability is generally available ([GA](https://cloud.google.com/products#product-launch-stages)). **Access Transparency** Feature Google Cloud Observability is generally available ([GA](https://cloud.google.com/products#product-launch-stages)). **App Engine flexible environment .NET** Feature App Engine permanently blocks insecure traffic with TLS version 1.1 and earlier. For `appspot.com` domains, this block occurs at the connection level. For custom domains, the connection might succeed, but the requests are blocked. For more information, see [Secure minimum TLS](https://docs.cloud.google.com/appengine/docs/flexible/secure-minimum-tls.md.txt). **App Engine flexible environment Go** Feature App Engine permanently blocks insecure traffic with TLS version 1.1 and earlier. For `appspot.com` domains, this block occurs at the connection level. For custom domains, the connection might succeed, but the requests are blocked. For more information, see [Secure minimum TLS](https://docs.cloud.google.com/appengine/docs/flexible/secure-minimum-tls.md.txt). **App Engine flexible environment Java** Feature App Engine permanently blocks insecure traffic with TLS version 1.1 and earlier. For `appspot.com` domains, this block occurs at the connection level. For custom domains, the connection might succeed, but the requests are blocked. For more information, see [Secure minimum TLS](https://docs.cloud.google.com/appengine/docs/flexible/secure-minimum-tls.md.txt). **App Engine flexible environment Node.js** Feature App Engine permanently blocks insecure traffic with TLS version 1.1 and earlier. For `appspot.com` domains, this block occurs at the connection level. For custom domains, the connection might succeed, but the requests are blocked. For more information, see [Secure minimum TLS](https://docs.cloud.google.com/appengine/docs/flexible/secure-minimum-tls.md.txt). **App Engine flexible environment PHP** Feature App Engine permanently blocks insecure traffic with TLS version 1.1 and earlier. For `appspot.com` domains, this block occurs at the connection level. For custom domains, the connection might succeed, but the requests are blocked. For more information, see [Secure minimum TLS](https://docs.cloud.google.com/appengine/docs/flexible/secure-minimum-tls.md.txt). **App Engine flexible environment Python** Feature App Engine permanently blocks insecure traffic with TLS version 1.1 and earlier. For `appspot.com` domains, this block occurs at the connection level. For custom domains, the connection might succeed, but the requests are blocked. For more information, see [Secure minimum TLS](https://docs.cloud.google.com/appengine/docs/flexible/secure-minimum-tls.md.txt). **App Engine flexible environment Ruby** Feature App Engine permanently blocks insecure traffic with TLS version 1.1 and earlier. For `appspot.com` domains, this block occurs at the connection level. For custom domains, the connection might succeed, but the requests are blocked. For more information, see [Secure minimum TLS](https://docs.cloud.google.com/appengine/docs/flexible/secure-minimum-tls.md.txt). **App Engine flexible environment custom runtimes** Feature App Engine permanently blocks insecure traffic with TLS version 1.1 and earlier. For `appspot.com` domains, this block occurs at the connection level. For custom domains, the connection might succeed, but the requests are blocked. For more information, see [Secure minimum TLS](https://docs.cloud.google.com/appengine/docs/flexible/secure-minimum-tls.md.txt). **App Engine standard environment Go** Feature App Engine permanently blocks insecure traffic with TLS version 1.1 and earlier. For `appspot.com` domains, this block occurs at the connection level. For custom domains, the connection might succeed, but the requests are blocked. For more information, see [Secure minimum TLS](https://docs.cloud.google.com/appengine/docs/standard/secure-minimum-tls.md.txt). **App Engine standard environment Java** Feature App Engine permanently blocks insecure traffic with TLS version 1.1 and earlier. For `appspot.com` domains, this block occurs at the connection level. For custom domains, the connection might succeed, but the requests are blocked. For more information, see [Secure minimum TLS](https://docs.cloud.google.com/appengine/docs/standard/secure-minimum-tls.md.txt). **App Engine standard environment Node.js** Feature App Engine permanently blocks insecure traffic with TLS version 1.1 and earlier. For `appspot.com` domains, this block occurs at the connection level. For custom domains, the connection might succeed, but the requests are blocked. For more information, see [Secure minimum TLS](https://docs.cloud.google.com/appengine/docs/standard/secure-minimum-tls.md.txt). **App Engine standard environment PHP** Feature App Engine permanently blocks insecure traffic with TLS version 1.1 and earlier. For `appspot.com` domains, this block occurs at the connection level. For custom domains, the connection might succeed, but the requests are blocked. For more information, see [Secure minimum TLS](https://docs.cloud.google.com/appengine/docs/standard/secure-minimum-tls.md.txt). **App Engine standard environment Python** Feature App Engine permanently blocks insecure traffic with TLS version 1.1 and earlier. For `appspot.com` domains, this block occurs at the connection level. For custom domains, the connection might succeed, but the requests are blocked. For more information, see [Secure minimum TLS](https://docs.cloud.google.com/appengine/docs/standard/secure-minimum-tls.md.txt). **App Engine standard environment Ruby** Feature App Engine permanently blocks insecure traffic with TLS version 1.1 and earlier. For `appspot.com` domains, this block occurs at the connection level. For custom domains, the connection might succeed, but the requests are blocked. For more information, see [Secure minimum TLS](https://docs.cloud.google.com/appengine/docs/standard/secure-minimum-tls.md.txt). **BigQuery** Feature The [`AI.KEY_DRIVERS` function](https://docs.cloud.google.com/bigquery/docs/reference/standard-sql/bigqueryml-syntax-ai-key-drivers.md.txt) is now [generally available](https://cloud.google.com/products#product-launch-stages) (GA). You can use the `AI.KEY_DRIVERS` function to identify segments of data that cause statistically significant changes to a summable metric. Feature You can query the [`INFORMATION_SCHEMA.FAILOVER_HISTORY` view](https://docs.cloud.google.com/bigquery/docs/information-schema-failover-history) to retrieve a near real-time list of failover events for reservations within an administration project that use [managed disaster recovery](https://docs.cloud.google.com/bigquery/docs/managed-disaster-recovery). This feature is now in ([Preview](https://cloud.google.com/products#product-launch-stages)). **Cloud Interconnect** Feature [Network Connectivity Center (NCC)](https://docs.cloud.google.com/network-connectivity/docs/network-connectivity-center/concepts/overview.md.txt) support for [Partner Cross-Cloud Interconnect for Amazon Web Services (AWS)](https://docs.cloud.google.com/network-connectivity/docs/interconnect/concepts/partner-cci-for-csp-overview.md.txt) is [Generally Available](https://cloud.google.com/products#product-launch-stages). **Cloud Run** Feature Support for specifying custom target CPU or concurrency utilization using [scaling controls](https://docs.cloud.google.com/run/docs/configuring/scaling-controls.md.txt) is in [General Availability (GA)](https://cloud.google.com/products#product-launch-stages). **Cloud SQL for PostgreSQL** Change You can use the pgAudit extension to prevent string literals that might indicate sensitive information, such as passwords and secrets, from appearing in your log query results. This release provides minor bug fixes to the previous version. This pgAudit extension capability is supported on `[PostgreSQL version].R20260712.01_RC31` or later. For more information, see [Audit for PostgreSQL using pgAudit](https://docs.cloud.google.com/sql/docs/postgres/pg-audit.md.txt). **Compute Engine** Announcement Interface-based versioning (IBV) for the Compute Engine API is now generally available. IBV lets you call a specific, date-based API version so you can adopt API changes on your own schedule. For more information, see [Compute Engine API versioning](https://docs.cloud.google.com/compute/docs/api/how-tos/api-versioning-guide). Feature **Generally available** : Compute Engine API version `2026-09-01` is now generally available. In this version, `aggregatedList` methods return partial results by default when a scope is unreachable. The `returnPartialSuccess` query parameter is no longer available in `aggregatedList` and `list` methods. For more information, see the [`2026-09-01` REST reference](https://docs.cloud.google.com/compute/docs/reference/rest/2026-09-01). Feature **Preview** : Compute Engine API version `2026-10-01-preview` is now available in Preview. In this version, the `quotas` field is no longer available in responses from the `projects.get`, `regions.get`, and `regions.list` methods. To view and manage quota information, use the [Cloud Quotas API](https://docs.cloud.google.com/docs/quotas/overview.md.txt). For more information, see the [`2026-10-01-preview` REST reference](https://docs.cloud.google.com/compute/docs/reference/rest/2026-10-01-preview). Feature **Generally available**: You can create a standard or archive snapshot of a disk and protect the snapshot with a customer-managed encryption key (CMEK), even if the source disk isn't protected with a CMEK. If the source disk is protected with a CMEK, then you can use a different CMEK to encrypt the new snapshot. For more information, see [Create a CMEK-encrypted snapshot](https://docs.cloud.google.com/compute/docs/disks/customer-managed-encryption.md.txt#create_snapshot). **Gemini Enterprise** Feature **Gemini Enterprise: Support for new actions** Support for new actions is generally available (GA) for the following data store: - [Microsoft Outlook](https://docs.cloud.google.com/gemini/enterprise/docs/connectors/ms-outlook.md.txt): Add attachments, Create message, Forward mail, Move mail, Reply to message, and Update message. For more information, see [Connect a third-party data source](https://docs.cloud.google.com/gemini/enterprise/docs/connectors/connect-third-party-data-source.md.txt). Feature **Gemini Enterprise: New data stores (Preview)** The following data stores are available in Gemini Enterprise: - [D\&B Finance Analytics](https://docs.cloud.google.com/gemini/enterprise/docs/connectors/d_b_finance_analytics.md.txt) - [Omni Analytics](https://docs.cloud.google.com/gemini/enterprise/docs/connectors/omni_analytics.md.txt) - [Zapier](https://docs.cloud.google.com/gemini/enterprise/docs/connectors/zapier.md.txt) These data stores are in Public Preview. For more information, see [Connect a third-party data source](https://docs.cloud.google.com/gemini/enterprise/docs/connectors/connect-third-party-data-source.md.txt). Feature **Gemini Enterprise: Gemini 3.8 Flash is the default model for AlphaEvolve** AlphaEvolve experiments can now generate candidate programs with Gemini 3.7 Flash and Gemini 3.8 Flash. Gemini 3.8 Flash is the default model AlphaEvolve uses when you do not explicitly specify a model, replacing Gemini 3.5 Flash. To use a different model, specify the one you want in the `models` field of `generationSettings`. Experiments created before this change keep the model recorded in their configuration. For more information, see [Supported models](https://docs.cloud.google.com/gemini/enterprise/docs/alphaevolve/reference-guide/api-reference#supported-models). **Gemini Enterprise Agent Platform** Feature **Custom denial messages for semantic governance policies** You can now configure a fixed **Denial message** on a semantic governance policy to show end users when the policy denies a request, in place of the policy denial rationale. The message can be up to 1,000 characters and is configurable in the Google Cloud console on the policy create or edit page, or by setting `agentResponseCustomization.denialMessage` on the policy resource using the REST API. When a single request triggers denials from more than one policy, the policy engine combines the configured Denial messages, deduplicates them, and falls back to a generic message for firing policies that don't have one configured. For more information, see [Configure a semantic governance policy](https://docs.cloud.google.com/gemini-enterprise-agent-platform/govern/policies/configure-semantic-governance.md.txt) and [Information exposure risk](https://docs.cloud.google.com/gemini-enterprise-agent-platform/govern/policies/semantic-governance-overview.md.txt#natural-language-constraints-nlc). **Looker** Announcement The latest versions in the Looker (Google Cloud core) [release channels](https://docs.cloud.google.com/looker/docs/looker-core-release-process.md.txt#release_channels) are beginning deployment as follows: - Latest version in the Rapid channel: **Looker 26.18** - Latest version in the No Channel channel: **Looker 26.18** The Regular channel remains on **Looker 26.14**. **Network Connectivity Center** Feature [Network Connectivity Center (NCC)](https://docs.cloud.google.com/network-connectivity/docs/network-connectivity-center/concepts/overview.md.txt) support for [Partner Cross-Cloud Interconnect for Amazon Web Services (AWS)](https://docs.cloud.google.com/network-connectivity/docs/interconnect/concepts/partner-cci-for-csp-overview.md.txt) is [Generally Available](https://cloud.google.com/products#product-launch-stages). Billing for [Partner Cross-Cloud Interconnect](https://docs.cloud.google.com/network-connectivity/docs/interconnect/concepts/partner-cci-for-csp-overview.md.txt) is going to commence over the next 30 days following General Availability. For the most current billing information, see [Network Connectivity Center pricing](https://cloud.google.com/network-connectivity/pricing). **SAP on Google Cloud** Announcement **Hyperdisk sizing widget for SAP HANA** To view Hyperdisk-based disk configurations that help you meet SAP HANA size and performance requirements, use the sizing widget that's available in the [Minimum sizes for SSD-based Persistent Disk or Hyperdisk volumes](https://docs.cloud.google.com/sap/docs/sap-hana-planning-guide.md.txt#hana-minimum-pd-sizes-ssd-balanced) section of the SAP HANA planning guide. This widget lets you select an SAP-certified machine type and view up to three tailored disk configurations that Google Cloud recommends for it. **Secure Source Manager** Feature Secure Source Manager webhooks now support service account authorization. For more information, see [Webhooks overview](https://docs.cloud.google.com/secure-source-manager/docs/webhooks-overview.md.txt) and [Set up webhooks](https://docs.cloud.google.com/secure-source-manager/docs/set-up-webhooks.md.txt). **Security Command Center** Feature Event Threat Detection integrates with Sensitive Data Protection to enrich findings that affect sensitive resources. For more information, see [Sensitive data enrichment](https://docs.cloud.google.com/security-command-center/docs/concepts-event-threat-detection-overview.md.txt#sdp-enrichment). ## September 28, 2026 **Agent Platform Workbench** Change ### 20260927.00_p0 Release Change Installed latest packages from upstream dependencies. Security Bulk security patch remediating Critical and High-severity CVEs in the Workbench custom container images. Change ### 20260927.00_p0 Release Change Installed latest packages from upstream dependencies. Security Bulk security patch remediating Critical and High-severity CVEs in the Workbench custom container images. **Application Integration** Security A Confused Deputy vulnerability was discovered in the Email Task component in Application Integration versions prior to June 30, 2026. For more information, see the [GCP-2026-066](https://docs.cloud.google.com/application-integration/docs/security-bulletins.md.txt#gcp-2026-066) security bulletin. Security A Deserialization of Untrusted Data vulnerability was discovered in the JavaScript Task in Application Integration versions prior to June 28, 2026. For more information, see the [GCP-2026-065](https://docs.cloud.google.com/application-integration/docs/security-bulletins.md.txt#gcp-2026-065) security bulletin. Security An Incorrect Authorization vulnerability was discovered in the task configuration in Application Integration versions prior to June 17, 2026. For more information, see the [GCP-2026-064](https://docs.cloud.google.com/application-integration/docs/security-bulletins.md.txt#gcp-2026-064) security bulletin. **BigQuery** Feature The [BigQuery Data Transfer Service MCP server](https://docs.cloud.google.com/bigquery/docs/reference/datatransfer/mcp.md.txt) is now [Generally Available](https://cloud.google.com/products#product-launch-stages) (GA). Feature You can now write the output rows produced by [BigQuery continuous queries](https://docs.cloud.google.com/bigquery/docs/continuous-queries-introduction.md.txt) directly into [Apache Iceberg managed tables](https://docs.cloud.google.com/bigquery/docs/biglake-iceberg-tables-in-bigquery). This lets you continuously process streaming data from BigQuery and write it into your open-format lakehouse by using an [`INSERT` DML statement](https://docs.cloud.google.com/bigquery/docs/continuous-queries.md.txt#write-bigquery). **Bigtable** Libraries ### Go #### [1.58.0](https://github.com/googleapis/google-cloud-go/compare/bigtable/v1.57.0...bigtable/v1.58.0) (2026-09-25) ##### Features - **all:** Update supported go versions ([#20520](https://github.com/googleapis/google-cloud-go/issues/20520)) ([90413d3](https://github.com/googleapis/google-cloud-go/commit/90413d3e9d381ef4b92e3c496d98b023c5b2d8cc)) - **bigtable:** Support hot duration, disabled, and effective backup policy ([#20573](https://github.com/googleapis/google-cloud-go/issues/20573)) ([da2bfcc](https://github.com/googleapis/google-cloud-go/commit/da2bfcc3bcf396acbd3fbbbbfb50cb7feb184496)) - Update API sources and regenerate ([#20526](https://github.com/googleapis/google-cloud-go/issues/20526)) ([e6f37a3](https://github.com/googleapis/google-cloud-go/commit/e6f37a362b6e37b0bc74e77b8d7f151dc7443fb8)) - Update API sources and regenerate ([#20570](https://github.com/googleapis/google-cloud-go/issues/20570)) ([cc91d66](https://github.com/googleapis/google-cloud-go/commit/cc91d66d3435de4bed07ffec7abc226cdcdbf29c)) - Update API sources and regenerate. ([e6f37a3](https://github.com/googleapis/google-cloud-go/commit/e6f37a362b6e37b0bc74e77b8d7f151dc7443fb8)) ##### Bug Fixes - **bigtable:** Detect omitted MutateRows response entries in ApplyBulk ([#20557](https://github.com/googleapis/google-cloud-go/issues/20557)) ([68b3f33](https://github.com/googleapis/google-cloud-go/commit/68b3f3321bd5ba7d72a60b425345a4680023925b)) - **bigtable:** Fix TestRetryApplyBulk_OverallRequestFailure test interceptor ([#20574](https://github.com/googleapis/google-cloud-go/issues/20574)) ([25bc085](https://github.com/googleapis/google-cloud-go/commit/25bc085c8fde602f7027cb48532f204be9e0dbd5)) - **various:** Address format directive issues ([#20547](https://github.com/googleapis/google-cloud-go/issues/20547)) ([e2e1047](https://github.com/googleapis/google-cloud-go/commit/e2e104731999b3bfc75ed0b8f2d71844ced3b073)) ### Java #### [1.92.0](https://github.com/googleapis/google-cloud-java/compare/v1.91.0...v1.92.0) (2026-09-23) ##### Bug Fixes - **bigtable:** don't notify config listeners while holding the manager lock ([#14294](https://github.com/googleapis/google-cloud-java/issues/14294)) ([4426ccd](https://github.com/googleapis/google-cloud-java/commit/4426ccdd45a82e9b10bc8f6f2174cecbcd9254d7)) - **bigtable:** fall back to classic path when per-RPC CallCredentials are set on session path ([#14477](https://github.com/googleapis/google-cloud-java/issues/14477)) ([57bacb0](https://github.com/googleapis/google-cloud-java/commit/57bacb006a74b0465d0601abd97536d801b92854)) - **bigtable:** fix abnormal session closures and scale-up in session pool ([#14431](https://github.com/googleapis/google-cloud-java/issues/14431)) ([6361ecd](https://github.com/googleapis/google-cloud-java/commit/6361ecddb460882f9ea82e877fca475a7699c087)) ### Python #### [2.47.0](https://github.com/googleapis/google-cloud-python/compare/google-cloud-bigtable-v2.46.0...google-cloud-bigtable-v2.47.0) (2026-09-24) ##### Features - update API sources and regenerate ([#18446](https://github.com/googleapis/google-cloud-python/issues/18446)) ([54f1019](https://github.com/googleapis/google-cloud-python/commit/54f10190a4ab7b3772010bf9006de55266f74da9)) **Cloud Asset Inventory** Feature The following resource types are publicly available through the [ExportAssets](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/exportAssets.md.txt), [ListAssets](https://docs.cloud.google.com/asset-inventory/docs/listing-assets), [BatchGetAssetsHistory](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/batchGetAssetsHistory.md.txt), [QueryAssets](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/queryAssets.md.txt), [Feed](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/feeds.md.txt), and Search ([SearchAllResources](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/searchAllResources.md.txt), [SearchAllIamPolicies](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/searchAllIamPolicies.md.txt)) APIs. - Agent Identity API - `agentidentity.googleapis.com/AuthProvider` **Cloud Load Balancing** Feature Zonal network endpoint groups (NEGs) with `GCE_VM_IP` and `GCE_VM_IP_PORT` endpoints support IPv6-only endpoints that reference IPv6-only or dual-stack Compute Engine VM network interfaces. This feature is available in **Preview**. For more information, see [Zonal network endpoint groups overview](https://docs.cloud.google.com/load-balancing/docs/negs/zonal-neg-concepts.md.txt). **Cloud Logging** Fixed Ops Agent version 2.73.0 includes patches for a Go vulnerability involving system root certificates, [CVE-2026-111943](https://www.cve.org/CVERecord?id=CVE-2026-111943). For more information, see [Ops Agent 2.73.0 notes](https://github.com/GoogleCloudPlatform/ops-agent/releases/tag/2.73.0). Deprecated The legacy Logging agent has officially reached its end of support. All standard maintenance and regular bug fixes for the agent have ceased. We recommend migrating to one of the [supported alternatives](https://docs.cloud.google.com/logging/docs/agent.md.txt). For more information about this deprecation, see [Legacy Monitoring and Logging agents end of support](https://docs.cloud.google.com/stackdriver/docs/deprecations/legacy-agents). Breaking Only platform services can write log entries to billing accounts. These logs have names with the format `billingAccounts/[BILLING_ACCOUNT_ID]/logs/[LOG_ID]`. For more information, see [`entries.write`](https://docs.cloud.google.com/logging/docs/reference/v2/rest/v2/entries/write.md.txt). **Cloud Monitoring** Deprecated The legacy Monitoring agent has officially reached its end of support. All standard maintenance and regular bug fixes for the agent have ceased. We recommend migrating to one of the [supported alternatives](https://docs.cloud.google.com/monitoring/agent). For more information about this deprecation, see [Legacy Monitoring and Logging agent end of support](https://docs.cloud.google.com/stackdriver/docs/deprecations/legacy-agents). **Cloud NAT** Feature **Preview** : Cloud NAT gateways for Private NAT support [source-based NAT rules](https://docs.cloud.google.com/nat/docs/nat-rules-overview.md.txt) for IPv4 addresses. **Cloud Product Registry API** Feature **Cloud Product Registry is now generally available (GA)** The Cloud Product Registry API is now [generally available (GA)](https://cloud.google.com/products#product-launch-stages). The Cloud Product Registry API serves as the authoritative source of truth for first-party Google Cloud products, allowing you to programmatically access the official hierarchy of Product Suites, Logical Products, and Logical Product Variants. For more information, see [Cloud Product Registry overview](https://docs.cloud.google.com/product-registry/overview.md.txt), [REST API reference](https://docs.cloud.google.com/product-registry/reference/cloudproductregistry-api/rest.md.txt), and [MCP reference](https://docs.cloud.google.com/product-registry/reference/cloudproductregistry-api/mcp.md.txt). **Cloud Run** Feature Create [custom URLs](https://docs.cloud.google.com/run/docs/custom-urls.md.txt), like `example.cloud.run`, that are easy to remember and globally available for your Cloud Run services. No DNS configuration, load balancers, or extra costs required ([Preview](https://cloud.google.com/products#product-launch-stages)). **Cloud SQL for MySQL** Breaking To improve security, removed the `cloudsql.instances.export` permission from the following roles: - Cloud SQL Viewer (`roles/cloudsql.viewer`) - Basic Reader (`roles/reader`) - Basic Viewer (Legacy) (`roles/viewer`) To retain export capabilities, assign the Cloud SQL Editor (`roles/cloudsql.editor`) role or update custom roles to include the `cloudsql.instances.export` permission. For more information, see [Cloud SQL roles](https://docs.cloud.google.com/sql/docs/mysql/iam-roles.md.txt). Change Cloud SQL for MySQL 9.7.1 is upgraded to MySQL 9.7.2. For more information, see the [MySQL 9.7.2 Release Notes](https://dev.mysql.com/doc/relnotes/mysql/9.7/en/news-9-7-2.html) and [Cloud SQL database versions](https://docs.cloud.google.com/sql/docs/mysql/db-versions.md.txt). Change Cloud SQL for MySQL 8.4.10 is upgraded to MySQL 8.4.11. For more information, see the [MySQL 8.4.11 Release Notes](https://dev.mysql.com/doc/relnotes/mysql/8.4/en/news-8-4-11.html) and [Cloud SQL database versions](https://docs.cloud.google.com/sql/docs/mysql/db-versions.md.txt). **Cloud SQL for PostgreSQL** Breaking To improve security, removed the `cloudsql.instances.export` permission from the following roles: - Cloud SQL Viewer (`roles/cloudsql.viewer`) - Basic Reader (`roles/reader`) - Basic Viewer (Legacy) (`roles/viewer`) To retain export capabilities, assign the Cloud SQL Editor (`roles/cloudsql.editor`) role or update custom roles to include the `cloudsql.instances.export` permission. For more information, see [Cloud SQL roles](https://docs.cloud.google.com/sql/docs/postgres/iam-roles.md.txt). **Cloud SQL for SQL Server** Breaking To improve security, removed the `cloudsql.instances.export` permission from the following roles: - Cloud SQL Viewer (`roles/cloudsql.viewer`) - Basic Reader (`roles/reader`) - Basic Viewer (Legacy) (`roles/viewer`) To retain export capabilities, assign the Cloud SQL Editor (`roles/cloudsql.editor`) role or update custom roles to include the `cloudsql.instances.export` permission. For more information, see [Cloud SQL roles](https://docs.cloud.google.com/sql/docs/sqlserver/iam-roles.md.txt). **Cloud Service Mesh** Deprecated Cloud Service Mesh support for the managed `ISTIOD` control plane on Google Kubernetes Engine (GKE) on Google Cloud is deprecated as of September 28, 2026, and support will end on **March 1, 2028** . After March 1, 2028, managed `ISTIOD` control plane components on GKE on Google Cloud will not receive updates, security patches, or support from Google Cloud, and workload sidecars on unmodernized clusters will fail and be unable to receive or send requests. Google Cloud is transitioning managed Cloud Service Mesh with Istio APIs to the `TRAFFIC_DIRECTOR` control plane implementation using Istio APIs. As part of this transition, support will also end for any features that are incompatible with the `TRAFFIC_DIRECTOR` control plane. To continue using managed Cloud Service Mesh on GKE, you must modernize your clusters by March 1, 2028: 1. Confirm that you affected. 2. Check your compatibility. Review the [Supported features](https://docs.cloud.google.com/service-mesh/v1.30/docs/supported-features-managed.md.txt) to confirm feature compatibility with the `TRAFFIC_DIRECTOR` control plane and [evaluate a fleet's compatibility for control plane modernization](https://docs.cloud.google.com/service-mesh/v1.30/docs/migrate/eligibility.md.txt). 3. Plan your modernization following the [modernization guide](https://docs.cloud.google.com/service-mesh/v1.30/docs/modernization.md.txt). For more details on the transition, see [Managed control plane](https://docs.cloud.google.com/service-mesh/v1.30/docs/managed-control-plane-overview.md.txt) documentation and monitor the [release notes](https://docs.cloud.google.com/service-mesh/v1.30/docs/release-notes.md.txt) for ongoing updates. Deprecated Cloud Service Mesh support for the managed `ISTIOD` control plane on Google Kubernetes Engine (GKE) on Google Cloud is deprecated as of September 28, 2026, and support will end on **March 1, 2028** . After March 1, 2028, managed `ISTIOD` control plane components on GKE on Google Cloud will not receive updates, security patches, or support from Google Cloud, and workload sidecars on unmodernized clusters will fail and be unable to receive or send requests. Google Cloud is transitioning managed Cloud Service Mesh with Istio APIs to the `TRAFFIC_DIRECTOR` control plane implementation using Istio APIs. As part of this transition, support will also end for any features that are incompatible with the `TRAFFIC_DIRECTOR` control plane. To continue using managed Cloud Service Mesh on GKE, you must modernize your clusters by March 1, 2028: 1. Confirm that you affected. 2. Check your compatibility. Review the [Supported features](https://docs.cloud.google.com/service-mesh/docs/supported-features-managed.md.txt) to confirm feature compatibility with the `TRAFFIC_DIRECTOR` control plane and [evaluate a fleet's compatibility for control plane modernization](https://docs.cloud.google.com/service-mesh/docs/migrate/eligibility.md.txt). 3. Plan your modernization following the [modernization guide](https://docs.cloud.google.com/service-mesh/docs/modernization.md.txt). For more details on the transition, see [Managed control plane](https://docs.cloud.google.com/service-mesh/docs/managed-control-plane-overview.md.txt) documentation and monitor the [release notes](https://docs.cloud.google.com/service-mesh/docs/release-notes.md.txt) for ongoing updates. Deprecated Cloud Service Mesh support for the in-cluster `ISTIOD` control plane on Google Kubernetes Engine (GKE) on Google Cloud is deprecated as of September 28, 2026, and support will end on **March 1, 2028**. After March 1, 2028, in-cluster control plane components on GKE will not receive updates, security patches, or support from Google Cloud. Cloud Service Mesh with the in-cluster `ISTIOD` control plane on Google Distributed Cloud (software only) continues to be supported as described in [Supported platforms](https://docs.cloud.google.com/service-mesh/v1.30/docs/supported-platforms.md.txt#off-gcp). You must migrate your clusters to managed Cloud Service Mesh by March 1, 2028. review the [Supported features](https://docs.cloud.google.com/service-mesh/v1.30/docs/supported-features-managed.md.txt) to confirm feature compatibility, and follow the [migration guide](https://docs.cloud.google.com/service-mesh/v1.30/docs/tutorials/migrate-in-cluster-to-managed-on-new-cluster.md.txt) to transition to managed Cloud Service Mesh with the `TRAFFIC_DIRECTOR` control plane. For more details on the deprecation schedule, see [Deprecations](https://docs.cloud.google.com/service-mesh/deprecations.md.txt). Deprecated Cloud Service Mesh support for the in-cluster `ISTIOD` control plane on Google Kubernetes Engine (GKE) on Google Cloud is deprecated as of September 28, 2026, and support will end on **March 1, 2028**. After March 1, 2028, in-cluster control plane components on GKE will not receive updates, security patches, or support from Google Cloud. Cloud Service Mesh with the in-cluster `ISTIOD` control plane on Google Distributed Cloud (software only) continues to be supported as described in [Supported platforms](https://docs.cloud.google.com/service-mesh/docs/supported-platforms.md.txt#off-gcp). You must migrate your clusters to managed Cloud Service Mesh by March 1, 2028. review the [Supported features](https://docs.cloud.google.com/service-mesh/docs/supported-features-managed.md.txt) to confirm feature compatibility, and follow the [migration guide](https://docs.cloud.google.com/service-mesh/docs/tutorials/migrate-in-cluster-to-managed-on-new-cluster.md.txt) to transition to managed Cloud Service Mesh with the `TRAFFIC_DIRECTOR` control plane. For more details on the deprecation schedule, see [Deprecations](https://docs.cloud.google.com/service-mesh/deprecations.md.txt). **Colab Enterprise** Feature You can now use the Google Cloud console to set an existing runtime template as the default runtime template for a project and region, with or without accelerators. New default runtimes in that project and region use the template's configuration. For more information, see [Set a runtime template as the default runtime template](https://docs.cloud.google.com/colab/docs/runtimes.md.txt#set-default-runtime-template). **Compute Engine** Feature **Allowlisted GA** : You can expose the host ID of a Compute Engine instance to verify its physical location in relation to other compute instances in your Google Cloud organization. Use compute instance proximity in a zone to optimize latency-sensitive workloads or improve the reliability of your applications. For more information, see [View the physical location of a Compute Engine instance](https://docs.cloud.google.com/compute/docs/instances/view-instance-topology.md.txt). Feature **Generally available** : The [C4D](https://docs.cloud.google.com/compute/docs/general-purpose-machines.md.txt#supported_disk_types_for_c4d) machine series supports Hyperdisk Throughput. For more information, see [About Hyperdisk Throughput](https://docs.cloud.google.com/compute/docs/disks/hd-types/hyperdisk-throughput.md.txt) and [Hyperdisk Throughput performance limits](https://docs.cloud.google.com/compute/docs/disks/hyperdisk-perf-limits.md.txt#hdt-perf). **Container Optimized OS** Change ### cos-dev-138-20162-0-0 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.18.51](https://cos.googlesource.com/third_party/kernel/+/e2eaa37d91b2b8020497e55ee941fa23bb334d64) | v29.4.3 | v2.4.1 | [See List](https://storage.googleapis.com/cos-tools/20162.0.0/lakitu/gpu_driver_versions.textproto) | Change Enabled automatic loading of RDMA kernel modules when CX-9 devices are detected. Change Ensure time sync prior to TLS handshake. Change Updated cos-gpu-installer to v2.7.8. Change Updated google-guest-configs to v20260918.00. Change Updated the Linux kernel to v6.18.51. Feature Added support for loading the CephFS kernel driver. Fixed Added support for NVIDIA driver v580.178.04. Fixed Added support for NVIDIA driver v595.91.07. Fixed Added support for bare metal TPUs. Fixed Fixed a bug which could cause DOCA workloads to fail to initialize. Fixed Fixed an issue where temporary efivarfs mounts under /tmp could persist after boot. Fixed Upgraded app-admin/oslogin to v20260902.00. Fixed Upgraded app-admin/sosreport to v4.12.0. Fixed Upgraded app-arch/unzip to v6.0_p31. Fixed Upgraded app-arch/xz-utils to v5.8.4. Fixed Upgraded app-misc/ca-certificates to v20260601.3.112.5. Fixed Upgraded chromeos-base/chromeos-common-script to v0.0.1-r675. Fixed Upgraded chromeos-base/debugd-client to v0.0.1-r2742. Fixed Upgraded chromeos-base/google-breakpad to v2026.09.04.193747-r281. Fixed Upgraded chromeos-base/power_manager-client to v0.0.1-r2976. Fixed Upgraded chromeos-base/session_manager-client to v0.0.1-r2838. Fixed Upgraded containerd and containerd-test to v2.4.1. Fixed Upgraded dev-lang/luajit to v2.1.1787165859. Fixed Upgraded dev-libs/expat to v2.8.4. Fixed Upgraded dev-libs/json-c to v0.19-r2. Fixed Upgraded dev-libs/libgcrypt to v1.12.3-r1. Fixed Upgraded dev-libs/libpcre2 to v10.48. Fixed Upgraded dev-libs/libxml2 to v2.15.4. Fixed Upgraded dev-libs/xxhash to v0.8.3-r2. Fixed Upgraded dev-python/pyjwt to v2.14.0. Fixed Upgraded sys-devel/binutils-config to v5.6. Security Fixed CVE-2026-0864 in dev-lang/python. Security Fixed CVE-2026-56391 in sys-apps/coreutils. Security Fixed CVE-2026-90054 in the Linux kernel. Security Upgraded net-misc/rsync to version 3.5.0. This fixes CVE-2026-53791, CVE-2026-53784, CVE-2026-53786, CVE-2026-53789, CVE-2026-53795, CVE-2026-53797, CVE-2026-53798, CVE-2026-53799, CVE-2026-53800, CVE-2026-53801, CVE-2026-53802, CVE-2026-53803, CVE-2026-70455, CVE-2026-70457, CVE-2026-70459, CVE-2026-70461, and CVE-2026-70463. Change ### cos-133-19999-44-85 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.18.48](https://cos.googlesource.com/third_party/kernel/+/21a2b64279c09aacca101f3eeda3503a9fefeed0) | v29.4.3 | v2.4.1 | [See List](https://storage.googleapis.com/cos-tools/19999.44.85/lakitu/gpu_driver_versions.textproto) | Change Enabled automatic loading of RDMA kernel modules when CX-9 devices are detected. Change Ensure time sync prior to TLS handshake. Security Fixed CVE-2026-0864 in dev-lang/python. Change Updated cos-gpu-installer to v2.7.8. Change Updated google-guest-configs to v20260918.00. Security Upgraded net-misc/rsync to version 3.5.0. This fixes CVE-2026-53791, CVE-2026-53784, CVE-2026-53786, CVE-2026-53789, CVE-2026-53795, CVE-2026-53797, CVE-2026-53798, CVE-2026-53799, CVE-2026-53800, CVE-2026-53801, CVE-2026-53802, CVE-2026-53803, CVE-2026-70455, CVE-2026-70457, CVE-2026-70459, CVE-2026-70461, and CVE-2026-70463. Fixed Added support for NVIDIA driver v580.178.04. Fixed Added support for NVIDIA driver v595.91.07. Fixed Added support for bare metal TPUs. Fixed Fixed an issue where temporary efivarfs mounts under /tmp could persist after boot. Fixed Upgraded app-admin/oslogin to v20260902.00. Fixed Upgraded app-arch/zstd to v1.5.7-r1. Fixed Upgraded containerd and containerd-test to v2.4.1. Fixed Upgraded dev-libs/expat to v2.8.4. Fixed Upgraded dev-libs/libverto to v0.3.2-r1. Fixed Upgraded dev-libs/libxml2 to v2.15.4. Fixed Upgraded dev-libs/popt to v1.19-r1. Security Fixed CVE-2026-15308 in dev-lang/python. Change ### cos-125-19216-700-7 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.12.110](https://cos.googlesource.com/third_party/kernel/+/393cf3f7db2dfb458f3f1513e7eb6ef3a81930ba) | v27.5.1 | v2.2.7 | [See List](https://storage.googleapis.com/cos-tools/19216.700.7/lakitu/gpu_driver_versions.textproto) | Announcement This is an [LTS Refresh release.](https://docs.cloud.google.com/container-optimized-os/docs/concepts/versioning.md.txt#lts_refresh_releases) Change Ensure time sync prior to TLS handshake. Fixed Added support for bare metal TPUs. Change Runtime sysctl changes: - Changed: net.ipv4.udp_mem: 188034 250715 376068 -\> 188034 250714 376068
Change ### cos-117-18613-767-2 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.6.157](https://cos.googlesource.com/third_party/kernel/+/04c29e4b70e72c933c0bf02443f8334f4bb78d32) | v24.0.9 | v1.7.34 | [See List](https://storage.googleapis.com/cos-tools/18613.767.2/lakitu/gpu_driver_versions.textproto) | Announcement This is an [LTS Refresh release.](https://docs.cloud.google.com/container-optimized-os/docs/concepts/versioning.md.txt#lts_refresh_releases) Change Ensure time sync prior to TLS handshake. Fixed Added support for bare metal TPUs. Fixed Upgraded app-admin/google-guest-configs to v20260911.00. Change ### cos-129-19506-505-8 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.12.110](https://cos.googlesource.com/third_party/kernel/+/39c6d6f687e655460d68a8405647b6b44e6e688b) | v27.5.1 | v2.2.7 | [See List](https://storage.googleapis.com/cos-tools/19506.505.8/lakitu/gpu_driver_versions.textproto) | Announcement This is an [LTS Refresh release.](https://docs.cloud.google.com/container-optimized-os/docs/concepts/versioning.md.txt#lts_refresh_releases) Change Ensure time sync prior to TLS handshake. Fixed Added support for bare metal TPUs. Change ### cos-121-18867-624-2 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.6.157](https://cos.googlesource.com/third_party/kernel/+/d3eba511730ad022ab42709e5700ada54b787344) | v27.5.1 | v2.0.10 | [See List](https://storage.googleapis.com/cos-tools/18867.624.2/lakitu/gpu_driver_versions.textproto) | Announcement This is an [LTS Refresh release.](https://docs.cloud.google.com/container-optimized-os/docs/concepts/versioning.md.txt#lts_refresh_releases) Fixed Added support for bare metal TPUs. Fixed Upgraded app-arch/bzip2 to v1.0.8-r5. **Dataform** Feature [Extended access options and user credentials authentication](https://docs.cloud.google.com/dataform/docs/schedule-runs.md.txt) for running and scheduling Dataform workflows are now [generally available](https://cloud.google.com/products#product-launch-stages) (GA). **Gemini Enterprise** Feature **Gemini Enterprise: Configure granular access controls for apps and data stores** Administrators can configure granular, resource-level Identity and Access Management (IAM) permissions to restrict access to specific Gemini Enterprise apps and data stores using the Google Cloud console, the Google Cloud CLI, or the REST API. Key capabilities include: - **Independent resource-level permissions:** Grant **Gemini Enterprise Admin** , **Gemini Enterprise Viewer** , or **Gemini Enterprise User** roles on individual apps or data stores without granting access across the entire Google Cloud project. - **Custom project-level roles for restricted personas:** Create custom project-level roles for restricted administrators, restricted viewers, and restricted end users so principals can access only their assigned apps and data stores. - **Data store details and permissions management:** View data store configurations, connected apps, sync details, and user permissions in the Google Cloud console. For more information, see: - [Configure granular access controls for apps and data stores](https://docs.cloud.google.com/gemini/enterprise/docs/iam-policy-for-apps-and-data-stores.md.txt) - [Get data store and entity details](https://docs.cloud.google.com/gemini/enterprise/docs/get-datastore-details.md.txt). **Gemini Enterprise Agent Platform** Feature **Anthropic's Claude Sonnet 5.5** [Claude Sonnet 5.5](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/partner-models/claude/sonnet-5-5.md.txt) is available in Model Garden. Feature **Provisioned Throughput: Support for changing order scope and increasing term** Provisioned Throughput now directly supports from the self service console the ability to change the scope or increase the term of an order through a supersede and replace operation. For more information, see [Restructure an order](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/provisioned-throughput/purchase-provisioned-throughput.md.txt#restructure-order). Feature **Gemini 3 models supported by the Interactions API in Preview** Gemini 3 models are supported by the Interactions API in [Preview](https://cloud.google.com/products#product-launch-stages) on Gemini Enterprise Agent Platform. For more information, see the [Interactions API overview](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/capabilities/interactions.md.txt). Feature **Gemini 3.8 Flash TTS and Gemini 3.8 Flash-Lite TTS (Preview)** [Gemini 3.8 Flash TTS](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/gemini/3-8-flash-tts.md.txt) and [Gemini 3.8 Flash-Lite TTS](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/gemini/3-8-flash-lite-tts) are available in [Preview](https://cloud.google.com/products#product-launch-stages) on the global endpoint. The models support structured speaker and style metadata, inline vocal tags, multi-speaker dialogue, streaming, [voice design](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/text-to-speech/voice-design), and [voice replication](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/text-to-speech/voice-replication). For more information, see [Generate speech with Gemini TTS](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/text-to-speech/overview). **Google Kubernetes Engine** Feature The storage-optimized [Z4D machine series](https://docs.cloud.google.com/compute/docs/storage-optimized-machines.md.txt#z4d_series) is available with GKE clusters running 1.36.3-gke.1244000 or later. You can use Z4D machine types in Standard or Autopilot mode. For more information about limitations for this machine series in GKE, see [About machine support with GKE clusters](https://docs.cloud.google.com//kubernetes-engine/docs/concepts/machine-support#machine-support). **Model Armor** Feature Template-specific exclusion rules are available in [Preview](https://cloud.google.com/products#product-launch-stages). This feature lets you configure dictionary (word and phrase lists) and regular expression rules to mitigate false-positive detections for prompt injection and jailbreak detection and responsible AI filters. For more information, see [Configure template-specific exclusion rules](https://docs.cloud.google.com/model-armor/configure-exclusion-rules). **Security Command Center** Feature Risk Engine detects and reports reasoning engines that can modify IAM policies and perform lateral movement. These findings are generated as a [toxic combination](https://docs.cloud.google.com/security-command-center/docs/toxic-combinations-overview.md.txt). **Storage Transfer Service** Feature Storage Transfer Service now supports transferring data from multiple containers within a Microsoft Azure Storage account in a single transfer job. For more information, see [Transfer all containers in an Azure Storage account](https://docs.cloud.google.com/storage-transfer/docs/create-transfers/agentless/azure-all-containers.md.txt). ## September 27, 2026 **Agent Platform Workbench** Change ### 20260927-2130-rc0 Release Change Installed latest packages from upstream dependencies. Change ### M151 Release Change Installed latest packages from upstream dependencies. Feature JupyterLab now forwards client-side logs (console errors, uncaught exceptions, unhandled promise rejections, and failed network requests) to the instance backend, where they surface in Cloud Logging for easier debugging. Change ### 20260927-1408-rc0 Release Change ### 20260927-1408-rc0 Release Change Installed latest packages from upstream dependencies. Change Installed latest packages from upstream dependencies. **Google SecOps SOAR** Announcement Release 6.3.101 is being rolled out to the first phase of regions as listed [here](https://docs.cloud.google.com/chronicle/docs/soar/overview-and-introduction/soar-gradual-release.md.txt). This release contains internal and customer bug fixes. ## September 26, 2026 **Backup and DR** Security > [!NOTE] > **Note:** These fixes and updates are available starting with Backup and DR release 11.0.17.496. These fixes are not rolled out to the 11.0.16 release; we recommend upgrading the backup/recovery appliance to version 11.0.17 to receive these updates. **Security Bulletin -- Appliance:** - Addressed multiple input sanitization vulnerabilities, including SQL injection and cross-site scripting (XSS), across appliance platform server utilities. - Remediated an authorization and validation vulnerability in user management workflows. **Security Bulletin -- Host Agent:** - Strengthened local RPC interface access controls and improved credential isolation between concurrent backup jobs on the Host Agent. - Hardened database layer against command injection, path traversal, and unauthorized directory permission modifications. - Remediated local privilege escalation vulnerabilities in Oracle and SAP HANA host agent environment and profile handling. - Improved temporary file creation and link handling across Windows and Linux Host Agents to mitigate symlink race conditions. - Addressed buffer overflow vulnerabilities in Linux Host Agent components. **Libraries Bugs (Appliance):** - Upgraded third-party runtime and application libraries (including Go and Java packages such as Netty and Jackson Databind) on the appliance management server. - Updated the Linux kernel and base operating system packages across Backup and DR appliance virtual machine images to mitigate reported vulnerabilities. Fixed > [!NOTE] > **Note:** These fixes and updates are available starting with Backup and DR release 11.0.17.496. These fixes are not rolled out to the 11.0.16 release; we recommend upgrading the backup/recovery appliance to version 11.0.17 to receive these updates. These issues have been resolved for the Host Agent: - Resolved an issue where Oracle ASM backups failed with the error "Failed to create ASM staging disk group". - Resolved an issue causing Oracle RAC database restores to fail with error 6407 due to invalid node names in the nodelist. - Fixed a PostgreSQL backup failure during snapshot preparation where the database user lacked execute permissions on `pg_backup_start`. - Corrected an issue where the Oracle mount process was unable to locate the undo catalog configuration file. - Improved Oracle backup metadata processing to support databases containing a large volume of datafiles. - Resolved an issue where discovery of SAP Sybase instances failed when multiple instances were configured under different user accounts. - Fixed an issue causing PostgreSQL database discovery to fail during host agent discovery workflows. - Resolved an issue that prevented successful discovery of MySQL database applications. Change > [!NOTE] > **Note:** These fixes and updates are available starting with Backup and DR release 11.0.17.496. These fixes are not rolled out to the 11.0.16 release; we recommend upgrading the backup/recovery appliance to version 11.0.17 to receive these updates. **Non-Breaking Changes (Host Agent):** - Modernized host agent database integration scripts for IBM Db2, MySQL, MariaDB, SAP Sybase IQ, and MaxDB to standard Bash execution for improved stability and security hardening. Feature > [!NOTE] > **Note:** These fixes and updates are available starting with Backup and DR release 11.0.17.496. These fixes are not rolled out to the 11.0.16 release; we recommend upgrading the backup/recovery appliance to version 11.0.17 to receive these updates. These features are now available for the Host Agent: - Added Linux Changed Block Tracking (CBT) support for Red Hat Enterprise Linux (RHEL) 10 OS family kernels. - Expanded Linux Changed Block Tracking (CBT) support across the latest kernel updates for RHEL 8, RHEL 9, and RHEL 10 distributions. **Google SecOps SOAR** Announcement [Release 6.3.100](https://docs.cloud.google.com/chronicle/docs/soar/release-notes.md.txt#September_06_2026) is now available for all regions. ## September 25, 2026 **API Keys API** Feature The API Keys remote Model Context Protocol (MCP) server is available in [Preview](https://cloud.google.com/products#product-launch-stages). You can connect to the API Keys remote MCP server from AI applications to create, inspect, restrict, and manage the lifecycle of API keys in your Google Cloud projects. For more information, see the [API Keys MCP reference](https://docs.cloud.google.com/api-keys/docs/reference/mcp.md.txt). **Assured Workloads** Feature The [Switzerland Data Boundary](https://docs.cloud.google.com/assured-workloads/docs/control-packages/switzerland-data-boundary.md.txt) supports the following products: - Datastore - Document AI - Google Cloud Observability - Vertex AI Workbench **Audit Manager** Feature Audit Manager includes [Gemini-generated summaries](https://docs.cloud.google.com/audit-manager/docs/view-audit#compliance-score) that provide high-level information about the audit results for cloud controls, controls, or resources in [Preview](https://cloud.google.com/products#product-launch-stages). **Compute Engine** Feature **Generally available** : New X5 series with 50% larger memory instances: Breaking the previous 32TB memory limit of the X4 [memory-optimized machine type](https://docs.cloud.google.com/compute/docs/memory-optimized-machines.md.txt), a new X5 series introduces massive 48TB configurations. This empowers the largest SAP HANA and RISE with SAP customers to easily scale up their mission-critical databases on a single node. **Gemini Enterprise Agent Platform** Feature **Semantic governance policies support VPC Service Controls (Preview)** Semantic governance policy and the Semantic governance policy engine support [VPC Service Controls](https://docs.cloud.google.com/vpc-service-controls/docs/overview.md.txt) in [Preview](https://cloud.google.com/products#product-launch-stages). You can include Semantic governance policy and the policy engine in your service perimeter to help mitigate the risk of data exfiltration when governing agent tool calls. For more information, see [VPC Service Controls with Gemini Enterprise Agent Platform](https://docs.cloud.google.com/gemini-enterprise-agent-platform/machine-learning/general/vpc-service-controls#add-restricted-services) and [Semantic governance policies overview](https://docs.cloud.google.com/gemini-enterprise-agent-platform/govern/policies/semantic-governance-overview). **Google Cloud Contact Center as a Service** Announcement **Advanced reporting dashboards 6.14** We've released version 6.14 of the advanced reporting dashboards. Feature **Two new tables in the Real-time Queue Monitoring - Calls dashboard: Today's Scheduled Calls and Upcoming Scheduled Calls** We've added two new tables to the **Real-time Queue Monitoring - Calls** dashboard: **Today's Scheduled Calls** and **Upcoming Scheduled Calls**. These tables display pending scheduled calls across your allowed scheduling window, regardless of when they were initially created. The tables provide actionable details for each scheduled call, including the time until the call is due, an overdue flag, and a direct CRM link to the scheduled call. With these tables, you can view your full schedule of pending callbacks to help you plan staffing. For more information, see [Queue monitoring dashboards](https://docs.cloud.google.com/contact-center/ccai-platform/docs/dashboards-real-time-queue-monitor). Fixed This release addresses the following issues: - Fixed an issue that caused delays when loading and refreshing real-time agent dashboards. - Fixed an issue where the **Queue Group** and **Queue Name** filters inflated agent counts by including historical, rather than just current, queue assignments. If you have alerts or thresholds based on the previously inflated counts, update them to reflect the new, accurate counts. - Fixed an issue where certain queues were incorrectly mapped or dropped entirely from **Queue Group** filter results. - Fixed an issue where the **Is Inbound Call** and **Is Inbound Chat** columns in the **Live Agent Data** table on the **Real-time Agent Monitoring** dashboard displayed inverted values, incorrectly showing `No` for inbound interactions and `Yes` for outbound. This update also standardizes how interaction direction is defined across all reports, ensuring accurate classification and filtering for API-dialed calls, scheduled callbacks, and direct inbound calls. Additionally, it introduces several enhancements to reporting dashboards to ensure accurate timezone formatting, correct CSAT population by direction, and proper queue time tracking for newer call types. - Fixed an issue where the **Queue Time** column of the **Queued Calls** tile in advanced reporting displayed inflated wait times for calls that re-entered a queue after being answered or transferred. - Fixed an issue where agents performing mandatory after-call work were incorrectly classified as "In-Call" instead of "Wrap-up" on real-time reporting dashboards. You can expect a decrease in active "In-Call" agent counts and a corresponding increase in "Wrap-up" statuses across your live monitoring views. This change only affects dashboard reporting and doesn't affect agent routing or historical data. No action is required. - Fixed an issue where the SLA Target on the **Real-time Channel Performance** dashboards appeared blank for queues with no recent activity or when filters matched no configured queues. - Fixed an issue where the **Missed Interactions** dashboards double-counted declined calls and inflated missed chat volumes by incorrectly including agent response-time alerts. You can expect chat volumes to drop and average missed chat time to rise. - Fixed an issue where selecting the **Subtotals** option for call queue metrics for a Look returned an error. - Fixed an issue in downloadable call and chat history reports where French-language calls incorrectly appeared under English queue names. - Fixed an issue where scheduled calls disappeared from real-time reporting dashboards 12 hours after their creation, which caused the metric to undercount the total number of upcoming scheduled calls.
- Fixed an issue where filter options for agent and team data in advanced reporting dashboards weren't correctly scoped to the user's assigned permissions. - Fixed an issue where the **Agents** monitoring page became unresponsive when displaying large numbers of agents, causing significant latency when navigating to other pages. - Fixed an issue that caused the following problems with raw data exports: - Poor export performance due to inefficient database queries. - In the `call_recordings` export, the `url` field incorrectly contained a timestamp instead of the actual recording URL. The `url` field now contains the correct recording URL, and the timestamp has been moved to a newly added `updated_at` field. If you ingest `call_recordings` data using a fixed schema, update your data mappings to accommodate these changes. **Google Kubernetes Engine** Feature GKE Standard clusters now support up to 512 maximum Pods per node, an increase from the previous limit of 256. Nodes configured for 257 to 512 Pods will now be allocated a /22 Pod CIDR block (1,024 IP addresses). **Managed Service for Apache Airflow** Change *(Airflow 3.3.1, 3.2.2, and 2.11.1)* The `apache-airflow-providers-google` package was upgraded to version 22.4.0. For more information about changes, see the [apache-airflow-providers-google changelog](https://airflow.apache.org/docs/apache-airflow-providers-google/stable/changelog.html). Fixed Fixed an issue where OpenID Connect (OIDC) ID token audience strings were incorrectly converted to lowercase. The audience field now preserves case-sensitivity. This fixes integration failures with external services that require case-sensitive audience values. Change Airflow 2.10.5 is no longer included in new Managed Airflow images and builds Change New [Airflow builds](https://docs.cloud.google.com/composer/docs/composer-versions.md.txt#images-composer-3) are available in Managed Airflow (Gen 3): - [composer-3-airflow-3.3.1-build.3](https://docs.cloud.google.com/composer/docs/versions-packages.md.txt#composer-3-airflow-3-3-1-build-3) (extended upgrade timeline version) - [composer-3-airflow-3.2.2-build.7](https://docs.cloud.google.com/composer/docs/versions-packages.md.txt#composer-3-airflow-3-2-2-build-7) (extended upgrade timeline version) - [composer-3-airflow-2.11.1-build.20](https://docs.cloud.google.com/composer/docs/versions-packages.md.txt#composer-3-airflow-2-11-1-build-20) (extended upgrade timeline version) Change New [images](https://docs.cloud.google.com/composer/docs/composer-versions.md.txt#images-composer-2) are available in Managed Airflow (Gen 2): - [composer-2.17.14-airflow-2.11.1](https://docs.cloud.google.com/composer/docs/versions-packages.md.txt#composer-2-17-14-airflow-2-11-1) (extended upgrade timeline version) Deprecated The following Managed Airflow versions and builds have reached their [end of support period](https://docs.cloud.google.com/composer/docs/composer-versioning-overview.md.txt#version-deprecation-and-support): composer-3-airflow-2.9.3-build.33, composer-3-airflow-2.10.5-build.13, composer-3-airflow-2.9.3-build.34, composer-3-airflow-2.10.5-build.14, composer-2.14.1-airflow-2.9.3, composer-2.14.1-airflow-2.10.5, composer-2.14.2-airflow-2.9.3, and composer-2.14.2-airflow-2.10.5. ## September 24, 2026 **Access Approval** Feature Fault Injection Testing is generally available ([GA](https://cloud.google.com/products#product-launch-stages)). **Access Transparency** Feature Fault Injection Testing is generally available ([GA](https://cloud.google.com/products#product-launch-stages)). **Apigee hybrid** Announcement ### v1.15.8 On September 24, 2026 we released an updated version of the Apigee hybrid software, v1.15.8. - For information on upgrading, see [Upgrading Apigee hybrid to version v1.15.8](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/upgrade.md.txt). - For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.15/big-picture.md.txt). > [!NOTE] > **Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images). Fixed #### Fixed in this release | Bug ID | Description | |---|---| | **535928300** | **Fixed a security issue in JWT refresh token revocation handling.** | | **535683286** | **Fixed a security issue in HTTP target interim-response (`103 Early Hints`) handling to prevent response desynchronization.** | | **534852923** | **Fixed a security issue in the `JavaCallout` policy.** | | **534420582** | **The `JSONThreatProtection` policy now supports an optional `` child element that rejects JSON payloads containing duplicate keys within the same object.** | | **531773665** | **Fixed an issue where the `VerifyAPIKey` policy could fail with a `NullPointerException` when reading developer attributes.** | | **469642464** | **Improved input validation in AI protection policies to prevent server-side request forgery (SSRF).** | | **449228485** | **Apigee hybrid now supports configuring custom Kubernetes `PodDisruptionBudget` (`minAvailable` or `maxUnavailable`) values for Apigee hybrid components in your `overrides.yaml` file. These overrides take effect from Apigee hybrid v1.15.9, which adds the `podDisruptionBudget` field to the CRDs in the `apigee-operator` chart.** | Security | Bug ID | Description | |---|---| | **N/A** | **Security fixes for `apigee-asm-ingress`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) | | **N/A** | **Security fixes for `apigee-asm-istiod`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) | | **N/A** | **Security fixes for `apigee-connect-agent`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) | | **N/A** | **Security fixes for `apigee-fluent-bit`.** This addresses the following vulnerabilities: - [CVE-2025-13151](https://nvd.nist.gov/vuln/detail/CVE-2025-13151) - [CVE-2025-14524](https://nvd.nist.gov/vuln/detail/CVE-2025-14524) - [CVE-2025-14819](https://nvd.nist.gov/vuln/detail/CVE-2025-14819) - [CVE-2026-14456](https://nvd.nist.gov/vuln/detail/CVE-2026-14456) - [CVE-2026-14457](https://nvd.nist.gov/vuln/detail/CVE-2026-14457) - [CVE-2026-14662](https://nvd.nist.gov/vuln/detail/CVE-2026-14662) - [CVE-2026-14663](https://nvd.nist.gov/vuln/detail/CVE-2026-14663) - [CVE-2026-14664](https://nvd.nist.gov/vuln/detail/CVE-2026-14664) - [CVE-2026-14666](https://nvd.nist.gov/vuln/detail/CVE-2026-14666) - [CVE-2026-14668](https://nvd.nist.gov/vuln/detail/CVE-2026-14668) - [CVE-2026-14669](https://nvd.nist.gov/vuln/detail/CVE-2026-14669) - [CVE-2026-14670](https://nvd.nist.gov/vuln/detail/CVE-2026-14670) - [CVE-2026-14671](https://nvd.nist.gov/vuln/detail/CVE-2026-14671) - [CVE-2026-14672](https://nvd.nist.gov/vuln/detail/CVE-2026-14672) - [CVE-2026-14673](https://nvd.nist.gov/vuln/detail/CVE-2026-14673) - [CVE-2026-14677](https://nvd.nist.gov/vuln/detail/CVE-2026-14677) - [CVE-2026-14678](https://nvd.nist.gov/vuln/detail/CVE-2026-14678) - [CVE-2026-14679](https://nvd.nist.gov/vuln/detail/CVE-2026-14679) - [CVE-2026-14680](https://nvd.nist.gov/vuln/detail/CVE-2026-14680) - [CVE-2026-14681](https://nvd.nist.gov/vuln/detail/CVE-2026-14681) - [CVE-2026-15741](https://nvd.nist.gov/vuln/detail/CVE-2026-15741) - [CVE-2026-15742](https://nvd.nist.gov/vuln/detail/CVE-2026-15742) - [CVE-2026-16239](https://nvd.nist.gov/vuln/detail/CVE-2026-16239) - [CVE-2026-16241](https://nvd.nist.gov/vuln/detail/CVE-2026-16241) - [CVE-2026-18024](https://nvd.nist.gov/vuln/detail/CVE-2026-18024) - [CVE-2026-18408](https://nvd.nist.gov/vuln/detail/CVE-2026-18408) - [CVE-2026-18798](https://nvd.nist.gov/vuln/detail/CVE-2026-18798) - [CVE-2026-19385](https://nvd.nist.gov/vuln/detail/CVE-2026-19385) - [CVE-2026-1965](https://nvd.nist.gov/vuln/detail/CVE-2026-1965) - [CVE-2026-34743](https://nvd.nist.gov/vuln/detail/CVE-2026-34743) - [CVE-2026-3783](https://nvd.nist.gov/vuln/detail/CVE-2026-3783) - [CVE-2026-3784](https://nvd.nist.gov/vuln/detail/CVE-2026-3784) - [CVE-2026-3805](https://nvd.nist.gov/vuln/detail/CVE-2026-3805) - [CVE-2026-4873](https://nvd.nist.gov/vuln/detail/CVE-2026-4873) - [CVE-2026-54874](https://nvd.nist.gov/vuln/detail/CVE-2026-54874) - [CVE-2026-5545](https://nvd.nist.gov/vuln/detail/CVE-2026-5545) - [CVE-2026-5773](https://nvd.nist.gov/vuln/detail/CVE-2026-5773) - [CVE-2026-6253](https://nvd.nist.gov/vuln/detail/CVE-2026-6253) - [CVE-2026-6276](https://nvd.nist.gov/vuln/detail/CVE-2026-6276) - [CVE-2026-63072](https://nvd.nist.gov/vuln/detail/CVE-2026-63072) - [CVE-2026-63073](https://nvd.nist.gov/vuln/detail/CVE-2026-63073) - [CVE-2026-63074](https://nvd.nist.gov/vuln/detail/CVE-2026-63074) - [CVE-2026-63075](https://nvd.nist.gov/vuln/detail/CVE-2026-63075) - [CVE-2026-63076](https://nvd.nist.gov/vuln/detail/CVE-2026-63076) - [CVE-2026-6429](https://nvd.nist.gov/vuln/detail/CVE-2026-6429) - [CVE-2026-6464](https://nvd.nist.gov/vuln/detail/CVE-2026-6464) - [CVE-2026-6469](https://nvd.nist.gov/vuln/detail/CVE-2026-6469) - [CVE-2026-6470](https://nvd.nist.gov/vuln/detail/CVE-2026-6470) - [CVE-2026-6471](https://nvd.nist.gov/vuln/detail/CVE-2026-6471) - [CVE-2026-6473](https://nvd.nist.gov/vuln/detail/CVE-2026-6473) - [CVE-2026-7168](https://nvd.nist.gov/vuln/detail/CVE-2026-7168) - [CVE-2026-75803](https://nvd.nist.gov/vuln/detail/CVE-2026-75803) | | **N/A** | **Security fixes for `apigee-hybrid-cassandra`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) - [CVE-2026-54512](https://nvd.nist.gov/vuln/detail/CVE-2026-54512) - [CVE-2026-54513](https://nvd.nist.gov/vuln/detail/CVE-2026-54513) - [CVE-2026-54514](https://nvd.nist.gov/vuln/detail/CVE-2026-54514) - [CVE-2026-54515](https://nvd.nist.gov/vuln/detail/CVE-2026-54515) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [CVE-2026-59888](https://nvd.nist.gov/vuln/detail/CVE-2026-59888) - [GHSA-72hv-8253-57qq](https://osv.dev/vulnerability/GHSA-72hv-8253-57qq) - [GHSA-r7wm-3cxj-wff9](https://osv.dev/vulnerability/GHSA-r7wm-3cxj-wff9) | | **N/A** | **Security fixes for `apigee-hybrid-cassandra-client`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) | | **N/A** | **Security fixes for `apigee-mart-server`.** This addresses the following vulnerabilities: - [CVE-2026-54515](https://nvd.nist.gov/vuln/detail/CVE-2026-54515) - [CVE-2026-55831](https://nvd.nist.gov/vuln/detail/CVE-2026-55831) - [CVE-2026-55833](https://nvd.nist.gov/vuln/detail/CVE-2026-55833) - [CVE-2026-56745](https://nvd.nist.gov/vuln/detail/CVE-2026-56745) - [CVE-2026-56746](https://nvd.nist.gov/vuln/detail/CVE-2026-56746) - [CVE-2026-56819](https://nvd.nist.gov/vuln/detail/CVE-2026-56819) - [CVE-2026-59889](https://nvd.nist.gov/vuln/detail/CVE-2026-59889) - [CVE-2026-59898](https://nvd.nist.gov/vuln/detail/CVE-2026-59898) - [CVE-2026-59899](https://nvd.nist.gov/vuln/detail/CVE-2026-59899) - [CVE-2026-59900](https://nvd.nist.gov/vuln/detail/CVE-2026-59900) - [CVE-2026-59901](https://nvd.nist.gov/vuln/detail/CVE-2026-59901) - [CVE-2026-59903](https://nvd.nist.gov/vuln/detail/CVE-2026-59903) - [CVE-2026-59921](https://nvd.nist.gov/vuln/detail/CVE-2026-59921) - [CVE-2026-73508](https://nvd.nist.gov/vuln/detail/CVE-2026-73508) - [GHSA-mhm7-754m-9p8w](https://osv.dev/vulnerability/GHSA-mhm7-754m-9p8w) | | **N/A** | **Security fixes for `apigee-mint-task-scheduler`.** This addresses the following vulnerabilities: - [CVE-2026-54515](https://nvd.nist.gov/vuln/detail/CVE-2026-54515) - [CVE-2026-55831](https://nvd.nist.gov/vuln/detail/CVE-2026-55831) - [CVE-2026-55833](https://nvd.nist.gov/vuln/detail/CVE-2026-55833) - [CVE-2026-56745](https://nvd.nist.gov/vuln/detail/CVE-2026-56745) - [CVE-2026-56746](https://nvd.nist.gov/vuln/detail/CVE-2026-56746) - [CVE-2026-56819](https://nvd.nist.gov/vuln/detail/CVE-2026-56819) - [CVE-2026-59889](https://nvd.nist.gov/vuln/detail/CVE-2026-59889) - [CVE-2026-59898](https://nvd.nist.gov/vuln/detail/CVE-2026-59898) - [CVE-2026-59899](https://nvd.nist.gov/vuln/detail/CVE-2026-59899) - [CVE-2026-59900](https://nvd.nist.gov/vuln/detail/CVE-2026-59900) - [CVE-2026-59901](https://nvd.nist.gov/vuln/detail/CVE-2026-59901) - [CVE-2026-59903](https://nvd.nist.gov/vuln/detail/CVE-2026-59903) - [CVE-2026-59921](https://nvd.nist.gov/vuln/detail/CVE-2026-59921) - [CVE-2026-73508](https://nvd.nist.gov/vuln/detail/CVE-2026-73508) - [GHSA-mhm7-754m-9p8w](https://osv.dev/vulnerability/GHSA-mhm7-754m-9p8w) | | **N/A** | **Security fixes for `apigee-open-telemetry-collector`.** This addresses the following vulnerabilities: - [CVE-2026-43871](https://nvd.nist.gov/vuln/detail/CVE-2026-43871) - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-81871](https://nvd.nist.gov/vuln/detail/CVE-2026-81871) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) | | **N/A** | **Security fixes for `apigee-operators`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) - [GHSA-w67g-5rqw-f597](https://osv.dev/vulnerability/GHSA-w67g-5rqw-f597) | | **N/A** | **Security fixes for `apigee-prom-prometheus`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) | | **N/A** | **Security fixes for `apigee-prometheus-adapter`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [CVE-2026-81870](https://nvd.nist.gov/vuln/detail/CVE-2026-81870) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) | | **N/A** | **Security fixes for `apigee-redis`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) | | **N/A** | **Security fixes for `apigee-runtime`.** This addresses the following vulnerabilities: - [CVE-2026-54515](https://nvd.nist.gov/vuln/detail/CVE-2026-54515) - [CVE-2026-55831](https://nvd.nist.gov/vuln/detail/CVE-2026-55831) - [CVE-2026-55833](https://nvd.nist.gov/vuln/detail/CVE-2026-55833) - [CVE-2026-56745](https://nvd.nist.gov/vuln/detail/CVE-2026-56745) - [CVE-2026-56746](https://nvd.nist.gov/vuln/detail/CVE-2026-56746) - [CVE-2026-56819](https://nvd.nist.gov/vuln/detail/CVE-2026-56819) - [CVE-2026-59889](https://nvd.nist.gov/vuln/detail/CVE-2026-59889) - [CVE-2026-59898](https://nvd.nist.gov/vuln/detail/CVE-2026-59898) - [CVE-2026-59899](https://nvd.nist.gov/vuln/detail/CVE-2026-59899) - [CVE-2026-59900](https://nvd.nist.gov/vuln/detail/CVE-2026-59900) - [CVE-2026-59901](https://nvd.nist.gov/vuln/detail/CVE-2026-59901) - [CVE-2026-59903](https://nvd.nist.gov/vuln/detail/CVE-2026-59903) - [CVE-2026-59921](https://nvd.nist.gov/vuln/detail/CVE-2026-59921) - [CVE-2026-73508](https://nvd.nist.gov/vuln/detail/CVE-2026-73508) - [CVE-2026-75595](https://nvd.nist.gov/vuln/detail/CVE-2026-75595) - [CVE-2026-75596](https://nvd.nist.gov/vuln/detail/CVE-2026-75596) - [GHSA-mhm7-754m-9p8w](https://osv.dev/vulnerability/GHSA-mhm7-754m-9p8w) | | **N/A** | **Security fixes for `apigee-synchronizer`.** This addresses the following vulnerabilities: - [CVE-2026-54515](https://nvd.nist.gov/vuln/detail/CVE-2026-54515) - [CVE-2026-55831](https://nvd.nist.gov/vuln/detail/CVE-2026-55831) - [CVE-2026-55833](https://nvd.nist.gov/vuln/detail/CVE-2026-55833) - [CVE-2026-56745](https://nvd.nist.gov/vuln/detail/CVE-2026-56745) - [CVE-2026-56746](https://nvd.nist.gov/vuln/detail/CVE-2026-56746) - [CVE-2026-56819](https://nvd.nist.gov/vuln/detail/CVE-2026-56819) - [CVE-2026-59889](https://nvd.nist.gov/vuln/detail/CVE-2026-59889) - [CVE-2026-59898](https://nvd.nist.gov/vuln/detail/CVE-2026-59898) - [CVE-2026-59899](https://nvd.nist.gov/vuln/detail/CVE-2026-59899) - [CVE-2026-59900](https://nvd.nist.gov/vuln/detail/CVE-2026-59900) - [CVE-2026-59901](https://nvd.nist.gov/vuln/detail/CVE-2026-59901) - [CVE-2026-59903](https://nvd.nist.gov/vuln/detail/CVE-2026-59903) - [CVE-2026-59921](https://nvd.nist.gov/vuln/detail/CVE-2026-59921) - [CVE-2026-73508](https://nvd.nist.gov/vuln/detail/CVE-2026-73508) - [GHSA-mhm7-754m-9p8w](https://osv.dev/vulnerability/GHSA-mhm7-754m-9p8w) | | **N/A** | **Security fixes for `apigee-watcher`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) | Change **Correction: API base path limit for Apigee hybrid organizations** The [December 16, 2024](https://docs.cloud.google.com/apigee/docs/hybrid/release-notes.md.txt#December_16_2024) release note for enhanced per-environment proxy limits stated that the maximum number of API base paths per Apigee organization is 3000. That number is incorrect. The maximum number of API base paths per organization is 6,000 for both Apigee and Apigee hybrid. For optimal performance, Apigee recommends using no more than 3,000 API proxy basepaths per environment or environment group. This is a recommendation, not an enforced limit. For more information, see [Limits](https://docs.cloud.google.com/apigee/docs/api-platform/reference/limits.md.txt#environment-and-organization) and [Enhanced per-environment proxy limits](https://docs.cloud.google.com/apigee/docs/hybrid/v1.17/enhanced-proxy-limits.md.txt). **BigQuery** Feature In the BigQuery Studio query editor, the **Query results** table now keeps the row numbers visible on the left as you scroll horizontally. This helps you maintain context and track data across wide tables. This feature is [generally available](https://cloud.google.com/products#product-launch-stages) (GA). **Certificate Manager** Feature You can now attach tags to Certificate Manager resources during creation. This feature is available in [Preview](https://cloud.google.com/products#product-launch-stages). For more information, see [Create and manage tags for Certificate Manager resources](https://docs.cloud.google.com/certificate-manager/docs/create-manage-tags.md.txt). **Cloud Scheduler** Change Cloud Scheduler is available in the following [locations](https://docs.cloud.google.com/scheduler/docs/locations.md.txt): - `asia-south2` (Delhi, India) - `europe-west12` (Turin, Italy) - `northamerica-northeast2` (Toronto, Ontario, Canada) **Cloud Workstations** Feature Cloud Workstations is a covered [product](https://cloud.google.com/security/compliance/hipaa#covered-products) under [Google Cloud HIPAA BAA](https://cloud.google.com/terms/hipaa-baa). **Compute Engine** Feature **Preview** : To protect standard snapshots from accidental or malicious deletion, Compute Engine retains deleted snapshots in the *recycle bin* for three days before permanently erasing the snapshots. For more information, see [Retain deleted resources in the recycle bin](https://docs.cloud.google.com/compute/docs/disks/retain-deleted-resources.md.txt). **Data Studio** Feature **Bulk styling** You can customize all series, dimensions, or metrics at once, or select an individual item to style it separately. Styles that you set for an individual item override styles that you set for all items. For more information, see the [Line chart and combo chart reference](https://docs.cloud.google.com/data-studio/line-chart-and-combo-chart-reference.md.txt), [Time series reference](https://docs.cloud.google.com/data-studio/time-series-reference.md.txt), and [Table reference](https://docs.cloud.google.com/data-studio/table-reference.md.txt). Feature **Connect to PostgreSQL (Private IP)** You can connect Data Studio to PostgreSQL databases on Cloud SQL by using a private IP address. Private IP connections keep your database traffic on a private network instead of the public internet. For more information, see [Connect to PostgreSQL](https://docs.cloud.google.com/data-studio/connect-to-postgresql.md.txt). Deprecated **MySQL 5.6 and 5.7 deprecation** Support for MySQL 5.6 and 5.7 in the MySQL connector is ending: - Creating new data sources that connect to MySQL 5.6 or 5.7 won't be possible after February 26, 2027. - Data sources or reports that use MySQL 5.6 or 5.7 might not properly load data after February 26, 2027. For more information, see [Connect to MySQL](https://docs.cloud.google.com/data-studio/connect-to-mysql.md.txt). Feature **Partner connection launch update** The following partner connectors have been added to the Data Studio Connector Gallery: - [Facebook Ads Analytics](https://datastudio.google.com/c/datasources/create?connectorId=AKfycbwiyh8LyfZyQ8aG5Fp39pCsIEccpSsK-w3j8y6N-ZB3-rZJX9-aUP9C0e1F5PivZ_Uv) By Langquang. Sources: Facebook Ads - [Nextdoor](https://datastudio.google.com/c/datasources/create?connectorId=AKfycbx5xGzeuSxYpDnwhsjnEmprY9sB2h294iHRjaW4YoGxdc023iTwWfNVZQmxpIBe_CtzXA) By Windsor.ai. Sources: Nextdoor - [Attentive](https://datastudio.google.com/c/datasources/create?connectorId=AKfycbz9s4Rb2k13vtaOIg9ZdqeEArMsmzI1ch3qfwGLP4DYgypHWJ_oHEpYKmDlJepMRV7x) By Windsor.ai. Sources: Attentive - [Contractors Cloud](https://datastudio.google.com/c/datasources/create?connectorId=AKfycbz0G_xUNoIowgyV5SkOZrr6xknZbC-RrGQ68iyJt8Slhv4UrMB6hXx7_jkPniZuo9fxQw) By Windsor.ai. Sources: Contractors Cloud - [AppLovin](https://datastudio.google.com/c/datasources/create?connectorId=AKfycbwa_VfDqwKV4nU-g91I3Du2yNkUjGo6IZrsS_SeU2nHWx0nnAZWWulop_gjr6se5C0l) By Windsor.ai. Sources: AppLovin - [SEOmonitor](https://datastudio.google.com/c/datasources/create?connectorId=AKfycbwrkqEETu9VxmB6PY9qjlewyPaHdOeIVv-CmeqNMIUMB_8869OUENmB2kXa-duMY9kl) By SEOmonitor. Sources: SEOmonitor - [SimilarWeb](https://datastudio.google.com/c/datasources/create?connectorId=AKfycbxeFsVMVREcnL3ONWeGosaa_PxhjKR7CVJYvCuE93sQEpka6Yf9oPohdv_D4LLSvEGr) By Windsor.ai. Sources: SimilarWeb - [Salesforce](https://datastudio.google.com/c/datasources/create?connectorId=AKfycbxNSTS9Oxw51dEWq547XhMy73Sw44hFa6w2gK-dYOchos0do-ovfa9buYXSUn6q9reJzA) By Dataslayer. Sources: Salesforce - [Facebook Ads (Meta Ads)](https://datastudio.google.com/c/datasources/create?connectorId=AKfycbwg5L8WnTzgsyCMHmKhyGoX1OadvEpaGeothozHT7ae4nNKim0hfATfgIojdpSL1xKC) By Datablaster. Sources: Meta Ads - [Google Search Console](https://datastudio.google.com/c/datasources/create?connectorId=AKfycbw3JAdju3IIS5dA47OcoGjShqKNQ_Z9N0r24m-FPdlX1gQa_-ld2tbbIhaTh69DCM3Qqw) By Data Bloo. Sources: Google Search Console - [CleverReach](https://datastudio.google.com/c/datasources/create?connectorId=AKfycbxljd9HY3q4bpQLfC_RdgImEcv7-ZvieLYsE53biXnKF8V5C1HVCSAqOKBoxsk4gCIO3Q) By Power My Analytics. Sources: CleverReach - [Cin7 Core AppiWorks](https://datastudio.google.com/c/datasources/create?connectorId=AKfycbyunnrPcqWgRkYHecPxUfGrZTQnFuK9jynShqfP5ig3OdT0KS8A_ztUIwFup0gBHZ6kxA) By Jivrus Technologies. Sources: Cin7 - [Mangools AI Search Watcher](https://datastudio.google.com/c/datasources/create?connectorId=AKfycbwcwpBC1B5lfxYrqd_80uzzwnxWaOjKKo7ArfjglcnnreHZ-3WTwUVTMyIayLT-mmp0UQ) By Mangools.com. Sources: Mangools - [Amazon Vendor Central](https://datastudio.google.com/c/datasources/create?connectorId=AKfycbx2W2J3Wc7U9ExmzjSBV0q2RtRR_DwLzpNP7xcP4TtxHoA5lBPQsExmLlde7qQHKy5OWw) By Power My Analytics. Sources: Amazon - [快客-Microsoft Ads 串接](https://datastudio.google.com/c/datasources/create?connectorId=AKfycbwe2lMdXwfn76g7H0G3MnUrYmkerlw5koa5Q-69AcT0ty_fZCXjMDW8PBJrryUlYj0b) By 黑客數位. Sources: Bing Ads - [Leadinfo](https://datastudio.google.com/c/datasources/create?connectorId=AKfycby1g9ueAD9P0wfa-EI5h_PYZU4W4bpHxkit_X5Vt-5iuY5QXxap3_pftCvbvPtlypgOow) By Leadinfo. Sources: Leadinfo **Gemini Enterprise Agent Platform** Feature **Gemini 3.8 Live** Gemini 3.8 Live is generally available. This release introduces improvements in voice quality, model reliability, and agent orchestration. For more information, see the following: - [Gemini 3.8 Live](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/gemini/3-8-live.md.txt) - [Gemini Live API overview](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/live-api.md.txt) Feature **Muse Spark 1.3 from Meta** [Muse Spark 1.3 from Meta](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/partner-models/meta/muse-spark-1-3.md.txt) is available in [Preview](https://cloud.google.com/products#product-launch-stages). Muse Spark 1.3 from Meta is a reasoning model trained for agentic workflows and competitive coding. It delivers higher first-attempt accuracy, reliable built-in tool calling with MCP support, and 1M-token long context for multi-step tasks. Fixed **CodeMender updates (v0.10.0)** This release introduces updates to CodeMender: - **Impact-aware PR delta scanning** : Added `--diff` and `--staged` flags to `cm find` to audit modified pull request hunks and 1-hop neighbor files while suppressing pre-existing vulnerabilities. - **SARIF report export and CI gating** : Added SARIF v2.1.0 export (`--format sarif`, `--output`) and severity-based CI gating (`--fail-on`) to `cm report` to integrate scan results into CI/CD pipelines and code scanning tools. - **Adaptive hybrid deep scanning** : Added `--deep` and `--deep-workers` flags to `cm find` to combine deterministic file pruning, parallel package-batched analysis, and post-triage verification for higher vulnerability recall and precision. - **Custom workspace directory** : Added support for the `CM_HOME` environment variable to override the default `~/.codemender` directory for configuration, local state (`state.db`), backups, and artifacts. - **Bug fixes** : - Required build and test validation (`build.command`) to succeed during `cm fix` before marking a patch as applied and a finding as fixed. - Stabilized vulnerability fingerprints across multiple scans and bound `cm verify` directly to the target finding ID to prevent duplicate findings. - Restored the configured session model automatically when reconnecting to an active session with `cm session resume`. - Updated `cm verify` to add `.exploit` to `.gitignore` before execution so cancelled verification sessions do not leave untracked proof-of-concept scripts. For more information, see the [CodeMender documentation](https://docs.cloud.google.com/gemini-enterprise-agent-platform/agents/codemender.md.txt). **Google Kubernetes Engine** Feature GKE ambient networking is now available in [Preview](https://cloud.google.com/products#product-launch-stages) through an allowlist. GKE ambient networking provides a simplified, sidecarless deployment model for a service mesh with Layer 4 capabilities. By moving proxy functionality to node-level components integrated into [GKE Dataplane V2](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/dataplane-v2.md.txt), ambient networking reduces resource overhead, eliminates workload restarts for proxy updates, and simplifies mesh lifecycle management. The Preview release supports single-cluster Layer 4 mesh capabilities using the [Gateway API](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/gateway-api.md.txt), which includes mutual TLS (mTLS), service discovery, Layer 4 traffic management, and Layer 4 telemetry. For more information, see [Ambient networking overview](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/ambient-overview.md.txt) and [Prepare GKE ambient networking](https://docs.cloud.google.com/kubernetes-engine/docs/how-to/prepare-ambient-networking.md.txt). **Knowledge Catalog** Feature Knowledge Catalog support for importing dbt metadata is now [generally available](https://cloud.google.com/products#product-launch-stages) and includes the following updates: - You can import metadata from dbt Cloud job runs using the dbt Cloud interface, the dbt platform CLI, or the dbt Administrative API and webhooks. - You can generate and import metadata artifacts from dbt Core 2.x and dbt Fusion in addition to dbt Core 1.x. - You can import entry links (`--include-entry-links` and `--skip-bigquery-link`) to capture dbt lineage and semantic relationships and link materialized dbt nodes to physical BigQuery tables, and search related BigQuery entries using the `lookupEntryLinks` method. - You can configure dbt metadata import jobs and search or view imported dbt entries using the Google Cloud console, the Google Cloud CLI, or the Dataplex REST API. For more information, see [Import metadata from dbt Core](https://docs.cloud.google.com/knowledge-catalog/docs/dbt-transfer.md.txt). Feature Data products now support configuring a default IAM role in an access group. The default role, once configured, is automatically granted on all packaged and supported assets in the data product. Data product owners can override the default role for individual assets. In addition, the assets table in a data product now shows the permission state of each asset (`Applied`, `Failed`, or `Unsupported`). For more information, see [Create data products](https://docs.cloud.google.com/knowledge-catalog/docs/create-data-products.md.txt) and [Manage data products](https://docs.cloud.google.com/knowledge-catalog/docs/manage-data-products.md.txt). **Looker** Announcement Beginning September 21, 2026, the following features will be automatically enabled for Looker (original) instances running Looker 26.16. Feature Looker now displays an **Authorize OAuth Connection** dialog when users initiate an OAuth authorization flow for database connections. This dialog notifies users that authorizing the connection allows Looker to access data on their behalf, and that privileged Looker users---such as administrators and developers---may have visibility into their data (for example, when an administrator runs queries by using another user's active OAuth token during a sudo session). Feature Looker now includes a [**Filters on Visualization Tiles** preview feature](https://docs.cloud.google.com/looker/docs/filters-user-defined-dashboards.md.txt#filters-on-visualization-tiles) that lets dashboard creators place filter controls directly on individual visualization tiles rather than only in the dashboard filter bar. Announcement The latest versions in the Looker (Google Cloud core) [release channels](https://docs.cloud.google.com/looker/docs/looker-core-release-process.md.txt#release_channels) are beginning deployment as follows: - Latest version in the Rapid channel: **Looker 26.16** - Latest version in the Regular channel: **Looker 26.14** - Latest version in the No Channel channel: **Looker 26.16** **Update:** Looker 26.16 won't be deployed to Looker (Google Cloud core); instead, Looker 26.18 will begin rolling out to Looker (Google Cloud core) on September 29, 2026. This update was added on September 29, 2026. Feature Looker now includes a long polling concurrency guard. This prevents issues where queries cause long poll requests that oversaturate Looker and cause Looker to freeze. If a query causes a long poll request, Looker will display the error message `Query polling capacity reached. Please try again later.` **Memorystore for Valkey** Feature [Support](https://docs.cloud.google.com/memorystore/docs/valkey/supported-versions.md.txt) for version 9.1 of Valkey is [generally available](https://docs.cloud.google.com/products#product-launch-stages). **Model Armor** Feature You can use the following filters in Melbourne (`australia-southeast2`) with [data residency enforcement enabled](https://docs.cloud.google.com/model-armor/manage-templates.md.txt#set-data-residency-compliance): - Prompt injection and jailbreak detection - Responsible AI For information about available Model Armor features for each region, see [Supported features by region](https://docs.cloud.google.com/model-armor/feature-availability-by-region#supported-by-region). **SAP on Google Cloud** Announcement **New SAP certifications: X5 series of memory-optimized bare metal machine types** For use with SAP HANA scale-up (OLAP and OLTP) and SAP NetWeaver workloads, SAP has certified the Compute Engine X5 series of memory-optimized bare metal machine types with the Intel Granite Rapids CPU platform. For more information, see: - For SAP HANA, see [X5 memory-optimized bare metal machine types](https://docs.cloud.google.com/sap/docs/sap-hana-planning-guide.md.txt#x5-memory-optimized) - For SAP NetWeaver, see [X5 memory-optimized bare metal machine types](https://docs.cloud.google.com/sap/docs/certifications-sap-apps#sap-certified-x5) **Security Command Center** Change The following Security Command Center finding category names from AI Protection have new names to clarify that AI Protection detects tuned models and to remove the legacy `VERTEX_1P_` prefix: - `VERTEX_1P_TUNED_MODEL_DETECTED` changes to `TUNED_MODEL_DETECTED`. - `VERTEX_1P_TUNED_MODEL_NOT_PROTECTED_BY_MODEL_ARMOR` changes to `TUNED_MODEL_NOT_PROTECTED_BY_MODEL_ARMOR`. For more information about AI Protection findings, see [AI Protection overview](https://docs.cloud.google.com/security-command-center/docs/ai-protection-overview.md.txt) and [AI Discovery service findings](https://docs.cloud.google.com/security-command-center/docs/concepts-vulnerabilities-findings.md.txt#aip-ds-findings). ## September 23, 2026 **Apigee API hub** Feature **Preview launch of AWS API Gateway and Azure API Management plugins** API hub now includes two new built-in plugins for ingesting API metadata from third-party gateways: **AWS API Gateway** and **Azure API Management** . Both plugins are in [Public Preview](https://cloud.google.com/products#product-launch-stages), extending API hub's multi-cloud governance to give you a single pane of glass across your Google Cloud, AWS, and Azure APIs. **What's new** - **Automated discovery and onboarding**: Connect your AWS account or Azure API Management (APIM) service and API hub automatically discovers your existing deployed APIs and related metadata. - **Scheduled pull sync**: A full metadata sync runs every 6 hours by default, with reconciliation (upserts and orphan deletes) to keep your catalog in sync with the source gateway. - **Optional near-real-time push sync** : Deploy a customer-managed AWS Lambda function (for AWS API Gateway) or Azure Function (for Azure API Management) to relay control-plane change events to API hub in near real time. For sample deployment code, see the [apigee-samples](https://github.com/GoogleCloudPlatform/apigee-samples/tree/main/apihub-plugins) repository. For more information, see [About plugins](https://docs.cloud.google.com/apigee/docs/apihub/plugins.md.txt), [Manage third-party plugins](https://docs.cloud.google.com/apigee/docs/apihub/manage-third-party-plugins.md.txt), and [Create a plugin instance](https://docs.cloud.google.com/apigee/docs/apihub/create-plugin-instances.md.txt). Feature **Spec-to-deployment linkage and gateway revision tracking in API hub (GA)** API hub now provides a first-class, bidirectional link between API specifications, operations, and the deployments that serve them, together with native tracking of the underlying gateway revision. **What's new** - **Direct visibility between specs and deployments**: See exactly which API specification and operations are served by a specific deployment, and navigate from a spec to the deployments that serve it. - **Native gateway revision tracking** : Deployments now capture and display their underlying gateway revision (for example, an Apigee proxy revision) via the new `source_revision` field on the Deployment resource. - **More accurate operation resolution**: When multiple revisions expose overlapping operations (same method and path), API hub associates each operation with its specific specification instead of dropping duplicates. - **Multiple spec revisions per API**: API hub can store multiple revisions of the same spec for an API deployed across different environments. **Cloud Asset Inventory** Feature The following resource types are publicly available through the [ExportAssets](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/exportAssets.md.txt), [ListAssets](https://docs.cloud.google.com/asset-inventory/docs/listing-assets), [BatchGetAssetsHistory](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/batchGetAssetsHistory.md.txt), [QueryAssets](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/queryAssets.md.txt), [Feed](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/feeds.md.txt), and Search ([SearchAllResources](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/searchAllResources.md.txt), [SearchAllIamPolicies](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/searchAllIamPolicies.md.txt)) APIs. - Google Cloud Migration Center - `migrationcenter.googleapis.com/Asset` - `migrationcenter.googleapis.com/CostAssessmentJob` **Cloud Key Management Service** Feature **Preview:** Cloud EKM supports external key migration. For keys with the `EXTERNAL` or `EXTERNAL_VPC` protection levels, you can create new key versions with either of these protection levels. You can also change the protection level of existing external key versions to change how you access your existing key material with zero downtime and without reconfiguring your applications. For more information about migrating external keys, see [Migrate external keys](https://docs.cloud.google.com/kms/docs/migrate-external-keys). **Cloud Service Mesh** Announcement **1.30.4-asm.14 is now available for in-cluster Cloud Service Mesh.** For details on upgrading Cloud Service Mesh, see [Upgrade Cloud Service Mesh](https://docs.cloud.google.com/service-mesh/v1.30/docs/upgrade/upgrade.md.txt). Cloud Service Mesh 1.30.4-asm.14 uses Envoy v1.38.5-dev. Announcement **1.30.4-asm.14 is now available for in-cluster Cloud Service Mesh.** For details on upgrading Cloud Service Mesh, see [Upgrade Cloud Service Mesh](https://docs.cloud.google.com/service-mesh/docs/upgrade/upgrade.md.txt). Cloud Service Mesh 1.30.4-asm.14 uses Envoy v1.38.5-dev. Fixed Patch 1.30.4-asm.14 contains the fix for the following platform CVEs: | CVE | Proxy | Control Plane | Distroless | CNI | Severity | |---|---|---|---|---|---| | [CVE-2022-31045](https://nvd.nist.gov/vuln/detail/CVE-2022-31045) | Yes | Yes | Yes | Yes | Medium (9.8) | | [CVE-2026-5450](https://nvd.nist.gov/vuln/detail/CVE-2026-5450) | No | No | Yes | No | Low (9.8) | | [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) | Yes | Yes | Yes | Yes | High (8.7) | | [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) | Yes | Yes | Yes | Yes | High (8.7) | | [CVE-2026-54371](https://nvd.nist.gov/vuln/detail/CVE-2026-54371) | Yes | Yes | No | Yes | Medium (8.4) | | [CVE-2019-14993](https://nvd.nist.gov/vuln/detail/CVE-2019-14993) | Yes | Yes | Yes | Yes | High (7.5) | | [CVE-2021-39155](https://nvd.nist.gov/vuln/detail/CVE-2021-39155) | Yes | Yes | Yes | Yes | High (7.5) | | [CVE-2021-39156](https://nvd.nist.gov/vuln/detail/CVE-2021-39156) | Yes | Yes | Yes | Yes | High (7.5) | | [CVE-2022-23635](https://nvd.nist.gov/vuln/detail/CVE-2022-23635) | Yes | Yes | Yes | Yes | High (7.5) | | [CVE-2026-5928](https://nvd.nist.gov/vuln/detail/CVE-2026-5928) | No | No | Yes | No | Low (7.5) | | [CVE-2026-59847](https://nvd.nist.gov/vuln/detail/CVE-2026-59847) | Yes | Yes | No | Yes | Medium (7.5) | | [CVE-2026-59850](https://nvd.nist.gov/vuln/detail/CVE-2026-59850) | Yes | Yes | No | Yes | Medium (7.5) | | [CVE-2026-59843](https://nvd.nist.gov/vuln/detail/CVE-2026-59843) | Yes | Yes | No | Yes | Medium (6.5) | | [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) | Yes | Yes | Yes | Yes | Medium (6.3) | | [CVE-2026-13757](https://nvd.nist.gov/vuln/detail/CVE-2026-13757) | Yes | Yes | No | Yes | Medium (6.2) | | [CVE-2026-18938](https://nvd.nist.gov/vuln/detail/CVE-2026-18938) | Yes | Yes | No | Yes | Medium (6.2) | | [CVE-2024-2236](https://nvd.nist.gov/vuln/detail/CVE-2024-2236) | Yes | Yes | No | Yes | Low (5.9) | | [CVE-2026-59845](https://nvd.nist.gov/vuln/detail/CVE-2026-59845) | Yes | Yes | No | Yes | Medium (5.9) | | [CVE-2026-27171](https://nvd.nist.gov/vuln/detail/CVE-2026-27171) | Yes | Yes | No | Yes | Low (5.5) | | [CVE-2026-13595](https://nvd.nist.gov/vuln/detail/CVE-2026-13595) | Yes | Yes | No | Yes | Medium (5.3) | | [CVE-2026-59848](https://nvd.nist.gov/vuln/detail/CVE-2026-59848) | Yes | Yes | No | Yes | Medium (5.3) | | [CVE-2025-6141](https://nvd.nist.gov/vuln/detail/CVE-2025-6141) | Yes | Yes | No | Yes | Low (4.8) | | [CVE-2026-27456](https://nvd.nist.gov/vuln/detail/CVE-2026-27456) | Yes | Yes | No | Yes | Medium (4.7) | | [CVE-2025-5278](https://nvd.nist.gov/vuln/detail/CVE-2025-5278) | Yes | Yes | No | Yes | Low (4.4) | | [CVE-2026-59846](https://nvd.nist.gov/vuln/detail/CVE-2026-59846) | Yes | Yes | No | Yes | Medium (3.9) | | [CVE-2026-19499](https://nvd.nist.gov/vuln/detail/CVE-2026-19499) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-19542](https://nvd.nist.gov/vuln/detail/CVE-2026-19542) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-41990](https://nvd.nist.gov/vuln/detail/CVE-2026-41990) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-42250](https://nvd.nist.gov/vuln/detail/CVE-2026-42250) | Yes | Yes | No | Yes | Low (0.0) | | [CVE-2026-53612](https://nvd.nist.gov/vuln/detail/CVE-2026-53612) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-53613](https://nvd.nist.gov/vuln/detail/CVE-2026-53613) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-53614](https://nvd.nist.gov/vuln/detail/CVE-2026-53614) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-53615](https://nvd.nist.gov/vuln/detail/CVE-2026-53615) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-53910](https://nvd.nist.gov/vuln/detail/CVE-2026-53910) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-57062](https://nvd.nist.gov/vuln/detail/CVE-2026-57062) | Yes | Yes | No | Yes | Low (0.0) | | [CVE-2026-6368](https://nvd.nist.gov/vuln/detail/CVE-2026-6368) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-6791](https://nvd.nist.gov/vuln/detail/CVE-2026-6791) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-77117](https://nvd.nist.gov/vuln/detail/CVE-2026-77117) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-80489](https://nvd.nist.gov/vuln/detail/CVE-2026-80489) | Yes | Yes | No | Yes | Medium (0.0) | Fixed Patch 1.30.4-asm.14 contains the fix for the following platform CVEs: | CVE | Proxy | Control Plane | Distroless | CNI | Severity | |---|---|---|---|---|---| | [CVE-2022-31045](https://nvd.nist.gov/vuln/detail/CVE-2022-31045) | Yes | Yes | Yes | Yes | Medium (9.8) | | [CVE-2026-5450](https://nvd.nist.gov/vuln/detail/CVE-2026-5450) | No | No | Yes | No | Low (9.8) | | [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) | Yes | Yes | Yes | Yes | High (8.7) | | [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) | Yes | Yes | Yes | Yes | High (8.7) | | [CVE-2026-54371](https://nvd.nist.gov/vuln/detail/CVE-2026-54371) | Yes | Yes | No | Yes | Medium (8.4) | | [CVE-2019-14993](https://nvd.nist.gov/vuln/detail/CVE-2019-14993) | Yes | Yes | Yes | Yes | High (7.5) | | [CVE-2021-39155](https://nvd.nist.gov/vuln/detail/CVE-2021-39155) | Yes | Yes | Yes | Yes | High (7.5) | | [CVE-2021-39156](https://nvd.nist.gov/vuln/detail/CVE-2021-39156) | Yes | Yes | Yes | Yes | High (7.5) | | [CVE-2022-23635](https://nvd.nist.gov/vuln/detail/CVE-2022-23635) | Yes | Yes | Yes | Yes | High (7.5) | | [CVE-2026-5928](https://nvd.nist.gov/vuln/detail/CVE-2026-5928) | No | No | Yes | No | Low (7.5) | | [CVE-2026-59847](https://nvd.nist.gov/vuln/detail/CVE-2026-59847) | Yes | Yes | No | Yes | Medium (7.5) | | [CVE-2026-59850](https://nvd.nist.gov/vuln/detail/CVE-2026-59850) | Yes | Yes | No | Yes | Medium (7.5) | | [CVE-2026-59843](https://nvd.nist.gov/vuln/detail/CVE-2026-59843) | Yes | Yes | No | Yes | Medium (6.5) | | [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) | Yes | Yes | Yes | Yes | Medium (6.3) | | [CVE-2026-13757](https://nvd.nist.gov/vuln/detail/CVE-2026-13757) | Yes | Yes | No | Yes | Medium (6.2) | | [CVE-2026-18938](https://nvd.nist.gov/vuln/detail/CVE-2026-18938) | Yes | Yes | No | Yes | Medium (6.2) | | [CVE-2024-2236](https://nvd.nist.gov/vuln/detail/CVE-2024-2236) | Yes | Yes | No | Yes | Low (5.9) | | [CVE-2026-59845](https://nvd.nist.gov/vuln/detail/CVE-2026-59845) | Yes | Yes | No | Yes | Medium (5.9) | | [CVE-2026-27171](https://nvd.nist.gov/vuln/detail/CVE-2026-27171) | Yes | Yes | No | Yes | Low (5.5) | | [CVE-2026-13595](https://nvd.nist.gov/vuln/detail/CVE-2026-13595) | Yes | Yes | No | Yes | Medium (5.3) | | [CVE-2026-59848](https://nvd.nist.gov/vuln/detail/CVE-2026-59848) | Yes | Yes | No | Yes | Medium (5.3) | | [CVE-2025-6141](https://nvd.nist.gov/vuln/detail/CVE-2025-6141) | Yes | Yes | No | Yes | Low (4.8) | | [CVE-2026-27456](https://nvd.nist.gov/vuln/detail/CVE-2026-27456) | Yes | Yes | No | Yes | Medium (4.7) | | [CVE-2025-5278](https://nvd.nist.gov/vuln/detail/CVE-2025-5278) | Yes | Yes | No | Yes | Low (4.4) | | [CVE-2026-59846](https://nvd.nist.gov/vuln/detail/CVE-2026-59846) | Yes | Yes | No | Yes | Medium (3.9) | | [CVE-2026-19499](https://nvd.nist.gov/vuln/detail/CVE-2026-19499) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-19542](https://nvd.nist.gov/vuln/detail/CVE-2026-19542) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-41990](https://nvd.nist.gov/vuln/detail/CVE-2026-41990) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-42250](https://nvd.nist.gov/vuln/detail/CVE-2026-42250) | Yes | Yes | No | Yes | Low (0.0) | | [CVE-2026-53612](https://nvd.nist.gov/vuln/detail/CVE-2026-53612) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-53613](https://nvd.nist.gov/vuln/detail/CVE-2026-53613) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-53614](https://nvd.nist.gov/vuln/detail/CVE-2026-53614) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-53615](https://nvd.nist.gov/vuln/detail/CVE-2026-53615) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-53910](https://nvd.nist.gov/vuln/detail/CVE-2026-53910) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-57062](https://nvd.nist.gov/vuln/detail/CVE-2026-57062) | Yes | Yes | No | Yes | Low (0.0) | | [CVE-2026-6368](https://nvd.nist.gov/vuln/detail/CVE-2026-6368) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-6791](https://nvd.nist.gov/vuln/detail/CVE-2026-6791) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-77117](https://nvd.nist.gov/vuln/detail/CVE-2026-77117) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-80489](https://nvd.nist.gov/vuln/detail/CVE-2026-80489) | Yes | Yes | No | Yes | Medium (0.0) | Announcement **1.29.7-asm.18 is now available for in-cluster Cloud Service Mesh.** For details on upgrading Cloud Service Mesh, see [Upgrade Cloud Service Mesh](https://docs.cloud.google.com/service-mesh/v1.30/docs/upgrade/upgrade.md.txt). Cloud Service Mesh 1.29.7-asm.18 uses Envoy v1.37.6. Announcement **1.29.7-asm.18 is now available for in-cluster Cloud Service Mesh.** For details on upgrading Cloud Service Mesh, see [Upgrade Cloud Service Mesh](https://docs.cloud.google.com/service-mesh/docs/upgrade/upgrade.md.txt). Cloud Service Mesh 1.29.7-asm.18 uses Envoy v1.37.6. Fixed Patch 1.29.7-asm.18 contains the fix for the following platform CVEs: | CVE | Proxy | Control Plane | Distroless | CNI | Severity | |---|---|---|---|---|---| | [CVE-2022-31045](https://nvd.nist.gov/vuln/detail/CVE-2022-31045) | No | Yes | Yes | Yes | Medium (9.8) | | [CVE-2026-11856](https://nvd.nist.gov/vuln/detail/CVE-2026-11856) | No | Yes | No | Yes | Medium (9.8) | | [CVE-2026-5450](https://nvd.nist.gov/vuln/detail/CVE-2026-5450) | No | No | Yes | No | Low (9.8) | | [CVE-2026-57433](https://nvd.nist.gov/vuln/detail/CVE-2026-57433) | No | Yes | No | Yes | Medium (9.8) | | [CVE-2026-12087](https://nvd.nist.gov/vuln/detail/CVE-2026-12087) | No | Yes | No | Yes | Medium (9.1) | | [CVE-2026-13221](https://nvd.nist.gov/vuln/detail/CVE-2026-13221) | No | Yes | No | Yes | Medium (9.1) | | [CVE-2026-75803](https://nvd.nist.gov/vuln/detail/CVE-2026-75803) | No | Yes | No | Yes | Low (9.1) | | [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) | No | Yes | Yes | Yes | High (8.7) | | [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) | No | Yes | Yes | Yes | High (8.7) | | [CVE-2026-54371](https://nvd.nist.gov/vuln/detail/CVE-2026-54371) | No | Yes | No | Yes | Medium (8.4) | | [CVE-2026-57432](https://nvd.nist.gov/vuln/detail/CVE-2026-57432) | No | Yes | No | Yes | Medium (8.4) | | [CVE-2019-14993](https://nvd.nist.gov/vuln/detail/CVE-2019-14993) | No | Yes | Yes | Yes | High (7.5) | | [CVE-2021-39155](https://nvd.nist.gov/vuln/detail/CVE-2021-39155) | No | Yes | Yes | Yes | High (7.5) | | [CVE-2021-39156](https://nvd.nist.gov/vuln/detail/CVE-2021-39156) | No | Yes | Yes | Yes | High (7.5) | | [CVE-2022-23635](https://nvd.nist.gov/vuln/detail/CVE-2022-23635) | No | Yes | Yes | Yes | High (7.5) | | [CVE-2026-42151](https://nvd.nist.gov/vuln/detail/CVE-2026-42151) | No | Yes | No | No | High (7.5) | | [CVE-2026-42154](https://nvd.nist.gov/vuln/detail/CVE-2026-42154) | No | Yes | No | No | High (7.5) | | [CVE-2026-48959](https://nvd.nist.gov/vuln/detail/CVE-2026-48959) | No | Yes | No | Yes | Medium (7.5) | | [CVE-2026-54874](https://nvd.nist.gov/vuln/detail/CVE-2026-54874) | No | Yes | No | Yes | Low (7.5) | | [CVE-2026-5928](https://nvd.nist.gov/vuln/detail/CVE-2026-5928) | No | No | Yes | No | Low (7.5) | | [CVE-2026-59847](https://nvd.nist.gov/vuln/detail/CVE-2026-59847) | No | Yes | No | Yes | Medium (7.5) | | [CVE-2026-59850](https://nvd.nist.gov/vuln/detail/CVE-2026-59850) | No | Yes | No | Yes | Medium (7.5) | | [CVE-2026-63072](https://nvd.nist.gov/vuln/detail/CVE-2026-63072) | No | Yes | No | Yes | Medium (7.5) | | [CVE-2026-63076](https://nvd.nist.gov/vuln/detail/CVE-2026-63076) | No | Yes | No | Yes | Medium (7.5) | | [CVE-2026-8932](https://nvd.nist.gov/vuln/detail/CVE-2026-8932) | No | Yes | No | Yes | Low (7.5) | | [CVE-2026-9538](https://nvd.nist.gov/vuln/detail/CVE-2026-9538) | No | Yes | No | Yes | Medium (7.5) | | [CVE-2026-48962](https://nvd.nist.gov/vuln/detail/CVE-2026-48962) | No | Yes | No | Yes | Medium (7.3) | | [CVE-2026-7017](https://nvd.nist.gov/vuln/detail/CVE-2026-7017) | No | Yes | No | Yes | Medium (7.1) | | [CVE-2026-59843](https://nvd.nist.gov/vuln/detail/CVE-2026-59843) | No | Yes | No | Yes | Medium (6.5) | | [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) | No | Yes | Yes | Yes | Medium (6.3) | | [CVE-2026-13757](https://nvd.nist.gov/vuln/detail/CVE-2026-13757) | No | Yes | No | Yes | Medium (6.2) | | [CVE-2026-18938](https://nvd.nist.gov/vuln/detail/CVE-2026-18938) | No | Yes | No | Yes | Medium (6.2) | | [CVE-2026-40179](https://nvd.nist.gov/vuln/detail/CVE-2026-40179) | No | Yes | No | No | Medium (6.1) | | [CVE-2026-44903](https://nvd.nist.gov/vuln/detail/CVE-2026-44903) | No | Yes | No | No | Medium (6.1) | | [CVE-2024-2236](https://nvd.nist.gov/vuln/detail/CVE-2024-2236) | No | Yes | No | Yes | Low (5.9) | | [CVE-2026-59845](https://nvd.nist.gov/vuln/detail/CVE-2026-59845) | No | Yes | No | Yes | Medium (5.9) | | [CVE-2026-63074](https://nvd.nist.gov/vuln/detail/CVE-2026-63074) | No | Yes | No | Yes | Low (5.9) | | [CVE-2025-15649](https://nvd.nist.gov/vuln/detail/CVE-2025-15649) | No | Yes | No | Yes | Medium (5.5) | | [CVE-2026-27171](https://nvd.nist.gov/vuln/detail/CVE-2026-27171) | No | Yes | No | Yes | Low (5.5) | | [CVE-2026-13595](https://nvd.nist.gov/vuln/detail/CVE-2026-13595) | No | Yes | No | Yes | Medium (5.3) | | [CVE-2026-59848](https://nvd.nist.gov/vuln/detail/CVE-2026-59848) | No | Yes | No | Yes | Medium (5.3) | | [CVE-2025-6141](https://nvd.nist.gov/vuln/detail/CVE-2025-6141) | No | Yes | No | Yes | Low (4.8) | | [CVE-2026-27456](https://nvd.nist.gov/vuln/detail/CVE-2026-27456) | No | Yes | No | Yes | Medium (4.7) | | [CVE-2025-5278](https://nvd.nist.gov/vuln/detail/CVE-2025-5278) | No | Yes | No | Yes | Low (4.4) | | [CVE-2026-59846](https://nvd.nist.gov/vuln/detail/CVE-2026-59846) | No | Yes | No | Yes | Medium (3.9) | | [CVE-2026-19499](https://nvd.nist.gov/vuln/detail/CVE-2026-19499) | No | Yes | No | Yes | Medium (0.0) | | [CVE-2026-19542](https://nvd.nist.gov/vuln/detail/CVE-2026-19542) | No | Yes | No | Yes | Medium (0.0) | | [CVE-2026-41990](https://nvd.nist.gov/vuln/detail/CVE-2026-41990) | No | Yes | No | Yes | Medium (0.0) | | [CVE-2026-42250](https://nvd.nist.gov/vuln/detail/CVE-2026-42250) | No | Yes | No | Yes | Low (0.0) | | [CVE-2026-53612](https://nvd.nist.gov/vuln/detail/CVE-2026-53612) | No | Yes | No | Yes | Medium (0.0) | | [CVE-2026-53613](https://nvd.nist.gov/vuln/detail/CVE-2026-53613) | No | Yes | No | Yes | Medium (0.0) | | [CVE-2026-53614](https://nvd.nist.gov/vuln/detail/CVE-2026-53614) | No | Yes | No | Yes | Medium (0.0) | | [CVE-2026-53615](https://nvd.nist.gov/vuln/detail/CVE-2026-53615) | No | Yes | No | Yes | Medium (0.0) | | [CVE-2026-53910](https://nvd.nist.gov/vuln/detail/CVE-2026-53910) | No | Yes | No | Yes | Medium (0.0) | | [CVE-2026-57062](https://nvd.nist.gov/vuln/detail/CVE-2026-57062) | No | Yes | No | Yes | Low (0.0) | | [CVE-2026-6368](https://nvd.nist.gov/vuln/detail/CVE-2026-6368) | No | Yes | No | Yes | Medium (0.0) | | [CVE-2026-6791](https://nvd.nist.gov/vuln/detail/CVE-2026-6791) | No | Yes | No | Yes | Medium (0.0) | | [CVE-2026-77117](https://nvd.nist.gov/vuln/detail/CVE-2026-77117) | No | Yes | No | Yes | Medium (0.0) | | [CVE-2026-80489](https://nvd.nist.gov/vuln/detail/CVE-2026-80489) | No | Yes | No | Yes | Medium (0.0) | Fixed Patch 1.29.7-asm.18 contains the fix for the following platform CVEs: | CVE | Proxy | Control Plane | Distroless | CNI | Severity | |---|---|---|---|---|---| | [CVE-2022-31045](https://nvd.nist.gov/vuln/detail/CVE-2022-31045) | No | Yes | Yes | Yes | Medium (9.8) | | [CVE-2026-11856](https://nvd.nist.gov/vuln/detail/CVE-2026-11856) | No | Yes | No | Yes | Medium (9.8) | | [CVE-2026-5450](https://nvd.nist.gov/vuln/detail/CVE-2026-5450) | No | No | Yes | No | Low (9.8) | | [CVE-2026-57433](https://nvd.nist.gov/vuln/detail/CVE-2026-57433) | No | Yes | No | Yes | Medium (9.8) | | [CVE-2026-12087](https://nvd.nist.gov/vuln/detail/CVE-2026-12087) | No | Yes | No | Yes | Medium (9.1) | | [CVE-2026-13221](https://nvd.nist.gov/vuln/detail/CVE-2026-13221) | No | Yes | No | Yes | Medium (9.1) | | [CVE-2026-75803](https://nvd.nist.gov/vuln/detail/CVE-2026-75803) | No | Yes | No | Yes | Low (9.1) | | [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) | No | Yes | Yes | Yes | High (8.7) | | [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) | No | Yes | Yes | Yes | High (8.7) | | [CVE-2026-54371](https://nvd.nist.gov/vuln/detail/CVE-2026-54371) | No | Yes | No | Yes | Medium (8.4) | | [CVE-2026-57432](https://nvd.nist.gov/vuln/detail/CVE-2026-57432) | No | Yes | No | Yes | Medium (8.4) | | [CVE-2019-14993](https://nvd.nist.gov/vuln/detail/CVE-2019-14993) | No | Yes | Yes | Yes | High (7.5) | | [CVE-2021-39155](https://nvd.nist.gov/vuln/detail/CVE-2021-39155) | No | Yes | Yes | Yes | High (7.5) | | [CVE-2021-39156](https://nvd.nist.gov/vuln/detail/CVE-2021-39156) | No | Yes | Yes | Yes | High (7.5) | | [CVE-2022-23635](https://nvd.nist.gov/vuln/detail/CVE-2022-23635) | No | Yes | Yes | Yes | High (7.5) | | [CVE-2026-42151](https://nvd.nist.gov/vuln/detail/CVE-2026-42151) | No | Yes | No | No | High (7.5) | | [CVE-2026-42154](https://nvd.nist.gov/vuln/detail/CVE-2026-42154) | No | Yes | No | No | High (7.5) | | [CVE-2026-48959](https://nvd.nist.gov/vuln/detail/CVE-2026-48959) | No | Yes | No | Yes | Medium (7.5) | | [CVE-2026-54874](https://nvd.nist.gov/vuln/detail/CVE-2026-54874) | No | Yes | No | Yes | Low (7.5) | | [CVE-2026-5928](https://nvd.nist.gov/vuln/detail/CVE-2026-5928) | No | No | Yes | No | Low (7.5) | | [CVE-2026-59847](https://nvd.nist.gov/vuln/detail/CVE-2026-59847) | No | Yes | No | Yes | Medium (7.5) | | [CVE-2026-59850](https://nvd.nist.gov/vuln/detail/CVE-2026-59850) | No | Yes | No | Yes | Medium (7.5) | | [CVE-2026-63072](https://nvd.nist.gov/vuln/detail/CVE-2026-63072) | No | Yes | No | Yes | Medium (7.5) | | [CVE-2026-63076](https://nvd.nist.gov/vuln/detail/CVE-2026-63076) | No | Yes | No | Yes | Medium (7.5) | | [CVE-2026-8932](https://nvd.nist.gov/vuln/detail/CVE-2026-8932) | No | Yes | No | Yes | Low (7.5) | | [CVE-2026-9538](https://nvd.nist.gov/vuln/detail/CVE-2026-9538) | No | Yes | No | Yes | Medium (7.5) | | [CVE-2026-48962](https://nvd.nist.gov/vuln/detail/CVE-2026-48962) | No | Yes | No | Yes | Medium (7.3) | | [CVE-2026-7017](https://nvd.nist.gov/vuln/detail/CVE-2026-7017) | No | Yes | No | Yes | Medium (7.1) | | [CVE-2026-59843](https://nvd.nist.gov/vuln/detail/CVE-2026-59843) | No | Yes | No | Yes | Medium (6.5) | | [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) | No | Yes | Yes | Yes | Medium (6.3) | | [CVE-2026-13757](https://nvd.nist.gov/vuln/detail/CVE-2026-13757) | No | Yes | No | Yes | Medium (6.2) | | [CVE-2026-18938](https://nvd.nist.gov/vuln/detail/CVE-2026-18938) | No | Yes | No | Yes | Medium (6.2) | | [CVE-2026-40179](https://nvd.nist.gov/vuln/detail/CVE-2026-40179) | No | Yes | No | No | Medium (6.1) | | [CVE-2026-44903](https://nvd.nist.gov/vuln/detail/CVE-2026-44903) | No | Yes | No | No | Medium (6.1) | | [CVE-2024-2236](https://nvd.nist.gov/vuln/detail/CVE-2024-2236) | No | Yes | No | Yes | Low (5.9) | | [CVE-2026-59845](https://nvd.nist.gov/vuln/detail/CVE-2026-59845) | No | Yes | No | Yes | Medium (5.9) | | [CVE-2026-63074](https://nvd.nist.gov/vuln/detail/CVE-2026-63074) | No | Yes | No | Yes | Low (5.9) | | [CVE-2025-15649](https://nvd.nist.gov/vuln/detail/CVE-2025-15649) | No | Yes | No | Yes | Medium (5.5) | | [CVE-2026-27171](https://nvd.nist.gov/vuln/detail/CVE-2026-27171) | No | Yes | No | Yes | Low (5.5) | | [CVE-2026-13595](https://nvd.nist.gov/vuln/detail/CVE-2026-13595) | No | Yes | No | Yes | Medium (5.3) | | [CVE-2026-59848](https://nvd.nist.gov/vuln/detail/CVE-2026-59848) | No | Yes | No | Yes | Medium (5.3) | | [CVE-2025-6141](https://nvd.nist.gov/vuln/detail/CVE-2025-6141) | No | Yes | No | Yes | Low (4.8) | | [CVE-2026-27456](https://nvd.nist.gov/vuln/detail/CVE-2026-27456) | No | Yes | No | Yes | Medium (4.7) | | [CVE-2025-5278](https://nvd.nist.gov/vuln/detail/CVE-2025-5278) | No | Yes | No | Yes | Low (4.4) | | [CVE-2026-59846](https://nvd.nist.gov/vuln/detail/CVE-2026-59846) | No | Yes | No | Yes | Medium (3.9) | | [CVE-2026-19499](https://nvd.nist.gov/vuln/detail/CVE-2026-19499) | No | Yes | No | Yes | Medium (0.0) | | [CVE-2026-19542](https://nvd.nist.gov/vuln/detail/CVE-2026-19542) | No | Yes | No | Yes | Medium (0.0) | | [CVE-2026-41990](https://nvd.nist.gov/vuln/detail/CVE-2026-41990) | No | Yes | No | Yes | Medium (0.0) | | [CVE-2026-42250](https://nvd.nist.gov/vuln/detail/CVE-2026-42250) | No | Yes | No | Yes | Low (0.0) | | [CVE-2026-53612](https://nvd.nist.gov/vuln/detail/CVE-2026-53612) | No | Yes | No | Yes | Medium (0.0) | | [CVE-2026-53613](https://nvd.nist.gov/vuln/detail/CVE-2026-53613) | No | Yes | No | Yes | Medium (0.0) | | [CVE-2026-53614](https://nvd.nist.gov/vuln/detail/CVE-2026-53614) | No | Yes | No | Yes | Medium (0.0) | | [CVE-2026-53615](https://nvd.nist.gov/vuln/detail/CVE-2026-53615) | No | Yes | No | Yes | Medium (0.0) | | [CVE-2026-53910](https://nvd.nist.gov/vuln/detail/CVE-2026-53910) | No | Yes | No | Yes | Medium (0.0) | | [CVE-2026-57062](https://nvd.nist.gov/vuln/detail/CVE-2026-57062) | No | Yes | No | Yes | Low (0.0) | | [CVE-2026-6368](https://nvd.nist.gov/vuln/detail/CVE-2026-6368) | No | Yes | No | Yes | Medium (0.0) | | [CVE-2026-6791](https://nvd.nist.gov/vuln/detail/CVE-2026-6791) | No | Yes | No | Yes | Medium (0.0) | | [CVE-2026-77117](https://nvd.nist.gov/vuln/detail/CVE-2026-77117) | No | Yes | No | Yes | Medium (0.0) | | [CVE-2026-80489](https://nvd.nist.gov/vuln/detail/CVE-2026-80489) | No | Yes | No | Yes | Medium (0.0) | Announcement **1.28.10-asm.40 is now available for in-cluster Cloud Service Mesh.** For details on upgrading Cloud Service Mesh, see [Upgrade Cloud Service Mesh](https://docs.cloud.google.com/service-mesh/v1.28/docs/upgrade/upgrade.md.txt). Cloud Service Mesh 1.28.10-asm.40 uses Envoy v1.36.10-dev. Announcement **1.28.10-asm.40 is now available for in-cluster Cloud Service Mesh.** For details on upgrading Cloud Service Mesh, see [Upgrade Cloud Service Mesh](https://docs.cloud.google.com/service-mesh/v1.28/docs/upgrade/upgrade.md.txt). Cloud Service Mesh 1.28.10-asm.40 uses Envoy v1.36.10-dev. Fixed Patch 1.28.10-asm.40 contains the fix for the following platform CVEs: | CVE | Proxy | Control Plane | Distroless | CNI | Severity | |---|---|---|---|---|---| | [CVE-2022-31045](https://nvd.nist.gov/vuln/detail/CVE-2022-31045) | Yes | Yes | Yes | Yes | Medium (9.8) | | [CVE-2026-11856](https://nvd.nist.gov/vuln/detail/CVE-2026-11856) | Yes | Yes | No | Yes | Medium (9.8) | | [CVE-2026-5450](https://nvd.nist.gov/vuln/detail/CVE-2026-5450) | No | No | Yes | No | Low (9.8) | | [CVE-2026-57433](https://nvd.nist.gov/vuln/detail/CVE-2026-57433) | Yes | Yes | No | Yes | Medium (9.8) | | [CVE-2026-12087](https://nvd.nist.gov/vuln/detail/CVE-2026-12087) | Yes | Yes | No | Yes | Medium (9.1) | | [CVE-2026-13221](https://nvd.nist.gov/vuln/detail/CVE-2026-13221) | Yes | Yes | No | Yes | Medium (9.1) | | [CVE-2026-75803](https://nvd.nist.gov/vuln/detail/CVE-2026-75803) | Yes | Yes | No | Yes | Low (9.1) | | [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) | Yes | Yes | Yes | Yes | High (8.7) | | [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) | Yes | Yes | Yes | Yes | High (8.7) | | [CVE-2026-54371](https://nvd.nist.gov/vuln/detail/CVE-2026-54371) | Yes | Yes | No | Yes | Medium (8.4) | | [CVE-2026-57432](https://nvd.nist.gov/vuln/detail/CVE-2026-57432) | Yes | Yes | No | Yes | Medium (8.4) | | [CVE-2019-14993](https://nvd.nist.gov/vuln/detail/CVE-2019-14993) | Yes | Yes | Yes | Yes | High (7.5) | | [CVE-2021-39155](https://nvd.nist.gov/vuln/detail/CVE-2021-39155) | Yes | Yes | Yes | Yes | High (7.5) | | [CVE-2021-39156](https://nvd.nist.gov/vuln/detail/CVE-2021-39156) | Yes | Yes | Yes | Yes | High (7.5) | | [CVE-2022-23635](https://nvd.nist.gov/vuln/detail/CVE-2022-23635) | Yes | Yes | Yes | Yes | High (7.5) | | [CVE-2026-42151](https://nvd.nist.gov/vuln/detail/CVE-2026-42151) | No | Yes | No | No | High (7.5) | | [CVE-2026-42154](https://nvd.nist.gov/vuln/detail/CVE-2026-42154) | No | Yes | No | No | High (7.5) | | [CVE-2026-48959](https://nvd.nist.gov/vuln/detail/CVE-2026-48959) | Yes | Yes | No | Yes | Medium (7.5) | | [CVE-2026-54874](https://nvd.nist.gov/vuln/detail/CVE-2026-54874) | Yes | Yes | No | Yes | Low (7.5) | | [CVE-2026-5928](https://nvd.nist.gov/vuln/detail/CVE-2026-5928) | No | No | Yes | No | Low (7.5) | | [CVE-2026-59847](https://nvd.nist.gov/vuln/detail/CVE-2026-59847) | Yes | Yes | No | Yes | Medium (7.5) | | [CVE-2026-59850](https://nvd.nist.gov/vuln/detail/CVE-2026-59850) | Yes | Yes | No | Yes | Medium (7.5) | | [CVE-2026-63072](https://nvd.nist.gov/vuln/detail/CVE-2026-63072) | Yes | Yes | No | Yes | Medium (7.5) | | [CVE-2026-63076](https://nvd.nist.gov/vuln/detail/CVE-2026-63076) | Yes | Yes | No | Yes | Medium (7.5) | | [CVE-2026-8932](https://nvd.nist.gov/vuln/detail/CVE-2026-8932) | Yes | Yes | No | Yes | Low (7.5) | | [CVE-2026-9538](https://nvd.nist.gov/vuln/detail/CVE-2026-9538) | Yes | Yes | No | Yes | Medium (7.5) | | [CVE-2026-48962](https://nvd.nist.gov/vuln/detail/CVE-2026-48962) | Yes | Yes | No | Yes | Medium (7.3) | | [CVE-2026-7017](https://nvd.nist.gov/vuln/detail/CVE-2026-7017) | Yes | Yes | No | Yes | Medium (7.1) | | [CVE-2026-59843](https://nvd.nist.gov/vuln/detail/CVE-2026-59843) | Yes | Yes | No | Yes | Medium (6.5) | | [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) | Yes | Yes | Yes | Yes | Medium (6.3) | | [CVE-2026-13757](https://nvd.nist.gov/vuln/detail/CVE-2026-13757) | Yes | Yes | No | Yes | Medium (6.2) | | [CVE-2026-18938](https://nvd.nist.gov/vuln/detail/CVE-2026-18938) | Yes | Yes | No | Yes | Medium (6.2) | | [CVE-2026-40179](https://nvd.nist.gov/vuln/detail/CVE-2026-40179) | No | Yes | No | No | Medium (6.1) | | [CVE-2026-44903](https://nvd.nist.gov/vuln/detail/CVE-2026-44903) | No | Yes | No | No | Medium (6.1) | | [CVE-2024-2236](https://nvd.nist.gov/vuln/detail/CVE-2024-2236) | Yes | Yes | No | Yes | Low (5.9) | | [CVE-2026-59845](https://nvd.nist.gov/vuln/detail/CVE-2026-59845) | Yes | Yes | No | Yes | Medium (5.9) | | [CVE-2026-63074](https://nvd.nist.gov/vuln/detail/CVE-2026-63074) | Yes | Yes | No | Yes | Low (5.9) | | [CVE-2025-15649](https://nvd.nist.gov/vuln/detail/CVE-2025-15649) | Yes | Yes | No | Yes | Medium (5.5) | | [CVE-2026-27171](https://nvd.nist.gov/vuln/detail/CVE-2026-27171) | Yes | Yes | No | Yes | Low (5.5) | | [CVE-2026-13595](https://nvd.nist.gov/vuln/detail/CVE-2026-13595) | Yes | Yes | No | Yes | Medium (5.3) | | [CVE-2026-59848](https://nvd.nist.gov/vuln/detail/CVE-2026-59848) | Yes | Yes | No | Yes | Medium (5.3) | | [CVE-2025-6141](https://nvd.nist.gov/vuln/detail/CVE-2025-6141) | Yes | Yes | No | Yes | Low (4.8) | | [CVE-2026-27456](https://nvd.nist.gov/vuln/detail/CVE-2026-27456) | Yes | Yes | No | Yes | Medium (4.7) | | [CVE-2025-5278](https://nvd.nist.gov/vuln/detail/CVE-2025-5278) | Yes | Yes | No | Yes | Low (4.4) | | [CVE-2026-59846](https://nvd.nist.gov/vuln/detail/CVE-2026-59846) | Yes | Yes | No | Yes | Medium (3.9) | | [CVE-2026-19499](https://nvd.nist.gov/vuln/detail/CVE-2026-19499) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-19542](https://nvd.nist.gov/vuln/detail/CVE-2026-19542) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-41990](https://nvd.nist.gov/vuln/detail/CVE-2026-41990) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-42250](https://nvd.nist.gov/vuln/detail/CVE-2026-42250) | Yes | Yes | No | Yes | Low (0.0) | | [CVE-2026-53612](https://nvd.nist.gov/vuln/detail/CVE-2026-53612) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-53613](https://nvd.nist.gov/vuln/detail/CVE-2026-53613) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-53614](https://nvd.nist.gov/vuln/detail/CVE-2026-53614) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-53615](https://nvd.nist.gov/vuln/detail/CVE-2026-53615) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-53910](https://nvd.nist.gov/vuln/detail/CVE-2026-53910) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-57062](https://nvd.nist.gov/vuln/detail/CVE-2026-57062) | Yes | Yes | No | Yes | Low (0.0) | | [CVE-2026-6368](https://nvd.nist.gov/vuln/detail/CVE-2026-6368) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-6791](https://nvd.nist.gov/vuln/detail/CVE-2026-6791) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-77117](https://nvd.nist.gov/vuln/detail/CVE-2026-77117) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-80489](https://nvd.nist.gov/vuln/detail/CVE-2026-80489) | Yes | Yes | No | Yes | Medium (0.0) | | [GHSA-gcjh-h69q-9w9g](https://github.com/advisories/GHSA-gcjh-h69q-9w9g) | No | Yes | No | No | Medium (0.0) | Fixed Patch 1.28.10-asm.40 contains the fix for the following platform CVEs: | CVE | Proxy | Control Plane | Distroless | CNI | Severity | |---|---|---|---|---|---| | [CVE-2022-31045](https://nvd.nist.gov/vuln/detail/CVE-2022-31045) | Yes | Yes | Yes | Yes | Medium (9.8) | | [CVE-2026-11856](https://nvd.nist.gov/vuln/detail/CVE-2026-11856) | Yes | Yes | No | Yes | Medium (9.8) | | [CVE-2026-5450](https://nvd.nist.gov/vuln/detail/CVE-2026-5450) | No | No | Yes | No | Low (9.8) | | [CVE-2026-57433](https://nvd.nist.gov/vuln/detail/CVE-2026-57433) | Yes | Yes | No | Yes | Medium (9.8) | | [CVE-2026-12087](https://nvd.nist.gov/vuln/detail/CVE-2026-12087) | Yes | Yes | No | Yes | Medium (9.1) | | [CVE-2026-13221](https://nvd.nist.gov/vuln/detail/CVE-2026-13221) | Yes | Yes | No | Yes | Medium (9.1) | | [CVE-2026-75803](https://nvd.nist.gov/vuln/detail/CVE-2026-75803) | Yes | Yes | No | Yes | Low (9.1) | | [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) | Yes | Yes | Yes | Yes | High (8.7) | | [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) | Yes | Yes | Yes | Yes | High (8.7) | | [CVE-2026-54371](https://nvd.nist.gov/vuln/detail/CVE-2026-54371) | Yes | Yes | No | Yes | Medium (8.4) | | [CVE-2026-57432](https://nvd.nist.gov/vuln/detail/CVE-2026-57432) | Yes | Yes | No | Yes | Medium (8.4) | | [CVE-2019-14993](https://nvd.nist.gov/vuln/detail/CVE-2019-14993) | Yes | Yes | Yes | Yes | High (7.5) | | [CVE-2021-39155](https://nvd.nist.gov/vuln/detail/CVE-2021-39155) | Yes | Yes | Yes | Yes | High (7.5) | | [CVE-2021-39156](https://nvd.nist.gov/vuln/detail/CVE-2021-39156) | Yes | Yes | Yes | Yes | High (7.5) | | [CVE-2022-23635](https://nvd.nist.gov/vuln/detail/CVE-2022-23635) | Yes | Yes | Yes | Yes | High (7.5) | | [CVE-2026-42151](https://nvd.nist.gov/vuln/detail/CVE-2026-42151) | No | Yes | No | No | High (7.5) | | [CVE-2026-42154](https://nvd.nist.gov/vuln/detail/CVE-2026-42154) | No | Yes | No | No | High (7.5) | | [CVE-2026-48959](https://nvd.nist.gov/vuln/detail/CVE-2026-48959) | Yes | Yes | No | Yes | Medium (7.5) | | [CVE-2026-54874](https://nvd.nist.gov/vuln/detail/CVE-2026-54874) | Yes | Yes | No | Yes | Low (7.5) | | [CVE-2026-5928](https://nvd.nist.gov/vuln/detail/CVE-2026-5928) | No | No | Yes | No | Low (7.5) | | [CVE-2026-59847](https://nvd.nist.gov/vuln/detail/CVE-2026-59847) | Yes | Yes | No | Yes | Medium (7.5) | | [CVE-2026-59850](https://nvd.nist.gov/vuln/detail/CVE-2026-59850) | Yes | Yes | No | Yes | Medium (7.5) | | [CVE-2026-63072](https://nvd.nist.gov/vuln/detail/CVE-2026-63072) | Yes | Yes | No | Yes | Medium (7.5) | | [CVE-2026-63076](https://nvd.nist.gov/vuln/detail/CVE-2026-63076) | Yes | Yes | No | Yes | Medium (7.5) | | [CVE-2026-8932](https://nvd.nist.gov/vuln/detail/CVE-2026-8932) | Yes | Yes | No | Yes | Low (7.5) | | [CVE-2026-9538](https://nvd.nist.gov/vuln/detail/CVE-2026-9538) | Yes | Yes | No | Yes | Medium (7.5) | | [CVE-2026-48962](https://nvd.nist.gov/vuln/detail/CVE-2026-48962) | Yes | Yes | No | Yes | Medium (7.3) | | [CVE-2026-7017](https://nvd.nist.gov/vuln/detail/CVE-2026-7017) | Yes | Yes | No | Yes | Medium (7.1) | | [CVE-2026-59843](https://nvd.nist.gov/vuln/detail/CVE-2026-59843) | Yes | Yes | No | Yes | Medium (6.5) | | [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) | Yes | Yes | Yes | Yes | Medium (6.3) | | [CVE-2026-13757](https://nvd.nist.gov/vuln/detail/CVE-2026-13757) | Yes | Yes | No | Yes | Medium (6.2) | | [CVE-2026-18938](https://nvd.nist.gov/vuln/detail/CVE-2026-18938) | Yes | Yes | No | Yes | Medium (6.2) | | [CVE-2026-40179](https://nvd.nist.gov/vuln/detail/CVE-2026-40179) | No | Yes | No | No | Medium (6.1) | | [CVE-2026-44903](https://nvd.nist.gov/vuln/detail/CVE-2026-44903) | No | Yes | No | No | Medium (6.1) | | [CVE-2024-2236](https://nvd.nist.gov/vuln/detail/CVE-2024-2236) | Yes | Yes | No | Yes | Low (5.9) | | [CVE-2026-59845](https://nvd.nist.gov/vuln/detail/CVE-2026-59845) | Yes | Yes | No | Yes | Medium (5.9) | | [CVE-2026-63074](https://nvd.nist.gov/vuln/detail/CVE-2026-63074) | Yes | Yes | No | Yes | Low (5.9) | | [CVE-2025-15649](https://nvd.nist.gov/vuln/detail/CVE-2025-15649) | Yes | Yes | No | Yes | Medium (5.5) | | [CVE-2026-27171](https://nvd.nist.gov/vuln/detail/CVE-2026-27171) | Yes | Yes | No | Yes | Low (5.5) | | [CVE-2026-13595](https://nvd.nist.gov/vuln/detail/CVE-2026-13595) | Yes | Yes | No | Yes | Medium (5.3) | | [CVE-2026-59848](https://nvd.nist.gov/vuln/detail/CVE-2026-59848) | Yes | Yes | No | Yes | Medium (5.3) | | [CVE-2025-6141](https://nvd.nist.gov/vuln/detail/CVE-2025-6141) | Yes | Yes | No | Yes | Low (4.8) | | [CVE-2026-27456](https://nvd.nist.gov/vuln/detail/CVE-2026-27456) | Yes | Yes | No | Yes | Medium (4.7) | | [CVE-2025-5278](https://nvd.nist.gov/vuln/detail/CVE-2025-5278) | Yes | Yes | No | Yes | Low (4.4) | | [CVE-2026-59846](https://nvd.nist.gov/vuln/detail/CVE-2026-59846) | Yes | Yes | No | Yes | Medium (3.9) | | [CVE-2026-19499](https://nvd.nist.gov/vuln/detail/CVE-2026-19499) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-19542](https://nvd.nist.gov/vuln/detail/CVE-2026-19542) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-41990](https://nvd.nist.gov/vuln/detail/CVE-2026-41990) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-42250](https://nvd.nist.gov/vuln/detail/CVE-2026-42250) | Yes | Yes | No | Yes | Low (0.0) | | [CVE-2026-53612](https://nvd.nist.gov/vuln/detail/CVE-2026-53612) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-53613](https://nvd.nist.gov/vuln/detail/CVE-2026-53613) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-53614](https://nvd.nist.gov/vuln/detail/CVE-2026-53614) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-53615](https://nvd.nist.gov/vuln/detail/CVE-2026-53615) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-53910](https://nvd.nist.gov/vuln/detail/CVE-2026-53910) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-57062](https://nvd.nist.gov/vuln/detail/CVE-2026-57062) | Yes | Yes | No | Yes | Low (0.0) | | [CVE-2026-6368](https://nvd.nist.gov/vuln/detail/CVE-2026-6368) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-6791](https://nvd.nist.gov/vuln/detail/CVE-2026-6791) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-77117](https://nvd.nist.gov/vuln/detail/CVE-2026-77117) | Yes | Yes | No | Yes | Medium (0.0) | | [CVE-2026-80489](https://nvd.nist.gov/vuln/detail/CVE-2026-80489) | Yes | Yes | No | Yes | Medium (0.0) | | [GHSA-gcjh-h69q-9w9g](https://github.com/advisories/GHSA-gcjh-h69q-9w9g) | No | Yes | No | No | Medium (0.0) | **Cloud Trace** Feature The Google Cloud CLI version 586.0.0 includes the following changes: - Added `create` and `update` methods to the `gcloud observability buckets` command group. - Promoted the `gcloud observability` commands from `BETA` to `GA`. For more information, see the [`gcloud observability`](https://docs.cloud.google.com/sdk/gcloud/reference/observability) reference pages. For example usage, see the guides that describe how to configure and manage observability buckets: - [Create observability buckets](https://docs.cloud.google.com/stackdriver/docs/observability/create-observability-buckets.md.txt) - [Update observability buckets](https://docs.cloud.google.com/stackdriver/docs/observability/update-observability-buckets.md.txt) - [List buckets and manage datasets](https://docs.cloud.google.com/stackdriver/docs/observability/storage-manage.md.txt) **Cloud Workstations** Feature [Regional endpoints](https://docs.cloud.google.com/vpc/docs/regional-service-endpoints.md.txt#cloud-workstations) (`workstations.REGION.rep.googleapis.com`) are generally available (GA) for Cloud Workstations. Regional endpoints help you meet data residency requirements by routing and terminating HTTPS connections to the Cloud Workstations API within a specific region, keeping data in transit within your chosen regional boundary. Regional endpoints for Cloud Workstations are available in the following [regions](https://docs.cloud.google.com/workstations/docs/locations.md.txt): - `asia-south1` (Mumbai, India, APAC) - `europe-west6` (Zurich, Switzerland, Europe) - `us-central1` (Council Bluffs, Iowa, North America) - `us-east1` (Moncks Corner, South Carolina, North America) - `us-east4` (Ashburn, Virginia, North America) - `us-east5` (Columbus, Ohio, North America) - `us-west1` (The Dalles, Oregon, North America) - `us-west4` (Las Vegas, Nevada, North America) You can also use the Google Cloud CLI `gcloud workstations` command group to configure regional endpoints. For more information, see [Regional service endpoints](https://docs.cloud.google.com/vpc/docs/regional-service-endpoints.md.txt#cloud-workstations) and the [Cloud Workstations REST API reference](https://docs.cloud.google.com/workstations/docs/reference/rest.md.txt). **Confidential VM** Feature Support for [Intel TDX on `c4-standard-*` machine types](https://docs.cloud.google.com/confidential-computing/confidential-vm/docs/supported-configurations.md.txt#machine-type-cpu-zone) is generally available ([GA](https://cloud.google.com/products#product-launch-stages)). **Config Connector** Announcement Config Connector version 1.157.0 is now available. Feature New Alpha Resources (Direct Reconciler): - `AIPlatformModel` - Manage [Vertex AI models](https://cloud.google.com/vertex-ai/docs/model-registry/introduction). - `APIHubExternalAPI` - Manage [API Hub external APIs](https://cloud.google.com/apigee/docs/reference/apis/apihub/rest/v1/projects.locations.externalApis). - `NotebookInstanceV2` - Manage [Agent Platform Workbench instance](https://docs.cloud.google.com/gemini-enterprise-agent-platform/notebooks/workbench/reference/rest/v2/projects.locations.instances.md.txt). - `RedisClusterEndpoint` - Manage [Memorystore for Redis Cluster endpoints](https://cloud.google.com/memorystore/docs/cluster/reference/rest/v1/projects.locations.clusters#ClusterEndpoint). Feature New Fields: - `NetworkServicesEdgeCacheService` - Added `routeMethods` and `compressionMode` support. Fixed Bug Fixes: - [`NetworkConnectivityInternalRange`](https://github.com/GoogleCloudPlatform/k8s-config-connector/pull/12615) - Fixed continuous reconciliation loop and 400 error on `NetworkConnectivityInternalRange` when auto-allocation fields are set. Change Other: - **BeyondCorpClientGateway**: Removed support for the deprecated BeyondCorp Enterprise client connector. **Gemini Enterprise** Feature **Gemini Enterprise: Gemini 3.8 Flash enabled by default** Gemini 3.8 Flash is generally available (GA) and enabled by default in the Gemini Enterprise app in the `global`, `us`, and `eu` regions. Gemini Enterprise administrators can use the **Gemini 3.8 Flash** toggle in feature management to turn off the model for their users, or turn it on for unsupported in-country regions by confirming the warning dialog to route traffic to the `global` endpoint. For more information, see: - [Manage web app features](https://docs.cloud.google.com/gemini/enterprise/docs/manage-web-app-features.md.txt) - [Data residency for Gemini Enterprise Standard and Plus Editions and Gemini Notebook Enterprise](https://docs.cloud.google.com/gemini/enterprise/docs/locations) **Google Cloud Contact Center as a Service** Announcement **Google Cloud CCaaS 6.15** We've released version 6.15 of Google Cloud CCaaS. The timing of the update to your instance depends on the deployment schedule that you have chosen. For more information, see [Deployment schedules](https://docs.cloud.google.com/contact-center/ccai-platform/docs/deployment-schedules). Feature **Remove a user from all teams at once** Using the new **Remove from all teams** button, you can remove a user from all of the teams that they belong to. Administrators: There's a new **Remove from all teams** button in the **Teams** section of the **Edit User** dialog. For more information, see [Remove a user from teams](https://docs.cloud.google.com/contact-center/ccai-platform/docs/add-edit-user#remove-user-from-teams). Fixed This release addresses the following issues: - Fixed an issue that led to increased startup latency and errors for mobile and web chat sessions. - Fixed an issue where agents were incorrectly demoted to an **Unresponsive** status and removed from the routing pool despite successfully receiving call offers. - Fixed an issue where dialed numbers on Twilio BYOC SIP inbound calls were incorrectly formatted with extra digits from the SIP host and port. - Fixed an issue that prevented chat transcripts from being generated and delivered for sessions containing structured message content. - Fixed an issue where the call adapter incorrectly showed a call as on hold after a carrier failed to process the hold request, leaving the audio channel open between the agent and the customer. - Fixed an issue where a failed media download caused the service to restart unexpectedly. - Fixed an issue that caused queue-specific wrap-up and disposition settings to reset to global defaults after changing unrelated fields on the **Queue Settings** page. - Fixed an issue where machine translation didn't activate for chats that were transferred into a non-English language queue if the session originated with a virtual agent. - Fixed an issue where generative knowledge assist answers that contain long URLs were cut off at the edge of the panel. - Fixed an issue where queued calls were neither routed to available agents nor offered a callback. - Fixed an issue where voicemails were automatically dismissed and marked as read if a playback error occurred. - Fixed an issue where agent call recordings were missing or attached to the wrong call record after a virtual agent deflection. - Fixed an issue where unanswered DCR calls that were routed using Nexmo disconnected the caller instead of requeuing the call. - Fixed an issue that prevented virtual agents from transferring calls to a human-agent queue. - Fixed an issue where calls lacking a carrier hangup reason were incorrectly categorized as "customer abandoned", even when the call center didn't answer the call. - Fixed an issue where the call event API payload for DCR calls contained incorrect virtual agent parameters. - Fixed an issue where custom data from chat interactions wasn't recorded in Salesforce records. - Fixed an issue where Mexico time zones were incorrectly applying daylight saving time adjustments. - Fixed an issue where agents and end-users were joined to separate conferences, preventing audio communication between them. - Fixed an issue where call recording deletion tasks entered an endless loop if the provider didn't return a successful response. - Fixed an issue where IVR voice calls didn't send custom wrap-up events to Dialogflow CX under certain configurations. - Fixed an issue where a trailing slash in the host URL caused the web SDK to unexpectedly re-enable features that had been previously disabled for specific deployments. **Google Distributed Cloud (software only) for VMware** Announcement Google Distributed Cloud (software only) for VMware 1.35.500-gke.142 is available for download. To upgrade, see [Upgrade clusters](https://docs.cloud.google.com/kubernetes-engine/distributed-cloud/vmware/docs/how-to/upgrading.md.txt). Google Distributed Cloud 1.35.500-gke.142 runs on Kubernetes v1.35.8-gke.100. If you use a third-party storage vendor, check the listing of our previously-qualified [storage partners](https://docs.cloud.google.com/kubernetes-engine/enterprise/docs/resources/partner-storage.md.txt). After a release, it takes approximately 7 to 14 days for the version to become available for use with GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform. Fixed The following issues were fixed in 1.35.500-gke.142: - Fixed vulnerabilities listed in [Vulnerability fixes](https://docs.cloud.google.com/kubernetes-engine/distributed-cloud/vmware/docs/vulnerabilities.md.txt). - Fixed a reconciliation loop issue in `metrics-server` by checking the ConfigMap on the target cluster. - Updated `etcd` to `v3.5.33-0-gke.3` to address security vulnerabilities CVE-2026-46595 and CVE-2026-39821. - Fixed an issue in split-datacenter environments where cluster validation and diagnostics incorrectly reported missing datastores for PersistentVolumes residing in the user datacenter. - Fixed an issue where deleting a cluster stalled indefinitely because node pool controllers recreated machine resources during cluster deletion. **Google Distributed Cloud (software only) for bare metal** Announcement Google Distributed Cloud (software only) for bare metal 1.35.500-gke.142 is available for download. To upgrade, see [Upgrade clusters](https://docs.cloud.google.com/release-notes/how-to/upgrade). Google Distributed Cloud for bare metal 1.35.500-gke.142 runs on Kubernetes v1.35.8-gke.100. After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform. If you use a third-party storage vendor, check the listing of our previously-qualified [storage partners](https://docs.cloud.google.com/kubernetes-engine/enterprise/docs/resources/partner-storage.md.txt). Fixed The following issues were fixed in 1.35.500-gke.142: - Fixed vulnerabilities listed in [Vulnerability fixes](https://docs.cloud.google.com/kubernetes-engine/distributed-cloud/bare-metal/docs/vulnerabilities.md.txt). - Fixed an issue where node drain in maintenance mode did not wait for attached storage volumes to detach. - Fixed `BareMetalMachine` conditions during maintenance mode transitions. - Fixed a reconciliation loop issue in `metrics-server` by checking the ConfigMap on the target cluster. - Fixed an issue where the status for `Ingress` resources didn't update when using bundled ingress. - Updated `etcd` to `v3.5.33-0-gke.3` to address security vulnerabilities CVE-2026-46595 and CVE-2026-39821. - Fixed an issue where deleting a cluster stalled indefinitely because node pool controllers recreated machine resources during deletion. - Fixed an issue where updating control plane configurations caused multiple API servers to restart simultaneously, leading to transient control plane unavailability. - Fixed an issue where creating a worker node pool stalled indefinitely while waiting for node machines in the pool to become ready. **Google Kubernetes Engine** Change #### (2026-R40) Version updates GKE cluster versions have been updated. **New versions available for upgrades and new clusters.** The following versions are now available for new GKE clusters, and for manual control plane upgrades and node upgrades for existing clusters. For more information about versioning and upgrades, see [GKE versioning and support](https://cloud.google.com/kubernetes-engine/versioning) and [About GKE cluster upgrades](https://cloud.google.com/kubernetes-engine/upgrades). ### Rapid channel > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.36.4-gke.1391000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391000) is now the default version for cluster creation in the Rapid channel. - The following versions are now available in the Rapid channel: - [1.34.11-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1209000) - [1.35.8-gke.1626000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1626000) - [1.36.4-gke.1495000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495000) - [Alpha version](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#alpha-versions) 1.38.0-gke.1002000+preview is now available for GKE alpha clusters in the Rapid channel. - The following versions are no longer available in the Rapid channel: - 1.34.11-gke.1056000 - 1.35.8-gke.1380000 - 1.36.4-gke.1247000 - 1.37.0-gke.3165000 - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.11-gke.1102000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1102000) - 1.34 to [1.35.8-gke.1439000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1439000) - 1.35 to [1.36.4-gke.1391000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.11-gke.1102000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1102000) - 1.35 to [1.35.8-gke.1439000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1439000) - 1.36 to [1.36.4-gke.1391000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391000) - 1.37 to [1.37.0-gke.3503000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-0-gke-3503000) ### Regular channel > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.35.8-gke.1225000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1225000) is now the default version for cluster creation in the Regular channel. - The following versions are now available in the Regular channel: - [1.34.11-gke.1056000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1056000) - [1.35.8-gke.1380000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1380000) - [1.36.4-gke.1247000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1247000) - The following versions are no longer available in the Regular channel: - 1.34.10-gke.1328000 - 1.35.8-gke.1036000 - 1.36.4-gke.1082000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Regular channel. This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.11-gke.1044000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1044000) - 1.34 to [1.35.8-gke.1225000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1225000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.11-gke.1044000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1044000) - 1.35 to [1.35.8-gke.1225000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1225000) ### Stable channel > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.34.10-gke.1328000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-10-gke-1328000) is now available in the Stable channel. - Version 1.34.10-gke.1236000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Stable channel. This version will be removed in 90 days, or at the end of support, if sooner. ### Extended channel > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.35.8-gke.1225000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1225000) is now the default version for cluster creation in the Extended channel. - The following versions are now available in the Extended channel: - [1.31.14-gke.2689000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2689000) - [1.31.14-gke.2759000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2759000) - [1.32.13-gke.2411000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2411000) - [1.32.13-gke.2504000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2504000) - [1.33.13-gke.1636000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1636000) - [1.33.13-gke.1721000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1721000) - [1.34.11-gke.1056000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1056000) - [1.35.8-gke.1380000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1380000) - [1.36.4-gke.1247000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1247000) - The following versions are no longer available in the Extended channel: - 1.31.14-gke.2630000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.31.14-gke.2704000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.32.13-gke.2337000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.32.13-gke.2427000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.33.13-gke.1547000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.33.13-gke.1647000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.34.10-gke.1328000 - 1.35.8-gke.1036000 - 1.36.4-gke.1082000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or deprecated APIs, preventing upgrades: - 1.30 to [1.31.14-gke.2667000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2667000) - 1.31 to [1.32.13-gke.2393000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2393000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or other factors preventing minor version upgrades: - 1.31 to [1.31.14-gke.2667000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2667000) - 1.32 to [1.32.13-gke.2393000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2393000) - 1.33 to [1.33.13-gke.1613000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1613000) - 1.34 to [1.34.11-gke.1044000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1044000) - 1.35 to [1.35.8-gke.1225000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1225000) ### No channel (deprecated) > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.35.8-gke.1225000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1225000) is now the default version for cluster creation. - The following versions are now available: - [1.34.11-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1209000) - [1.35.8-gke.1626000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1626000) - [1.36.4-gke.1495000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495000) - The following node versions are now available: - [1.31.14-gke.2759000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2759000) - [1.32.13-gke.2504000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2504000) - [1.33.13-gke.1721000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1721000) - [1.34.11-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1209000) - [1.35.8-gke.1626000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1626000) - [1.36.4-gke.1495000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495000) - The following versions are no longer available: - 1.34.10-gke.1236000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.35.7-gke.1222000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.1082000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.11-gke.1044000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1044000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.11-gke.1044000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1044000) Security #### (2026-R40) Security updates This release includes new GKE versions that use updated Container-Optimized OS images. These updated images are cumulative, incorporating security fixes from all Container-Optimized OS versions released since the previous GKE release. To identify the specific vulnerabilities that were resolved in each updated Container-Optimized OS image, see the **Security** release notes for that image. The following table includes links to the release notes for each updated Container-Optimized OS image: | GKE version | Container-Optimized OS version | Details | |---|---|---| | 1.31.14-gke.2759000 | cos-121-18867-584-7 | [cos-121-18867-584-7 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m121.md.txt#cos-121-18867-584-7_) | | 1.32.13-gke.2504000 | cos-121-18867-584-7 | [cos-121-18867-584-7 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m121.md.txt#cos-121-18867-584-7_) | | 1.33.13-gke.1721000 | cos-121-18867-584-7 | [cos-121-18867-584-7 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m121.md.txt#cos-121-18867-584-7_) | | 1.34.11-gke.1209000 | cos-125-19216-655-12 | [cos-125-19216-655-12 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m125.md.txt#cos-125-19216-655-12_) | | 1.35.8-gke.1626000 | cos-125-19216-655-12 | [cos-125-19216-655-12 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m125.md.txt#cos-125-19216-655-12_) | | 1.36.4-gke.1495000 | cos-129-19506-448-20 | [cos-129-19506-448-20 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m129.md.txt#cos-129-19506-448-20_) | | 1.38.0-gke.1002000+preview | cos-beta-133-19999-44-28 | [cos-beta-133-19999-44-28 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m133.md.txt#cos-beta-133-19999-44-28_) |
Change #### (2026-R40) Version updates > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.34.10-gke.1328000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-10-gke-1328000) is now available in the Stable channel. - Version 1.34.10-gke.1236000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Stable channel. This version will be removed in 90 days, or at the end of support, if sooner. Change #### (2026-R40) Version updates > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.35.8-gke.1225000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1225000) is now the default version for cluster creation in the Regular channel. - The following versions are now available in the Regular channel: - [1.34.11-gke.1056000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1056000) - [1.35.8-gke.1380000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1380000) - [1.36.4-gke.1247000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1247000) - The following versions are no longer available in the Regular channel: - 1.34.10-gke.1328000 - 1.35.8-gke.1036000 - 1.36.4-gke.1082000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Regular channel. This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.11-gke.1044000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1044000) - 1.34 to [1.35.8-gke.1225000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1225000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.11-gke.1044000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1044000) - 1.35 to [1.35.8-gke.1225000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1225000) Change #### (2026-R40) Version updates > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.36.4-gke.1391000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391000) is now the default version for cluster creation in the Rapid channel. - The following versions are now available in the Rapid channel: - [1.34.11-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1209000) - [1.35.8-gke.1626000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1626000) - [1.36.4-gke.1495000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495000) - [Alpha version](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#alpha-versions) 1.38.0-gke.1002000+preview is now available for GKE alpha clusters in the Rapid channel. - The following versions are no longer available in the Rapid channel: - 1.34.11-gke.1056000 - 1.35.8-gke.1380000 - 1.36.4-gke.1247000 - 1.37.0-gke.3165000 - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.11-gke.1102000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1102000) - 1.34 to [1.35.8-gke.1439000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1439000) - 1.35 to [1.36.4-gke.1391000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.11-gke.1102000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1102000) - 1.35 to [1.35.8-gke.1439000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1439000) - 1.36 to [1.36.4-gke.1391000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391000) - 1.37 to [1.37.0-gke.3503000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-0-gke-3503000) Change #### (2026-R40) Version updates > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.35.8-gke.1225000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1225000) is now the default version for cluster creation. - The following versions are now available: - [1.34.11-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1209000) - [1.35.8-gke.1626000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1626000) - [1.36.4-gke.1495000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495000) - The following node versions are now available: - [1.31.14-gke.2759000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2759000) - [1.32.13-gke.2504000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2504000) - [1.33.13-gke.1721000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1721000) - [1.34.11-gke.1209000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1209000) - [1.35.8-gke.1626000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1626000) - [1.36.4-gke.1495000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1495000) - The following versions are no longer available: - 1.34.10-gke.1236000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.35.7-gke.1222000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.4-gke.1082000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.11-gke.1044000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1044000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.11-gke.1044000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1044000) Change #### (2026-R40) Version updates > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.35.8-gke.1225000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1225000) is now the default version for cluster creation in the Extended channel. - The following versions are now available in the Extended channel: - [1.31.14-gke.2689000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2689000) - [1.31.14-gke.2759000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2759000) - [1.32.13-gke.2411000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2411000) - [1.32.13-gke.2504000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2504000) - [1.33.13-gke.1636000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1636000) - [1.33.13-gke.1721000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1721000) - [1.34.11-gke.1056000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1056000) - [1.35.8-gke.1380000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1380000) - [1.36.4-gke.1247000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1247000) - The following versions are no longer available in the Extended channel: - 1.31.14-gke.2630000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.31.14-gke.2704000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.32.13-gke.2337000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.32.13-gke.2427000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.33.13-gke.1547000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.33.13-gke.1647000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.34.10-gke.1328000 - 1.35.8-gke.1036000 - 1.36.4-gke.1082000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or deprecated APIs, preventing upgrades: - 1.30 to [1.31.14-gke.2667000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2667000) - 1.31 to [1.32.13-gke.2393000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2393000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or other factors preventing minor version upgrades: - 1.31 to [1.31.14-gke.2667000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2667000) - 1.32 to [1.32.13-gke.2393000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2393000) - 1.33 to [1.33.13-gke.1613000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1613000) - 1.34 to [1.34.11-gke.1044000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1044000) - 1.35 to [1.35.8-gke.1225000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1225000) **Managed Service for Apache Spark** Breaking **Managed Service for Apache Spark** (formerly Google Cloud Serverless for Apache Spark): - **Preconfigured Conda channels removed:** Preconfigured conda channels (such as `conda-forge`) have been removed from configurations. All runtime version aliases now point to the latest runtime version without conda channel configuration. - **Affected runtime versions:** `1.2.89+`, `2.2.89+`, and `2.3.42+`. **Managed Service for Apache Spark** (formerly Dataproc on Compute Engine): - **Enforced SPNEGO Authentication on Web UIs:** Disabled anonymous access to YARN (ResourceManager, NodeManager) and HiveServer2 web interfaces on Kerberos-enabled clusters to align with Zero-Trust architecture. End users and administrators must hold an active Kerberos ticket (kinit) and configure their browser/client for SPNEGO negotiation to access cluster consoles. - **Affected runtime versions:** `2.2.88+`, `2.3.37+`, `3.0.3+`. - **End-to-End Encryption for Apache Ranger (HTTPS):** Ranger Admin, UserSync, and client plugins now enforce HTTPS on port 6182 for SSL-enabled clusters. Traffic routed through Apache Knox Component Gateway is encrypted end-to-end with multizone support, and direct access should target `https://:6182` instead of legacy HTTP port 6080. - **Affected runtime versions:** `2.2.88+`, `2.3.37+`, `3.0.3+`. Announcement **Managed Service for Apache Spark** (formerly Dataproc on Compute Engine): [Lightning Engine](https://docs.cloud.google.com/managed-spark/docs/guides/lightning-engine.md.txt) is now supported in [`3.0` cluster image versions](https://docs.cloud.google.com/managed-spark/docs/concepts/versioning/image-release-3.0.md.txt) starting with subminor image version [`3.0.2`](https://docs.cloud.google.com/managed-spark/docs/release-notes.md.txt#September_04_2026) (`3.0.2-debian13` and `3.0.2-ubuntu24`). Announcement New [**Managed Service for Apache Spark** (formerly Google Cloud Serverless for Apache Spark) subminor runtime versions](https://docs.cloud.google.com/managed-spark/docs/concepts/versions/serverless-versions.md.txt#supported-dataproc-serverless-for-spark-runtime-versions): - 1.2.89 - 2.2.89 - 2.3.42 Key updates in these runtime versions include: - **Feature updates:** - **Apache Iceberg 1.10:** In the `2.3` runtime, Serverless `2.3` batches with Lightning Engine now use Apache Iceberg version `1.10` by default. - **Parquet footer caching:** Enabled Parquet footer caching by default for Lightning Engine (Velox) in the `2.3` runtime. If executor out-of-memory (OOM) or task failure spikes on tiny files are observed, these can be mitigated by setting `spark.gluten.sql.columnar.backend.velox.cacheParquetFooters=false`. - **Lakehouse catalog:** Enabled Lakehouse catalog auto-loading in the `2.3` runtime using the `spark.dataproc.lakehouse.project` property. **Service Extensions** Feature Support for [route](https://docs.cloud.google.com/service-extensions/docs/configure-route-extensions.md.txt#configure-route-plugins) and [traffic](https://docs.cloud.google.com/service-extensions/docs/configure-traffic-extensions.md.txt#configure-traffic-plugins) extensions that use plugins is [generally available (GA)](https://cloud.google.com/products#product-launch-stages) for regional external Application Load Balancers and regional internal Application Load Balancers. For more information, see [Supported Application Load Balancers for user-managed extensions](https://docs.cloud.google.com/service-extensions/docs/lb-extensions-overview#supported-lbs). ## September 22, 2026 **Access Approval** Feature Developer Connect is generally available ([GA](https://cloud.google.com/products#product-launch-stages)). **Access Transparency** Feature Developer Connect is generally available ([GA](https://cloud.google.com/products#product-launch-stages)). **BigQuery** Feature You can now [publish a BigQuery data agent in Gemini Enterprise](https://docs.cloud.google.com/bigquery/docs/create-data-agents#publish-agent-gemini-enterprise) by registering the agent with Agent Registry and importing it using default Google-managed credentials. When BigQuery and Gemini Enterprise are in the same Google Cloud project and configured with a matching [Agent Gateway](https://docs.cloud.google.com/gemini-enterprise-agent-platform/govern/gateways/agent-gateway-overview.md.txt) region, you don't need to manually copy the Agent-to-Agent (A2A) JSON card or configure OAuth client credentials. These features are in [Preview](https://cloud.google.com/products#product-launch-stages). **Bigtable** Feature You can use the Google Cloud console to create and manage protobuf schemas (schema bundles) for your Bigtable tables. You can also view schema bundle definitions in Bigtable Studio. This feature is [generally available (GA)](https://cloud.google.com/products#product-launch-stages). For more information, see [Create and manage protobuf schemas](https://docs.cloud.google.com/bigtable/docs/create-manage-protobuf-schemas). **Cloud NGFW** Feature You can now use Cloud NGFW Enterprise advanced threat prevention with cross-region internal Application Load Balancers ([Preview](https://cloud.google.com/products#product-launch-stages)). You can configure global network firewall policies with security profile groups to inspect incoming traffic targeting load balancer forwarding rules. This integration supports intrusion detection and prevention service and Advanced malware sandbox (WildFire) to protect workloads and backends. For more information, see [Supported load balancers](https://docs.cloud.google.com/firewall/docs/about-firewalls#ngfw-load-balancers). This feature is available in **Preview**. **Cloud Trace** Feature The following remote Google Cloud MCP servers automatically generate a trace span for `tools/call` operations. - Identity and Access Management - Organization Policy Service - Policy Analyzer - Security Command Center - Spanner - Unified Maintenance These spans can help you understand the behavior of your agentic applications. For more information, see [Investigate MCP calls using Trace](https://docs.cloud.google.com/stackdriver/docs/instrumentation/trace-remote-mcp-server-calls.md.txt). Feature You can use Terraform to configure resources managed by the Observability API. For example, you can use Terraform to create and update observability buckets, create links on datasets, and configure default settings. For more information, see the following documents: - [Set defaults for observability buckets](https://docs.cloud.google.com/stackdriver/docs/observability/set-defaults-for-observability-buckets.md.txt) - [Create observability buckets](https://docs.cloud.google.com/stackdriver/docs/observability/create-observability-buckets.md.txt) - [Update observability buckets](https://docs.cloud.google.com/stackdriver/docs/observability/update-observability-buckets.md.txt) - [List buckets and manage datasets](https://docs.cloud.google.com/stackdriver/docs/observability/storage-manage.md.txt) **Cluster Toolkit** Feature Cluster Toolkit v1.104.0 is available. This release adds agent skills to let you debug Kueue workloads on Google Kubernetes Engine (GKE) and migrate from the Accelerated Processing Kit (XPK). It also adds optional support for managed instance groups on [static compute nodes](https://docs.cloud.google.com/cluster-toolkit/docs/slurm/manage-static-nodes.md.txt) and [Private Service Connect interfaces](https://docs.cloud.google.com/vpc/docs/about-private-service-connect-interfaces) on Slurm nodesets and login nodes. Additionally, `gcluster` now validates [placement policies](https://docs.cloud.google.com/compute/docs/instances/placement-policies-overview.md.txt), [reservations](https://docs.cloud.google.com/compute/docs/instances/reservations-overview.md.txt), and queues when you submit GKE jobs. This update also runs the Lustre Networking (LNet) setup script only when Lustre is enabled and prevents LNet errors from causing deployments to fail. For more information, see the [release announcement on GitHub](https://github.com/GoogleCloudPlatform/cluster-toolkit/discussions/6355). **Compute Engine** Deprecated As of September 15, 2026, NVIDIA P100 (`nvidia-tesla-p100` and `nvidia-tesla-p100-vws`) GPUs have reached end of support (EOS) and are shut down. You can no longer create, launch, or access Compute Engine instances or other Google Cloud resources that use NVIDIA P100 GPUs. For information about migrating your workloads to supported GPU alternatives such as the G2 (NVIDIA L4) or G4 (NVIDIA RTX PRO 6000) machine series, see [NVIDIA P100 end of support](https://docs.cloud.google.com/compute/docs/eol/p100-eos.md.txt). Deprecated NVIDIA T4 (`nvidia-tesla-t4` and `nvidia-tesla-t4-vws`) and NVIDIA P4 (`nvidia-tesla-p4` and `nvidia-tesla-p4-vws`) GPUs are deprecated and will reach end of support (EOS) on August 1, 2027. After August 1, 2027, you won't be able to create, launch, or access Compute Engine instances or other Google Cloud resources that run NVIDIA T4 or P4 GPUs. In addition, you can no longer purchase or renew 3-year committed use discounts (CUDs) for NVIDIA T4 or P4 GPUs. To transition your workloads to supported GPU models such as the G2 (NVIDIA L4) or G4 (NVIDIA RTX PRO 6000) machine series before the EOS date, see [NVIDIA T4 end of support](https://docs.cloud.google.com/compute/docs/eol/t4-eos.md.txt) and [NVIDIA P4 end of support](https://docs.cloud.google.com/compute/docs/eol/p4-eos.md.txt). **Developer Connect** Announcement The Secret Manager API is no longer enabled by default when you enable the Developer Connect API. For Git repository connections, you must enable the Secret Manager API explicitly. **Gemini Enterprise** Feature **Gemini Enterprise: D\&B Risk Analytics data store** The D\&B Risk Analytics data store is generally available (GA) in Gemini Enterprise. You can connect D\&B Risk Analytics to run third-party and counterparty risk workflows against your D\&B Risk Analytics tenant using natural language. Supported workflows include KYB onboarding, counterparty due diligence, sanctions and adverse media screening, and supplier and financial risk assessment. The data store also supports actions, such as creating an entity, starting a screening, and updating tags and custom fields. For more information, see [Connect D\&B Risk Analytics](https://docs.cloud.google.com/gemini/enterprise/docs/connectors/d_b_risk_analytics). Feature **Gemini Enterprise: New data store (Preview)** The following data store is available in Gemini Enterprise: - [DirectBooker](https://docs.cloud.google.com/gemini/enterprise/docs/connectors/directbooker.md.txt) This data store is in Public Preview. For more information, see [Connect a third-party data source](https://docs.cloud.google.com/gemini/enterprise/docs/connectors/connect-third-party-data-source). **Gemini Enterprise Agent Platform** Feature **Anthropic's Claude Opus 5.5** [Claude Opus 5.5](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/partner-models/claude/opus-5-5.md.txt) is available in Model Garden. **Network Intelligence Center** Feature [Connectivity Tests](https://docs.cloud.google.com/network-intelligence-center/docs/connectivity-tests/concepts/overview.md.txt) analyzes firewall policy rules that use [Google Threat Intelligence data](https://docs.cloud.google.com/firewall/docs/threat-intelligence-overview.md.txt). ## September 21, 2026 **Access Context Manager** Feature Access Context Manager supports extended session length for Workforce Identity Federation. This feature is in [Preview](https://cloud.google.com/products#product-launch-stages) for Looker (Google Cloud core) customers. For more information, see [Configure extended session length for Workforce Identity Federation](https://docs.cloud.google.com/access-context-manager/docs/extended-session-length-for-workforce-identity-federation.md.txt). **Agent Platform Workbench** Change ### 20260920.00_p0 Release Change Installed latest packages from upstream dependencies. Feature JupyterLab now forwards client-side logs (console errors, uncaught exceptions, unhandled promise rejections, and failed network requests) to the instance backend, where they surface in Cloud Logging for easier debugging. Change ### 20260920.00_p0 Release Change Installed latest packages from upstream dependencies. Feature JupyterLab now forwards client-side logs (console errors, uncaught exceptions, unhandled promise rejections, and failed network requests) to the instance backend, where they surface in Cloud Logging for easier debugging. **AlloyDB for PostgreSQL** Feature You can now use the AlloyDB Columnar Engine as a read-optimized, in-memory cache for HNSW vector indexes. This feature is generally available ([GA](https://cloud.google.com/products#product-launch-stages)). It accelerates vector search performance and increases queries per second (QPS) for vector workloads. For more information, see [Accelerate queries with the Columnar Engine](https://docs.cloud.google.com/alloydb/docs/ai/accelerate-with-ce.md.txt). **Anthos Config Management** Change Addressed multiple Common Vulnerabilities and Exposures (CVEs) by updating dependencies. Fixed Fixed an issue with duration histograms to ensure accurate latency reporting for sub-second operations. **Apigee X** Announcement On September 21st, 2026, we began maintenance updates of Apigee instances [configured for maintenance windows](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/maintenance-windows.md.txt). If you set a preferred window for maintenance for your instance, and your instance version is below **1-18-0-apigee-4** , your instance will be updated to **1-18-0-apigee-4** within the next seven to 21 days. A notification containing the expected date of upgrade will be sent within the next two business days. > [!NOTE] > Note: Instances that meet either of the following two criteria will **not** be updated: > > - Your instance has a DNS misconfiguration, as described in [Known Issue 445936920](https://docs.cloud.google.com/apigee/docs/release/known-issues.md.txt). > - Your instance uses an Apigee Java Library that has been removed, as described in [Apigee release notes dated October 16, 2025](https://docs.cloud.google.com/apigee/docs/release/release-notes.md.txt#October_16_2025). For more information on participating in scheduled maintenance windows, see [Maintenance overview](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/maintenance.md.txt) and [Manage Apigee instance maintenance windows](https://docs.cloud.google.com/apigee/docs/api-platform/system-administration/maintenance-windows.md.txt). Announcement On September 21st, 2026, we released an updated version of Apigee (1-18-0-apigee-5). > [!NOTE] > **Note:** Rollouts of this release began today and can take four or more business days to be completed across all Google Cloud zones. Your instances might not have the features and fixes available until the rollout is complete. Security | Bug ID | Description | |---|---| | **560130499** | **Security fix for Apigee.** Fixed a security issue in the Java Callout policy. | | **547681234** | **Security fix for Apigee.** Patched [CVE-2026-69247](https://nvd.nist.gov/vuln/detail/CVE-2026-69247) by upgrading a third-party library used by the Apigee model-security engine. | | **556568593** | **Security fix for Apigee.** Patched [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) by upgrading gRPC. | | **N/A** | **Security fix for Apigee infrastructure.** | Fixed | Bug ID | Description | |---|---| | **559009293** | Fixed elevated OAuth and VerifyAPIKey latency and Cassandra read load for AppGroup apps by caching the AppGroup entity in the Message Processor runtime, matching Developer-app behavior. | | **558888960** | Fixed distributed tracing so that the target URL is included as a span attribute in all scenarios. | | **556750755** | Fixed EventFlow (Server-Sent Events) dropping or truncating events that follow a large (greater than 16 KB) event under load on the http-adaptor data path. | | **553931019** | The MCP tools/list method now aggregates tools across all approved API products. | | **531783017** | Implemented the `true` element of SSLInfo for a Syslog endpoint, so that the syslog target's TLS server identity is verified. | | **554114419** | Policies can now change request pseudo-headers (for example, :path and :authority) when HTTP/2 is in use. | | **548763108** | Blocked outbound HTTP from the Message Processor to Kubernetes-internal targets. | | **513032450** | Restored a 15-second TCP keep-alive on the Apigee Connect control-plane connection so that a silently dropped connection recovers in seconds rather than approximately two hours. | | **N/A** | Updates to infrastructure and libraries. | **BigQuery** Feature *Lakehouse* now supports Workday Data Lake as a remote catalog provider for cross-cloud data access ([Preview](https://cloud.google.com/products#product-launch-stages)). You can configure federated catalogs to query data stored in Workday Data Lake directly from Google Cloud using BigQuery or Apache Spark without migrating data or building complex ETL pipelines. For more information, see [Set up cross-cloud connection for Workday Data Lake](https://docs.cloud.google.com/lakehouse/docs/set-up-cross-cloud-connection-workday). Feature The **Query results** pane in the BigQuery Studio query editor lets you [view a short history of recent runs for a query](https://docs.cloud.google.com/bigquery/docs/managing-jobs.md.txt#view-job), including [multi-statement queries](https://docs.cloud.google.com/bigquery/docs/multi-statement-queries.md.txt#view_multi_statement_query_results), without having to navigate to the **Job history** tab. This feature is [generally available](https://cloud.google.com/products#product-launch-stages) (GA). Feature BigQuery [generative AI functions](https://docs.cloud.google.com/bigquery/docs/generative-ai-overview.md.txt#locations) now support the `gemini-3.8-flash` Gemini model. **Bigtable** Libraries ### Node.js #### [7.3.0](https://github.com/googleapis/google-cloud-node/compare/bigtable-v7.2.0...bigtable-v7.3.0) (2026-09-15) ##### Features - PNPM workspace ([#8973](https://github.com/googleapis/google-cloud-node/issues/8973)) ([1ea27c9](https://github.com/googleapis/google-cloud-node/commit/1ea27c9c9bf4e4cbf79381321dcb9bce7951a76f)) ### Python #### [2.45.0](https://github.com/googleapis/google-cloud-python/compare/google-cloud-bigtable-v2.44.0...google-cloud-bigtable-v2.45.0) (2026-09-14) ##### Features - **bigtable:** Rerouted MutateRows to use the data client ([#18195](https://github.com/googleapis/google-cloud-python/issues/18195)) ([3bbcbdf](https://github.com/googleapis/google-cloud-python/commit/3bbcbdf1a62dd10ab96f72e5c8198cffe9174ac7)) ### Python #### [2.46.0](https://github.com/googleapis/google-cloud-python/compare/google-cloud-bigtable-v2.45.0...google-cloud-bigtable-v2.46.0) (2026-09-17) ##### Features - **bigtable:** Rerouted RowSet and RowRange to use ReadRows from data client ([#18196](https://github.com/googleapis/google-cloud-python/issues/18196)) ([1857302](https://github.com/googleapis/google-cloud-python/commit/1857302d5c602087b9a782c62694c33013eb77ea)) - Rerouted ReadRows to data client ([#18198](https://github.com/googleapis/google-cloud-python/issues/18198)) ([934cd2d](https://github.com/googleapis/google-cloud-python/commit/934cd2da82be8b835192baa222e3a2ab5aa4b8d1)) - update API sources and regenerate ([#18396](https://github.com/googleapis/google-cloud-python/issues/18396)) ([e9f8e59](https://github.com/googleapis/google-cloud-python/commit/e9f8e590b7b395e660cc5437535166dfb920d246)) - update API sources and regenerate. ([e9f8e59](https://github.com/googleapis/google-cloud-python/commit/e9f8e590b7b395e660cc5437535166dfb920d246)) ##### Bug Fixes - **bigtable:** Added rst_stream exception handling for ReadRows. ([#18197](https://github.com/googleapis/google-cloud-python/issues/18197)) ([f30df60](https://github.com/googleapis/google-cloud-python/commit/f30df60eda27810cec277663dff532a158c999f3)) **Cloud SQL for MySQL** Feature The [C4 machine series](https://docs.cloud.google.com/sql/docs/mysql/machine-series-overview.md.txt#c4) is available for Cloud SQL for MySQL Enterprise Plus instances in the following regions: - `asia-east2` --- Hong Kong - `asia-southeast2` --- Jakarta, Indonesia - `europe-west3` --- Frankfurt, Germany - `europe-west4` --- Eemshaven, Netherlands - `europe-west8` --- Milan, Italy - `us-east5` --- Columbus, Ohio, USA - `us-south1` --- Dallas, Texas, USA - `us-west4` --- Las Vegas, Nevada, USA The C4 machine series provides the following benefits: - Supports fifth and sixth generation Intel Xeon Scalable processors. - Offers a price-performance balance that makes it suitable for high-demand workloads. **Cloud SQL for PostgreSQL** Feature The [C4 machine series](https://docs.cloud.google.com/sql/docs/postgres/machine-series-overview.md.txt#c4) is available for Cloud SQL for PostgreSQL Enterprise Plus instances in the following regions: - `asia-east2` --- Hong Kong - `asia-southeast2` --- Jakarta, Indonesia - `europe-west3` --- Frankfurt, Germany - `europe-west4` --- Eemshaven, Netherlands - `europe-west8` --- Milan, Italy - `us-east5` --- Columbus, Ohio, USA - `us-south1` --- Dallas, Texas, USA - `us-west4` --- Las Vegas, Nevada, USA The C4 machine series provides the following benefits: - Supports fifth and sixth generation Intel Xeon Scalable processors. - Offers a price-performance balance that makes it suitable for high-demand workloads. **Cloud SQL for SQL Server** Feature The [C4 machine series](https://docs.cloud.google.com/sql/docs/sqlserver/machine-series-overview.md.txt#c4) is available for Cloud SQL for SQL Server Enterprise Plus instances in the following regions: - `asia-east2` --- Hong Kong - `asia-southeast2` --- Jakarta, Indonesia - `europe-west3` --- Frankfurt, Germany - `europe-west4` --- Eemshaven, Netherlands - `europe-west8` --- Milan, Italy - `us-east5` --- Columbus, Ohio, USA - `us-south1` --- Dallas, Texas, USA - `us-west4` --- Las Vegas, Nevada, USA The C4 machine series provides the following benefits: - Supports fifth and sixth generation Intel Xeon Scalable processors. - Offers a price-performance balance that makes it suitable for high-demand workloads. **Container Optimized OS** Change ### cos-125-19216-655-40 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.12.105](https://cos.googlesource.com/third_party/kernel/+/1133af89a76cd21b91110351a353e7300d39c96b) | v27.5.1 | v2.2.7 | [See List](https://storage.googleapis.com/cos-tools/19216.655.40/lakitu/gpu_driver_versions.textproto) | Feature Added support for loading the CephFS kernel driver. Fixed Fixed an issue where temporary efivarfs mounts under /tmp could persist after boot. Fixed Upgraded app-arch/bzip2 to v1.0.8-r5. Fixed Upgraded app-shells/dash to v0.5.13.5. Security Fixed CVE-2026-0864 in dev-lang/python. Security Fixed CVE-2026-15308 in dev-lang/python. Security Upgraded net-misc/rsync to version 3.5.0. This fixes CVE-2026-53791, CVE-2026-53784, CVE-2026-53786, CVE-2026-53789, CVE-2026-53795, CVE-2026-53797, CVE-2026-53798, CVE-2026-53799, CVE-2026-53800, CVE-2026-53801, CVE-2026-53802, CVE-2026-53803, CVE-2026-70455, CVE-2026-70457, CVE-2026-70459, CVE-2026-70461, and CVE-2026-70463. Change ### cos-129-19506-448-53 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.12.105](https://cos.googlesource.com/third_party/kernel/+/59eca8c9ae14588103453a37c861e6ab42230de4) | v27.5.1 | v2.2.7 | [See List](https://storage.googleapis.com/cos-tools/19506.448.53/lakitu/gpu_driver_versions.textproto) | Feature Added support for loading the CephFS kernel driver. Feature Fixed a performance issue in the GVE driver on multi-NUMA systems. Fixed Fixed an issue where temporary efivarfs mounts under /tmp could persist after boot. Security Fixed CVE-2026-0864 in dev-lang/python. Security Fixed CVE-2026-15308 in dev-lang/python. Security Upgraded net-misc/rsync to version 3.5.0. This fixes CVE-2026-53791, CVE-2026-53784, CVE-2026-53786, CVE-2026-53789, CVE-2026-53795, CVE-2026-53797, CVE-2026-53798, CVE-2026-53799, CVE-2026-53800, CVE-2026-53801, CVE-2026-53802, CVE-2026-53803, CVE-2026-70455, CVE-2026-70457, CVE-2026-70459, CVE-2026-70461, and CVE-2026-70463. Change ### cos-121-18867-584-32 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.6.153](https://cos.googlesource.com/third_party/kernel/+/6e1e80a35e6e73b5aa0e3d6e0c87668f627b06f1) | v27.5.1 | v2.0.10 | [See List](https://storage.googleapis.com/cos-tools/18867.584.32/lakitu/gpu_driver_versions.textproto) | Fixed Fixed an issue where temporary efivarfs mounts under /tmp could persist after boot. Fixed Upgraded app-misc/jq to v1.8.2. Security Fixed CVE-2026-0864 in dev-lang/python. Security Fixed CVE-2026-15308 in dev-lang/python. Security Fixed CVE-2026-80916 in the Linux kernel. Security Upgraded net-misc/rsync to version 3.5.0. This fixes CVE-2026-53791, CVE-2026-53784, CVE-2026-53786, CVE-2026-53789, CVE-2026-53795, CVE-2026-53797, CVE-2026-53798, CVE-2026-53799, CVE-2026-53800, CVE-2026-53801, CVE-2026-53802, CVE-2026-53803, CVE-2026-70455, CVE-2026-70457, CVE-2026-70459, CVE-2026-70461, and CVE-2026-70463. Change ### cos-117-18613-731-29 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.6.153](https://cos.googlesource.com/third_party/kernel/+/6ee831c40108c3b447bc8edad4c4ebd45b746574) | v24.0.9 | v1.7.34 | [See List](https://storage.googleapis.com/cos-tools/18613.731.29/lakitu/gpu_driver_versions.textproto) | Fixed Fixed an issue where temporary efivarfs mounts under /tmp could persist after boot. Fixed Upgraded dev-libs/expat to v2.8.4. Security Fixed CVE-2026-0864 in dev-lang/python. Security Upgraded net-misc/rsync to version 3.5.0. This fixes CVE-2026-53791, CVE-2026-53784, CVE-2026-53786, CVE-2026-53789, CVE-2026-53795, CVE-2026-53797, CVE-2026-53798, CVE-2026-53799, CVE-2026-53800, CVE-2026-53801, CVE-2026-53802, CVE-2026-53803, CVE-2026-70455, CVE-2026-70457, CVE-2026-70459, CVE-2026-70461, and CVE-2026-70463. **Dataform** Feature The Dataform remote Model Context Protocol (MCP) server now supports pipeline authoring in development workspaces and Git repository operations. AI agents can create and list workspaces, search and edit files, commit changes and push commits to remote Git providers, update repository settings, and organize repositories in folders. For more information, see [Use the Dataform remote MCP server](https://docs.cloud.google.com/dataform/docs/use-dataform-mcp.md.txt) and the [Dataform MCP reference](https://docs.cloud.google.com/dataform/docs/reference/mcp.md.txt). This feature is [generally available](https://cloud.google.com/products#product-launch-stages) (GA). **Document AI** Feature [Custom extractor](https://docs.cloud.google.com/document-ai/docs/ce-with-genai.md.txt) model `pretrained-foundation-model-v3.1-lite-2026-07-15` powered by Gemini 3.1 Flash Lite LLM is available in [Preview](https://cloud.google.com/products/#product-launch-stages). This processor version supports fine-tuning and is serving multi-region locations in the US and EU. CMEK is not fully supported in all regions, support requires being allowlisted. Contact your Google Cloud account team for more information. For more information about available models, see the [custom extractor](https://docs.cloud.google.com/document-ai/docs/custom-based-extraction) page. Feature [Gemini layout parser](https://docs.cloud.google.com/document-ai/docs/layout-parse-chunk.md.txt) model `pretrained-layout-parser-v3.1-lite-2026-08-11`is in [Preview](https://cloud.google.com/products/#product-launch-stages). **Gemini Enterprise** Feature **Gemini Enterprise: Transfer ownership of shared agents** Administrators can transfer ownership of shared employee-made agents to another user or to themselves in the Google Cloud console. This is useful when reassigning agents created by departing employees or when temporary workers hand over agents to full-time staff. Key characteristics and requirements include: - **Administrator only:** Only users with the Gemini Enterprise Admin role (`roles/discoveryengine.agentspaceAdmin` or `roles/discoveryengine.admin`) can transfer agent ownership. Agent owners cannot transfer ownership unless they are also administrators. - **Shared agents only:** Ownership transfer is supported only for agents that are already shared. Private agents cannot be transferred. - **Single owner:** Each agent has only one owner at a time. When ownership is transferred, the selected user becomes the sole owner, and the previous owner is retained as a permissioned user with the `agentUser` role. - **Agents with schedules or triggers:** If the transferred agent has a schedule trigger or event trigger, the transfer operation marks them as disabled schedules or events. The new owner must enable it before being able to use the agent. - **Identity formats:** Administrators can transfer ownership to users with Google accounts (using email addresses) or to users in a Workforce Identity Federation (WIF) pool (using workforce identity principal identifiers). For more information, see [Transfer agent ownership](https://docs.cloud.google.com/gemini/enterprise/docs/share-custom-agents#transfer-ownership). **Gemini Enterprise Agent Platform** Fixed **CodeMender updates (v0.9.0)** This release introduces updates to CodeMender: - **Interactive HTML security reports** : Overhauled `cm report --format html` to provide a modern, interactive dashboard featuring severity metric cards, syntax-highlighted code snippets with line numbers, and an inline patch diff viewer. Added the `--open` (`-o`) flag to automatically open the generated report in the default browser. - **Expanded language support** : Added out-of-the-box vulnerability scanning support for C# (`.cs`), Rust (`.rs`), Kotlin (`.kt`, `.kts`), Ruby (`.rb`), and PHP (`.php`) to the default discovery configuration and initialization templates. - **Per-turn latency metrics** : Enhanced `cm stats` and session exports to report per-turn latency breakdowns, distinguishing time spent waiting on model inference from local tool execution. - **Bug fixes** : - Improved session reliability and error recovery during long-running repository scans. - Fixed local workspace state compatibility issues when upgrading from earlier CLI versions. For more information, see the [CodeMender documentation](https://docs.cloud.google.com/gemini-enterprise-agent-platform/agents/codemender.md.txt). **Google SecOps** Feature **Google Cloud organization ID enrichment for direct ingestion** Google SecOps now automatically enriches logs ingested through [Google Cloud direct ingestion](https://docs.cloud.google.com/chronicle/docs/ingestion/cloud/ingest-gcp-logs#option_1_direct_ingestion) with the originating Google Cloud organization ID. Previously, direct ingestion did not include organization-level identifiers, requiring customers with multiple Google Cloud organizations to configure separate Cloud Logging sinks and feeds to distinguish their log sources. With this update, you can easily identify the source organization for each event, filter UDM searches, scope detection rules, and configure Data RBAC or [Data Processing Pipelines](https://docs.cloud.google.com/chronicle/docs/ingestion/data-processing-pipeline.md.txt) across multi-organization environments without additional configuration. In UDM events, the organization ID appears automatically under `metadata.base_labels.ingestion_kv_labels`: - `key`: `"gcp_organization_id"` - `value`: `""` **Rollout details**: This feature will roll out gradually starting September 21, 2026, through September 28, 2026. No action or configuration change is required. **Google SecOps SIEM** Feature **Google Cloud organization ID enrichment for direct ingestion** Google SecOps now automatically enriches logs ingested through [Google Cloud direct ingestion](https://docs.cloud.google.com/chronicle/docs/ingestion/cloud/ingest-gcp-logs#option_1_direct_ingestion) with the originating Google Cloud organization ID. Previously, direct ingestion did not include organization-level identifiers, requiring customers with multiple Google Cloud organizations to configure separate Cloud Logging sinks and feeds to distinguish their log sources. With this update, you can easily identify the source organization for each event, filter UDM searches, scope detection rules, and configure Data RBAC or [Data Processing Pipelines](https://docs.cloud.google.com/chronicle/docs/ingestion/data-processing-pipeline.md.txt) across multi-organization environments without additional configuration. In UDM events, the organization ID appears automatically under `metadata.base_labels.ingestion_kv_labels`: - `key`: `"gcp_organization_id"` - `value`: `""` **Rollout details**: This feature will roll out gradually starting September 21, 2026, through September 28, 2026. No action or configuration change is required. **Identity and Access Management** Feature You can use System for Cross-domain Identity Management (SCIM) data as the source for both user and group claims in the OAuth sign-in workflows for Looker. You can also use Extended Session Length (ESL) when using SCIM. This feature is in [Preview](https://cloud.google.com/products#product-launch-stages). For more information, see the following: - [SCIM provisioning for Workforce Identity Federation](https://docs.cloud.google.com/iam/docs/workforce-identity-federation-scim.md.txt) - [Configure SCIM with Microsoft Entra ID](https://docs.cloud.google.com/iam/docs/configure-scim-ms-entra.md.txt) - [Configure SCIM with Okta](https://docs.cloud.google.com/iam/docs/configure-scim-okta.md.txt) - [Troubleshoot SCIM provisioning and synchronization](https://docs.cloud.google.com/iam/docs/troubleshooting-workforce-identity-federation.md.txt#scim-signin-users-groups-fail) **Secure Source Manager** Feature Secure Source Manager now supports rendering Mermaid diagrams in Markdown files, pull requests, issues, and comments. You can use standard `mermaid` fenced code blocks to create flowcharts, sequence diagrams, class diagrams, entity-relationship diagrams, state diagrams, and XY charts. For more information, see [Add diagrams with Mermaid](https://docs.cloud.google.com/secure-source-manager/docs/work-with-issues-pull-requests.md.txt#add-diagrams-with-mermaid). **Storage Transfer Service** Feature Storage Transfer Service now supports filtering Amazon S3 source objects by storage class. You can specify a list of storage classes to include when creating or updating transfer jobs using the Google Cloud console, the `gcloud` CLI, or the REST API. For more information, see [Filter source objects by storage class](https://docs.cloud.google.com/storage-transfer/docs/filtering-by-storage-class.md.txt). Feature Storage Transfer Service now supports filtering source objects using glob patterns with wildcard characters such as `*` and `?`. Glob filtering is supported for transfers from Amazon S3 and Microsoft Azure Blob Storage when configuring transfer jobs using the `gcloud` CLI or the REST API. For more information, see [Filter source objects using wildcards](https://docs.cloud.google.com/storage-transfer/docs/filter-by-glob-pattern.md.txt). ## September 18, 2026 **Agent Platform Workbench** Change ### 20260918-2230-rc0 Release Change ### 20260918-2230-rc0 Release Change Installed latest packages from upstream dependencies. Change Installed latest packages from upstream dependencies. Feature JupyterLab now forwards client-side logs (console errors, uncaught exceptions, unhandled promise rejections, and failed network requests) to the instance backend, where they surface in Cloud Logging for easier debugging. Feature JupyterLab now forwards client-side logs (console errors, uncaught exceptions, unhandled promise rejections, and failed network requests) to the instance backend, where they surface in Cloud Logging for easier debugging. Change ### 20260918-2130-rc0 Release Change Installed latest packages from upstream dependencies. Feature JupyterLab now forwards client-side logs (console errors, uncaught exceptions, unhandled promise rejections, and failed network requests) to the instance backend, where they surface in Cloud Logging for easier debugging. **Audit Manager** Feature You can [download FedRAMP 20x Class B (Low) compliance documents](https://docs.cloud.google.com/audit-manager/docs/download_compliance_documents) from Audit Manager. **Cloud Healthcare API** Feature **General availability:** You can now bulk-delete specific FHIR resources by resource ID. In the [`projects.locations.datasets.fhirStores.bulkDelete`](https://cloud.google.com/healthcare-api/docs/reference/rest/v1/projects.locations.datasets.fhirStores/bulkDelete) method, set the new `gcsSource.uri` field to a Cloud Storage file or wildcard pattern that lists the resources to delete. Each line must use the format `{resourceType}/{resourceId}`, for example `Patient/123`. The `gcsSource` field can't be used with the `type` or `until` filters. For more information, see [Bulk-deleting FHIR resources by resource ID](https://cloud.google.com/healthcare-api/docs/how-tos/fhir-bulk-delete#bulk-delete-by-id). **Cloud Load Balancing** Feature Managed workload identity for backend mTLS is **generally available** for the following Application Load Balancers: - Global external Application Load Balancers - Regional external Application Load Balancers - Cross-region internal Application Load Balancers - Regional internal Application Load Balancers The key benefits are as follows: - **Streamline certificate management**: Automated certificate and trust management for backend mTLS through seamless integration with Certificate Authority Service and Certificate Manager. - **Eliminate operational toil**: Certificates are automatically rotated based on the workload identity pool's configuration, removing the complexity and manual bottleneck of private key provisioning and maintenance. - **Improve visibility and governance**: Gain visibility into communication between distributed services and proactively apply governance to workloads across environments. For more information, see [Backend mTLS with managed workload identity overview](https://docs.cloud.google.com/load-balancing/docs/managed-workload-identities-load-balancers-overview.md.txt) **Cloud Scheduler** Change Cloud Scheduler is available in the following [location](https://docs.cloud.google.com/scheduler/docs/locations.md.txt): - `asia-southeast3` (Bangkok, Thailand) **Config Controller** Change Config Controller now uses the following versions of its included products: - Config Connector v1.156.0, [release notes](https://docs.cloud.google.com/config-connector/docs/release-notes.md.txt#September_08_2026) **Gemini Enterprise** Feature **Gemini Enterprise: Support for new actions (Preview)** Support for new actions is available in Public Preview for the following data stores: - [Microsoft OneDrive](https://docs.cloud.google.com/gemini/enterprise/docs/connectors/ms-onedrive.md.txt): Copy folder, move file, move folder, rename file, rename folder, share file or folder, and update file properties. - [Microsoft Outlook](https://docs.cloud.google.com/gemini/enterprise/docs/connectors/ms-outlook.md.txt): Create calendar, RSVP to event, and update calendar. - [Microsoft SharePoint](https://docs.cloud.google.com/gemini/enterprise/docs/connectors/ms-sharepoint.md.txt): Create list item, discard check out document, get list fields, get list item, list lists, share resource, update file properties, update list, update list item, and update page. - [Microsoft Teams](https://docs.cloud.google.com/gemini/enterprise/docs/connectors/ms-teams.md.txt): Add member to channel, create channel, create chat, create schedule, create time off entry, update channel, update channel message, update chat, update chat message, and update time off entry. For more information, see [Connect a third-party data source](https://docs.cloud.google.com/gemini/enterprise/docs/connectors/connect-third-party-data-source.md.txt). Feature **Gemini Enterprise: New data stores and support for new actions (Preview)** The following data stores are available in Public Preview in Gemini Enterprise: - [Adobe Workfront](https://docs.cloud.google.com/gemini/enterprise/docs/connectors/adobe-workfront.md.txt) - [Kiwi.com](https://docs.cloud.google.com/gemini/enterprise/docs/connectors/kiwi-com.md.txt) - [Squarespace](https://docs.cloud.google.com/gemini/enterprise/docs/connectors/squarespace.md.txt) - [Starburst](https://docs.cloud.google.com/gemini/enterprise/docs/connectors/starburst.md.txt) - [Windsor.ai](https://docs.cloud.google.com/gemini/enterprise/docs/connectors/windsor-ai.md.txt) (actions supported) You can search and read data from these data stores, and perform actions using natural language. **Gemini Enterprise Agent Platform** Feature **xAI's Grok 4.6 is generally available** [Grok 4.6](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/partner-models/grok/grok-4-6.md.txt) is now [generally available (GA)](https://cloud.google.com/products#product-launch-stages) and available for production use on the global endpoint and the US multi-region endpoint. Breaking **Agent Platform SDK for Python version 2.0.1 is available** Version 2.0.1 of the Agent Platform SDK for Python (`google-cloud-agentplatform`) is now available. This release migrates generative AI modules to the Google Gen AI SDK, decouples the agent surface from `google-cloud-aiplatform` into a dedicated package, and introduces restructured namespaces. For details and migration instructions from `google-cloud-aiplatform`, see the [Agent Platform SDK for Python version 2.0.1 migration guide](https://docs.cloud.google.com/gemini-enterprise-agent-platform/machine-learning/python-sdk/sdk-migration.md.txt). **Google Cloud Contact Center as a Service** Announcement **Google Cloud CCaaS 6.13** We've released version 6.13 of Google Cloud CCaaS. The timing of the update to your instance depends on the deployment schedule that you have chosen. For more information, see [Deployment schedules](https://docs.cloud.google.com/contact-center/ccai-platform/docs/deployment-schedules). Fixed This release addresses the following issues: - Fixed an issue where session metadata and data feed files were missing from external storage for chats that ended before the first message from the end-user. - Fixed an issue with Kustomer integrations where the caller's information didn't appear on the **Incoming call** page of the call adapter for direct-line inbound calls. - Fixed an issue with inbound mobile calls where the end-user leg of the call failed, returning `Unknown error`, while the agent leg connected normally. - Fixed an agent desktop issue where live call and chat data were lost. - Fixed an issue that occurred when the receiving agent in an agent-to-agent transfer didn't answer the call. The receiving agent was marked as active on the call indefinitely, even after the call ended. - Fixed an issue where the **Dismiss** button remained active after an agent sent a message, resulting in a 409 error when clicked. - Fixed an issue where duplicate "chat finished" events were reported when the end-user left a chat session at nearly the same time that the agent ended the chat session. - Fixed an issue where deflected calls were missing from the **All Call History** and **Voice Inbound (IVR) History** reports. - Fixed an issue that occurred when a direct inbound call was deflected to the agent's overcapacity queue, then that queue redirected to a SIP URI. The SIP redirect didn't include the custom SIP headers. - Fixed an issue where an in-queue announcement interval of several minutes for inbound IVR calls was incorrectly reduced to approximately 60 seconds. - Fixed an issue where calls that agents were unable to answer due to microphone failures were incorrectly reported as "picked up" in the **Agent Activity Timeline** report. - Fixed an issue where the system incorrectly marked agents as still being on a call after it ended, which either prevented them from changing their status to **Available** or silently blocked them from receiving new calls. - Fixed an issue where processing delays for ended calls caused timeout errors. - Fixed an issue where a sudden spike in calls bypassed capacity limits, causing agent availability to drop below required minimums. - Fixed an issue where the **Agent Activity Timeline** report incorrectly attributed manual agent logins and logouts to **System** instead of the appropriate agents. - Fixed an issue where calls with a missed offer became permanently stuck in the queue, preventing them from being routed to other available agents. This occurred with queues configured with multicast fallback disabled. - Fixed an issue where manual or cascade outbound calls that were canceled before connecting were missing from team-filtered **Call History** reports. - Fixed an issue that prevented over-capacity deflection from triggering when an agent warm-transferred an outbound call to a queue. - Fixed an issue where calls weren't correctly routed to the top-ranked agent when using agent priority overrides. - Fixed an issue where escalated voice calls were incorrectly reported as both answered and abandoned. - Fixed an issue where calls were missing from the **All Call History** and **Voice Inbound History** reports if the caller hung up before leaving a voicemail. - Fixed an issue where Salesforce click-to-dial outbound calls were incorrectly associated with the most recent open case instead of the case from which the call was initiated. - Fixed an issue where email accounts remained disconnected indefinitely after a temporary authentication failure. - Fixed an issue in Agent Assist where long periods of silence during calls caused connection timeouts, triggering false-positive error alerts. - Fixed an issue where the **arrow-down-icon** and **arrow-up-icon** arrows on the **Agents \> Filter Settings** page were rendered at an incorrect scale. - Fixed an issue where incoming calls incorrectly created duplicate Salesforce accounts instead of linking to existing accounts. - Fixed an issue where the outbound call queue list displayed stale information, potentially causing calls to be placed in a queue that didn't match the agent's selected language. - Fixed an issue where the menus for transferring calls and forwarding calls to voicemail appeared in English instead of the agent's selected language. - Fixed an issue where the wrap-up disposition panel froze after a network reconnection even though the submission had completed successfully. - Fixed an issue where outbound, click-to-dial calls initiated in Salesforce incorrectly linked to and reassigned ownership of other cases associated with the same phone number. - Fixed an issue where the agent adapter went blank and prevented new calls from reaching the agent if an end-user hung up immediately after the agent received the call notification. - Fixed an issue where calls that failed to connect got stuck in a silent 'connecting' state in the call adapter. - Fixed an issue where Salesforce CRM connections dropped for organizations enforcing OAuth Refresh Token Rotation. - Fixed an issue where part of an agent's audio was dropped from recordings when a virtual task assistant ran in the middle of a call. - Fixed a web SDK issue where menus in the pre-chat and chat screens didn't comply with WAI-ARIA keyboard navigation standards. - Fixed a web SDK issue where screen readers couldn't identify the purpose of the **Text size** options for the chat screen. Announcement **Advanced reporting dashboards 6.4** We've released version 6.4 of the advanced reporting dashboards. Feature **Real-time Agent Monitoring dashboard: new Active call ID(s) column** The **Real-time Agent Monitoring** dashboard now has an **Active Call ID(s)** column in the **Live Agent Data** table. The column displays the call ID(s) for any call in a connecting, connected, or reconnecting state for the agent. If an agent is handling multiple concurrent calls, the call IDs appear in a comma-separated list. The **Active Call ID(s)** column reduces the number of steps required for supervisors to identify active calls during live monitoring. Feature **Improved filtering by team** We made the following changes to team-based filtering: - Renamed the **Teams** filter to **Agent Teams** to clarify that it filters by the agent team handling the interactions. This change is in the **Real-time Queue Monitoring - Calls** , **Real-time Queue Monitoring - Chats** , **Real-time Connected - Calls** , and **Real-time Connected - Chats** dashboards. For more information, see [Queue monitoring dashboards](https://docs.cloud.google.com/contact-center/ccai-platform/docs/dashboards-real-time-queue-monitor), [Real-time Connected - Calls dashboard](https://docs.cloud.google.com/contact-center/ccai-platform/docs/dashboards-calls-connected), and [Real-time Connected - Chats dashboard](https://docs.cloud.google.com/contact-center/ccai-platform/docs/dashboards-chats-connected). - Added a **Queue Teams** filter to the **Real-time Queued - Calls** and **Real-time Queued - Chats** dashboards. This lets you filter queued interactions by the team assigned to the queue. Feature **Improved the Real-time Calls and Real-time Chats dashboards** We made the following dashboard improvements: - **Real-time Calls - Calls Connected dashboard** . Added the following columns to the **Connected Calls** table: - **Total Consumer Talk Time**. Total time since the call first connected to a virtual agent or a human agent. - **Total Hold Time**. Total time the call has spent on hold so far, including a hold currently in progress. - **Real-time Chats - Chats Connected dashboard** . Added the following column to the **Connected Chats** table: - **Total Consumer Chat Time**. Total time since the chat first connected to a virtual agent or a human agent. Feature **Real-time Calls - Calls Queued dashboard: new Projecting column** The **Real-time Calls - Calls Queued** dashboard has a new **Projecting** column in the **Call Queued** table. Indicates whether the routing engine (deltacast) is currently projecting this queued call to an available agent. Feature **Advanced reporting available in French Canadian** All advanced reporting dashboards and Explores are now available in French Canadian. When you select French Canadian as your profile language in the CCAI Platform portal, these dashboards and Explores display in that language. Administrators: There's a new **Français (CAN)** option when you click **Admin \> Change Language** in the CCAI Platform portal. Fixed This release addresses the following issues: - Fixed an issue where the formatting of numeric values was inconsistent across tiles. - Fixed an issue where column headers, filter labels, and tile titles didn't immediately switch to a newly selected language. - Fixed an issue where the **Productive Agents** column in the tables of the **Queue Group Performance - All** dashboard didn't display values appropriate to the queue group settings. - Fixed an issue in the **Call Queue Metrics (Historical)** Explore where filtering by **Agent Name** without including it as a visible column resulted in zero rows being returned. - Fixed an issue that affected calls to a sub-menu that were deflected using **Custom After Hours Deflection** to a message. These calls were incorrectly attributed to the parent menu in the **All Queued Interactions** report. - Fixed the effectiveness of the **Direction** filter in the following dashboards: - **Agent Performance** . The **Agent Productivity Detailed -- Calls** and **Agent Productivity Detailed -- Chats** tables correctly reflect the filter setting. - **Real-time Agent Monitoring** . The **Agent Performance** table and historical metrics tiles correctly reflect the filter setting. - **All Interactions -- Calls** and **All Interactions -- Chats** . The **IVR Interactions** (calls only) and **Virtual Agent Interactions** tables correctly reflect the filter setting. - Fixed an issue with the **Queue Performance - Calls** dashboard when short abandons were present in the specified date range. The **Avg Queue Time** column in the **Queue Summary** table incorrectly displayed the raw sum of queue durations instead of a true average. - Fixed an issue where team filters didn't apply correctly when generating the **Individual Call History Report** and the **Individual Chat History Report**. This resulted in the inclusion of data from unmanaged queues. - Fixed an issue where French Canadian translations for several dashboard metrics and labels were incorrect, incomplete, or missing. - Fixed the following issues with the **Real-time Calls - Calls Queued** dashboard: - The **Total Queued Now** metric didn't include callers who were returned to the queue after an automated-answer detection miss. - The **Current Max Queue Wait Time (H:M:S)** and **Current Avg Queue Wait Time (H:M:S)** metrics mistakenly measured from a caller's original entry into the queue, rather than from their most recent return to the queue. - Fixed an issue where a gray bar appeared at the bottom of the advanced reporting dashboards, preventing a full view of the dashboards. **Google SecOps** Feature **Resizable side panels in the Investigation Management experience** You can now dynamically resize the **Case preview** and **Alert and detection preview** side panels in the revamped **Investigation Management** experience in Google SecOps. You can adjust the panel width using your mouse or keyboard shortcuts to view detailed telemetry, parsed UDM records, and raw logs without navigating away from your main case queue. To explore the complete triage workflow, see [Investigation and case management overview](https://docs.cloud.google.com/chronicle/docs/secops/investigate/investigation-management/investigation-management-overview.md.txt). **Memorystore for Valkey** Feature The [basic token-based authentication](https://docs.cloud.google.com/memorystore/docs/valkey/manage-basic-auth.md.txt) feature is [generally available](https://docs.cloud.google.com/products#product-launch-stages). **Model Armor** Feature Filter version `v4` is available and set as the default for the `Latest` alias. Filter version `v3` is promoted to the `Stable` alias in all supported regions except the following: - In `asia-northeast3`, `v1` remains the `Stable` version. - In `australia-southeast2`, `v3` becomes the `Stable` version on September 25, 2026. If your templates use the `Stable` alias, they automatically upgrade to `v3` when `v3` becomes `Stable` in that region. Filter versions `v1` (except in `asia-northeast3`, and starting September 25, 2026 in `australia-southeast2`) and `v2` transition to `Legacy` status and retire on December 17, 2026. If your templates are explicitly configured with `v1` or `v2` in regions where those versions are in `Legacy` status, you must migrate them to `v3` or the `Stable` alias before December 17, 2026. For more information, see [Version release timeline](https://docs.cloud.google.com/model-armor/set-filter-version#release-timeline) and [Model Armor filter version history](https://docs.cloud.google.com/model-armor/version-history#release-history). **Spanner** Feature Spanner supports automatic parameterization of SQL query literals to improve query performance, reduce latency, and lower CPU costs. Spanner converts literal values hardcoded in CRUD-style queries, such as primary key lookups, index lookups, and primary key joins, into query parameters, allowing execution plans to be cached and reused to reduce latency and CPU costs. For more information, see [Use query parameters](https://docs.cloud.google.com/spanner/docs/sql-best-practices.md.txt#query-parameters) and statement hints ([GoogleSQL](https://docs.cloud.google.com/spanner/docs/reference/standard-sql/query-syntax.md.txt#statement_hints) and [PostgreSQL](https://docs.cloud.google.com/spanner/docs/reference/postgresql/query-syntax.md.txt#statement-hints)). ## September 17, 2026 **Anti Money Laundering AI** Announcement New minor engine versions released for the retail line of business within the `v004.005`, `v004.009`, and `v004.010` version lines (`aml-retail.default.v004.005.202608-000`, `aml-retail.default.v004.009.202608-000`, and `aml-retail.default.v004.010.202608-000`). These versions extend support for the major engine version and include no significant changes compared to the previous minor versions. **Apigee hybrid** Announcement ### v1.16.10 On September 17, 2026 we released an updated version of the Apigee hybrid software, v1.16.10. - For information on upgrading, see [Upgrading Apigee hybrid to version v1.16.10](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/upgrade.md.txt). - For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/big-picture.md.txt). > [!NOTE] > **Note:** This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images). Fixed #### Fixed in this release | Bug ID | Description | |---|---| | **556750755** | **Fixed an issue where EventFlow (Server-Sent Events) dropped or truncated events following a large (\>16 KB) event under load on the `http-adaptor` datapath.** | | **547712217** | **Fixed an issue where EventFlow (Server-Sent Events) responses larger than 16 KB could be truncated or corrupted across socket reads.** | | **519729209** | **Fixed a SAML XML Signature Wrapping (XSW) vulnerability in the `ValidateSAMLAssertion` policy.** | | **514384893** | **Hardened the `Script` policy to block server-side request forgery (SSRF) to link-local addresses.** | | **505645076** | **Fixed a security issue in the `OAuthV2` policy to prevent unauthorized token injection via HTTP form parameters.** | | **505543289** | **Fixed thread-safety issues in the Netty client connection pool and channel lifecycle.** | | **503817773** | **Improved security in the `OAuthV2` policy implicit grant `redirect_uri` validation.** | | **502268966** | **Apigee hybrid now supports optional decoding of percent-encoded path separators (`%2F` and `%5C`) before flow selection via the `request.path.decode.encoded.separators` proxy property.** | | **480770263** | **Fixed an issue in the `SpikeArrest` policy to handle edge cases that previously caused `NullPointerException` and `500` errors.** | | **472526232** | **Improved SAML assertion validation in the `ValidateSAMLAssertion` policy against entity and comment injection.** | | **470375542** | **Fixed a memory leak in `WSFrameDecoder` that could result in a spike in `503` responses with `no_healthy_upstream` errors.** | | **449228485** | **Apigee hybrid now supports configuring custom Kubernetes `PodDisruptionBudget` (`minAvailable` or `maxUnavailable`) values for Apigee hybrid components in your `overrides.yaml` file. These overrides take effect from Apigee hybrid v1.16.11, which adds the `podDisruptionBudget` field to the CRDs in the `apigee-operator` chart.** | | **402250928** | **Apigee hybrid now supports routing outbound calls from AI policies, such as the Model Armor and semantic caching policies, through an HTTP forward proxy.** | Feature **Kubernetes 1.36 support** Apigee hybrid v1.16.10 adds support for Kubernetes 1.36 on Google Kubernetes Engine (GKE), Google Distributed Cloud Virtual for VMware (vSphere), Google Distributed Cloud Virtual for bare metal, Amazon EKS, Azure AKS, and Rancher Kubernetes Engine (RKE2). For more information, see [Supported platforms](https://docs.cloud.google.com/apigee/docs/hybrid/supported-platforms.md.txt). Feature **Forward proxy support for AI policies** Apigee hybrid v1.16.10 adds forward proxy support for AI policies, such as the Model Armor and semantic caching policies. Outbound calls from these policies can now be routed through an HTTP forward proxy. For more information, see [Configure a forward proxy](https://docs.cloud.google.com/apigee/docs/hybrid/v1.16/forward-proxy.md.txt), [Get started with the Model Armor policies](https://docs.cloud.google.com/apigee/docs/api-platform/tutorials/using-model-armor-policies.md.txt), and [Get started with semantic caching policies](https://docs.cloud.google.com/apigee/docs/api-platform/tutorials/using-semantic-caching-policies.md.txt). Security | Bug ID | Description | |---|---| | **N/A** | **Security fixes for `apigee-asm-ingress`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) | | **N/A** | **Security fixes for `apigee-asm-istiod`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) | | **N/A** | **Security fixes for `apigee-connect-agent`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) | | **N/A** | **Security fixes for `apigee-fluent-bit`.** This addresses the following vulnerabilities: - [CVE-2025-13151](https://nvd.nist.gov/vuln/detail/CVE-2025-13151) - [CVE-2025-14524](https://nvd.nist.gov/vuln/detail/CVE-2025-14524) - [CVE-2025-14819](https://nvd.nist.gov/vuln/detail/CVE-2025-14819) - [CVE-2026-14456](https://nvd.nist.gov/vuln/detail/CVE-2026-14456) - [CVE-2026-14457](https://nvd.nist.gov/vuln/detail/CVE-2026-14457) - [CVE-2026-14662](https://nvd.nist.gov/vuln/detail/CVE-2026-14662) - [CVE-2026-14663](https://nvd.nist.gov/vuln/detail/CVE-2026-14663) - [CVE-2026-14664](https://nvd.nist.gov/vuln/detail/CVE-2026-14664) - [CVE-2026-14666](https://nvd.nist.gov/vuln/detail/CVE-2026-14666) - [CVE-2026-14668](https://nvd.nist.gov/vuln/detail/CVE-2026-14668) - [CVE-2026-14669](https://nvd.nist.gov/vuln/detail/CVE-2026-14669) - [CVE-2026-14670](https://nvd.nist.gov/vuln/detail/CVE-2026-14670) - [CVE-2026-14671](https://nvd.nist.gov/vuln/detail/CVE-2026-14671) - [CVE-2026-14672](https://nvd.nist.gov/vuln/detail/CVE-2026-14672) - [CVE-2026-14673](https://nvd.nist.gov/vuln/detail/CVE-2026-14673) - [CVE-2026-14677](https://nvd.nist.gov/vuln/detail/CVE-2026-14677) - [CVE-2026-14678](https://nvd.nist.gov/vuln/detail/CVE-2026-14678) - [CVE-2026-14679](https://nvd.nist.gov/vuln/detail/CVE-2026-14679) - [CVE-2026-14680](https://nvd.nist.gov/vuln/detail/CVE-2026-14680) - [CVE-2026-14681](https://nvd.nist.gov/vuln/detail/CVE-2026-14681) - [CVE-2026-15741](https://nvd.nist.gov/vuln/detail/CVE-2026-15741) - [CVE-2026-15742](https://nvd.nist.gov/vuln/detail/CVE-2026-15742) - [CVE-2026-16239](https://nvd.nist.gov/vuln/detail/CVE-2026-16239) - [CVE-2026-16241](https://nvd.nist.gov/vuln/detail/CVE-2026-16241) - [CVE-2026-18024](https://nvd.nist.gov/vuln/detail/CVE-2026-18024) - [CVE-2026-18408](https://nvd.nist.gov/vuln/detail/CVE-2026-18408) - [CVE-2026-18798](https://nvd.nist.gov/vuln/detail/CVE-2026-18798) - [CVE-2026-19385](https://nvd.nist.gov/vuln/detail/CVE-2026-19385) - [CVE-2026-1965](https://nvd.nist.gov/vuln/detail/CVE-2026-1965) - [CVE-2026-34743](https://nvd.nist.gov/vuln/detail/CVE-2026-34743) - [CVE-2026-3783](https://nvd.nist.gov/vuln/detail/CVE-2026-3783) - [CVE-2026-3784](https://nvd.nist.gov/vuln/detail/CVE-2026-3784) - [CVE-2026-3805](https://nvd.nist.gov/vuln/detail/CVE-2026-3805) - [CVE-2026-4873](https://nvd.nist.gov/vuln/detail/CVE-2026-4873) - [CVE-2026-54874](https://nvd.nist.gov/vuln/detail/CVE-2026-54874) - [CVE-2026-5545](https://nvd.nist.gov/vuln/detail/CVE-2026-5545) - [CVE-2026-5773](https://nvd.nist.gov/vuln/detail/CVE-2026-5773) - [CVE-2026-6253](https://nvd.nist.gov/vuln/detail/CVE-2026-6253) - [CVE-2026-6276](https://nvd.nist.gov/vuln/detail/CVE-2026-6276) - [CVE-2026-63072](https://nvd.nist.gov/vuln/detail/CVE-2026-63072) - [CVE-2026-63073](https://nvd.nist.gov/vuln/detail/CVE-2026-63073) - [CVE-2026-63074](https://nvd.nist.gov/vuln/detail/CVE-2026-63074) - [CVE-2026-63075](https://nvd.nist.gov/vuln/detail/CVE-2026-63075) - [CVE-2026-63076](https://nvd.nist.gov/vuln/detail/CVE-2026-63076) - [CVE-2026-6429](https://nvd.nist.gov/vuln/detail/CVE-2026-6429) - [CVE-2026-6464](https://nvd.nist.gov/vuln/detail/CVE-2026-6464) - [CVE-2026-6469](https://nvd.nist.gov/vuln/detail/CVE-2026-6469) - [CVE-2026-6470](https://nvd.nist.gov/vuln/detail/CVE-2026-6470) - [CVE-2026-6471](https://nvd.nist.gov/vuln/detail/CVE-2026-6471) - [CVE-2026-6473](https://nvd.nist.gov/vuln/detail/CVE-2026-6473) - [CVE-2026-7168](https://nvd.nist.gov/vuln/detail/CVE-2026-7168) - [CVE-2026-75803](https://nvd.nist.gov/vuln/detail/CVE-2026-75803) | | **N/A** | **Security fixes for `apigee-hybrid-cassandra-client`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) | | **N/A** | **Security fixes for `apigee-mart-server`.** This addresses the following vulnerabilities: - [CVE-2026-55831](https://nvd.nist.gov/vuln/detail/CVE-2026-55831) - [CVE-2026-55833](https://nvd.nist.gov/vuln/detail/CVE-2026-55833) - [CVE-2026-56745](https://nvd.nist.gov/vuln/detail/CVE-2026-56745) - [CVE-2026-56746](https://nvd.nist.gov/vuln/detail/CVE-2026-56746) - [CVE-2026-56819](https://nvd.nist.gov/vuln/detail/CVE-2026-56819) - [CVE-2026-59898](https://nvd.nist.gov/vuln/detail/CVE-2026-59898) - [CVE-2026-59899](https://nvd.nist.gov/vuln/detail/CVE-2026-59899) - [CVE-2026-59900](https://nvd.nist.gov/vuln/detail/CVE-2026-59900) - [CVE-2026-59901](https://nvd.nist.gov/vuln/detail/CVE-2026-59901) - [CVE-2026-59903](https://nvd.nist.gov/vuln/detail/CVE-2026-59903) - [CVE-2026-59921](https://nvd.nist.gov/vuln/detail/CVE-2026-59921) - [CVE-2026-73508](https://nvd.nist.gov/vuln/detail/CVE-2026-73508) - [CVE-2026-75595](https://nvd.nist.gov/vuln/detail/CVE-2026-75595) - [CVE-2026-75596](https://nvd.nist.gov/vuln/detail/CVE-2026-75596) | | **N/A** | **Security fixes for `apigee-mint-task-scheduler`.** This addresses the following vulnerabilities: - [CVE-2026-55831](https://nvd.nist.gov/vuln/detail/CVE-2026-55831) - [CVE-2026-55833](https://nvd.nist.gov/vuln/detail/CVE-2026-55833) - [CVE-2026-56745](https://nvd.nist.gov/vuln/detail/CVE-2026-56745) - [CVE-2026-56746](https://nvd.nist.gov/vuln/detail/CVE-2026-56746) - [CVE-2026-56819](https://nvd.nist.gov/vuln/detail/CVE-2026-56819) - [CVE-2026-59898](https://nvd.nist.gov/vuln/detail/CVE-2026-59898) - [CVE-2026-59899](https://nvd.nist.gov/vuln/detail/CVE-2026-59899) - [CVE-2026-59900](https://nvd.nist.gov/vuln/detail/CVE-2026-59900) - [CVE-2026-59901](https://nvd.nist.gov/vuln/detail/CVE-2026-59901) - [CVE-2026-59903](https://nvd.nist.gov/vuln/detail/CVE-2026-59903) - [CVE-2026-59921](https://nvd.nist.gov/vuln/detail/CVE-2026-59921) - [CVE-2026-73508](https://nvd.nist.gov/vuln/detail/CVE-2026-73508) - [CVE-2026-75595](https://nvd.nist.gov/vuln/detail/CVE-2026-75595) - [CVE-2026-75596](https://nvd.nist.gov/vuln/detail/CVE-2026-75596) | | **N/A** | **Security fixes for `apigee-open-telemetry-collector`.** This addresses the following vulnerability: - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) | | **N/A** | **Security fixes for `apigee-operators`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) - [GHSA-w67g-5rqw-f597](https://osv.dev/vulnerability/GHSA-w67g-5rqw-f597) | | **N/A** | **Security fixes for `apigee-prom-prometheus`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) | | **N/A** | **Security fixes for `apigee-prometheus-adapter`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) | | **N/A** | **Security fixes for `apigee-redis`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-46600](https://nvd.nist.gov/vuln/detail/CVE-2026-46600) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) | | **N/A** | **Security fixes for `apigee-runtime`.** This addresses the following vulnerabilities: - [CVE-2026-55831](https://nvd.nist.gov/vuln/detail/CVE-2026-55831) - [CVE-2026-55833](https://nvd.nist.gov/vuln/detail/CVE-2026-55833) - [CVE-2026-56745](https://nvd.nist.gov/vuln/detail/CVE-2026-56745) - [CVE-2026-56746](https://nvd.nist.gov/vuln/detail/CVE-2026-56746) - [CVE-2026-56819](https://nvd.nist.gov/vuln/detail/CVE-2026-56819) - [CVE-2026-59898](https://nvd.nist.gov/vuln/detail/CVE-2026-59898) - [CVE-2026-59899](https://nvd.nist.gov/vuln/detail/CVE-2026-59899) - [CVE-2026-59900](https://nvd.nist.gov/vuln/detail/CVE-2026-59900) - [CVE-2026-59901](https://nvd.nist.gov/vuln/detail/CVE-2026-59901) - [CVE-2026-59903](https://nvd.nist.gov/vuln/detail/CVE-2026-59903) - [CVE-2026-59921](https://nvd.nist.gov/vuln/detail/CVE-2026-59921) - [CVE-2026-73508](https://nvd.nist.gov/vuln/detail/CVE-2026-73508) - [CVE-2026-75595](https://nvd.nist.gov/vuln/detail/CVE-2026-75595) - [CVE-2026-75596](https://nvd.nist.gov/vuln/detail/CVE-2026-75596) | | **N/A** | **Security fixes for `apigee-synchronizer`.** This addresses the following vulnerabilities: - [CVE-2026-55831](https://nvd.nist.gov/vuln/detail/CVE-2026-55831) - [CVE-2026-55833](https://nvd.nist.gov/vuln/detail/CVE-2026-55833) - [CVE-2026-56745](https://nvd.nist.gov/vuln/detail/CVE-2026-56745) - [CVE-2026-56746](https://nvd.nist.gov/vuln/detail/CVE-2026-56746) - [CVE-2026-56819](https://nvd.nist.gov/vuln/detail/CVE-2026-56819) - [CVE-2026-59898](https://nvd.nist.gov/vuln/detail/CVE-2026-59898) - [CVE-2026-59899](https://nvd.nist.gov/vuln/detail/CVE-2026-59899) - [CVE-2026-59900](https://nvd.nist.gov/vuln/detail/CVE-2026-59900) - [CVE-2026-59901](https://nvd.nist.gov/vuln/detail/CVE-2026-59901) - [CVE-2026-59903](https://nvd.nist.gov/vuln/detail/CVE-2026-59903) - [CVE-2026-59921](https://nvd.nist.gov/vuln/detail/CVE-2026-59921) - [CVE-2026-73508](https://nvd.nist.gov/vuln/detail/CVE-2026-73508) - [CVE-2026-75595](https://nvd.nist.gov/vuln/detail/CVE-2026-75595) - [CVE-2026-75596](https://nvd.nist.gov/vuln/detail/CVE-2026-75596) | | **N/A** | **Security fixes for `apigee-watcher`.** This addresses the following vulnerabilities: - [CVE-2026-33818](https://nvd.nist.gov/vuln/detail/CVE-2026-33818) - [CVE-2026-39821](https://nvd.nist.gov/vuln/detail/CVE-2026-39821) - [CVE-2026-56853](https://nvd.nist.gov/vuln/detail/CVE-2026-56853) - [CVE-2026-56858](https://nvd.nist.gov/vuln/detail/CVE-2026-56858) - [CVE-2026-56859](https://nvd.nist.gov/vuln/detail/CVE-2026-56859) - [CVE-2026-56860](https://nvd.nist.gov/vuln/detail/CVE-2026-56860) - [CVE-2026-56862](https://nvd.nist.gov/vuln/detail/CVE-2026-56862) - [CVE-2026-56864](https://nvd.nist.gov/vuln/detail/CVE-2026-56864) - [CVE-2026-56865](https://nvd.nist.gov/vuln/detail/CVE-2026-56865) - [CVE-2026-84303](https://nvd.nist.gov/vuln/detail/CVE-2026-84303) - [CVE-2026-84304](https://nvd.nist.gov/vuln/detail/CVE-2026-84304) - [CVE-2026-84445](https://nvd.nist.gov/vuln/detail/CVE-2026-84445) - [GHSA-hrxh-6v49-42gf](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) | **BigQuery** Feature You can [add unit tests](https://docs.cloud.google.com/dataform/docs/test-data.md.txt#unit-tests) to pipelines to validate your SQL transformation logic against mock datasets. Unit tests for pipelines are [generally available](https://cloud.google.com/products#product-launch-stages) (GA). **Cloud Asset Inventory** Feature The following resource type is publicly available through the [ExportAssets](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/exportAssets.md.txt), [ListAssets](https://docs.cloud.google.com/asset-inventory/docs/listing-assets), [BatchGetAssetsHistory](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/batchGetAssetsHistory.md.txt), [QueryAssets](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/queryAssets.md.txt), and [Feed](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/feeds.md.txt) APIs. - Cloud TPU API - `tpu.googleapis.com/QueuedResource` Feature The following resource types are publicly available through the [ExportAssets](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/exportAssets.md.txt), [ListAssets](https://docs.cloud.google.com/asset-inventory/docs/listing-assets), [BatchGetAssetsHistory](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/batchGetAssetsHistory.md.txt), [QueryAssets](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/queryAssets.md.txt), [Feed](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/feeds.md.txt), [SearchAllResources](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/searchAllResources.md.txt), and [SearchAllIamPolicies](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/searchAllIamPolicies.md.txt) APIs. - Developer Connect - `developerconnect.googleapis.com/InsightsConfig` - Workload Manager - `workloadmanager.googleapis.com/Evaluation` **Cloud SQL for MySQL** Change Cloud SQL for MySQL now automatically enables point-in-time recovery (PITR) in a separate, asynchronous operation after disaster recovery (DR) switchover and replica failover operations complete. Because PITR enablement no longer blocks switchover and replica failover, these operations complete faster, helping you reduce your recovery time. For more information, see [Use advanced disaster recovery (DR)](https://docs.cloud.google.com/sql/docs/mysql/use-advanced-disaster-recovery.md.txt). **Cloud SQL for PostgreSQL** Change Cloud SQL for PostgreSQL now automatically enables point-in-time recovery (PITR) in a separate, asynchronous operation after disaster recovery (DR) switchover and replica failover operations complete. Because PITR enablement no longer blocks switchover and replica failover, these operations complete faster, helping you reduce your recovery time. For more information, see [Use advanced disaster recovery (DR)](https://docs.cloud.google.com/sql/docs/postgres/use-advanced-disaster-recovery.md.txt). **Compute Engine** Feature **Generally available**: The storage-optimized Z4D machine series is generally available for Compute Engine. Powered by AMD EPYC Turin processors and Titanium offload processors, Z4D instances are purpose-built for low core usage and high storage density workloads such as: - SQL, NoSQL, and vector databases - Data analytics and data warehouses - Search - Parallel file systems for AI/ML The Z4D machine series delivers up to 3 TB of memory and 42,000 GiB of local Titanium SSD capacity. Z4D also supports up to 400 Gbps of network bandwidth using two physical NICs. Z4D instances are available in predefined `standardlssd` and `highlssd` machine shapes. For more information, see [Storage-optimized machine family](https://docs.cloud.google.com/compute/docs/storage-optimized-machines.md.txt#z4d_series). **Container Optimized OS** Change ### cos-125-19216-655-28 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.12.105](https://cos.googlesource.com/third_party/kernel/+/8b85c09213b2044542f81eae6f4b12adafdf848e) | v27.5.1 | v2.2.7 | [See List](https://storage.googleapis.com/cos-tools/19216.655.28/lakitu/gpu_driver_versions.textproto) | Feature Fixed a performance issue in the GVE driver on multi-NUMA systems. Fixed Upgraded net-libs/libnftnl to v1.2.9. Security Fixed CVE-2026-80590 in the Linux kernel. Security Fixed CVE-2026-80737 in the Linux kernel. Security Fixed CVE-2026-80788 in the Linux kernel. Security Fixed CVE-2026-80789 in the Linux kernel. Security Fixed CVE-2026-80791 in the Linux kernel. Security Fixed CVE-2026-80792 in the Linux kernel. Security Fixed CVE-2026-80793 in the Linux kernel. Security Fixed CVE-2026-80805 in the Linux kernel. Security Fixed CVE-2026-80806 in the Linux kernel. Security Fixed CVE-2026-80808 in the Linux kernel. Security Fixed CVE-2026-80837 in the Linux kernel. Security Fixed CVE-2026-80838 in the Linux kernel. Security Fixed CVE-2026-80839 in the Linux kernel. Security Fixed CVE-2026-80842 in the Linux kernel. Security Fixed CVE-2026-80843 in the Linux kernel. Security Fixed CVE-2026-80845 in the Linux kernel. Security Fixed CVE-2026-80852 in the Linux kernel. Security Fixed CVE-2026-80854 in the Linux kernel. Security Fixed CVE-2026-80855 in the Linux kernel. Security Fixed CVE-2026-80856 in the Linux kernel. Security Fixed CVE-2026-80862 in the Linux kernel. Security Fixed CVE-2026-80916 in the Linux kernel. Security Fixed CVE-2026-80917 in the Linux kernel. Change Runtime sysctl changes: - Changed: net.ipv4.udp_mem: 188034 250714 376068 -\> 188034 250715 376068
Change ### cos-129-19506-448-36 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.12.105](https://cos.googlesource.com/third_party/kernel/+/043c0c8ea2535cc8f7eda40e60161f375a3878ad) | v27.5.1 | v2.2.7 | [See List](https://storage.googleapis.com/cos-tools/19506.448.36/lakitu/gpu_driver_versions.textproto) | Security Fixed CVE-2026-56391 in sys-apps/coreutils. Security Fixed CVE-2026-80590 in the Linux kernel. Security Fixed CVE-2026-80737 in the Linux kernel. Security Fixed CVE-2026-80788 in the Linux kernel. Security Fixed CVE-2026-80789 in the Linux kernel. Security Fixed CVE-2026-80791 in the Linux kernel. Security Fixed CVE-2026-80792 in the Linux kernel. Security Fixed CVE-2026-80793 in the Linux kernel. Security Fixed CVE-2026-80805 in the Linux kernel. Security Fixed CVE-2026-80806 in the Linux kernel. Security Fixed CVE-2026-80808 in the Linux kernel. Security Fixed CVE-2026-80837 in the Linux kernel. Security Fixed CVE-2026-80838 in the Linux kernel. Security Fixed CVE-2026-80839 in the Linux kernel. Security Fixed CVE-2026-80842 in the Linux kernel. Security Fixed CVE-2026-80843 in the Linux kernel. Security Fixed CVE-2026-80845 in the Linux kernel. Security Fixed CVE-2026-80852 in the Linux kernel. Security Fixed CVE-2026-80854 in the Linux kernel. Security Fixed CVE-2026-80855 in the Linux kernel. Security Fixed CVE-2026-80856 in the Linux kernel. Security Fixed CVE-2026-80862 in the Linux kernel. Security Fixed CVE-2026-80916 in the Linux kernel. Security Fixed CVE-2026-80917 in the Linux kernel. Change ### cos-117-18613-731-21 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.6.153](https://cos.googlesource.com/third_party/kernel/+/6ee831c40108c3b447bc8edad4c4ebd45b746574) | v24.0.9 | v1.7.34 | [See List](https://storage.googleapis.com/cos-tools/18613.731.21/lakitu/gpu_driver_versions.textproto) | Security Fixed CVE-2026-80590 in the Linux kernel. Security Fixed CVE-2026-80737 in the Linux kernel. Security Fixed CVE-2026-80788 in the Linux kernel. Security Fixed CVE-2026-80789 in the Linux kernel. Security Fixed CVE-2026-80791 in the Linux kernel. Security Fixed CVE-2026-80792 in the Linux kernel. Security Fixed CVE-2026-80793 in the Linux kernel. Security Fixed CVE-2026-80805 in the Linux kernel. Security Fixed CVE-2026-80806 in the Linux kernel. Security Fixed CVE-2026-80808 in the Linux kernel. Security Fixed CVE-2026-80842 in the Linux kernel. Security Fixed CVE-2026-80843 in the Linux kernel. Security Fixed CVE-2026-80852 in the Linux kernel. Security Fixed CVE-2026-80854 in the Linux kernel. Security Fixed CVE-2026-80855 in the Linux kernel. Security Fixed CVE-2026-80856 in the Linux kernel. Security Fixed CVE-2026-80916 in the Linux kernel. Security Fixed CVE-2026-80917 in the Linux kernel. Change ### cos-121-18867-584-23 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.6.153](https://cos.googlesource.com/third_party/kernel/+/94e66fe5faf0c54135ca57e0fc71495f3727f0e5) | v27.5.1 | v2.0.10 | [See List](https://storage.googleapis.com/cos-tools/18867.584.23/lakitu/gpu_driver_versions.textproto) | Security Fixed CVE-2026-80590 in the Linux kernel. Security Fixed CVE-2026-80737 in the Linux kernel. Security Fixed CVE-2026-80788 in the Linux kernel. Security Fixed CVE-2026-80789 in the Linux kernel. Security Fixed CVE-2026-80791 in the Linux kernel. Security Fixed CVE-2026-80792 in the Linux kernel. Security Fixed CVE-2026-80793 in the Linux kernel. Security Fixed CVE-2026-80805 in the Linux kernel. Security Fixed CVE-2026-80806 in the Linux kernel. Security Fixed CVE-2026-80808 in the Linux kernel. Security Fixed CVE-2026-80842 in the Linux kernel. Security Fixed CVE-2026-80843 in the Linux kernel. Security Fixed CVE-2026-80852 in the Linux kernel. Security Fixed CVE-2026-80854 in the Linux kernel. Security Fixed CVE-2026-80855 in the Linux kernel. Security Fixed CVE-2026-80856 in the Linux kernel. Security Fixed CVE-2026-80917 in the Linux kernel. Change ### cos-beta-133-19999-44-44 |---|---|---|---| | Kernel | Docker | Containerd | [GPU Drivers](https://cloud.google.com/container-optimized-os/docs/how-to/run-gpus) | | [COS-6.18.48](https://cos.googlesource.com/third_party/kernel/+/6bfdf4d7391f8e3426a22b132b8661067f86017a) | v29.4.3 | v2.3.4 | [See List](https://storage.googleapis.com/cos-tools/19999.44.44/lakitu/gpu_driver_versions.textproto) | Change Fixed CVE-2026-56391 in sys-apps/coreutils. Security Fixed CVE-2026-58470 in net-misc/wget. Security Fixed CVE-2026-59890 in dev-python/setuptools. Security Upgraded net-libs/nghttp2 to 1.69.0 and fixed CVE-2026-58055. **Dataform** Feature You can [use unit tests to test Dataform actions](https://docs.cloud.google.com/dataform/docs/test-data.md.txt#unit-tests) against mock data with an expected result set. Dataform unit tests are [generally available](https://cloud.google.com/products#product-launch-stages) (GA). **Gemini Enterprise** Announcement **Gemini Enterprise: Gemini Code Assist availability update for subscriptions** If you're getting a new Gemini Enterprise Standard or Plus subscription or renewing an existing subscription online, the subscription no longer includes access to Gemini Code Assist features. Existing subscriptions that include Gemini Code Assist features can still access the features until the end of their subscription term. Instead of Gemini Code Assist, you can use Antigravity for IDEs with AI developer tools. For more information, see [AI developer tools overview](https://docs.cloud.google.com/gemini/enterprise/docs/ai-developer-tools-overview). If you're still looking to use Gemini Code Assist with your Gemini Enterprise licenses, you can obtain a new Gemini Enterprise subscription that includes Gemini Code Assist by [contacting Google Cloud sales](https://cloud.google.com/contact). Feature **Gemini Enterprise: Voice input for the chat box** You can speak your queries and prompts to Gemini Enterprise. Use the microphone button to record your voice, review and edit the transcribed text, and then submit the text. This feature is generally available (GA). To make voice input available to users, a Gemini Enterprise administrator must turn on the **Enable speech-to-text** toggle in the Google Cloud console. For more information, see the following: - [Manage web app features](https://docs.cloud.google.com/gemini/enterprise/docs/manage-web-app-features.md.txt) - [Chat with the assistant](https://docs.cloud.google.com/gemini/enterprise/docs/assistant-chat.md.txt) **Gemini Enterprise Agent Platform** Feature **Gemini Omni Flash supports stateful and streaming video generation (Preview)** Gemini Omni Flash supports stateful (`store: true`) and server-sent event (SSE) streaming (`stream: true`) video generation in the Interactions API in [Preview](https://cloud.google.com/products#product-launch-stages). You can temporarily store generated videos and interaction state on the server, stream status updates and final outputs over an SSE connection, or retrieve completed asynchronous interactions using unary or streaming GET requests. For more information, see [Generate videos from text](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/video/generate-videos-from-text). **Google Cloud Armor** Feature Cloud Armor managed rulesets protect your backend services and APIs from a wide range of web application threats using threat signatures which are automatically kept up-to-date. For more information, see [Managed rules overview](https://docs.cloud.google.com/armor/docs/managed-rules-overview). This feature is available in Preview. **Google Distributed Cloud (software only) for VMware** Announcement Google Distributed Cloud (software only) for VMware 1.34.900-gke.135 is now available for download. To upgrade, see [Upgrade a cluster](https://docs.cloud.google.com/kubernetes-engine/distributed-cloud/vmware/docs/how-to/upgrading.md.txt). Google Distributed Cloud 1.34.900-gke.135 runs on Kubernetes v1.34.7-gke.200. If you use a third-party storage vendor, check the listing of our previously-qualified [storage partners](https://docs.cloud.google.com/kubernetes-engine/enterprise/docs/resources/partner-storage.md.txt). After a release, it takes approximately 7 to 14 days for the version to become available for use with GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform. Fixed The following issues were fixed in 1.34.900-gke.135: - Fixed vulnerabilities listed in [Vulnerability fixes](https://docs.cloud.google.com/kubernetes-engine/distributed-cloud/vmware/docs/vulnerabilities.md.txt). - Fixed an issue where user clusters repeatedly alternated between `Reconciling` and `Running` states if the management cluster configured a different pod density than the user cluster. - Updated `etcd` to `v3.5.33-0-gke.3` to address security vulnerabilities CVE-2026-46595 and CVE-2026-39821. - Fixed an issue where `gkectl diagnose` and preflight validations failed to locate `PersistentVolume` datastores for user clusters deployed in a separate vSphere datacenter from the admin cluster (`cpNodesInAdminDatacenter: true`). - Fixed an issue where deleting a cluster could get stuck because the node pool controller attempted to recreate machine resources while deletion was in progress. **Google Distributed Cloud (software only) for bare metal** Announcement Google Distributed Cloud (software only) for bare metal 1.34.900-gke.135 is now available for download. To upgrade, see [Upgrade clusters](https://docs.cloud.google.com/release-notes/how-to/upgrade). Google Distributed Cloud for bare metal 1.34.900-gke.135 runs on Kubernetes v1.34.7-gke.200. After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform. If you use a third-party storage vendor, check the listing of our previously-qualified [storage partners](https://docs.cloud.google.com/kubernetes-engine/enterprise/docs/resources/partner-storage.md.txt). Fixed The following issues were fixed in 1.34.900-gke.135: - Fixed vulnerabilities listed in [Vulnerability fixes](https://docs.cloud.google.com/kubernetes-engine/distributed-cloud/bare-metal/docs/vulnerabilities.md.txt). - Fixed an issue where the status for `Ingress` resources was not updated when using bundled Ingress. - Fixed an issue where user clusters repeatedly alternated between `reconciling` and `running` states if the management cluster had a different pod density configuration than the user cluster. - Updated `etcd` to `v3.5.33-0-gke.3` to address security vulnerabilities CVE-2026-46595 and CVE-2026-39821. - Fixed an issue where deleting a cluster could get stuck because the node pool controller attempted to recreate machine resources while cluster deletion was in progress. **Google Kubernetes Engine** Change #### (2026-R39) Version updates GKE cluster versions have been updated. **New versions available for upgrades and new clusters.** The following versions are now available for new GKE clusters, and for manual control plane upgrades and node upgrades for existing clusters. For more information about versioning and upgrades, see [GKE versioning and support](https://cloud.google.com/kubernetes-engine/versioning) and [About GKE cluster upgrades](https://cloud.google.com/kubernetes-engine/upgrades). ### Rapid channel > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.36.4-gke.1247000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1247000) is now the default version for cluster creation in the Rapid channel. - The following versions are now available in the Rapid channel: - [1.34.11-gke.1102000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1102000) - [1.35.8-gke.1439000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1439000) - [1.36.4-gke.1391000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391000) - [1.37.0-gke.3503000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-0-gke-3503000) - The following versions are no longer available in the Rapid channel: - 1.34.11-gke.1044000 - 1.35.8-gke.1225000 - 1.36.4-gke.1082000 - 1.37.0-gke.2941000 - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.11-gke.1056000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1056000) - 1.34 to [1.35.8-gke.1380000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1380000) - 1.35 to [1.36.4-gke.1247000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1247000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.11-gke.1056000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1056000) - 1.35 to [1.35.8-gke.1380000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1380000) - 1.36 to [1.36.4-gke.1247000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1247000) - 1.37 to [1.37.0-gke.3165000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-0-gke-3165000) ### Regular channel > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.35.8-gke.1036000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1036000) is now the default version for cluster creation in the Regular channel. - The following versions are now available in the Regular channel: - [1.34.11-gke.1044000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1044000) - [1.35.8-gke.1225000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1225000) - [1.36.4-gke.1082000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1082000) - The following versions are no longer available in the Regular channel: - 1.34.10-gke.1236000 - 1.35.7-gke.1222000 - 1.36.3-gke.1640000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Regular channel. This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.10-gke.1328000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-10-gke-1328000) - 1.34 to [1.35.8-gke.1036000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1036000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.10-gke.1328000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-10-gke-1328000) - 1.35 to [1.35.8-gke.1036000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1036000) - 1.36 to [1.36.3-gke.1767000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-3-gke-1767000) ### Stable channel > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.34.10-gke.1236000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-10-gke-1236000) is now available in the Stable channel. - Version 1.34.10-gke.1106000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Stable channel. This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or deprecated APIs, preventing upgrades: - 1.34 to [1.35.6-gke.1250000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-6-gke-1250000) ### Extended channel > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.35.8-gke.1036000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1036000) is now the default version for cluster creation in the Extended channel. - The following versions are now available in the Extended channel: - [1.31.14-gke.2630000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2630000) - [1.31.14-gke.2667000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2667000) - [1.31.14-gke.2704000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2704000) - [1.32.13-gke.2337000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2337000) - [1.32.13-gke.2393000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2393000) - [1.32.13-gke.2427000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2427000) - [1.33.13-gke.1547000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1547000) - [1.33.13-gke.1613000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1613000) - [1.33.13-gke.1647000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1647000) - [1.34.11-gke.1044000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1044000) - [1.35.8-gke.1225000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1225000) - [1.36.4-gke.1082000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1082000) - The following versions are no longer available in the Extended channel: - 1.31.14-gke.2579000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.31.14-gke.2613000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.31.14-gke.2689000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.32.13-gke.2268000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.32.13-gke.2314000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.32.13-gke.2411000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.33.13-gke.1329000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.33.13-gke.1499000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.33.13-gke.1636000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.34.10-gke.1236000 - 1.35.7-gke.1222000 - 1.36.3-gke.1640000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or deprecated APIs, preventing upgrades: - 1.30 to [1.31.14-gke.2630000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2630000) - 1.31 to [1.32.13-gke.2337000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2337000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or other factors preventing minor version upgrades: - 1.31 to [1.31.14-gke.2630000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2630000) - 1.32 to [1.32.13-gke.2337000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2337000) - 1.33 to [1.33.13-gke.1547000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1547000) - 1.34 to [1.34.10-gke.1328000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-10-gke-1328000) - 1.35 to [1.35.8-gke.1036000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1036000) - 1.36 to [1.36.3-gke.1767000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-3-gke-1767000) ### No channel (deprecated) > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.35.8-gke.1036000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1036000) is now the default version for cluster creation. - The following versions are now available: - [1.34.11-gke.1102000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1102000) - [1.35.8-gke.1439000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1439000) - [1.36.4-gke.1391000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391000) - The following node versions are now available: - [1.31.14-gke.2704000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2704000) - [1.32.13-gke.2427000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2427000) - [1.33.13-gke.1647000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1647000) - [1.34.11-gke.1102000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1102000) - [1.35.8-gke.1439000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1439000) - [1.36.4-gke.1391000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391000) - The following versions are no longer available: - 1.34.10-gke.1106000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.35.7-gke.1150000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.3-gke.1640000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.10-gke.1328000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-10-gke-1328000) - 1.34 to [1.35.6-gke.1250000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-6-gke-1250000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.10-gke.1328000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-10-gke-1328000) - 1.35 to [1.35.6-gke.1250000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-6-gke-1250000) - 1.36 to [1.36.3-gke.1767000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-3-gke-1767000) Security #### (2026-R39) Security updates This release includes new GKE versions that use updated Container-Optimized OS images. These updated images are cumulative, incorporating security fixes from all Container-Optimized OS versions released since the previous GKE release. To identify the specific vulnerabilities that were resolved in each updated Container-Optimized OS image, see the **Security** release notes for that image. The following table includes links to the release notes for each updated Container-Optimized OS image: | GKE version | Container-Optimized OS version | Details | |---|---|---| | 1.37.0-gke.3503000 | cos-129-19506-299-82 | [cos-129-19506-299-82 release notes](https://docs.cloud.google.com/container-optimized-os/docs/release-notes/m129.md.txt#cos-129-19506-299-82_) |
Change #### (2026-R39) Version updates > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.34.10-gke.1236000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-10-gke-1236000) is now available in the Stable channel. - Version 1.34.10-gke.1106000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Stable channel. This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or deprecated APIs, preventing upgrades: - 1.34 to [1.35.6-gke.1250000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-6-gke-1250000) Change #### (2026-R39) Version updates > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.35.8-gke.1036000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1036000) is now the default version for cluster creation in the Regular channel. - The following versions are now available in the Regular channel: - [1.34.11-gke.1044000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1044000) - [1.35.8-gke.1225000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1225000) - [1.36.4-gke.1082000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1082000) - The following versions are no longer available in the Regular channel: - 1.34.10-gke.1236000 - 1.35.7-gke.1222000 - 1.36.3-gke.1640000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Regular channel. This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.10-gke.1328000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-10-gke-1328000) - 1.34 to [1.35.8-gke.1036000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1036000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.10-gke.1328000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-10-gke-1328000) - 1.35 to [1.35.8-gke.1036000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1036000) - 1.36 to [1.36.3-gke.1767000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-3-gke-1767000) Change #### (2026-R39) Version updates > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.36.4-gke.1247000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1247000) is now the default version for cluster creation in the Rapid channel. - The following versions are now available in the Rapid channel: - [1.34.11-gke.1102000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1102000) - [1.35.8-gke.1439000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1439000) - [1.36.4-gke.1391000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391000) - [1.37.0-gke.3503000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-0-gke-3503000) - The following versions are no longer available in the Rapid channel: - 1.34.11-gke.1044000 - 1.35.8-gke.1225000 - 1.36.4-gke.1082000 - 1.37.0-gke.2941000 - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.11-gke.1056000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1056000) - 1.34 to [1.35.8-gke.1380000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1380000) - 1.35 to [1.36.4-gke.1247000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1247000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.11-gke.1056000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1056000) - 1.35 to [1.35.8-gke.1380000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1380000) - 1.36 to [1.36.4-gke.1247000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1247000) - 1.37 to [1.37.0-gke.3165000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.37.md.txt#1-37-0-gke-3165000) Change #### (2026-R39) Version updates > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.35.8-gke.1036000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1036000) is now the default version for cluster creation. - The following versions are now available: - [1.34.11-gke.1102000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1102000) - [1.35.8-gke.1439000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1439000) - [1.36.4-gke.1391000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391000) - The following node versions are now available: - [1.31.14-gke.2704000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2704000) - [1.32.13-gke.2427000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2427000) - [1.33.13-gke.1647000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1647000) - [1.34.11-gke.1102000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1102000) - [1.35.8-gke.1439000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1439000) - [1.36.4-gke.1391000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1391000) - The following versions are no longer available: - 1.34.10-gke.1106000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.35.7-gke.1150000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - 1.36.3-gke.1640000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support). This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or deprecated APIs, preventing upgrades: - 1.33 to [1.34.10-gke.1328000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-10-gke-1328000) - 1.34 to [1.35.6-gke.1250000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-6-gke-1250000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or other factors preventing minor version upgrades: - 1.34 to [1.34.10-gke.1328000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-10-gke-1328000) - 1.35 to [1.35.6-gke.1250000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-6-gke-1250000) - 1.36 to [1.36.3-gke.1767000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-3-gke-1767000) Change #### (2026-R39) Version updates > [!NOTE] > **Note**: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones. - Version [1.35.8-gke.1036000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1036000) is now the default version for cluster creation in the Extended channel. - The following versions are now available in the Extended channel: - [1.31.14-gke.2630000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2630000) - [1.31.14-gke.2667000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2667000) - [1.31.14-gke.2704000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2704000) - [1.32.13-gke.2337000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2337000) - [1.32.13-gke.2393000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2393000) - [1.32.13-gke.2427000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2427000) - [1.33.13-gke.1547000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1547000) - [1.33.13-gke.1613000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1613000) - [1.33.13-gke.1647000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1647000) - [1.34.11-gke.1044000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-11-gke-1044000) - [1.35.8-gke.1225000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1225000) - [1.36.4-gke.1082000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-4-gke-1082000) - The following versions are no longer available in the Extended channel: - 1.31.14-gke.2579000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.31.14-gke.2613000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.31.14-gke.2689000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.32.13-gke.2268000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.32.13-gke.2314000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.32.13-gke.2411000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.33.13-gke.1329000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.33.13-gke.1499000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.33.13-gke.1636000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - 1.34.10-gke.1236000 - 1.35.7-gke.1222000 - 1.36.3-gke.1640000 is [deprecated](https://docs.cloud.google.com/kubernetes-engine/versioning.md.txt#patch-version-support) in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner. - Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release: - GKE upgrades clusters to the following new minor versions if there are no factors, such as [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or deprecated APIs, preventing upgrades: - 1.30 to [1.31.14-gke.2630000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2630000) - 1.31 to [1.32.13-gke.2337000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2337000) - GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has [maintenance exclusions](https://docs.cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions.md.txt#exclusions) or other factors preventing minor version upgrades: - 1.31 to [1.31.14-gke.2630000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.31.md.txt#1-31-14-gke-2630000) - 1.32 to [1.32.13-gke.2337000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.32.md.txt#1-32-13-gke-2337000) - 1.33 to [1.33.13-gke.1547000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.33.md.txt#1-33-13-gke-1547000) - 1.34 to [1.34.10-gke.1328000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.34.md.txt#1-34-10-gke-1328000) - 1.35 to [1.35.8-gke.1036000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.35.md.txt#1-35-8-gke-1036000) - 1.36 to [1.36.3-gke.1767000](https://docs.cloud.google.com/kubernetes-engine/docs/changelogs/1.36.md.txt#1-36-3-gke-1767000) **Looker** Announcement **Looker 26.18** will roll out to Looker (original) instances on the following schedule: - Expected deployment start: **Monday, September 21, 2026** - Expected final deployment and download available: **Sunday, October 4, 2026** Looker 26.18 is expected to include the following changes, features, and fixes. Fixed An issue has been fixed where custom content theme fonts were improperly applied to the Look edit mode bar. This feature now performs as expected. Fixed An issue has been fixed where downloading a dashboard as a CSV or ZIP file could result in a `500` error if any dashboard elements lacked an explicit title. This feature now performs as expected. Fixed An issue has been fixed where links created using the LookML `link` parameter could return a `500` error if no label was specified. This feature now performs as expected. Fixed An issue has been fixed where dashboard filter token chips didn't display an active highlighted background when a filter value was selected. This feature now performs as expected. Fixed An issue has been fixed where the Git connection test could fail to recognize Git credentials as sufficient if a branch protection rule on the Git provider restricted temporary branches. This feature now performs as expected. Fixed An issue has been fixed where analytic models that referenced cross-database, schema-qualified, or dot-delimited table names failed to compile in BigQuery and Snowflake DDL generation. This feature now performs as expected. Fixed An issue has been fixed where custom tooltips in Single Record visualizations appeared at the bottom of the Explore panel rather than directly beneath the selected row. This feature now performs as expected. Fixed An issue has been fixed where dashboard filter tokens and popover menus could fail to inherit fonts from custom themes. This feature now performs as expected. Fixed An issue has been fixed where dragging series between Y-axes on pivoted Cartesian charts could cause the Explore page to crash or prevent visualization configurations from being saved. This feature now performs as expected. Fixed An issue has been fixed in Explores where you couldn't scroll within the **Chart Config Editor** dialog when editing JSON visualization configurations. This feature now performs as expected. Fixed An issue has been fixed where scheduled PDF deliveries to Cloud Storage could produce corrupted files and unexpectedly replace spaces in filenames with underscores. This feature now performs as expected. Fixed An issue has been fixed where attempting to visualize pivoted query results in SQL Runner resulted in a `TypeError` configuration error. This feature now performs as expected. Fixed API requests that target a LookML project whose files or directories aren't found on the instance now return a `404 Not Found` error instead of a `500 Internal Server Error`. Fixed In Conversational Analytics, the **Open in Explore** button and sidebar exploration links are now hidden or disabled with explanatory tooltips when you lack `explore` permissions for the underlying model. Fixed The embed preload page now supports custom theming using the `theme` URL query parameter. Fixed Donut Multiples visualizations now automatically hide overlapping value labels. Fixed An issue has been fixed in self-service analytics where CSV and Excel uploads to BigQuery and Snowflake could fail or corrupt data when files contained multiline headers, leading numeric characters, UTF-8 BOM markers, or special characters. This feature now performs as expected. Fixed An issue has been fixed where creating a shared branch based on the production branch in a bare repository project could initialize from stale remote commits, causing the Looker IDE to immediately report the branch as being behind production. This feature now performs as expected. Fixed An issue has been fixed where scheduled deliveries intermittently failed with permission errors such as `Cannot send all results` because user permissions were incorrectly cached across scheduled jobs on worker threads. This feature now performs as expected. **NetApp Volumes** Feature Organization Policy Service custom constraints are available for Google Cloud NetApp Volumes. You can use custom constraints to control how NetApp Volumes is used in your organization. For example, you can restrict storage pool or volume capacity, or enforce that storage pools are created only with Premium or Extreme service levels. For more information, see [Custom organization policy constraints](https://docs.cloud.google.com/netapp/volumes/docs/secure-control-access/custom-constraints.md.txt). **Oracle Database@Google Cloud** Feature For Exadata Database Service, Oracle Database@Google Cloud is available in `europe-west12` (Turin, Italy) region. For a list of supported locations, see [Supported regions and zones](https://docs.cloud.google.com/oracle/database/docs/regions-and-zones.md.txt). **Secure Web Proxy** Feature Secure Web Proxy supports [distributed tracing](https://docs.cloud.google.com/secure-web-proxy/docs/distributed-tracing-overview) by integrating with [Cloud Trace](https://docs.cloud.google.com/trace/docs/overview.md.txt). With distributed tracing, you can [track the lifecycle of outbound requests](https://docs.cloud.google.com/secure-web-proxy/docs/monitor-traces) from internal workloads through your Secure Web Proxy gateways to external endpoints. This integration helps you detect latency bottlenecks and troubleshoot connectivity errors. This feature is available in [Preview](https://cloud.google.com/products#product-launch-stages). **Spanner** Feature Spanner queues are [generally available (GA)](https://cloud.google.com/products/#product-launch-stages). Spanner queues provide transactional messaging to help you manage asynchronous work. The feature pairs this capability with the scalability and reliability of Spanner, letting you build event-driven applications. For more information, see the [Spanner queues overview](https://docs.cloud.google.com/spanner/docs/queues/queues-overview). ## September 16, 2026 **Backup and DR** Feature You can now use auto-protection policies and resource labels to automatically protect Compute Engine instances and Persistent Disks at scale in Backup and DR. This feature allows you to automatically assign a backup plan to qualifying resources across projects based on user-defined labels. This feature is in **Preview** . For more information, see [Automate resource protection](https://docs.cloud.google.com/backup-disaster-recovery/docs/protect/automate-protection.md.txt). **BigQuery** Feature You can use the [migration lineage service](https://docs.cloud.google.com/bigquery/docs/migration/migration-lineage.md.txt) to visualize the data flow and connections in your source database and help you plan a BigQuery data warehouse migration. This feature is in [Preview](https://cloud.google.com/products#product-launch-stages). **Cloud Data Fusion** Change The BigQuery Source plugin version 0.24.7 is available in Cloud Data Fusion version 6.11.0 and later. This release includes the following change: - Fixed an issue that caused intermittent pipeline failures in the BigQuery Source plugin when errors occurred during the creation of the temporary staging bucket ([PLUGIN-1787](https://cdap.atlassian.net/browse/PLUGIN-1787)). **Cloud Number Registry** Breaking You must [designate a project to manage Cloud Number Registry](https://docs.cloud.google.com/number-registry/designate-project-cloud-number-registry) before you can [set up Cloud Number Registry](https://docs.cloud.google.com/number-registry/set-up-cloud-number-registry) for an organization. **Datastream** Feature Datastream now supports MongoDB extended JSON canonical mode as the default format for new streams from MongoDB sources to BigQuery destinations. Canonical mode provides higher data fidelity by explicitly labeling every BSON type to prevent precision loss during data exchange. For more information, see the following: - [Stream data from MongoDB databases](https://docs.cloud.google.com/datastream/docs/sources-mongodb.md.txt) - [MongoDB data types in BigQuery](https://docs.cloud.google.com/datastream/docs/bq-map-data-types#mongodb-data-types) **Filestore** Feature Small capacity Filestore instances for the Regional service tier are [generally available (GA)](https://cloud.google.com/products#product-launch-stages). Small capacity instances start at 100 GiB and scale in 1 GiB increments, providing an option for development, testing, and applications with low traffic or basic storage needs. For more information, see [Small capacity instances](https://docs.cloud.google.com/filestore/docs/service-tiers.md.txt#small-instances). Feature Filestore agent volumes provide managed, high-density elastic NFS storage backed by regional volume pools for stateful AI agent sandboxes, autonomous agent fleets, and multi-agent developer environments. The Filestore agent volumes feature is available to all Google Cloud customers for evaluation and non-production use. To request access for your Google Cloud project, submit the Filestore agent volumes [access request form](https://forms.gle/vYPkcFiZVoTjf7Ah7). Production support is offered on an allow list basis under a limited [General Availability (GA)](https://cloud.google.com/products#product-launch-stages) program. To check your eligibility or to request production support, use the access form. For more information, see [About Filestore agent volumes](https://docs.cloud.google.com/filestore/docs/agent-volumes-overview.md.txt). **Gemini Enterprise Agent Platform** Feature **CodeMender updates (v0.8.0)** This release introduces updates to CodeMender: - **Gemini 3.8 Flash default** : Gemini 3.8 Flash (`gemini-3.8-flash`) is now supported and enabled as the default model for CodeMender CLI sessions, delivering faster inference and improved reasoning. A one-time notice in the CLI informs users when the new default is active. - **Tool payload guardrails**: Introduced safe output limits for file reading (2 MiB) and codebase grep search (512 KiB) with centered match context windows, eliminating payload overflow errors and improving stability during large repository scans. - **Bug fixes** : - Fixed an issue where shell detection and command execution on Windows could fail during repository resets and exploit verification when Git Bash was installed in standard registry or non-PATH locations. - Fixed an issue in `cm verify` where verified findings could report "not found" or fail to persist confidence and status upon session completion or resumption. - Fixed syntax errors in generated verification scripts caused by invalid regex escaping in grep assertions during `cm verify`. - Prevented HTTP 409 lease conflict errors during long-running sessions by ensuring streaming HTTP connections are promptly released. For more information, see [CodeMender documentation](https://docs.cloud.google.com/gemini-enterprise-agent-platform/agents/codemender.md.txt). Feature **Gemini 3.8 Flash Cyber available in allowlisted GA** Gemini 3.8 Flash Cyber is a post-training version of the Gemini 3.8 Flash model tailored specifically for cybersecurity use cases. Gemini 3.8 Flash Cyber is available in GA behind an allowlist. For more information, see [Gemini 3.8 Flash Cyber](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/gemini/3-8-flash-cyber). **Google SecOps Marketplace** Feature **CyberArk PAM**: Version 13.0 - The following new job has been added: - **Sync Integration Credentials Job** Feature **Siemplify**: Version 113.0 - The following new action has been added: - **Attach Playbook to Case** Change **Microsoft 365 Defender**: Version 32.0 - Improved the rate limit handling and timestamp updating mechanism in the following connector: - **Microsoft 365 Defender - Incidents Connector** - Added the `Sync Direction` and `Closed Reason Mapping` parameters for configurable sync direction and improved comment payload handling to skip empty and whitespace comments in the following job: - **Sync Alerts** Change **Microsoft Graph Mail**: Version 47.0 - Added support for S/MIME digital signing and encryption in the following action: - **Send Email** - Added support for HTML URL extraction, attachment exclusions, event field exclusions, and S/MIME signature verification bypass in the following connector: - **Microsoft Graph Mail Connector** Change **Palo Alto Cortex XDR**: Version 33.0 - Added the `Unzip File` parameter and improved error handling for failed retrievals in the following action: - **Download File** Change **Microsoft Graph Mail Delegated**: Version 24.0 - Added support for S/MIME digital signing and encryption in the following action: - **Send Email** - Added support for HTML URL extraction, attachment exclusions, event field exclusions, and S/MIME signature verification bypass in the following connector: - **Microsoft Graph Mail Delegated Connector** Change **CrowdStrike Falcon**: Version 82.0 - Updated the polling logic to prevent host containment flapping in the following actions: - **Contain Endpoint** - **Lift Contained Endpoint** Change **Microsoft Graph Security**: Version 29.0 - **Integration**: Added support for Microsoft Sovereign / GCC High environments by adding Login API Root and API Root parameters. **Identity and Access Management** Feature The Cloud OAuth API (`cloudoauth.googleapis.com`) is available in [Preview](https://cloud.google.com/products#product-launch-stages). The Cloud OAuth API provides dedicated OAuth 2.0 and OpenID Connect (OIDC) token exchange and authentication endpoints for Workforce Identity Federation integrations. Applications can use the Cloud OAuth API to exchange external credentials, authorization codes, or refresh tokens for Google Cloud access tokens, or to retrieve authenticated user profile claims and enterprise group memberships. For more information, see the following documentation: - [Cloud OAuth API overview](https://docs.cloud.google.com/iam/docs/cloud-oauth-api-overview.md.txt) - [Exchange tokens with the Cloud OAuth API](https://docs.cloud.google.com/iam/docs/cloud-oauth-exchange-tokens.md.txt) - [Retrieve user info with the Cloud OAuth API](https://docs.cloud.google.com/iam/docs/cloud-oauth-userinfo.md.txt) - [Retrieve enterprise groups with the Cloud OAuth API](https://docs.cloud.google.com/iam/docs/cloud-oauth-groups.md.txt) **Secure Source Manager** Feature Secure Source Manager webhooks now support **Pull request comment** trigger events. You can configure webhooks to trigger notifications whenever a comment is added, edited, or deleted on a pull request. For more information, see the [Pull request comment event payload](https://docs.cloud.google.com/secure-source-manager/docs/webhooks-overview.md.txt#pull-request-comment-event-payload) in the [Webhooks overview](https://docs.cloud.google.com/secure-source-manager/docs/webhooks-overview.md.txt). **Security Command Center** Feature You can use the following MCP server endpoints to enable LLM agents to perform investigative and management tasks in Security Command Center. - [Security Command Center](https://docs.cloud.google.com/security-command-center/docs/reference/mcp) - [Security Command Center Management](https://docs.cloud.google.com/security-command-center/docs/reference/security-center-management/mcp.md.txt) This feature is in [Preview](https://cloud.google.com/products#product-launch-stages). **Virtual Private Cloud** Feature **General Availability** : You can add Dynamic NICs to the same VPC network used by other network interfaces of a Compute Engine instance. For more information, see [Multiple network interfaces](https://docs.cloud.google.com/vpc/docs/multiple-interfaces-concepts.md.txt#specifications). Feature **General Availability** : VPC Flow Logs supports logging for App Engine resources that are configured with [Direct VPC egress](https://docs.cloud.google.com/appengine/docs/standard/vpc-direct-vpc.md.txt). For more information, see [Serverless flows](https://docs.cloud.google.com/vpc/docs/about-traffic-flows.md.txt#serverless-flows) and [ServerlessDetails field format](https://docs.cloud.google.com/vpc/docs/about-flow-logs-records.md.txt#serverless-details). Feature **General Availability**: VPC Flow Logs adds the following metadata annotations for Private Service Connect: - `src_psc_interface` and `dest_psc_interface` - `psc.consumer_connection` - `psc.psc_endpoint.name` - `psc.psc_attachment.name` For more information, see [Record format](https://docs.cloud.google.com/vpc/docs/about-flow-logs-records.md.txt#record_format). ## September 15, 2026 **Artifact Registry** Feature Artifact Registry support for managing Conda packages with Artifact Registry repositories is in [Preview](https://cloud.google.com/products#section-22). For more information, see [Get started with Conda packages](https://docs.cloud.google.com/artifact-registry/docs/conda.md.txt). **Batch** Issue A workaround has been added for the known issue that [jobs might fail when specifying Compute Engine (or custom) VM OS images with outdated kernels](https://docs.cloud.google.com/batch/docs/known-issues.md.txt#jobs-fail-specify-compute-images-outdated-kernels). **Carbon Footprint** Change For the July 2026 data release (published mid-September 2026), we have upgraded the carbon model to version 17 and implemented the following updates: **Updating Scope 1 \& 3 Emissions from Google's Corporate Footprint** - Allocation factor refresh: Updated Scope 1 and Scope 3 allocation factors using company-wide data from the [2026 Google Environmental Report](https://sustainability.google/google-2026-environmental-report/). - Methodology application: For details on how corporate Scope 1 and Scope 3 emissions are distributed across cloud products and services, refer to the [non-electricity emission sources section of the methodology documentation](https://docs.cloud.google.com/carbon-footprint/docs/methodology.md.txt#non-electricity-allocation). **Updating Inputs for Scope 2 Market-Based Emissions Calculations** - Updated annual renewable electricity allocation percentages in accordance with the [2026 Google Environmental Report](https://sustainability.google/google-2026-environmental-report/). - Refreshed background annual emissions factors using updated government data sources across Scope 1, Scope 2, and Scope 3. Note that Scope 2 location-based emissions continue to be calculated using hourly greenhouse gas emission factors. Learn more in the[Scope 2 market-based allocation documentation](https://docs.cloud.google.com/carbon-footprint/docs/methodology.md.txt#market-based-allocation). - Incorporated marketplace purchases of Granular Certificates covering a significant portion of electricity load across carbon-intensive regions. - Granular certificate purchases represent market-based accounting allocations. Customers seeking to minimize emissions are encouraged to prioritize [regions with high Carbon Free Energy](https://cloud.google.com/sustainability/region-carbon#data) (CFE) scores for new workloads. **Regional Accounting \& Boundary Updates** - Aligned European clean energy matching boundaries with updated [RE100](https://www.theclimategroup.org/hubfs/RE100/PDFs/RE100%20technical%20criteria%20+%20appendices%20(15%20April%202025).pdf#page=28) criteria. - Corrected country mapping configurations in annual emission factor scripts to resolve historical data discrepancies across select Asian market regions (e.g., asia-east2, asia-northeast3). To correct your July emissions data, [schedule a manual data backfill](https://docs.cloud.google.com/bigquery/docs/working-with-transfers.md.txt#bq_8) for the month. **Cloud Asset Inventory** Feature The following resource type is publicly available through the [ExportAssets](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/exportAssets.md.txt), [ListAssets](https://docs.cloud.google.com/asset-inventory/docs/listing-assets), [BatchGetAssetsHistory](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/batchGetAssetsHistory.md.txt), [QueryAssets](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/TopLevel/queryAssets.md.txt), and [Feed](https://docs.cloud.google.com/asset-inventory/docs/reference/rest/v1/feeds.md.txt) APIs. - Network Management API - `networkmanagement.googleapis.com/VpcFlowLogsConfig` **Compute Engine** Feature **Public preview** : Network-optimized C4N machine type with 375 GiB to 12,000 GiB of attached Titanium SSD are now available in [Preview](https://cloud.google.com/products#product-launch-stages). You don't have to request allowlist approval. For more information, see [C4N machine series](https://docs.cloud.google.com/compute/docs/network-optimized-machines.md.txt#c4n_series). **Confidential Space** Announcement A new Confidential Space image (260800) is available. Support for Confidential Space on H100 GPU (`a3-highgpu-1g` machine family) with Intel Trust Authority (ITA) attestation is [generally available](https://cloud.google.com/products#product-launch-stages). **Gemini** Other ### Bug fixes in IntelliJ Various bug fixes and minor product enhancements. **Gemini Enterprise Agent Platform** Feature **Reinforcement learning fine-tuning in the Google Cloud console (Preview)** You can create, monitor, and test reinforcement learning fine-tuning jobs for Gemini models in the Google Cloud console ([Preview](https://cloud.google.com/products#product-launch-stages)). From the **Models \> Tuning** page, you can configure Python code or model-based reward functions, test reward logic against sample prompts before launching a job, track training and evaluation metrics in real time, and test tuned checkpoints in Agent Studio. For more information, see [Quick start: Reinforcement learning fine-tuning using the console](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/tuning/reinforcement-tuning/quick-start-console.md.txt). **Google Cloud Contact Center as a Service** Announcement **Mobile SDKs 2.16.2** We've released version 2.16.2 of the mobile SDKs. Feature **Chat check-in for the Mobile SDKs** Chat check-in is now available for the mobile SDKs. Chat check-in ensures that end-users are present and ready to engage before the system connects them to a human agent. This decreases the average agent handle time by eliminating the time lost when agents wait for end-users who have abandoned a chat. For more information, see: - [Chat check-in](https://docs.cloud.google.com/contact-center/ccai-platform/docs/chat-check-in.md.txt) - [SDK configuration](https://docs.cloud.google.com/contact-center/ccai-platform/docs/android-sdk-guide#sdk-configuration) (Android) - [Chat check-in after-hours options](https://docs.cloud.google.com/contact-center/ccai-platform/docs/ios-sdk-guide#chat_check-in_after-hours_options) (iOS) Feature **New "is typing" indicator in the Mobile SDKs** The mobile SDKs now display an "is typing" indicator to the end-user when an agent is typing. Fixed We've addressed the following issues. Android and iOS SDKs: - Fixed an issue that occurred after force-closing a mobile app while the check-in timeout dialog was displayed. When the app was relaunched, the check-in dialog didn't reappear. - Fixed an issue where mobile inbound calls didn't connect. iOS SDK only: - Fixed an issue where end-users received duplicate end-of-chat notifications when a virtual agent ended a conversation. - Fixed an issue where a virtual agent's final message appeared out of order during a chat escalation. - Fixed an issue where apps didn't upload logs when the server returned a relative URL. Android SDK only: - Fixed an issue where a five-second delay occurred between session creation and the initial chat fetch, significantly delaying when the message appeared. **Google Distributed Cloud (software only) for VMware** Announcement Google Distributed Cloud (software only) for VMware 1.33.1200-gke.83 is now available for download. To upgrade, see [Upgrade clusters](https://docs.cloud.google.com/kubernetes-engine/distributed-cloud/vmware/docs/how-to/upgrading.md.txt). Google Distributed Cloud 1.33.1200-gke.83 runs on Kubernetes v1.33.11-gke.100. If you use a third-party storage vendor, check the listing of our previously-qualified [storage partners](https://docs.cloud.google.com/kubernetes-engine/enterprise/docs/resources/partner-storage.md.txt). After a release, it takes approximately 7 to 14 days for the version to become available for use with GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform. Fixed The following issues were fixed in 1.33.1200-gke.83: - Fixed vulnerabilities listed in [Vulnerability fixes](https://docs.cloud.google.com/kubernetes-engine/distributed-cloud/vmware/docs/vulnerabilities.md.txt). **Google Distributed Cloud (software only) for bare metal** Announcement Google Distributed Cloud (software only) for bare metal 1.33.1200-gke.83 is now available for download. To upgrade, see [Upgrade clusters](https://docs.cloud.google.com/release-notes/how-to/upgrade). Google Distributed Cloud for bare metal 1.33.1200-gke.83 runs on Kubernetes v1.33.11-gke.100. After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform. If you use a third-party storage vendor, check the listing of our previously-qualified [storage partners](https://docs.cloud.google.com/kubernetes-engine/enterprise/docs/resources/partner-storage.md.txt). Fixed The following issues were fixed in 1.33.1200-gke.83: - Fixed vulnerabilities listed in [Vulnerability fixes](https://docs.cloud.google.com/kubernetes-engine/distributed-cloud/bare-metal/docs/vulnerabilities.md.txt). **Google SecOps** Feature **Grok filter match_all option in parser syntax** The Google SecOps parser syntax is updated to support the `match_all` option within the Grok filter. This allows parsers to extract all non-overlapping pattern occurrences within a field, rather than returning only the first match. For more information, see [Parser syntax reference](https://docs.cloud.google.com/chronicle/docs/reference/parser-syntax.md.txt#grok_match_all_option). **Google SecOps SIEM** Feature **Grok filter match_all option in parser syntax** The Google SecOps parser syntax is updated to support the `match_all` option within the Grok filter. This allows parsers to extract all non-overlapping pattern occurrences within a field, rather than returning only the first match. For more information, see [Parser syntax reference](https://docs.cloud.google.com/chronicle/docs/reference/parser-syntax.md.txt#grok_match_all_option). **Infrastructure Manager** Feature Infrastructure Manager now supports the `us` multi-regional location in General Availability (GA). You can now create and manage deployments, revisions, and previews in the `us` multi-region (`projects/PROJECT_ID/locations/us`). Deployments in the `us` multi-region benefit from metadata and state file redundancy across data centers in the United States. For more information, see [Infrastructure Manager locations](https://docs.cloud.google.com/infrastructure-manager/docs/locations.md.txt). **NetApp Volumes** Announcement Effective September 15, 2026, you can't create new Flex File storage pools, but existing pools remain supported. Support for the Flex File service level of Google Cloud NetApp Volumes ends on June 15, 2027. You must migrate your data from Flex File to the Flex Unified service level. For more information, see [Migration to Flex Unified service level](https://docs.cloud.google.com/netapp/volumes/docs/get-started/migration-to-flex-unified.md.txt). **Policy Intelligence** Feature Policy Troubleshooter now supports troubleshooting access for [agent identities](https://docs.cloud.google.com/iam/docs/agent-identity-overview.md.txt). You can troubleshoot IAM allow policies, deny policies, and principal access boundary policies for agents acting under their own authority by entering the agent's principal identifier or by troubleshooting with an error ID from an access denial event. To learn more, see [Troubleshooting access](https://docs.cloud.google.com/policy-intelligence/docs/troubleshoot-access.md.txt#troubleshoot-access). ## September 14, 2026 **Agent Platform Workbench** Change ### M150 Release Change Installed latest packages from upstream dependencies. **Apigee hybrid** Announcement ### hybrid v1.17.0 On September 14, 2026 we released an updated version of the Apigee hybrid software, 1.17.0. - For information on upgrading, see [Upgrading Apigee hybrid to version v1.17](https://docs.cloud.google.com/apigee/docs/hybrid/v1.17/upgrade.md.txt). - For information on new installations, see [The big picture](https://docs.cloud.google.com/apigee/docs/hybrid/v1.17/big-picture.md.txt). > [!NOTE] > **Note:** This is a minor release: The container images used in minor releases are integrated with the Apigee hybrid Helm charts. Upgrading to a minor via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see [Apigee release process](https://docs.cloud.google.com/apigee/docs/release/apigee-release-process.md.txt#apigee-hybrid-container-images). Feature **Model Context Protocol (MCP) support** Apigee hybrid now supports [Model Context Protocol (MCP)](https://modelcontextprotocol.io), an open protocol that lets agentic AI applications use your APIs as tools through managed MCP endpoints. Apigee hybrid routes, authorizes, and secures these MCP tool calls the same way it manages your other APIs, so you don't need to run or maintain your own MCP servers. MCP support is an optional feature that is not enabled by default. You must explicitly enable it in your Apigee hybrid configuration. For more information, see [Model Context Protocol (MCP) overview](https://docs.cloud.google.com/apigee/docs/api-platform/apigee-mcp/apigee-mcp-overview.md.txt), [Enable MCP for Apigee hybrid](https://docs.cloud.google.com/apigee/docs/api-platform/apigee-mcp/enable-mcp.md.txt), and the [MCP quickstart](https://docs.cloud.google.com/apigee/docs/api-platform/apigee-mcp/apigee-mcp-quickstart.md.txt). Feature **Root CA certificate rotation** Apigee hybrid v1.17.0 lets you rotate the root certificate authority (CA) certificate that anchors trust for TLS communication between your runtime components. You can now replace the root CA before it expires, without downtime. For more information, see [Rotate the root CA](https://docs.cloud.google.com/apigee/docs/hybrid/v1.17/rotate-root-ca.md.txt). Feature **TLS 1.3 support** Apigee hybrid v1.17.0 adds support for TLS 1.3, a newer version of the Transport Layer Security (TLS) protocol that offers faster connection handshakes and stronger security than earlier TLS versions. For information about configuring TLS on the ingress gateway, see [Configuring TLS and mTLS on the Apigee ingress gateway](https://docs.cloud.google.com/apigee/docs/hybrid/v1.17/ingress-tls.md.txt). Feature **Forward proxy support for AI policies** Apigee hybrid v1.17.0 adds forward proxy support for AI policies, such as the Model Armor and semantic caching policies. Outbound calls from these policies can now be routed through an HTTP forward proxy. For more information, see [Configure a forward proxy](https://docs.cloud.google.com/apigee/docs/hybrid/v1.17/forward-proxy.md.txt), [Get started with the Model Armor policies](https://docs.cloud.google.com/apigee/docs/api-platform/tutorials/using-model-armor-policies.md.txt), and [Get started with semantic caching policies](https://docs.cloud.google.com/apigee/docs/api-platform/tutorials/using-semantic-caching-policies.md.txt). Feature **Semantic cache Private Service Connect (PSC) endpoint support** Apigee hybrid v1.17.0 adds Private Service Connect (PSC) endpoint support for semantic caching. The semantic caching policies can now reach their backing services over a Private Service Connect endpoint, which keeps that traffic on your private network. For more information, see [Configure semantic caching over Private Service Connect](https://docs.cloud.google.com/apigee/docs/api-platform/tutorials/using-semantic-caching-policies-psc.md.txt). Feature **Semantic cache distance measure support** Apigee hybrid v1.17.0 adds support for non-default Vertex AI Vector Search distance measures in the SemanticCacheLookup policy. A new optional `` element accepts `DOT_PRODUCT_DISTANCE` (the default, and the existing behavior), `COSINE_DISTANCE`, `SQUARED_L2_DISTANCE`, and `L1_DISTANCE`. The policy compares `` in the direction the declared measure implies, so declaring a non-default measure requires re-tuning the threshold in the same edit. For more information, see [SemanticCacheLookup policy](https://docs.cloud.google.com/apigee/docs/api-platform/reference/policies/semantic-cache-lookup-policy.md.txt). Feature **Reduced service account permissions** Apigee hybrid v1.17.0 reduces the Google Cloud IAM permissions that Apigee service accounts require. Service accounts that use Cloud Storage now require only the `storage.objects.get` and `storage.objects.create` permissions rather than the broader Storage Admin (`roles/storage.admin`) role. The Cassandra components also no longer run with the `privileged: true` security context. For more information about service accounts, see [Create service accounts](https://docs.cloud.google.com/apigee/docs/hybrid/v1.17/create-service-account.md.txt). Security Various security and CVE fixes are included in this release. **Backup and DR** Feature You can now monitor restore jobs for Filestore instances directly from the Backup and DR **Jobs** page in the Google Cloud console. When you trigger a restore on a Filestore instance, Backup and DR automatically tracks the job progress and status. For more information, see [Restore a Filestore instance from a backup vault](https://docs.cloud.google.com/backup-disaster-recovery/docs/cloud-console/filestore/filestore-instance-restore.md.txt) and [Monitor backup and restore jobs in Google Cloud console](https://docs.cloud.google.com/backup-disaster-recovery/docs/monitor-reports/monitor-jobs-console.md.txt). **BigQuery** Change An updated version of the [Simba ODBC driver for BigQuery](https://docs.cloud.google.com/bigquery/docs/reference/odbc-jdbc-drivers.md.txt#current_odbc_driver) is now available. Feature Metadata for [BigQuery Graph](https://docs.cloud.google.com/bigquery/docs/graph-overview.md.txt) is automatically ingested and searchable in [Knowledge Catalog](https://docs.cloud.google.com/bigquery/docs/use-knowledge-catalog.md.txt). This feature is available in [preview](https://cloud.google.com/products#product-launch-stages). Feature You can now include a `WHERE` clause inside of an [aggregate function call](https://docs.cloud.google.com/bigquery/docs/reference/standard-sql/aggregate-function-calls.md.txt) to filter your aggregate function input using a boolean expression. This feature is in [Preview](https://cloud.google.com/products#product-launch-stages). **Bigtable** Libraries ### Go #### [1.57.0](https://github.com/googleapis/google-cloud-go/compare/bigtable/v1.56.0...bigtable/v1.57.0) (2026-09-10) ##### Features - **bigtable:** Build the accelerator daemon for Windows ([#20455](https://github.com/googleapis/google-cloud-go/issues/20455)) ([df55af5](https://github.com/googleapis/google-cloud-go/commit/df55af57867ed03076cba91e3c3a18616711a5e4)) ##### Bug Fixes - **bigtable/bttest:** Honor timestamp_origin on SetCell ([#20469](https://github.com/googleapis/google-cloud-go/issues/20469)) ([528aaf8](https://github.com/googleapis/google-cloud-go/commit/528aaf81e9366b99e88f39c40acba2ccbd7830cd)), refs [#20468](https://github.com/googleapis/google-cloud-go/issues/20468) - **bigtable:** Keep single-key ReadRows on the streaming classic path ([#20506](https://github.com/googleapis/google-cloud-go/issues/20506)) ([2bfdb5d](https://github.com/googleapis/google-cloud-go/commit/2bfdb5d137567b5f339c96b9a330e2d5e9d610fa)) Feature You can use the Google Cloud console to create, list, and query [parameterized views](https://docs.cloud.google.com/bigtable/docs/parameterized-views-overview.md.txt) for your Bigtable instances. You can also configure view parameters and run queries in Bigtable Studio. This feature is [generally available (GA)](https://cloud.google.com/products#product-launch-stages). For more information, see [Create and manage parameterized views](https://docs.cloud.google.com/bigtable/docs/create-manage-parameterized-views.md.txt). **Cloud Logging** Feature Starting with version 2.71.0, you can use an Ops Agent configuration option to export your metrics, logs, and traces by using the OpenTelemetry-based [Telemetry API](https://docs.cloud.google.com/stackdriver/docs/reference/telemetry/overview.md.txt) rather than by using the Cloud Monitoring API, Logging API, or Trace API. For more information, see [Use the Telemetry API](https://docs.cloud.google.com/monitoring/agent/ops-agent/use-telemetry-api.md.txt). **Cloud Monitoring** Feature Starting with version 2.71.0, you can use an Ops Agent configuration option to export your metrics, logs, and traces by using the OpenTelemetry-based [Telemetry API](https://docs.cloud.google.com/stackdriver/docs/reference/telemetry/overview.md.txt) rather than by using the Cloud Monitoring API, Logging API, or Trace API For more information, see [Use the Telemetry API](https://docs.cloud.google.com/monitoring/agent/ops-agent/use-telemetry-api.md.txt). **Cloud SQL for PostgreSQL** Feature You can use the [`pg_textsearch`](https://github.com/timescale/pg_textsearch) extension in Cloud SQL for PostgreSQL to perform full-text search using the industry-standard [BM25 (Best Matching 25)](https://en.wikipedia.org/wiki/Okapi_BM25) scoring algorithm for highly accurate relevance scoring. This extension requires PostgreSQL 17 or later and is supported on PostgreSQL release `R20260712.01_06` or later. For more information, see [Full-text search using pg_textsearch](https://docs.cloud.google.com/sql/docs/postgres/pg-textsearch.md.txt). **Cloud SQL for SQL Server** Deprecated Beginning April 12, 2027, you won't be able to create new instances of Cloud SQL for SQL Server 2017. Starting on October 13, 2027, SQL Server 2017 will reach end of life (EOL) and Microsoft will stop releasing [security updates](https://learn.microsoft.com/en-us/sql/sql-server/end-of-support/sql-server-end-of-support-overview?view=sql-server-ver17#understand-the-sql-server-lifecycle). Cloud SQL for SQL Server will stop supporting SQL Server 2017 after this date. For more information, see [Database versions and version policies](https://docs.cloud.google.com/sql/docs/sqlserver/db-versions.md.txt). **Cloud Workstations** Feature Cloud Workstations supports customizing [provisioned IOPS and throughput](https://docs.cloud.google.com/workstations/docs/reference/rest/v1beta/projects.locations.workstationClusters.workstationConfigs.md.txt#gcehyperdiskbalancedhighavailability) for Hyperdisk Balanced High Availability disks. This customization feature is in Preview. **Compute Engine** Feature **Preview**: You can create regional disks, including Hyperdisk Balanced High Availability volumes, from custom and public OS images. For more information, see [Create and manage regional disks](https://docs.cloud.google.com/compute/docs/disks/regional-persistent-disk.md.txt). **Gemini Enterprise** Feature **Gemini Notebook Enterprise: Rotate CMEK keys (GA)** Rotating customer-managed encryption keys (CMEK) that protect your Gemini Notebook Enterprise instances is generally available (GA). When you make a new version of a registered key the primary version in Cloud Key Management Service (Cloud KMS), Gemini Notebook Enterprise detects the change and re-encrypts your data with the new key version automatically. For more information, see [Rotate Cloud KMS keys](https://docs.cloud.google.com/gemini/enterprise/notebooklm-enterprise/docs/cmek#rotate-keys). Feature **Gemini Enterprise: Rotate CMEK keys (GA)** Rotating customer-managed encryption keys (CMEK) that protect your Gemini Enterprise apps and data connectors is generally available (GA). When you make a new version of a registered key the primary version in Cloud Key Management Service (Cloud KMS), Gemini Enterprise detects the change and re-encrypts your data with the new key version automatically. For more information, see [Rotate Cloud KMS keys](https://docs.cloud.google.com/gemini/enterprise/docs/cmek#rotate-keys). **Gemini Enterprise Agent Platform** Deprecated **Gemini model deprecation and retirement date updates** The retirement and deprecation dates for the following Gemini models have been updated: - **Gemini 2.5 Flash Image (`gemini-2.5-flash-image`)** : Deprecated and scheduled for retirement on March 15, 2027 (extended from October 2, 2026). Migrate to [Gemini 3.1 Flash-Lite Image](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/gemini/3-1-flash-lite-image.md.txt) (`gemini-3.1-flash-lite-image`). - **Gemini 3.1 Flash-Lite Image (`gemini-3.1-flash-lite-image`)**: Retirement date is scheduled for June 28, 2027 or later. For more information, see [Gemini model versions and lifecycle](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/model-versions.md.txt). Fixed **CodeMender updates (v0.7.0)** This release introduces updates to CodeMender: - **Network stream resilience**: Improved CLI session stability with automatic reconnection and transient error recovery during long-running scans and remediation workflows. - **Configuration uniformity** : Standardized directory exclusion rules across configuration files and CLI scanning flags under `scan_config.exclude_dirs`. - **Bug fixes** : - Fixed an issue where `cm report` incorrectly categorized `DISMISSED` findings as `OPEN` in the summary table. - Resolved sandbox permission denial errors by preventing child worker processes from attempting to create internal session logs on disk. - Hardened sandbox command policy to prevent directory traversal and file inspection outside the designated repository root into adjacent directories. For more information, see [CodeMender documentation](https://docs.cloud.google.com/gemini-enterprise-agent-platform/agents/codemender.md.txt). Feature **Cyber Verification Program for Claude is available in Preview** Anthropic's Cyber Verification Program (CVP) is available in [Preview](https://cloud.google.com/products#product-launch-stages) on Gemini Enterprise Agent Platform. CVP enables verified organizations to use supported Claude models (Claude Opus 4.7, Claude Opus 4.8, Claude Sonnet 5, and Claude Opus 5) for legitimate defensive cybersecurity tasks with default dual-use restrictions lifted. For more information, see [Cyber Verification Program for Claude](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/partner-models/claude/cyber-verification-program). **Google SecOps** Feature **\[Spotlight Feature\] GoogleSQL query support in Search** This feature is in public preview. You can now use GoogleSQL in **Search** to query your security data in Google SecOps, offering a flexible and powerful industry-standard alternative to YARA-L 2.0. GoogleSQL is optimized for broad data exploration, statistical aggregation, and deep-dive ad hoc investigations. You can query telemetry tables including but not limited to UDM events, entity graphs, detection rules, and case management data---using either standard declarative SQL or the linear, sequential Piped SQL syntax. For more information, see [Get started with GoogleSQL](https://docs.cloud.google.com/chronicle/docs/reference/standard-sql/getting-started-googlesql.md.txt). Deprecated **MANDIANT_ACTIVE_BREACH_IOC`,`MANDIANT_FUSION_IOC`, and`OPEN_SOURCE_INTEL_IOC\` feeds are being removed** The `MANDIANT_ACTIVE_BREACH_IOC`, `MANDIANT_FUSION_IOC`, and `OPEN_SOURCE_INTEL_IOC` feeds are [deprecated](https://docs.cloud.google.com/chronicle/docs/deprecations.md.txt) in favor of the `GTI_IOC` feed. After March 18, 2027, we will be removing the `MANDIANT_ACTIVE_BREACH_IOC`, `MANDIANT_FUSION_IOC`, and `OPEN_SOURCE_INTEL_IOC` feeds. For more information on how to migrate, see [Migrate Mandiant legacy feeds to GTI](https://docs.cloud.google.com/chronicle/docs/detection/ati-fusion-feed.md.txt#migrateToGTI). **Google SecOps SIEM** Deprecated **MANDIANT_ACTIVE_BREACH_IOC`,`MANDIANT_FUSION_IOC`, and`OPEN_SOURCE_INTEL_IOC\` feeds are being removed** The `MANDIANT_ACTIVE_BREACH_IOC`, `MANDIANT_FUSION_IOC`, and `OPEN_SOURCE_INTEL_IOC` feeds are [deprecated](https://docs.cloud.google.com/chronicle/docs/deprecations.md.txt) in favor of the `GTI_IOC` feed. After March 18, 2027, we will be removing the `MANDIANT_ACTIVE_BREACH_IOC`, `MANDIANT_FUSION_IOC`, and `OPEN_SOURCE_INTEL_IOC` feeds. For more information on how to migrate, see [Migrate Mandiant legacy feeds to GTI](https://docs.cloud.google.com/chronicle/docs/detection/ati-fusion-feed.md.txt#migrateToGTI). **Knowledge Catalog** Feature Metadata for BigQuery Graph is now automatically ingested and searchable in Knowledge Catalog. This feature is available in [preview](https://cloud.google.com/products#product-launch-stages). For more information, see [Knowledge Catalog overview](https://docs.cloud.google.com/knowledge-catalog/docs/introduction.md.txt#ingestions). **Network Intelligence Center** Feature When adding a new Google Cloud Compute Engine, container, or VM Monitoring Point, [Cloud Network Insights](https://docs.cloud.google.com/network-intelligence-center/docs/cloud-network-insights) lets you generate Google Cloud CLI commands in the Google Cloud console to download Monitoring Point installation bundles. **Secret Manager** Feature Parameter Manager supports CRC32C checksums to verify data integrity when you add or access parameter versions. For more information, see [Data integrity assurance](https://docs.cloud.google.com/secret-manager/parameter-manager/docs/data-integrity.md.txt). **Security Command Center** Deprecated Data Security Posture Management is deprecated. It will be shut down on February 1, 2027. Learn more about the controls and [alternative detection capabilities](https://docs.cloud.google.com/security-command-center/docs/dspm-data-security.md.txt#data-security-framework). **Vertex AI Search** Feature **Agent Search: Rotate CMEK keys (GA)** Rotating customer-managed encryption keys (CMEK) that protect your Agent Search apps and data connectors is generally available (GA). When you make a new version of a registered key the primary version in Cloud Key Management Service (Cloud KMS), Agent Search detects the change and re-encrypts your data with the new key version automatically. For more information, see [Rotate Cloud KMS keys](https://docs.cloud.google.com/generative-ai-app-builder/docs/cmek#rotate-keys). Feature **Agent Search: Search query add-ons for configurable pricing (GA)** Search query add-on specifications (`searchAddonSpec`) for configurable pricing are generally available (GA) in the v1 API. You can use `searchAddonSpec` when you want to save money by turning off add-ons for individual search requests made programmatically. For more information, see [About controlling which add-ons apply to a search request](https://docs.cloud.google.com/generative-ai-app-builder/docs/enable-configurable-pricing#control-addons) and [REST, per search request](https://docs.cloud.google.com/generative-ai-app-builder/docs/enable-configurable-pricing#search-configurable) in *Manage configurable pricing for search query add-ons*. ## September 13, 2026 **Agent Platform Workbench** Change ### 20260911.00_p0 Release Change ### 20260913.00_p0 Release Change Installed latest packages from upstream dependencies. Change Installed latest packages from upstream dependencies. Fixed Fixed the %%bigquery notebook cell magic, which returned an error instead of query results in JupyterLab 4. Fixed Fixed the %%bigquery notebook cell magic, which returned an error instead of query results in JupyterLab 4. Change ### 20260913-2230-rc0 Release Change ### 20260913-2230-rc0 Release Change Installed latest packages from upstream dependencies. Change Installed latest packages from upstream dependencies. Fixed Fixed an issue where the `notebook-disable-nbconvert` metadata flag was ignored in custom containers. Change The obsolete `google-cloud-sdk` transitional package is no longer installed. The Google Cloud CLI itself is unchanged; it was already provided by the `google-cloud-cli` package. Fixed Fixed the %%bigquery notebook cell magic, which returned an error instead of query results in JupyterLab 4. Fixed Fixed an issue where the `notebook-disable-nbconvert` metadata flag was ignored in custom containers. Fixed Fixed the %%bigquery notebook cell magic, which returned an error instead of query results in JupyterLab 4. Change ### 20260913-2130-rc0 Release Change Installed latest packages from upstream dependencies. Fixed Fixed the %%bigquery notebook cell magic, which returned an error instead of query results in JupyterLab 4. Change ### M149 Release Change Installed latest packages from upstream dependencies. Fixed Fixed the %%bigquery notebook cell magic, which returned an error instead of query results in JupyterLab 4.