SemanticCacheLookup policy supports non-default Vector Search distance measures
Available in Apigee 1-18-0-apigee-4 and later. A new optional
<DistanceMeasureType> element accepts DOT_PRODUCT_DISTANCE (the
default, and the existing behavior), COSINE_DISTANCE,
SQUARED_L2_DISTANCE and L1_DISTANCE. The policy now compares
<Threshold> in the direction the declared measure implies, so declaring a
non-default measure requires re-tuning the threshold in the same edit. The 0-to-1 restriction on
<Threshold> is also removed.
BigQuery generative AI functions now support the following Gemini models:
gemini-3.5-flash-litegemini-3.6-flashgemini-3.7-flashA chart on a dashboard can override the dashboard's time-range setting. This feature lets you view trends over a long period or metric data with low sampling rates alongside charts that show only recent data, and is Generally Available (GA).
For more information, see the following documents:
XyChart widget that sets a time-range overridegcloud storage buckets anywhere-caches pause command.minikube component in Google Cloud CLI. The component will be removed after January 31, 2027. Existing local configurations and clusters in ~/.minikube will be preserved. Minikube is an open-source project and continues to be actively maintained. To avoid disruptions, please migrate to standard OSS Minikube installations: https://minikube.sigs.k8s.io/docs/start/.--edition flag in gcloud alloydb clusters create|update for alpha and beta tracks.gcloud apigee apis delete which deletes an API proxy and all of its
revisions. Undeploy every deployed revision first with gcloud apigee apis
undeploy.gcloud artifacts files upload which allows user to upload
Conda packages to a Conda repository.--cross-cloud-cache to gcloud biglake iceberg catalogs create and update commands to configure cross-cloud cache per catalog.--kms-key flag to gcloud biglake iceberg catalogs create and update commands.--kms-key flag to gcloud biglake delta-sharing catalogs create and update commands.gcloud backup-dr auto-protection-policies command group in alpha and beta tracks.gcloud backup-dr auto-protection-bindings command group in alpha and beta tracks.gcloud beta backup-dr binding-matching-resources command group to manage Backup and DR BindingMatchingResources.gcloud firestore change-streams commands to beta.gcloud firestore indexes composite create.--public-cluster and --allowed-source-ip-ranges flags to GA for gcloud managed-kafka clusters create and gcloud managed-kafka clusters update.--tags flag of gcloud redis instance create.--[no-]check-existing-usage flag to gcloud services
api-keys update and gcloud services api-keys delete to verify whether
the key has recent incompatible traffic before updating or deleting the key
(defaults to true).gcloud cluster-director clusters update help text and documentation where --update-slurm-partitions included an unsupported exclusive flag in examples.regex_rewrite support in url_rewrite block to GA for gcloud compute url-maps.--network-endpoint-group flag to gcloud compute backend-services create command.--ha-policy-fast-ip-move flag to gcloud compute backend-services create command.--ha-policy-leader-backend-group and --ha-policy-leader-instance flags to gcloud compute backend-services update command.--no-graceful-shutdown flag to gcloud compute instance-groups managed stop-instances command across all release tracks.--no-graceful-shutdown flag to gcloud compute instance-groups managed delete-instances command across all release tracks.--outlier-detection-* flags to gcloud compute backend-services create and update commands to configure outlier detection settings.gcloud compute recoverable-snapshots recover to beta.gcloud compute recoverable-snapshots delete to beta.gcloud compute recoverable-snapshots describe to beta.gcloud compute recoverable-snapshots list to beta.gcloud compute recoverable-snapshots set-iam-policy to beta.gcloud compute recoverable-snapshots test-iam-permissions to beta.gcloud compute instances get-vm-extension-state to beta.gcloud compute instances list-vm-extension-states to beta.enable-vpc-scoped-dns sub-argument of --network-interface flag in gcloud compute instances create to GA.enable-vpc-scoped-dns sub-argument of --network-interface flag in gcloud compute instance-templates create to GA.Promoted --share-setting flag in gcloud compute reservations update to GA.
Promoted gcloud compute project-views describe command to GA.
--private-connection,
--psc-service-attachment, --static-ip-connectivity, and forward SSH flags
where supported) in gcloud database-migration connection-profiles update.--mysql-is-primary-destination flag to gcloud database-migration migration-jobs create command to specify whether the destination for the migration job is a primary instance.gcloud metastore services migrations start, describe, list,
and delete to GA for one-shot migrations (mode:BACKFILL).INCREMENTAL_SYNC mode in public preview for
iceberg migrations.gcloud design-center spaces application-templates export command to export IaC for an application template.gcloud design-center spaces application-templates revisions export command to export IaC for an application template revision.--input-variable-aliases, --add-input-variable-aliases,
--clear-input-variable-aliases, and --remove-input-variable-aliases flags
to gcloud design-center components update to manage input variable aliases.--tags flag to gcloud beta parametermanager parameters create to allow binding tags during parameter creation.gcloud policy-troubleshoot error-info-id to troubleshoot access denials using an IAM error identifier.Subscribe to these release notes at https://groups.google.com/forum/#!forum/google-cloud-sdk-announce.
Gemini Notebook Enterprise: Website URL ingestion blocked by VPC Service Controls
Projects with VPC Service Controls enabled can't add website URLs as notebook sources in Gemini Notebook Enterprise.
This is because direct website ingestion performs a live web crawl, generating outbound traffic beyond Google networks, which would violate VPC Service Controls perimeter policies.
Other source types, such as Google Docs and YouTube URLs, remain supported in projects with VPC Service Controls enabled.
Gemini Enterprise: Configure custom actions and custom fields in data stores (Private preview)
Gemini Enterprise supports custom fields and custom entities for data store search and actions. You can do the following:
This feature is in private preview. For more information, see Manage custom actions.
Computer Use and Shell sandboxes are generally available
Computer Use and Shell sandboxes in Gemini Enterprise Agent Platform are now generally available (GA). This release also includes the following new features for Agent Platform sandboxes:
Shell sandboxes: Run untrusted shell commands, install packages, and manipulate files in an isolated Linux container using direct API /exec calls. For more information, see the Shell sandbox quickstart.
VPC Service Controls & Private Service Connect: Protect sandbox data and isolate network boundaries with VPC Service Controls, private ingress endpoints (PSC-E), and private egress routing (PSC-I). For more information, see Configure VPC Service Controls and Private Service Connect with sandboxes.
Customer-Managed Encryption Keys (CMEK): Protect sandbox data at rest, including disk storage and snapshot checkpoints, using Cloud KMS keys. For more information, see Configure customer-managed encryption keys (CMEK) for sandboxes.
Pausing and resuming sandboxes: Deschedule compute resources for idle sandboxes while preserving file system state and connection identity, and resume them in seconds. For more information, see Manage sandboxes.
Priority PayGo now supports the US and EU multi-region endpoints
You can send Priority PayGo requests to the us and eu multi-region
endpoints, in addition to the global endpoint.
For more information, see Priority PayGo.
Agent Gateway supports multiple Agent Registry instances
Agent Gateway now lets you associate up to two Agent Registry instances (one global registry and one regional or multi-region registry) with a single Agent Gateway instance. For more information, see Register your agents and destination resources.
Agent Gateway supports VPC Service Controls
Agent Gateway now enforces VPC Service Controls perimeter rules for agent communications. When you configure Agent Gateway with VPC connectivity, agent traffic is routed through your private VPC network, ensuring that your organization's VPC-SC perimeter rules are applied to all agent traffic as well.
Note that setting up VPC connectivity is required to enable VPC Service Controls
perimeter enforcement for Agent Gateway deployments. The connectivity template
must be configured in ALL_TRAFFIC egress mode.
Hubspot: Configure Do Not Call by phone number
In HubSpot integrations, you can now configure Do Not Call for specific phone numbers instead of for an entire contact or company record. Opt-out matching is no longer case-sensitive.
Administrators: There's a new Do Not Call Configuration section in the CRM pane, located at Settings > Developer Settings (with HubSpot selected).
Agent desktop: New network diagnostics tool
The agent desktop has a new network diagnostics tool in the navigation menu that displays network strength and diagnostics information. This tool can help you quickly assess your network's health and troubleshoot connection issues.
Agent desktop: Open from the CCaaS portal
You can now access the Agent Desktop using the new Apps menu. In the CCaaS portal, click Apps > Agent Desktop to open the Agent Desktop in a new browser tab. This lets you move between the portal and the Agent Desktop without ending your portal session.
This release addresses the following issues:
Fixed an issue where SmartAction statuses were incorrectly marked as "failed" when a call ended before a photo or video upload completed.
Fixed an issue where loading the outbound numbers list timed out or caused significant delays for organizations with large teams and custom roles.
Fixed an issue where estimated wait times of less than one minute were incorrectly rounded down to zero, preventing the system from accurately triggering over-capacity actions.
Fixed an issue where sudden spikes in call volume bypassed a team's capacity protections and reduced the team's agent availability to below configured minimums.
Fixed an issue where nested object values in custom data were incorrectly
displayed as [object Object] in the agent desktop session data feed.
Fixed an agent desktop issue where the navigation bar in the Previous Interactions page of the call adapter was overlapped by summary text and didn't stay fixed while scrolling.
Fixed an issue where answered voice calls triggered a second, unrequested callback after the end-user hung up.
Fixed an issue where intermittent IMAP connection rejections caused email fetch workers to enter an extended backoff loop, resulting in several hours of mailbox downtime.
Fixed an issue where inbound voice call recordings weren't exported to external storage when a virtual agent escalation was deflected to voicemail due to over-capacity.
Fixed an issue where manual wrap-up sessions were incorrectly attributed to the most recent call in the Agent Activity Timeline and in raw data exports, even when the wrap-up was unrelated to that call.
Fixed an issue where the "agent leg" of a call connection stalled in a connecting state for the full timeout duration before failing silently and moving the agent to an available status.
Fixed an issue where custom form responses weren't exported to external storage for instances without an external CRM integration.
Fixed an issue where a queue name saved in the SLA thresholds for queues dialog didn't persist after saving.
Fixed an issue where virtual agent voice calls triggered a session error during wrap-up.
Fixed an issue during high-capacity redirections where voicemails weren't saved.
Fixed an issue where completed call transfers generated duplicate queue duration records, leading to inflated reporting for queue volume and SLA metrics.
Fixed an agent desktop issue where the sentiment banner in the call adapter didn't immediately appear at the start of a call.
Fixed an issue where saving the Upload audio recording for Language Selection option of the Languages dialog didn't persist and switched to Text-to-speech.
Fixed an issue where inefficient database queries caused high CPU utilization and performance degradation across all communication channels.
Fixed an issue where transient connection errors during Twilio ICE token fetching caused agent call setup to fail or take longer to connect.
Fixed an issue where temporary connection drops during chat webhook delivery caused unnecessary delays.
Fixed an issue where work time and wait time durations overlapped in reporting metrics.
Fixed an issue where the agent adapter call history incorrectly displayed English queue names for French-Canadian calls.
Fixed an issue where agents were assigned calls from secondary queues even when their primary queue fell below the minimum availability threshold.
Fixed an issue where canceled virtual-agent-to-human escalations incorrectly reported negative queue durations and inaccurate SLA metrics in chat session data and reports.
Fixed an issue where creating or updating queues failed and returned a timeout error.
Fixed an agent desktop issue where an outbound call canceled by an agent while connecting was recorded as an unknown failure instead of an agent cancellation.
Fixed an issue where clicking the rewind and forward buttons on the voicemail page of the call adapter restarted the voicemail from the beginning.
Fixed an agent desktop issue where the chat adapter displayed a loading progress indicator instead of the chat transcript when a chat session was assigned.
Fixed an issue where a disposition prompt didn't appear in the call adapter after a disconnected call, even when mandatory disposition was configured.
Fixed an issue where Agent Assist real-time transcription didn't start on Vonage BYOC calls.
Fixed an issue where changes made outside of browser-originated HTTP requests (such as from API clients or background jobs) failed to generate audit log records.
Fixed an issue where over-capacity phone deflection didn't activate for direct agent calls, resulting in an error message or callers waiting indefinitely.
Fixed an issue where transient network connection failures during call and chat DAP lookups caused inbound calls to route to default queues or prevented chat sessions from starting.
Fixed a web SDK issue where static, non-interactive text within the chat widget incorrectly received keyboard focus, disrupting the navigation flow for keyboard and screen reader users.
Fixed an issue where temporary asset errors during deployments were cached by the CDN, leading to web SDK initialization failures.
Fixed an agent desktop issue where incomplete configuration settings prevented call control buttons from updating or rendering properly.
Fixed an issue where the audio for an over-capacity deflection played in the source queue's language instead of the destination queue's language following a cross-language transfer.
Fixed an issue where waiting chats weren't immediately offered to available agents who became eligible for a queue through a team membership update or direct queue assignment.
You can get IAM role suggestions from Gemini programmatically by using the Policy Assist API (Preview).
For more information, see the following documentation:
The deprecation of the Looker Mobile (Legacy) application has been postponed to January 31, 2027. Starting on January 31, 2027, support for the Looker Mobile (Legacy) app will be discontinued and the app will be unavailable for download from the App Store or Play Store. Although users will still be able to use the Looker Mobile (Legacy) app if they already have it installed, we recommend that you install the non-legacy Looker mobile app.
Google Cloud NetApp Volumes now supports the Flex Unified service level in the following regions:
asia-east1 (Taiwan)
australia-southeast2 (Melbourne)
europe-southwest1 (Madrid)
For more information about available regions, see Supported regions.
You can deploy Monitoring Points optimized for Amazon Web Services (AWS) or Microsoft Azure cloud infrastructure from Cloud Network Insights.
]]>Scheduled upgrade metadata is validated
The value of the notebook-upgrade-schedule metadata key is now validated when
you create or update an Agent Platform Workbench instance. The value must be a
single-line unix-cron
format schedule. For more
information, see Manage features through
metadata.
Conversational analytics now supports predictive modeling questions using the
AI.PREDICT function.
This feature is in
Preview.
To take advantage of reduced pricing for Cloud Run jobs, you can delay job execution to defer non-urgent tasks for up to 12 hours (Preview).
Regional endpoints (REP) are now generally available (GA) for the Cloud SQL for MySQL Admin API.
Regional endpoints let you interact with Cloud SQL for MySQL instances
using regionalized URLs (such as
sqladmin.{region}.rep.googleapis.com)
rather than through a single global endpoint.
Regional endpoints provide regional frontend and load balancing infrastructure that improves data residency by keeping network traffic within the same region as the instance. This reduces the instance's dependency on global frontend infrastructure.
Regional endpoints have strong regional isolation, so the failure of a load balancer or frontend in one region doesn't affect any other region. Regional service load balancers have a separate, regionally isolated control plane.
Regional endpoints are designed to meet stringent data residency and sovereignty standards, such as ITAR and Assured Workloads Regions, ensuring data in transit remains within the committed region.
Certificate management and TLS termination occurs within each region, on the regional load balancer, so data remains encrypted until it reaches its destination region and stays within that region while being processed there.
Regional endpoints (REP) are now generally available (GA) for the Cloud SQL for PostgreSQL Admin API.
Regional endpoints let you interact with Cloud SQL for PostgreSQL instances
using regionalized URLs (such as
sqladmin.{region}.rep.googleapis.com)
rather than through a single global endpoint.
Regional endpoints provide regional frontend and load balancing infrastructure that improves data residency by keeping network traffic within the same region as the instance. This reduces the instance's dependency on global frontend infrastructure.
Regional endpoints have strong regional isolation, so the failure of a load balancer or frontend in one region doesn't affect any other region. Regional service load balancers have a separate, regionally isolated control plane.
Regional endpoints are designed to meet stringent data residency and sovereignty standards, such as ITAR and Assured Workloads Regions, ensuring data in transit remains within the committed region.
Certificate management and TLS termination occurs within each region, on the regional load balancer, so data remains encrypted until it reaches its destination region and stays within that region while being processed there.
Regional endpoints (REP) are now generally available (GA) for the Cloud SQL for SQL Server Admin API.
Regional endpoints let you interact with Cloud SQL for SQL Server instances
using regionalized URLs (such as
sqladmin.{region}.rep.googleapis.com)
rather than through a single global endpoint.
Regional endpoints provide regional frontend and load balancing infrastructure that improves data residency by keeping network traffic within the same region as the instance. This reduces the instance's dependency on global frontend infrastructure.
Regional endpoints have strong regional isolation, so the failure of a load balancer or frontend in one region doesn't affect any other region. Regional service load balancers have a separate, regionally isolated control plane.
Regional endpoints are designed to meet stringent data residency and sovereignty standards, such as ITAR and Assured Workloads Regions, ensuring data in transit remains within the committed region.
Certificate management and TLS termination occurs within each region, on the regional load balancer, so data remains encrypted until it reaches its destination region and stays within that region while being processed there.
The Observability API supports VPC Service Controls. This integration is generally available.
For more information, see the following:
Generally available: You can convert a single-project reservation into a shared reservation, or a shared reservation into a single-project reservation. Modify the share type for a reservation to share your reserved resources with other projects in your Google Cloud organization, or to restrict access to only the reservation's owner project. For more information, see Modify the share type for a reservation.
Config Connector version 1.156.0 is now available.
New Alpha Resources (Direct Reconciler):
CCInsightsQAScorecard
ContentWarehouseSynonymSet
DevConnectAccountConnector
DiscoveryEngineEngine
DiscoveryEngineServingConfig
GKEHubFleet
ModelArmorTemplate
NetworkSecurityAuthzPolicy
RapidMigrationAssessmentCollector
SecurityCenterManagementEventThreatDetectionCustomModule
StorageInsightsDatasetConfig
VectorSearchCollection
New Fields:
spec.automatedBackupPolicy.locations field.spec.nodeConfig.swapConfig field.spec.nodeConfig.swapConfig field.spec.secondaryWorkerConfig.instanceFlexibilityPolicy field.NetworkSecurityFirewallEndpoint
spec.organizationRef field to support organizing resources at the organization level, and made spec.projectRef optional.New Features:
natIpAllocateOption an optional field in ComputeRouterNat to support dynamic allocation.Reconciliation Improvements:
We have added support for direct reconciliation to more resources, with opt-in behavior. The API is unchanged. To use the direct reconciler, add the alpha.cnrm.cloud.google.com/reconciler: direct annotation to the corresponding Config Connector object. The following resources now have direct reconciliation support:
VertexAITensorboard
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.18.48 | v29.4.3 | v2.3.4 | See List |
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.12.105 | v27.5.1 | v2.2.7 | See List |
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.18.49 | v29.4.3 | v2.3.2 | See List |
Updated containerd and containerd-test to v2.3.4.
Updated the Linux kernel to v6.18.48.
Fixed CVE-2026-33186 in app-containers/docker.
Updated the Linux kernel to v6.18.48.
Fixed docker cp failure when copying to/from containers with symlinked bind mounts.
Updated the Linux kernel to v6.18.49.
Fixed CVE-2026-33186 in app-admin/extensions-manager.
Updated sys-devel/binutils to v2.40.
Fixed CVE-2026-33186 in app-admin/google-osconfig-agent.
Update dev-go/net to v0.55.0 to fix CVE-2026-25680.
Fixed CVE-2026-33186 in app-admin/node-problem-detector.
Fixed CVE-2026-33186 in app-containers/containerd.
Fixed CVE-2026-33186 in app-emulation/kubernetes.
Upgraded app-containers/docker-credential-helpers to v0.9.9.
Upgraded dev-db/sqlite to v3.53.4.
Upgraded dev-libs/expat to v2.8.4.
Upgraded dev-libs/xxhash to v0.8.3-r2.
Upgraded net-libs/libnftnl to v1.2.9.
Fixed CVE-2026-6238 in sys-libs/glibc.
Updated dev-go/net to v0.55.0 to fix CVE-2026-25680.
Runtime sysctl changes:
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.6.153 | v24.0.9 | v1.7.34 | See List |
Fixed docker cp failure when copying to/from containers with symlinked bind mounts.
Upgraded app-admin/google-guest-configs to v20260819.00.
Upgraded app-arch/zstd to v1.5.7-r1.
Upgraded app-containers/docker-credential-helpers to v0.9.9.
Upgraded app-shells/dash to v0.5.13.5.
Upgraded dev-db/sqlite to v3.53.4.
Upgraded dev-libs/expat to v2.8.3.
Upgraded dev-libs/libverto to v0.3.2-r1.
Upgraded dev-libs/popt to v1.19-r1.
Upgraded dev-libs/xxhash to v0.8.3-r2.
Upgraded net-libs/libnftnl to v1.2.9.
Upgraded sys-apps/acl to v2.4.0-r2.
Upgraded sys-auth/passwdqc to v2.0.3-r1.
Upgraded sys-process/lsof to v4.99.7.
Fixed CVE-2026-6238 in sys-libs/glibc.
Updated dev-go/net to v0.55.0 to fix CVE-2026-25680.
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.6.153 | v27.5.1 | v2.0.10 | See List |
Fixed docker cp failure when copying to/from containers with symlinked bind mounts.
Upgraded app-admin/google-guest-configs to v20260819.00.
Upgraded app-containers/docker-credential-helpers to v0.9.9.
Upgraded dev-db/sqlite to v3.53.4.
Upgraded net-libs/libnftnl to v1.2.9.
Upgraded sys-auth/passwdqc to v2.0.3-r1.
Fixed CVE-2026-6238 in sys-libs/glibc.
Updated dev-go/net to v0.55.0 to fix CVE-2026-25680.
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.12.105 | v27.5.1 | v2.2.7 | See List |
Added support for NVIDIA driver v595.91.07.
Fixed docker cp failure when copying to/from containers with symlinked bind mounts.
Upgraded dev-db/sqlite to v3.53.4.
Fixed CVE-2026-6238 in sys-libs/glibc.
Updated dev-go/net to v0.55.0 to fix CVE-2026-25680.
Runtime sysctl changes:
Gemini Enterprise: Semantic search support in Google Cloud Marketplace (Preview)
The agent search in Google Cloud Marketplace now supports semantic search, allowing you to find agents by describing their functionality (for example, "generate reports" or "translate text") without needing exact keyword matches.
For more information, see Add and manage A2A agents from Google Cloud Marketplace.
Agent connectivity templates for VPC connectivity in Agent Gateway
Agent Gateway now uses agent connectivity templates
(agentConnectivityTemplate) to configure and manage egress connectivity to VPC
networks. Connectivity templates let you choose whether to route all outbound
agent traffic (ALL_TRAFFIC) or only traffic to certain private IP address
ranges (PRIVATE_RANGES_ONLY) into your VPC network. For more information, see
Set up VPC connectivity for Agent
Gateway.
Advanced reporting dashboards prerelease notes 6.4
Here are the pre-release notes for updates to the advanced reporting dashboards and other reporting in CCAI Platform. When we release these updates, we expect the new capabilities to be as shown here.
Real-time Agent Monitoring dashboard: new Active call ID(s) column
The Real-time Agent Monitoring dashboard now has an Active Call ID(s) column in the Live Agent Data table. The column displays the call ID(s) for any call in a connecting, connected, or reconnecting state for the agent. If an agent is handling multiple concurrent calls, the call IDs appear in a comma-separated list. The Active Call ID(s) column reduces the number of steps required for supervisors to identify active calls during live monitoring.
Improved filtering by team
We made the following changes to team-based filtering:
Renamed the Teams filter to Agent Teams to clarify that it filters by the agent team handling the interactions. This change is in the Real-time Queue Monitoring - Calls, Real-time Queue Monitoring - Chats, Real-time Calls - Calls Connected, and Real-time Chats - Chats Connected dashboards.
Added a Queue Teams filter to the Real-time Calls - Calls Queued and Real-time Chats - Chats Queued dashboards. This lets you filter queued interactions by the team assigned to the queue.
Improved the Real-time Calls and Real-time Chats dashboards
We made the following dashboard improvements:
Real-time Calls - Calls Connected dashboard. Added the following columns to the Connected Calls table:
Total Consumer Talk Time. Total time since the call first connected to a virtual agent or a human agent.
Total Hold Time. Total time the call has spent on hold so far, including a hold currently in progress.
Real-time Chats - Chats Connected dashboard. Added the following column to the Connected Chats table:
Real-time Calls - Calls Queued dashboard: new Projecting column
The Real-time Calls - Calls Queued dashboard has a new Projecting column in the Call Queued table. Indicates whether the routing engine (deltacast) is currently projecting this queued call to an available agent.
This release addresses the following issues:
Fixed an issue where the formatting of numeric values was inconsistent across tiles.
Fixed an issue where column headers, filter labels, and tile titles didn't immediately switch to a newly selected language.
Fixed an issue where the Productive Agents column in the tables of the Queue Group Performance - All dashboard didn't display values appropriate to the queue group settings.
Fixed an issue in the Call Queue Metrics (Historical) Explore where filtering by Agent Name without including it as a visible column resulted in zero rows being returned.
Fixed an issue that affected calls to a sub-menu that were deflected using Custom After Hours Deflection to a message. These calls were incorrectly attributed to the parent menu in the All Queued Interactions report.
Fixed the effectiveness of the Direction filter in the following dashboards:
Agent Performance. The Agent Productivity Detailed – Calls and Agent Productivity Detailed – Chats tables correctly reflect the filter setting.
Real-time Agent Monitoring. The Agent Performance table and historical metrics tiles correctly reflect the filter setting.
All Interactions – Calls and All Interactions – Chats. The IVR Interactions (calls only) and Virtual Agent Interactions tables correctly reflect the filter setting.
Fixed an issue with the Queue Performance - Calls dashboard when short abandons were present in the specified date range. The Avg Queue Time column in the Queue Summary table incorrectly displayed the raw sum of queue durations instead of a true average.
Fixed an issue where team filters didn't apply correctly when generating the Individual Call History Report and the Individual Chat History Report. This resulted in the inclusion of data from unmanaged queues.
Fixed the following issues with the Real-time Calls - Calls Queued dashboard:
The Total Queued Now metric didn't include callers who were returned to the queue after an automated-answer detection miss.
The Current Max Queue Wait Time (H:M:S) and Current Avg Queue Wait Time (H:M:S) metrics mistakenly measured from a caller's original entry into the queue, rather than from their most recent return to the queue.
Fixed an issue where a gray bar appeared at the bottom of the advanced reporting dashboards, preventing a full view of the dashboards.
GKE cluster versions have been updated.
New versions available for upgrades and new clusters.
The following versions are now available for new GKE clusters, and for manual control plane upgrades and node upgrades for existing clusters. For more information about versioning and upgrades, see GKE versioning and support and About GKE cluster upgrades.
This release includes new GKE versions that use updated Container-Optimized OS images. These updated images are cumulative, incorporating security fixes from all Container-Optimized OS versions released since the previous GKE release.
To identify the specific vulnerabilities that were resolved in each updated Container-Optimized OS image, see the Security release notes for that image. The following table includes links to the release notes for each updated Container-Optimized OS image:
| GKE version | Container-Optimized OS version | Details |
|---|---|---|
| 1.31.14-gke.2689000 | cos-117-18613-731-2 | cos-117-18613-731-2 release notes |
| 1.36.4-gke.1247000 | cos-129-19506-448-8 | cos-129-19506-448-8 release notes |
| 1.37.0-gke.3165000 | cos-129-19506-299-82 | cos-129-19506-299-82 release notes |
Parameter Manager supports using tags to group and organize parameters and conditionally manage access control using Identity and Access Management (IAM) policies.
For more information, see Create and manage tags.
General availability support for the following integration:
]]>Google addressed a security vulnerability (CVE-2026-65107) that affects Slurm clusters. Based on the Google Cloud product that you used to create your Slurm cluster, see one of the following to mitigate the vulnerability:
Privileged Access Manager is generally available (GA).
Privileged Access Manager is generally available (GA).
Google addressed a security vulnerability (CVE-2026-65107) in the Slurm sbcast
tool that affects Cluster Toolkit. For more information, see the
security bulletin.
Data domains in Knowledge Catalog allow you to logically organize the resources within the enterprise to discover and curate your data at scale. This feature is available in Preview.
For more information, see About data domains.
]]>[Spotlight Feature] Case playbooks
This feature is in preview. Google SecOps now supports case playbooks. You can run playbooks or execute manual actions across an entire case container rather than individual alerts, consolidating response tasks and reducing redundant operations during investigations.
For more information, see Case playbooks overview.
[Spotlight Feature] Reaction triggers
This feature is in preview. Google SecOps now supports reaction triggers. As post-ingestion triggers, they allow playbooks to automatically fire in response to real-time case or alert updates during active investigations, such as changes to the case assignee, case tags, alert priority, or newly added entities.
For more information, see Use reaction triggers in playbooks.
Release 6.3.100 is being rolled out to the first phase of regions as listed here.
This release contains internal and customer bug fixes.
Reaction triggers
This feature is in preview. Google SecOps now supports reaction triggers. As post-ingestion triggers, they allow playbooks to automatically fire in response to real-time case or alert updates during active investigations, such as changes to the case assignee, case tags, alert priority, or newly added entities.
For more information, see Use reaction triggers in playbooks.
Case playbooks
This feature is in preview. Google SecOps now supports case playbooks. You can run playbooks or execute manual actions across an entire case container rather than individual alerts, consolidating response tasks and reducing redundant operations during investigations.
For more information, see Case playbooks overview.
]]>Release 6.3.99 is now available for all regions.
]]>The remote Model Context Protocol (MCP) server for Audit Manager is generally available (GA).
Introducing the Incentives page, for tracking spend-based milestone credits, RaMP, and other conditional incentives
If you have a custom pricing contract, you might be enrolled in conditional incentives, where you earn credits or discounts for spending specific amounts on Google Cloud.
The Incentives page replaces the Spend-based Milestones tab that was located in the Credits page. The Incentives page provides a consolidated and enhanced experience for tracking your progress towards conditional incentives, including spend-based milestone credits and Rapid Migration & Modernization Program (RaMP) credits and discounts.
Learn more about tracking conditional incentives.
The C4 machine series is now available for Cloud SQL for MySQL Enterprise Plus instances in the following regions:
africa-south1 — Johannesburgasia-northeast3 — Seoulasia-south2 — Delhieurope-west6 — Zürichsouthamerica-west1 — Santiagous-west3 — Salt Lake CityThe C4 machine series provides the following benefits:
Cloud SQL supports in-place upgrades and downgrades to your instance's infrastructure. You can change all of the following in place:
Making in-place changes is the most direct and least error-prone way to reconfigure an instance.
For more information about in-place upgrades and downgrades, see Upgrade in place.
The C4 machine series is now available for Cloud SQL for PostgreSQL Enterprise Plus instances in the following regions:
africa-south1 — Johannesburgasia-northeast3 — Seoulasia-south2 — Delhieurope-west6 — Zürichsouthamerica-west1 — Santiagous-west3 — Salt Lake CityThe C4 machine series provides the following benefits:
Cloud SQL supports in-place upgrades and downgrades to your instance's infrastructure. You can change all of the following in place:
Making in-place changes is the most direct and least error-prone way to reconfigure an instance.
For more information about in-place upgrades and downgrades, see Upgrade in place.
Cloud SQL for SQL Server now supports connecting to instances with write endpoints using the Cloud SQL Auth Proxy or Cloud SQL language connectors. When you configure the proxy or a language connector with a write endpoint DNS name, connections are redirected automatically to the new primary instance during replica failover or switchover.
For more information, see Connect to an instance using a write endpoint.
The C4 machine series is now available for Cloud SQL for SQL Server Enterprise Plus instances in the following regions:
africa-south1 — Johannesburgasia-northeast3 — Seoulasia-south2 — Delhieurope-west6 — Zürichsouthamerica-west1 — Santiagous-west3 — Salt Lake CityThe C4 machine series provides the following benefits:
Cloud SQL supports in-place upgrades and downgrades to your instance's infrastructure. You can change all of the following in place:
Making in-place changes is the most direct and least error-prone way to reconfigure an instance.
For more information about in-place upgrades and downgrades, see Upgrade in place.
The Security Rules simulator is now available in the Google Cloud console for Firestore (Standard and Enterprise editions). You can test draft security rules against simulated database requests and evaluate authentication tokens before deploying rules.
For more information, see Test rules with the rules simulator or Test rules in the Google Cloud console.
New subscriptions for Gemini Code Assist can no longer be purchased through the Google Cloud console using billing accounts that don't have an active Gemini Code Assist subscription. Billing accounts that currently have an active Gemini Code Assist subscription are unaffected.
For billing accounts that don't have an active Gemini Code Assist subscription, you can obtain a new Gemini Code Assist subscription by contacting Google Cloud sales. For alternative AI developer tools, use Antigravity, which is available through eligible Gemini Enterprise subscriptions and through Gemini Enterprise Agent Platform.
New subscriptions for Gemini Code Assist can no longer be purchased through the Google Cloud console using billing accounts that don't have an active Gemini Code Assist subscription. Billing accounts that currently have an active Gemini Code Assist subscription are unaffected.
For billing accounts that don't have an active Gemini Code Assist subscription, you can obtain a new Gemini Code Assist subscription by contacting Google Cloud sales. For alternative AI developer tools, use Antigravity, which is available through eligible Gemini Enterprise subscriptions and through Gemini Enterprise Agent Platform.
Gemini Enterprise: Monday federated data store (GA)
Connecting a Monday data source with Gemini Enterprise using data federation is generally available (GA). You can use the Gemini Enterprise app assistant to search across your Monday boards, items, updates, and docs, and get answers grounded in that content without needing to ingest the data.
For more information, see Set up a Monday data store.
Gemini Enterprise: New data stores and support for new actions (Preview)
The following data stores are available in Public Preview in Gemini Enterprise:
You can search and read data from these data stores, and perform actions using natural language.
Gemini Enterprise: Create and manage projects
You can create and manage projects in the Gemini Enterprise web app to build a dedicated knowledge base for your own work or to collaborate with your team. Within a project, you can upload files and chat privately with the assistant to get answers grounded in your project files and web search.
This feature is generally available (GA). To make projects available to users, a Gemini Enterprise administrator must turn on the Enable projects toggle in the Google Cloud console.
For more information, see the following:
Kubernetes 1.37 is now available in the Rapid channel. For more information about the content of Kubernetes 1.37, read the Kubernetes 1.37 Release Notes and Kubernetes 1.37 Release Blog.
--node-creation-mode=KUBELET. For more information, see
Disable control plane node creation.reservedResourcesConfig option in the node system configuration file.Google Chronicle: Version 94.0
Reverted the execution mode to synchronous in the following action:
Looker 26.16 will roll out to Looker (original) instances on the following schedule:
Looker 26.16 is expected to include the following changes, features, and fixes.
An issue has been fixed where logging in with a Google Cloud Workforce Identity within an embedded iframe could fail as a result of frame restrictions or because the authentication popup closed before session cookies were established. This feature now performs as expected.
An issue has been fixed where switching to a histogram visualization in an Explore could fail or revert unexpectedly. Additionally, stack resolution on pivoted histograms has been improved. This feature now performs as expected.
An issue has been fixed where the alert creation and edit modal displayed Method instead of defaulting to Email as the notification method. This feature now performs as expected.
An issue has been fixed where embedded dashboards with numerous filters caused horizontal container overflow, prevented filters from wrapping across rows, and resulted in clipped tiles during PDF and PNG exports.
An issue has been fixed where custom themes configured as the instance default were not applied to dashboards in view-only mode or during dashboard navigation. This feature now performs as expected.
An issue has been fixed where LookML dashboard URLs that were opened from the search page contained encoded colons (%3A%3A), which prevented filter interactions from updating URL query parameters. This feature now performs as expected.
An issue has been fixed where Single Value visualizations and KPI visualizations would not allow creating a comparison against a non-measure table calculation. This feature now performs as expected.
An issue has been fixed where visualization-level filters could not be edited or deleted because of missing popover menus. This feature now performs as expected.
An issue has been fixed where resizing an Explore that contained a Word Cloud visualization could cause the Explore to crash. This feature now performs as expected.
An issue has been fixed where generating LookML for analytic models without selecting any database tables could cause Looker to create views for all database tables and to drop certain properties because of identifier case sensitivity. This feature now performs as expected.
An issue has been fixed where filter context banners and timezone settings were not preserved when generating PNG downloads from drill menus. This feature now performs as expected.
An issue has been fixed where applying pivots to merge queries could cause visualization errors and blank column headers in the results table. This feature now performs as expected.
An issue has been fixed where standalone tile exports from embedded dashboards with filter context could render off-screen or with clipped visualizations in PDF and PNG formats. This feature now performs as expected.
An issue has been fixed where clearing all text from a dashboard note tile failed to persist upon page refresh. This feature now performs as expected.
The BigQuery High Throughput API has been disabled by default to prevent connection errors for environments without bigquery.readsessions.create permissions. Additionally, required JVM flags for JDK 11 environments have been added. This feature now performs as expected.
An issue has been fixed where multi-line prompt text in dashboard chat views caused action buttons (such as the Thinking toggle and Send button) and vertical scrollbars to be misaligned. This feature now performs as expected.
An issue has been fixed where pinned Looks on boards generated broken URLs that redirected to the home page and failed to dynamically reflect title updates. This feature now performs as expected.
An issue has been fixed where selecting a suggestion could reset the dropdown to a loading spinner. This feature now performs as expected.
An issue has been fixed where collapsible navigation items in the Admin panel and the main navigation pane rendered rectangular focus outlines rather than rounded focus indicators during keyboard navigation. This feature now performs as expected.
An issue has been fixed where typed search strings persisted after you selected an autocomplete suggestion in multi-select filters. This feature now performs as expected.
When you duplicate a user-defined dashboard, associated Looker data agent instructions, configurations, and sources are now preserved on the copied dashboard.
Self-service models have been restricted to only their assigned user database connections, preventing unintended instance-wide database connection access.
Boxplot visualizations now render transparent median dividers and borders properly in inverted and dark theme layouts.
An issue has been fixed where IAM administrators on Looker (Google Cloud core) instances failed authentication when the auth_requires_role and strict Group Role Mapping were enabled. This feature now performs as expected.
The Semantic Search feature is now generally available.
Now available in preview, the Admin Assistant helps you use natural language to manage Looker roles.
Key updates in these image versions include:
3.0 images. Version 1.2.0 is available in 3.0 images.spark.gluten.sql.columnar.backend.velox.cacheParquetFooters=false.1.10 in 2.2 images. Users can opt-in by setting the cluster property, dataproc:dataproc.iceberg.version=1.10.2.2 and later.4.0.4 in 3.0 images.1.49 in 3.0 images to support lineage for tables created using the Lakehouse Runtime catalog.Managed Service for Apache Spark (formerly Dataproc on Compute Engine):
conda-forge) have been removed from configurations. All image version aliases now point to the latest image without conda channel configuration. Support for earlier images with conda channels configuration to be announced in upcoming release notes. Recommendation: Migrate to the latest image versions as soon as possible.
1.3.96+, 1.4.81+, 1.5.92+, 2.0.161+, 2.1.119+, 2.2.87+, and 2.3.36+.dataproc:conda.packages cluster property or direct conda install <package> command will fail.<channel>::<package>==<version> specification for the dataproc:conda.packages property (for example: dataproc:conda.packages=conda-forge::pip==24.0).conda install (for example: conda install <packages> -c conda-forge).google-guest-agent on Debian and Rocky Linux images (remediating CVE-2026-33186).dataproc) with sudo, or use Google Cloud OS Login.Managed Service for Apache Spark (formerly Dataproc on Compute Engine): Fixed a segmentation fault when OpenLineage parses complex SQL query strings with the Lakehouse Runtime catalog.
Clarification: August 5, 2026 release note for Melbourne and Seoul
In Melbourne (australia-southeast2) and Seoul (asia-northeast3), only the
Sensitive Data Protection filter is supported when data residency is
enforced. To use other Model Armor features in these regions,
disable data residency enforcement in the
template.
For information about available Model Armor features for each region, see Supported features by region.
]]>New model routing gateways might use a gateway.dev default hostname
If you create a gateway that uses model routing on or after September 3, 2026, it
might receive a gateway.dev default hostname instead of a run.app one, in the
form https://GATEWAY_ID-PROJECT_NUMBER.REGION.gateway.dev — for example, https://my-gateway-123456789012.us-central1.gateway.dev. This is a second gateway.dev format; other gateways keep the existing one.
To get a gateway's URL, read its defaultHostname property.
For more information, see Deploy an API to a gateway.
Conversational analytics now supports questions about market basket analysis. This feature is generally available (GA).
General availability: Filtered export of DICOM data using filterConfig is now
generally available (GA) in Cloud Healthcare API v1. You can supply a Cloud Storage
URI (resourcePathsGcsUri) containing a newline-delimited list of DICOMweb resource
paths (studies/<studyUID>[/series/<seriesUID>[/instances/<instanceUID>]]) in
projects.locations.datasets.dicomStores.export
to export targeted subsets of DICOM data rather than the entire DICOM store.
For more information, see
Exporting DICOM instances using filters.
You can use Storage batch operations to do the following:
For more information, see Storage batch operations overview and Create and manage batch operations jobs.
Gemini Enterprise: Latency and error rate views for agents
To monitor operational telemetry for your agents, use the two new views on the Observability tab:
This feature is generally available (GA). For more information, see Access metrics.
Gemini Enterprise: General availability of Workflow Builder (formerly Agent Designer)
Workflow Builder (formerly known as Agent Designer) is generally available (GA) in Gemini Enterprise.
Workflow Builder enables users across your organization to build multi-step automated workflows to streamline tasks and connect to enterprise data.
Key capabilities in this release include:
@-mention directly within Gemini Enterprise chat conversations.@-mention.@-mention.For more information, see Workflow Builder.
Google Cloud CCaaS 6.9
We've released version 6.9 of Google Cloud CCaaS.
The timing of the update to your instance depends on the deployment schedule that you have chosen. For more information, see Deployment schedules.
Agent desktop supports email
The agent desktop now supports email. Agents can handle email interactions using the email adapter in a desktop layout.
Administrators: There's a new Email Adapter checkbox in the following locations:
The Desktop Layout Builder dialog at Settings > Operation Management > Agent Desktop > Manage Desktop Layout Lists > Add desktop layout.
The Desktop Layout Builder at Settings > Operation Management > Agent Desktop > Manage Desktop Layout Lists > Add desktop layout > Next.
User experience change: There's a new new emails menu in the menu bar of the agent desktop.
For more information, see Create a desktop layout and Handle an email.
This release addresses the following issues:
Fixed an issue where agents couldn't send new outbound emails.
Fixed an issue where the disposition panel in the call adapter was incorrectly hidden or visible due to inconsistent state updates.
Fixed an issue where direct inbound voicemails appeared multiple times in the History tab of the call adapter.
Fixed an issue where voice callbacks were canceled at the end of operating hours instead of rolling over to the next day.
Fixed an issue where using click-to-dial from a Salesforce case incorrectly overwrote the parent account's mobile phone number with the dialed number.
Fixed an issue where ending a call resulted in significant latency or connection errors in the instance.
Fixed an issue where hold music in call recordings overlapped live conversation.
Fixed an issue where the deletion of a custom hours of operation group didn't appear in the Audit Dashboard.
Fixed an issue in Zendesk integrations where the system mistakenly navigated from the active ticket tab to the customer profile page when a voice call ended.
GKE support for using the c3-standard-*-lssd machine types as Confidential
GKE Nodes with Intel TDX is generally available. For more information, see the
following:
Self-service Bindplane Enterprise license download
This feature is currently in Preview for Google Security Operations tenants in the US and EU regions. Google Security Operations Enterprise Plus and Google Unified Security (GUS) customers can now download their Bindplane Enterprise (Google Edition) license key directly from the platform console under SIEM Settings > Collection Agents.
For more information, see Bindplane Enterprise (Google Edition).
Google Chronicle: Version 93.0
Added the following new action:
ServiceNow: Version 72.0
Added the ability to authenticate using client credentials without a refresh token to the following connector:
FireEye ETP: Version 11.0
Updated ontology mapping rules and fixed missing alert details and event data for v2 API issue in the following connector:
Self-service Bindplane Enterprise license download
This feature is currently in Preview for Google Security Operations tenants in the US and EU regions. Google Security Operations Enterprise Plus and Google Unified Security (GUS) customers can now download their Bindplane Enterprise (Google Edition) license key directly from the platform console under SIEM Settings > Collection Agents.
For more information, see Bindplane Enterprise (Google Edition).
You can use client-side metrics to troubleshoot why your application might experience high latency. This feature is generally available.
Spanner supports the following PostgreSQL-dialect database operators:
ILIKE (~~*)NOT ILIKE (!~~*)Spanner supports the following PostgreSQL-dialect database functions:
pg.ilikepg.not_ilikeFor more information, see Pattern matching operators and Functions.
VPC Service Controls feature (Status:
Preview):
VPC Service Controls supports retrieving and updating service perimeters that
contain deleted IAM principals. When you enable this feature, you can manage
perimeters that contain deleted user, group, or service account identities
without triggering the The email address is invalid or non-existent error.
For more information, see Supported identities for ingress and egress rules.
]]>AlloyDB real-time data access to BigQuery (in Preview) now offers limit pushdown and runtime projects:
LIMIT and OFFSET clauses are automatically pushed down to BigQuery, reducing network transfer and improving query response times. For more information, see Access to real-time data in BigQuery overview.Consider using least-privilege security controls to restrict foreign server usage. For more information, see Secure BigQuery data access using the foreign data wrapper.
Apigee Edge for Private Cloud release notes are now published on this page.
Release notes and patch announcements for Apigee Edge for Private Cloud are published here from September 2026 onward. You can subscribe to this page with a feed reader to be notified when a new release or patch is published.
Release notes published before September 2026 remain available in the Apigee Edge release notes archive.
Apigee Edge for Public Cloud release notes are now published on this page.
Release notes for Apigee Edge for Public Cloud, including its Edge UI, SSO, Message Processor, and integrated portal components, are published here from September 2026 onward. You can subscribe to this page with a feed reader to be notified when a new release is published.
Release notes published before September 2026 remain available in the Apigee Edge release notes archive.
Application Design Center supports the following components in General Availability:
An updated version of the Simba JDBC driver for BigQuery is now available.
Cloud SQL supports Workforce Identity Federation authentication. This lets you authenticate to your Cloud SQL instance using identities from an external identity provider such as Microsoft Active Directory or Okta. For more information, see Workforce Identity Federation authentication.
Cloud SQL supports Workforce Identity Federation authentication. This lets you authenticate to your Cloud SQL instance using identities from an external identity provider such as Microsoft Active Directory or Okta. For more information, see Workforce Identity Federation authentication.
Support for Intel TDX on
c3-standard-*-lssd machine types
is generally available (GA).
custom/ directory scaffolding across all developer skills for local extensions.Gemini Enterprise: Gemini 3.8 Flash available in Global, US, and EU regions
Gemini 3.8 Flash is generally available (GA) in the global, us, and eu
regions.
For more information, see:
Gemini 3.8 Flash is generally available
Gemini 3.8 Flash is now generally available (GA) and available for production use.
For more information on 3.8 Flash, see the model page.
CodeMender updates
This release introduces updates to CodeMender:
--json flag to cm stats to export aggregate and per-session metrics (CACHE_HIT%, THINK_RATIO%, TOOL_CALLS, DURATION).cm stats --session <id> to inspect turn-by-turn token consumption for specific sessions.cm report import failed on native JSON reports or findings referencing new files.For more information, see CodeMender documentation.
Deferred tier for autonomous agent scheduling (Preview)
The deferred tier is available in Preview. The deferred tier automatically queues non-latency-sensitive background agent workloads and schedules them to execute during off-peak hours.
Key capabilities and benefits include:
service_tier="deferred" in the Python SDK or "service_tier": "deferred" in REST API interaction requests.For more information, see Autonomous agent scheduling.
GKE cluster versions have been updated.
New versions available for upgrades and new clusters.
The following versions are now available for new GKE clusters, and for manual control plane upgrades and node upgrades for existing clusters. For more information about versioning and upgrades, see GKE versioning and support and About GKE cluster upgrades.
This release includes new GKE versions that use updated Container-Optimized OS images. These updated images are cumulative, incorporating security fixes from all Container-Optimized OS versions released since the previous GKE release.
To identify the specific vulnerabilities that were resolved in each updated Container-Optimized OS image, see the Security release notes for that image. The following table includes links to the release notes for each updated Container-Optimized OS image:
| GKE version | Container-Optimized OS version | Details |
|---|---|---|
| 1.31.14-gke.2667000 | cos-117-18613-675-64 | cos-117-18613-675-64 release notes |
| 1.32.13-gke.2393000 | cos-121-18867-584-3 | cos-121-18867-584-3 release notes |
| 1.35.8-gke.1225000 | cos-125-19216-532-135 | cos-125-19216-532-135 release notes |
| 1.36.4-gke.1082000 | cos-129-19506-299-161 | cos-129-19506-299-161 release notes |
| 1.37.0-gke.2155000 | cos-129-19506-299-82 | cos-129-19506-299-82 release notes |
OpenJDK 11 will no longer be supported as of January 14, 2027. Customer-hosted instances must upgrade to OpenJDK 21.
Filter version v3 will be promoted to the Stable alias on or before
September 25, 2026. On the same date, filter versions v1 and v2 transition
to Legacy status and retire on November 29, 2026.
If your templates use the Stable alias, they will automatically upgrade to
v3 when it is promoted. If your templates use explicit version numbers (v1
or v2), migrate them to v3 or the Stable alias before November 29, 2026.
For more information, see Set the filter version for a template.
Spanner supports using the TABLESAMPLE operator in PostgreSQL-dialect
databases to select a random sample of a dataset.
For more information, see
TABLESAMPLE operator.
On September 1, 2026, we released an updated version of the Apigee UI.
| Bug ID | Description |
|---|---|
| 547582067 |
Revisions can now be imported for API proxies and shared flows in a space Importing a revision in the Apigee UI now works for an API proxy or shared flow that is associated with a space. Previously, the Apigee UI did not include the space when it uploaded the revision bundle, so the import request was rejected and the new revision was not created. This affected both API proxies and shared flows. The earlier workaround of removing the API proxy or shared flow from its space, importing the revision, and then adding it back to the space is no longer needed. |
Support for the Go 1.27 runtime is in General Availability (GA).
Support for the Go 1.27 runtime is in General Availability (GA).
Backup vault support for AlloyDB for PostgreSQL instances encrypted with customer-managed encryption keys (CMEK) is generally available (GA), providing immutable and indelible storage with enforced retention. For more information, see Encrypt AlloyDB for PostgreSQL cluster backups.
Announcing the general availability (GA) of cross-region backups for AlloyDB for PostgreSQL clusters. You can now protect AlloyDB for PostgreSQL clusters against regional outages by storing backups in a distinct secondary region of your choice. To learn more, see Backup vaults for immutable and indelible backups.
The Rust SDK for BigQuery is now in Preview.
You can use the Google Cloud console to create and manage aggregate column families for your Bigtable tables. You can also view and query aggregate column families in Bigtable Studio. This feature is generally available (GA). For more information, see Create and manage tables and Manage your data using Bigtable Studio.
You can opt out of alert notifications from an SMS notification channel by sending a text message to the phone number associated with the notification channel. For more information, see Opt out of SMS notifications.
Support for the Go 1.27 runtime is in General Availability (GA).
Configure Agent Platform features on your Cloud Run services and jobs to securely authenticate AI agents and MCP servers using system-managed Agent Identities. This support also includes automatic registration in the Agent Registry (Preview).
Support for the Go 1.27 runtime is in General Availability (GA).
Managed Cloud Service Mesh will start using proxy version csm_mesh_proxy.20260819_RC00 for Gateway API on GKE clusters. This proxy version maps closest to Envoy version 1.37. This change is rolling out to all release channels and contains the fix for the managed Cloud Service Mesh security vulnerabilities listed in GCP-2026-057.
Developer Connect account connectors is now generally available.
Various bug fixes and minor product enhancements.
Gemini Enterprise: Overage controls available for all invoiced Cloud Billing accounts
Configuring overage controls in Gemini Enterprise is available to all projects linked to an invoiced Cloud Billing account. Previously, customers that received an email with the subject line [Billing Update] New Gemini Enterprise overage billing controls launching Aug 17, 2026 couldn't enable overages despite having an invoiced Cloud Billing account. This restriction no longer applies.
For more information, see Overview of overages and spend controls.
Anthropic's Claude Fable 5.1 is now available
Claude Fable 5.1 is available in Model Garden.
Embedding SKUs are changing
Memory bank uses the following embedding model SKUs:
For detailed information about individual SKUs, see Google Cloud Platform SKUs.
Pricing updates for agent metering
Session and memory bank compute metering is in effect for the Agent Platform compute SKU. For more information, see Gemini Agent Platform Pricing.
GKE version 1.35.1-gke.1031000 and later include the following changes to automatically created firewall rules for Services:
1000 to 999.If you use custom firewall rules to override GKE firewall rules for Services, these changes might cause unexpected behavior. Before you upgrade your clusters to version 1.35.1-gke.1031000 or later, do the following:
1000, change the priority of those rules to a numerically lower value (such as 999 or lower) to maintain their precedence.The bare metal machine types from the C3 machine
series are now generally
available with GKE clusters. You can now provision machine types such as
c3-standard-192-metal in Standard mode with any available GKE version.
To use these machine types with Autopilot mode, ComputeClasses, and node pool auto-creation, you must specify the exact machine type using a custom ComputeClass and use GKE version 1.35.3-gke.1389000 or later.
The Policy Analyzer MCP server is generally available. To learn about using the Policy Analyzer MCP server to let agents and AI applications analyze and audit IAM configurations, see Use the Policy Analyzer remote MCP server.
Fraud Defense Mobile SDK v18.9.3 is available for Android. This version includes detection and performance enhancements.
]]>You can now create, store, and manage pipelines in Git folders. This feature is in Preview.
BigQuery now supports TabFM,
Google's pre-trained foundation model for tabular data. TabFM enables zero-shot
regression and classification through in-context learning. It delivers
high-accuracy predictions on structured data without requiring model training
or hyperparameter tuning.
You can use TabFM directly through the
AI.PREDICT function
and evaluate model performance by using the
AI.EVALUATE function.
This feature is in
Preview.
Support for configuring daily token quotas for BigQuery generative AI functions has been restored.
Using folders to create, store, and manage pipelines is generally available.
You can now create an identity column, sometimes referred to as an auto-incrementing column, on a table. You can use identity columns to create and maintain primary keys on your tables. When you insert a row into a table that has an identity column, BigQuery generates a unique integer value for that column. This feature is in Preview.
BigQuery Graph is generally available (GA).
BigQuery Graph now includes support for the CALL
graph query statement,
and the following path inspection
GQL functions:
IS_ACYCLICIS_SIMPLEIS_TRAIL.You can use the pgAudit extension to prevent string literals that might indicate sensitive information, such as passwords and secrets, from appearing in your log query results.
This pgAudit extension capability is supported on
[PostgreSQL version].R20260712.01_06 or later.
For more information, see Audit for PostgreSQL using pgAudit.
1.30.4-asm.1 is now available for in-cluster Cloud Service Mesh.
You can now download 1.30.4-asm.1 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.30.4 subject to the list of supported features.
The following are not supported:
ENABLE_WILDCARD_HOST_SERVICE_ENTRIES_FOR_TLSCUSTOM external authorization providers per workloadDEBUG_ENDPOINT_AUTH_ALLOWED_NAMESPACES flagFor details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh version 1.30.4-asm.1 uses Envoy v1.38.4-dev.
In-cluster Cloud Service Mesh 1.27 is no longer supported. For more information and to view the earliest end-of-life dates for other versions, see Supported versions.
Starting August 31, 2026, you can no longer create or edit trace sinks. Trace sinks were deprecated on February 18, 2026. For more information, see Export trace spans with sinks deprecation.
For information about how to analyze your trace data using SQL, see the following documents:
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.18.46 | v29.4.3 | v2.3.2 | See List |
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.12.105 | v27.5.1 | v2.2.7 | See List |
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.18.46 | v29.4.3 | v2.3.2 | See List |
LTS Refresh from main-R133-cos-6.18 to release-R133-cos-6.18
Updated containerd and containerd-test to v2.2.7.
Updated cos-gpu-installer to v2.7.7.
Updated cos-gpu-installer to v2.7.7.
LTS Refresh from main-R129-cos-6.12 to release-R129-cos-6.12
Updated the Linux kernel to v6.18.46.
Updated the Linux kernel to v6.18.45.
Upgraded app-admin/fluent-bit to v4.2.8.
Added support for net-fs/lustre-client-drivers v2.14.0_p259.
Updated the Linux kernel to v6.18.46.
Upgraded app-arch/unzip to v6.0_p31.
Updated cos-gpu-installer to v2.7.6.
Added support for net-fs/lustre-client-drivers v2.14.0_p259.
Upgraded app-shells/dash to v0.5.13.5.
Updated net-misc/openssh to version 10.4_p1.
Updated cos-gpu-installer to v2.7.6.
Upgraded dev-libs/libverto to v0.3.2-r1.
Upgraded app-admin/google-guest-configs to v20260819.00.
Updated net-misc/openssh to version 10.4_p1.
Upgraded dev-libs/popt to v1.19-r1.
Upgraded app-admin/oslogin to v20260814.00.
Upgraded app-admin/fluent-bit to v4.2.8.
Upgraded sys-apps/acl to v2.4.0-r2.
Upgraded app-arch/zstd to v1.5.7-r1.
Upgraded app-admin/google-guest-configs to v20260819.00.
Upgraded sys-auth/passwdqc to v2.0.3-r1.
Upgraded app-containers/docker-credential-helpers to v0.9.9.
Upgraded app-admin/node-problem-detector to v0.8.25.
Fixed CVE-2026-68293 in the Linux kernel.
Upgraded app-shells/dash to v0.5.13.5.
Upgraded app-admin/oslogin to v20260814.00.
Upgraded dev-libs/libxml2 to v2.15.3. This fixes CVE-2026-0989, CVE-2026-0990, and CVE-2026-0992.
Upgraded chromeos-base/chromeos-dbus-bindings to v0.0.1-r2802.
Upgraded app-admin/sosreport to v4.12.0.
Runtime sysctl changes:
Upgraded chromeos-base/power_manager-client to v0.0.1-r2975.
Upgraded app-arch/unzip to v6.0_p31.
Upgraded chromeos-base/session_manager-client to v0.0.1-r2837.
Upgraded app-containers/docker-credential-helpers to v0.9.9.
Upgraded dev-db/sqlite to v3.53.4.
Upgraded app-containers/docker-registry-test to v2.8.3.
Upgraded dev-lang/luajit to v2.1.1780076327.
Upgraded app-shells/dash to v0.5.13.5.
Upgraded dev-libs/expat to v2.8.3.
Upgraded dev-db/sqlite to v3.53.4.
Upgraded dev-libs/gmp to v6.3.0-r2.
Upgraded sys-apps/acl to v2.4.0-r2.
Upgraded dev-libs/inih to v62.
Upgraded sys-apps/xemu to v0.0.10.
Upgraded dev-libs/libaio to v0.3.113_p8.
Upgraded sys-auth/passwdqc to v2.0.3-r1.
Upgraded dev-libs/libgpg-error to v1.61.
Upgraded sys-fs/e2fsprogs to v1.47.4.
Upgraded dev-libs/libltdl to v2.5.4.
Upgraded sys-libs/libcap-ng to v0.9.5-r1.
Upgraded dev-libs/libpcre2 to v10.47.
Upgraded sys-process/lsof to v4.99.7.
Upgraded dev-libs/libverto to v0.3.2-r1.
Fixed CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, and CVE-2026-46598 in dev-go/crypto.
Upgraded dev-libs/popt to v1.19-r1.
Upgraded dev-libs/libxml2 to v2.15.3. This fixes CVE-2026-0989, CVE-2026-0990, and CVE-2026-0992.
Upgraded dev-libs/userspace-rcu to v0.15.6.
Upgraded dev-python/oauthlib to v3.3.1.
Upgraded net-dns/c-ares to v1.34.8.
Upgraded net-libs/nghttp2 to v1.70.0.
Upgraded sys-apps/acl to v2.4.0-r2.
Upgraded sys-apps/ethtool to v7.0.
Upgraded sys-apps/pciutils to v3.15.0.
Upgraded sys-apps/xemu to v0.0.10.
Upgraded sys-auth/passwdqc to v2.1.0-r1.
Upgraded sys-libs/libcap-ng to v0.9.5-r1.
Upgraded sys-process/lsof to v4.99.7.
Upgraded dev-libs/libxml2 to v2.15.3. This fixes CVE-2026-0989, CVE-2026-0990, and CVE-2026-0992.
Upgraded vim & vim-core to version 9.2.0280. This fixes CVE-2026-35177.
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.12.105 | v27.5.1 | v2.2.7 | See List |
LTS Refresh from main-R125-cos-6.12 to release-R125-cos-6.12
Upgraded app-arch/zstd to v1.5.7-r1.
Upgraded app-containers/cni-plugins to v1.9.1.
Upgraded dev-libs/libverto to v0.3.2-r1.
Upgraded dev-libs/popt to v1.19-r1.
Upgraded dev-libs/xxhash to v0.8.3-r2.
Upgraded sys-auth/passwdqc to v2.0.3-r1.
Fixed CVE-2026-68293 in the Linux kernel.
Upgraded dev-libs/libxml2 to v2.15.3. This fixes CVE-2026-0989, CVE-2026-0990, and CVE-2026-0992.
Runtime sysctl changes:
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.6.153 | v27.5.1 | v2.0.10 | See List |
Updated cos-gpu-installer to v2.7.7.
LTS Refresh from main-R121-cos-6.6 to release-R121-cos-6.6
Fixed CVE-2026-64371 in the Linux kernel.
Fixed CVE-2026-68142 in the Linux kernel.
Fixed CVE-2026-68142 in the Linux kernel.
Fixed CVE-2026-68432 in the Linux kernel.
Upgraded dev-libs/libxml2 to v2.15.3. This fixes CVE-2026-0989, CVE-2026-0990, and CVE-2026-0992.
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.6.153 | v24.0.9 | v1.7.34 | See List |
LTS Refresh from main-R117-cos-6.6 to release-R117-cos-6.6
Fixed CVE-2026-59995, CVE-2026-59996, CVE-2026-59997, CVE-2026-59999, CVE-2026-60000, CVE-2026-60001, and CVE-2026-60002 in openssh.
Fixed CVE-2026-68142 in the Linux kernel.
Fixed CVE-2026-68142 in the Linux kernel.
Fixed CVE-2026-68432 in the Linux kernel.
Upgraded dev-libs/libxml2 to v2.15.3. This fixes CVE-2026-0989, CVE-2026-0990, and CVE-2026-0992.
You can now create a Datastream stream directly from the overview page of your Cloud SQL instances using the automated flow.
For more information, see Create a Cloud SQL stream using the automated flow.
Gemini Enterprise: Support for federated data stores in Assured Workloads with FedRAMP High compliance
Gemini Enterprise now supports connecting Google Workspace and third-party federated data stores to projects inside Assured Workloads folders, which automatically enforce security and compliance controls on your Google Cloud resources to meet FedRAMP High standards. This feature is generally available (GA). For more information, see
Gemini Enterprise: Gemini 3.5 Flash regional availability in Canada
Gemini 3.5 Flash is available in Canada (ca) with
in-region at-rest data residency (DRZ) and machine learning processing (MLP).
For more information, see Locations.
Gemini Enterprise: Gemini 3.1 Flash image available in US and EU multi-regions
Gemini 3.1 Flash image (Nano Banana 2) for image generation is generally
available in the us and eu multi-regions.
For more information, see:
Gemini Enterprise: Protect sensitive data with content policies
You can apply Sensitive Data Protection content policies to your Gemini Enterprise connectors, apps, and Gemini Notebook Enterprise notebooks.
Content policies inspect data for violating or unwanted content and block it. Content policies can block Gemini Enterprise apps from presenting sensitive or inappropriate material to users and can stop end users from uploading files that contain sensitive or inappropriate material.
This feature is generally available (GA). For more information, see Protect sensitive data in sources and Protect sensitive data in NotebookLM Enterprise sources.
Gemini 3.1 Flash Image and Gemini 3 Pro Image updates
This release introduces feature updates and expanded endpoint availability for Gemini 3.1 Flash Image and Gemini 3 Pro Image:
Multi-region endpoint support: Gemini 3.1 Flash Image (gemini-3.1-flash-image) is now available on US (us) and EU (eu) multi-region endpoints for model availability, ML processing, Provisioned Throughput, and PayGo Standard.
4K image output in GA: Generating 4K resolution images is now Generally Available (GA) for both Gemini 3.1 Flash Image and Gemini 3 Pro Image.
Video inputs in GA: Image generation from video inputs is now Generally Available (GA) for Gemini 3.1 Flash Image.
For more information, see the following:
IAM Unified Access Policies are generally available (GA)
IAM Unified Access Policies (Access policies) for Gemini Enterprise Agent Platform are generally available (GA). Agent Gateway uses Identity-Aware Proxy and Access policies to govern agentic communication between agent principals and destination resources, such as Model Context Protocol (MCP) servers, other agents, and registered or unregistered endpoints.
Key capabilities include:
For more information, see IAM access policies overview.
Session affinity support using GCPTrafficDistributionPolicy for GKE Gateway is generally available. This release currently supports single-cluster GKE Gateway load balancers using the following GatewayClasses:
gke-l7-rilbgke-l7-regional-external-managedgke-l7-global-external-managedIn addition to the session affinity types available in Preview, you can now use
the STRONG_COOKIE_AFFINITY type, which provides the most persistent session
stickiness among the session affinity types available in Google Cloud
Application Load Balancers.
The session affinity types require the following minimum GKE versions:
CLIENT_IP, HEADER_FIELD, GENERATED_COOKIE, and HTTP_COOKIE:
version 1.35.2-gke.1269001 or laterSTRONG_COOKIE_AFFINITY: version 1.36.3-gke.1767000 or laterFor more information, see Configure session affinity using GCPTrafficDistributionPolicy.
[Spotlight Feature] Customizable schedules for multi-event rules general availability
The customizable schedules for multi-event rules feature is now in General Availability (GA).
Customizable schedules give security teams granular control and transparency over how multi-event rules execute in Google SecOps, and provide the following capabilities:
To manage rule schedules with custom IAM roles, make sure your roles include chronicle.rules.modifyRules and chronicle.ruleDeployments.update. Predefined IAM roles include these permissions automatically.
For more information, see Configure customized schedules for rules and Understand rule run scheduling.
IAM Unified Access Policies for Agent Gateway are generally available (GA)
IAM Unified Access Policies (Access policies) for Agent Gateway and Identity-Aware Proxy (IAP) are generally available (GA). Identity-Aware Proxy integrates with Agent Gateway and uses Access policies to help secure and govern agentic egress communication between agent principals and destination resources, such as Model Context Protocol (MCP) servers, other agents, and registered or unregistered endpoints.
Key capabilities include:
For more information, see IAM access policies overview.
Localized data processing for European Union (EU)-based customers now applies to all Conversational Analytics data agents, including agents that are associated with Looker Explores, user-defined dashboards, and LookML dashboards. This support means that localized data processing now applies to all Conversational Analytics in Looker features.
Note: This item was added September 9, 2026.
The Looker Mobile (Legacy) application is no longer available for download from the App Store or Play Store and support for the app has been discontinued. Although users will still be able to use the Looker Mobile (Legacy) app if they already have it installed, we recommend that you install the non-legacy Looker mobile app.
Note: The deprecation of the Looker Mobile (Legacy) application has been postponed to January 31, 2027. This item was updated on September 9, 2026.
Managed Service for Apache Spark (formerly Dataproc on Compute Engine): The following subminor image versions announced on August 19, 2026 have been rolled back:
You can use access control list (ACL) policies to secure access to your clusters. You can enable fine-grained security by restricting user and service access to specific keys, commands, operations, and Pub/Sub channels. This feature is Generally Available.
You can use access control list (ACL) policies to secure access to your instances. You can enable fine-grained security by restricting user and service access to specific keys, commands, operations, and Pub/Sub channels. This feature is Generally Available.
IPv6 dynamic routes support for include and exclude spoke filters for hybrid spokes is available in Preview.
Export filters control which subnets or routes a spoke can send to the hub. Import filters control which subnets or routes can be accepted by a spoke from the hub.
Sensitive Data Protection content policies are in General
Availability. You can
use content policies to evaluate content and return an ALLOW or BLOCK
verdict based on data sensitivity.
For more information about content policies, see the following:
Sensitive Data Protection content policies are integrated with Gemini Enterprise. For more information, see the following:
Agent Gateway now supports Service Extensions to evaluate requests and delegate authorization decisions for agent traffic to either Google services or custom authorization services. This feature is generally available (GA).
For more information, see Integration with Agent Gateway.
General Availability: You can create Compute Engine instances that have multiple virtual network interfaces (vNICs) in the same VPC network. For more information, see Multiple network interfaces in the same VPC network.
]]>Installed latest packages from upstream dependencies.
Installed latest packages from upstream dependencies.
The terminal and file browser are now more responsive when working in a Cloud Storage bucket that is mounted through the file browser. Frequent background checks for non-existent files are now cached instead of repeatedly querying Cloud Storage, which previously could make actions such as listing files or running terminal commands take several seconds.
Cloud Storage buckets that you mount through the file browser are now automatically re-mounted after the instance is restarted or is stopped and started. Previously the mounted folder could be left behind as an empty, unusable directory that had to be manually removed and re-mounted.
The obsolete google-cloud-sdk transitional package is no longer installed. The Google Cloud CLI itself is unchanged; it was already provided by the google-cloud-cli package.
Installed latest packages from upstream dependencies.
Installed latest packages from upstream dependencies.
Cloud Storage buckets that you mount through the file browser are now automatically re-mounted after the instance is restarted or is stopped and started. Previously the mounted folder could be left behind as an empty, unusable directory that had to be manually removed and re-mounted.
The terminal and file browser are now more responsive when working in a Cloud Storage bucket that is mounted through the file browser. Frequent background checks for non-existent files are now cached instead of repeatedly querying Cloud Storage, which previously could make actions such as listing files or running terminal commands take several seconds.
Installed latest packages from upstream dependencies.
Fixed an issue where a notebook's cells and their outputs could be unexpectedly erased. The automatic reload of an open notebook (which keeps it in sync with changes made to its file on disk) is now restricted to run only while the Gemini CLI is in use, so notebooks are no longer overwritten at other times.
Cloud Storage buckets that you mount through the file browser are now automatically re-mounted after the instance is restarted or is stopped and started. Previously the mounted folder could be left behind as an empty, unusable directory that had to be manually removed and re-mounted.
The terminal and file browser are now more responsive when working in a Cloud Storage bucket that is mounted through the file browser. Frequent background checks for non-existent files are now cached instead of repeatedly querying Cloud Storage, which previously could make actions such as listing files or running terminal commands take several seconds.
Agent Platform Workbench instances internal agents now honor custom CA certificates installed on the host OS (e.g. via a custom VM image), fixing TLS certificate verification failures when Google API traffic is routed through a customer-managed proxy.
Installed latest packages from upstream dependencies.
Fixed an issue where a notebook's cells and their outputs could be unexpectedly erased. The automatic reload of an open notebook (which keeps it in sync with changes made to its file on disk) is now restricted to run only while the Gemini CLI is in use, so notebooks are no longer overwritten at other times.
The terminal and file browser are now more responsive when working in a Cloud Storage bucket that is mounted through the file browser. Frequent background checks for non-existent files are now cached instead of repeatedly querying Cloud Storage, which previously could make actions such as listing files or running terminal commands take several seconds.
Cloud Storage buckets that you mount through the file browser are now automatically re-mounted after the instance is restarted or is stopped and started. Previously the mounted folder could be left behind as an empty, unusable directory that had to be manually removed and re-mounted.
Agent Platform Workbench instances internal agents now honor custom CA certificates installed on the host OS (e.g. via a custom VM image), fixing TLS certificate verification failures when Google API traffic is routed through a customer-managed proxy.
Release 6.3.99 is being rolled out to the first phase of regions as listed here.
This release contains internal and customer bug fixes.
]]>Release 6.3.98 is now available for all regions.
]]>Upcoming authorization changes for integration runs
Application Integration is updating how identities are handled for integration runs. Every run will act as either the person who triggered it or a run-as service account that you configure, and running an integration will require permission to act as that service account. Integrations that run without a person, such as those started by a schedule or an event, will need an explicitly configured run-as service account.
Action might be required before the change takes effect. For guidance on identifying affected integrations and updating them, see Prepare for upcoming authorization changes.
You can now update access tokens from the Connection details page for your 2nd generation Bitbucket and 2nd generation Gitlab host connections. For more information, see the following:
Gemini Enterprise: New data stores and support for new actions (Preview)
The following data stores are available in Public Preview in Gemini Enterprise:
You can search and read data from these data stores using natural language.
Additionally, the following data stores support new actions in Public Preview:
From August 24 through August 26, 2026, the following features will be automatically enabled for Looker (original) instances running Looker 26.14.
The Advanced Unused Content Cleanup feature is now generally available.
Conversational Analytics verified queries, also known as golden queries, are now generally available. You can also now define verified queries in Looker (Google Cloud core) instances.
Now available in preview, model localization is supported for imported projects. By default, Looker uses the locale definitions from the importing project only, if the importing project has locale definitions. However, if you want to merge the locale definitions from an imported project with the locale definitions of the importing project, you can add the import_locale_defs: yesstatement to thelocalization_settings parameter in your importing project's manifest file. See the Localizing your LookML model documentation page for more information.
Note: This item was added on August 31, 2026 and changed from a non-breaking change to a feature on September 9, 2026.
You can now configure Continuous Integration to automatically run CI suites when a dbt Cloud CI job finishes. The CI suite run verifies whether changes in your dbt models will cause SQL errors in your Looker Explores before the dbt changes are deployed.
Now available in preview, the New/Edit Roles Enhancement feature provides a modernized, step-by-step interface for creating and editing roles on the Roles page in the Users section of the Admin panel.
Now available in preview, you can define and chat with data agents on a LookML dashboard. To use this feature, the Conversational Analytics and Enable Dashboard Agents settings must be enabled on the Gemini in Looker Admin page.
Now available in preview, you can define Looker-managed, in-database analytic models directly from existing LookML Explores by using the model_source subparameter of the derived_analytic_model parameter. Looker automatically translates your Explore topology, joins that are defined with foreign_key, dimensions, and measures into in-database analytic models (such as BigQuery Graphs or Snowflake semantic views).
For more information, see the derived_analytic_model parameter reference page.
The Google Maps Enhancements preview feature now includes the following features:
The Dual-axis Map option now supports points and circles. You can now specify a custom map layer by providing a URL to a TopoJSON file.
When the New Looker Explore and Merge Query Experience preview features are enabled, editing a merge query tile on a dashboard now opens the Join data page directly within the dashboard edit canvas, rather than opening a new tab.
The Conversational Analytics System Activity dashboard Token usage tab now includes observability information about top users and top conversations by token usage. The tab also now indicates the type of data agent in its observability metrics.
Now available in preview, model localization is supported for imported projects. By default, Looker uses the locale definitions from the importing project only, if the importing project has locale definitions. However, if you want to merge the locale definitions from an imported project with the locale definitions of the importing project, you can add the import_locale_defs: yesstatement to thelocalization_settings parameter in your importing project's manifest file. See the Localizing your LookML model documentation page for more information.
Note: This item was added August 31, 2026
When connecting Looker to your database, you can specify additional Java Database Connectivity (JDBC) parameters. To maintain security, Looker restricts the allowed values for certain parameters. For the JDBC parameters that have a restricted set of allowed values, the allowed values are listed in the "Supported JDBC parameters" section of the database configuration instructions page for your dialect.
Dashboard parameter filters now correctly respect manually restricted option lists when determining default values. This prevents filters from reverting to base LookML defaults that were intentionally hidden from the dashboard's user interface.
Tiles that are on dashboard tabs will now run only when the dashboard tab that they are saved on is opened.
Looker now supports connections to MongoSQL. Although existing connections to the legacy MongoDB Connector for BI are still fully supported, Looker recommends that you update MongoDB Connector for BI connections to use the MongoSQL dialect.
See the MongoDB documentation Transition from Atlas BI Connector to MongoSQL and the Looker documentation Migrating to MongoSQL for information on migrating from the MongoDB Atlas BI Connector to the newer MongoSQL Interface.
Note: One year before the MongoDB Connector for BI is to be deprecated, customers will be sent a service announcement to that effect. The information will also be reflected in product documentation and release notes.
Orchestration Pipelines are now generally available (GA).
Spanner supports creating secondary indexes based on scalar expressions that apply to one or more table columns. Expression indexes eliminate the need to create and maintain a dedicated generated column in your table for indexing purposes. For more information, see Create an index based on a scalar expression.
]]>On August 27th, 2026, we released an updated version of Apigee (1-18-0-apigee-4).
| Bug ID | Description |
|---|---|
| 507878328 | Upgraded the Apigee runtime to run on JDK 17, while maintaining backward compatibility with JDK 11. |
| 530965355 | Added an opt-in Message Processor connection-failure back-off (CWC property HTTPClient.backoff.enabled, defaults to false) that prevents the Message Processor from consuming excessive CPU when a target is completely unavailable. |
| 532793298 | Fixed an API product bug where combining a payloadOperationGroup with a REST or llmOperationGroup rejected REST/LLM traffic with a 401. |
| 534420582 | The JSONThreatProtection policy adds a new optional child element <RejectDuplicateKeys> that rejects request bodies containing duplicate JSON keys within the same object. Defaults to false to preserve existing behavior. |
| N/A | Updates to infrastructure and libraries. |
This list is incomplete; see entry for September 9, 2026.
| Bug ID | Description |
|---|---|
| 544570126 | Security fix for Apigee. Fixed a security issue in the PythonScript policy. |
| N/A | Security fix for Apigee infrastructure. |
The Data Engineering Agent is now HIPAA compliant. For more information, see HIPAA compliance on Google Cloud.
Core graph processing for BigQuery Graph requires an Enterprise or Enterprise Plus edition reservation. Existing allowlisted users can continue to use Standard edition or on-demand billing until April 26, 2027, after which these billing models will no longer be supported for core graph processing.
Graph measures will remain available in the Enterprise and Enterprise Plus editions and for queries run using on-demand pricing. Measures are not available in Standard edition.
You can now train models using XGBoost version 2.1 by using the
XGBOOST_VERSION option. BigQuery uses the XGBoost 3.1.0 library to load and
make predictions on XGBoost models. This feature is
generally available.
For regional external passthrough Network Load Balancers, reserving specific or automatically allocated bring your own IP (BYOIP) IPv6 addresses before creating a load balancer, and promoting an ephemeral BYOIP IPv6 address in use by a load balancer to a reserved static IP address, is generally available (GA).
For more information, see the following documentation:
Cloud SQL now makes it easier to configure Private Service Connect for your Cloud SQL instance. When you create an instance that's enabled with Private Service Connect, you can choose to automatically create the service connection policy and endpoint in the VPC network that you want to use with Private Service Connect.
For more information, see Configure Private Service Connect.
The rollout of the following extension upgrades is complete:
pg_partman is upgraded from 5.2.4 to 5.4.3.pgfincore is upgraded from 1.3.1 to 1.4.pgvector is upgraded from 0.8.1 to 0.8.5.For more information, see Configure PostgreSQL extensions.
Cloud SQL now makes it easier to configure Private Service Connect for your Cloud SQL instance. When you create an instance that's enabled with Private Service Connect, you can choose to automatically create the service connection policy and endpoint in the VPC network that you want to use with Private Service Connect.
For more information, see Configure Private Service Connect.
Cloud SQL now makes it easier to configure Private Service Connect for your Cloud SQL instance. When you create an instance that's enabled with Private Service Connect, you can choose to automatically create the service connection policy and endpoint in the VPC network that you want to use with Private Service Connect.
For more information, see Configure Private Service Connect.
The following images are now rolling out for managed Cloud Service Mesh:
These versions resolve the security vulnerabilities listed in Security Bulletin GCP-2026-057.
The following remote MCP server automatically generates a trace span for
tools/call operations.
These spans can help you understand the behavior of your agentic applications. For more information, see Investigate MCP calls using Trace.
CodeMender updates
This release introduces updates to CodeMender:
gemini-3.6-flash) and Gemini 3.7 Flash (gemini-3.7-flash, default).--unrestricted flag to cm verify to bypass command policy restrictions during exploit verification in isolated environments.For more information, see CodeMender documentation.
Gemini Omni 1.1 Flash is available in Public Preview
Gemini Omni 1.1 Flash (gemini-omni-1.1-flash-preview)
is available in Preview.
Gemini Omni 1.1 Flash is a multimodal model designed for video, image,
and text tasks, optimized for high-speed video generation that supports
audio and video editing.
Cloud Armor supports advanced match conditions to include attributes for inspecting request body content and parameters in Preview. This lets you write custom CEL rules to filter traffic based on raw body content, structured data (JSON, Form Data, GraphQL), and query parameters. For more information, see Configure custom rules language attributes.
Google Cloud CCaaS 6.7
We've released version 6.7 of Google Cloud CCaaS.
The timing of the update to your instance depends on the deployment schedule that you have chosen. For more information, see Deployment schedules.
Bulk email status updates
You can use the new apps/api/v1/email/update_status endpoint to change the
status of multiple email sessions to the status that you specify.
The new endpoint includes the following capabilities:
You can optionally specify the status that you expect email sessions to be in. Email sessions that aren't in that status aren't updated.
For each email session, the response reports whether it was updated, required no change, or couldn't be updated (and why). This means that integrations can handle partial success and identify which sessions still need attention.
For more information, see Bulk email status endpoint.
This release addresses the following issues:
Fixed an issue where blended SMS transcripts were incorrectly identified as call audio recordings when uploaded to Customer Experience Insights, causing them to appear as missing or unanalyzable data.
Fixed an issue where the chat text-input field was unresponsive after an agent accepted a new chat.
Fixed an issue where call-cascade agent availability safeguards weren't enforced for terminal queue paths, which resulted in agents being assigned calls from secondary queues even when their primary queue fell below the minimum availability threshold.
Fixed an issue where chats that were connected to an agent continued to appear on the Queued Chats dashboard with a status of Ongoing.
Fixed an issue where direct inbound and dial-by-extension calls didn't reach an agent when multiple calls were waiting in the agent's queue.
Fixed an issue where chat messages from supervisors were incorrectly attributed to the end-user in Customer Experience Insights transcripts.
Fixed an issue where changes to hours of operation didn't appear in the Audit Dashboard.
Fixed an issue with Salesforce integrations where outbound calls were incorrectly labeled as Inbound and didn't pass the CCAI Platform call ID into Salesforce case activity comments.
Fixed an issue where requests for agent activity logs resulted in high database latency and gateway timeouts.
Fixed an agent desktop issue where an agent sent a chat form to an end-user but the end-user didn't receive it.
Fixed an issue where a chat that was escalated from a virtual agent to a human agent was stuck in the queue and couldn't be successfully offered to available agents.
Fixed an issue where the Queue dashboard displayed
{{Count}} and
{{Level}} variables instead of numerals.
Fixed an issue where the wait times API incorrectly reported zero available agents for chat queues that had agent availability.
Fixed an issue where the Queues > Calls dashboard didn't load and timed out for instances with a large number of queues.
Fixed an agent desktop issue where the sentiment score didn't appear in the call adapter in the agent desktop or in Salesforce for calls that were escalated from a virtual agent to a human agent.
Fixed an issue where newly created voice queues didn't correctly inherit the global whisper and countdown settings.
Fixed an issue where queue duration metrics incorrectly included IVR timeout time for calls that were cold transferred into a closed queue.
Fixed an issue where an agent who reopened a previously read voicemail was stuck in In-call status, preventing them from accepting new contacts or changing their status.
Fixed an issue where an agent's assigned call ID was cleared during wrap-up, which prevented them from submitting their wrap-up disposition after refreshing the page.
You can now configure the disk capacity per broker when you create a Kafka cluster and increase it later. For more information, see Configure broker disk size.
Network Endpoint Group (NEG) pre-provisioning is now available in Preview. With
this feature, you can force the creation of empty zonal GCE_VM_IP_PORT NEGs in
specified zones (or all zones within a region) during Service creation,
regardless of whether the cluster has nodes in those zones. By extending the
cloud.google.com/neg Service annotation with a custom zones parameter, you can
seamlessly automate infrastructure deployments (such as attaching NEGs to
backend services) without waiting for workloads to deploy. For more information,
see Pre-provisioning empty
NEGs.
Scheduled maintenance
SOAR database and infrastructure maintenance is scheduled to take place during the standard maintenance window on Sunday, August 30. During this window, your system will experience a brief period of downtime. You don't need to take any action.
Scheduled maintenance
SOAR database and infrastructure maintenance is scheduled to take place during the standard maintenance window on Sunday, August 30. During this window, your system will experience a brief period of downtime. You don't need to take any action.
You can disable data residency enforcement for in-use and in-transit data in Model Armor templates. Disabling data residency enforcement allows cross-jurisdictional routing to enable Model Armor features that are otherwise unavailable in limited-support regions. Data at rest remains compliant with data residency requirements.
For more information, see Set data residency compliance and Data residency and endpoints.
General Availability: VPC Flow Logs generates log records for dropped traffic. For more information, see Records for dropped traffic.
General Availability: You can reserve static external IPv6 addresses from
bring your own IP addresses (BYOIP) sub-prefixes that are in
EXTERNAL_IPV6_FORWARDING_RULE_CREATION mode.
You can assign these addresses to forwarding rules for external passthrough Network Load Balancers and external protocol forwarding. You can also promote ephemeral IPv6 BYOIP addresses that are used by external forwarding rules to reserved static IP addresses.
For more information, see Create external forwarding rules.
]]>On August 26, 2026 we released an updated version of the Apigee hybrid software, v1.14.8.
| Bug ID | Description |
|---|---|
| N/A | Security fixes for apigee-asm-ingress. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-asm-istiod. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-connect-agent. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-fluent-bit. This addresses the following vulnerabilities:
|
| N/A | Security fixes for apigee-hybrid-cassandra. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-hybrid-cassandra-client. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-mart-server. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-mint-task-scheduler. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-operators. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-prom-prometheus. This addresses the following vulnerability: |
| N/A | Security fixes for apigee-prometheus-adapter. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-redis. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-runtime. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-synchronizer. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-watcher. This addresses the following vulnerabilities: |
An Improper Input Validation vulnerability was discovered in the JDBC driver in BigQuery Data Transfer Service versions prior to May 1, 2026. An authenticated attacker could use crafted JDBC connection string parameters to achieve remote code execution in the connector container and escalate privileges in the tenant project. For more information, see the GCP-2026-056 security bulletin.
You can now view real-time logs for your Python UDFs in Cloud Logging. This feature is generally available.
SSL policy cross-project referencing is now available for Application Load Balancers and proxy Network Load Balancers in Preview. You can use cross-project referencing to define and maintain a central SSL policy in an administrative project and reference it from target HTTPS proxies or target SSL proxies in different projects.
Cross-project referencing is supported for global and regional SSL policies. You can use cross-project referencing with the following load balancers:
For more information, see Cross-project SSL policy referencing.
VM Extension Manager extension policies for the Ops Agent are Generally Available (GA). Extension policies provide zonal and project-wide Ops Agent installation, version upgrades, and configuration management. For more information, see Install and manage the Ops Agent by using VM Extension Manager policies.
VM Extension Manager extension policies for the Ops Agent are Generally Available (GA). Extension policies provide zonal and project-wide Ops Agent installation, version upgrades, and configuration management. For more information, see Install and manage the Ops Agent by using VM Extension Manager policies.
1.29.7-asm.2 is now available for in-cluster Cloud Service Mesh.
For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.29.7-asm.2 uses Envoy v1.35.14.
This release resolves the security vulnerabilities listed in Security Bulletin GCP-2026-057.
Patch 1.29.7-asm.2 contains the fix for the following platform CVEs:
| CVE | Proxy | Control Plane | Distroless | CNI | Severity |
|---|---|---|---|---|---|
| CVE-2026-5704 | Yes | Yes | No | Yes | Medium (5.5) |
1.28.10-asm.24 is now available for in-cluster Cloud Service Mesh.
For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.10-asm.24 uses Envoy v1.36.10.
This release resolves the security vulnerabilities listed in Security Bulletin GCP-2026-057.
Patch 1.28.10-asm.24 contains the fix for the following platform CVEs:
| CVE | Proxy | Control Plane | Distroless | CNI | Severity |
|---|---|---|---|---|---|
| CVE-2026-5704 | Yes | Yes | No | Yes | Medium (5.5) |
1.27.9-asm.34 is now available for in-cluster Cloud Service Mesh.
For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.27.9-asm.34 uses Envoy v1.35.14.
This release resolves the security vulnerabilities listed in Security Bulletin GCP-2026-057.
Patch 1.27.9-asm.34 contains fixes for the following platform CVEs:
| CVE | Proxy | Control Plane | Distroless | CNI | Severity |
|---|---|---|---|---|---|
| CVE-2026-10536 | Yes | Yes | No | Yes | Low (9.8) |
| CVE-2026-42151 | No | No | No | Yes | High (7.5) |
| CVE-2026-42154 | No | No | No | Yes | High (7.5) |
| CVE-2026-40179 | No | No | No | Yes | Medium (6.1) |
| CVE-2026-44903 | No | No | No | Yes | Medium (6.1) |
| CVE-2026-5704 | Yes | Yes | No | Yes | Medium (5.5) |
For clusters using the TRAFFIC_DIRECTOR implementation, configuring the trace
sampling rate with randomSamplingPercentage with the Telemetry API is now
supported in the Rapid release channel. For more information, see
Accessing Cloud Trace.
Cloud Workstations supports an agent-optimized development experience.
Generally available: Red Hat Enterprise Linux (RHEL) images pre-configured with Logical Volume Manager (LVM) partitioning are available for Compute Engine in the Google Cloud console. LVM-enabled images let you manage volumes flexibly and size partitions dynamically on your boot disk.
For more information, see Red Hat Enterprise Linux (RHEL).
Generally available: Red Hat Enterprise Linux (RHEL) Extended Update Support (EUS) images are available for Compute Engine in the Google Cloud console. RHEL EUS images let you lock your VMs to a specific minor version while receiving critical security updates and bug fixes for up to two years.
For more information, see Red Hat Enterprise Linux (RHEL).
Various bug fixes and minor product enhancements.
Gemini Enterprise: Updates to A2UI Material catalog component properties
The A2UI component gallery reference has been updated to reflect the latest A2UI version v0.9 Material catalog component properties and schema:
MaterialButton: Added support for Material 3 styling properties
(appearance, disableRipple, and extended), along with new variants
(icon, fab, and mini-fab). Obsolete color and ARIA description
properties have been removed.checks: Replaced the static required boolean property
across input components (MaterialCheckbox, MaterialDatepicker,
MaterialInput, MaterialSelect, and MaterialTimepicker) with the
reactive validation checks rule array.MaterialIcon and MaterialChips: Added the tooltip property on
MaterialIcon and the action property on MaterialChips.justify alignment
values for MaterialColumn and MaterialRow, and updated allowed input
types for MaterialInput.For more information, see A2UI component gallery reference.
GKE cluster versions have been updated.
New versions available for upgrades and new clusters.
The following versions are now available for new GKE clusters, and for manual control plane upgrades and node upgrades for existing clusters. For more information about versioning and upgrades, see GKE versioning and support and About GKE cluster upgrades.
This release includes new GKE versions that use updated Container-Optimized OS images. These updated images are cumulative, incorporating security fixes from all Container-Optimized OS versions released since the previous GKE release.
To identify the specific vulnerabilities that were resolved in each updated Container-Optimized OS image, see the Security release notes for that image. The following table includes links to the release notes for each updated Container-Optimized OS image:
| GKE version | Container-Optimized OS version | Details |
|---|---|---|
| 1.31.14-gke.2630000 | cos-117-18613-675-56 | cos-117-18613-675-56 release notes |
| 1.34.10-gke.1328000 | cos-125-19216-532-123 | cos-125-19216-532-123 release notes |
| 1.35.8-gke.1026000 | cos-125-19216-532-123 | cos-125-19216-532-123 release notes |
| 1.37.0-gke.2034000+preview | cos-129-19506-299-82 | cos-129-19506-299-82 release notes |
In GKE version 1.36 and later, GCPAuthzPolicy and GCPAuthzExtension resources for GKE Gateway are now available in Preview. You can use these resources to enforce identity-based access control and zero-trust authorization on incoming traffic at the Gateway layer. These capabilities are supported on the following GatewayClasses:
For more information, see Configure the GCPAuthzExtension resource.
[Spotlight Feature] Mandiant Frontline Threats rule packs
Curated Detections has been enhanced with additional Mandiant Frontline Threats detections for Linux, MacOS, and Google Cloud. The following rule packs have been added to the Content Hub:
FireEye HX: Version 26.0
Proofpoint Email Protection: Version 11.0
Wiz: Version 10.0
Microsoft Graph Mail: Version 46.0
Microsoft Graph Mail Delegated: Version 23.0
ServiceNow: Version 71.0
[Spotlight Feature] Mandiant Frontline Threats rule packs
Curated Detections has been enhanced with additional Mandiant Frontline Threats detections for Linux, MacOS, and Google Cloud. The following rule packs have been added to the Content Hub:
Knowledge Catalog support for importing metadata from dbt Core and MetricFlow is available in Preview.
You can use the gcloud alpha dataplex dbt metadata-jobs command to extract and
import technical, semantic (MetricFlow), operational, data quality, and lineage
metadata from dbt Core artifacts into Knowledge Catalog.
For more information, see Import metadata from dbt Core and About metadata connectors.
(Airflow 3.3.1 and 3.2.2) Environments with Airflow 3.3.1 and 3.2.2 now support loading snapshots from environments with Airflow 2.11.1. This feature lets you migrate from Airflow 2.11.1 environments to Airflow 3 using snapshots, provided that your DAGs in Airflow 2.11.1 are compatible with Airflow 3.
This feature is gradually rolling out over several releases. In this release, it's available in the following regions: europe-north1, europe-west3, us-east1, and us-west2.
(Airflow 3.3.1) Backported #71091 to fix a warning about invalid characters for stats reporting generated by the DAG processor for every file.
New Airflow builds are available in Managed Airflow (Gen 3):
New images are available in Managed Airflow (Gen 2):
The following Managed Airflow versions and builds have reached their end of support period: composer-3-airflow-2.9.3-build.32, composer-3-airflow-2.10.5-build.12, composer-2.14.0-airflow-2.10.5, composer-2.14.0-airflow-2.9.3.
Oracle on Google Cloud Compute supports running Oracle workloads on Compute Engine's M4N machine series that provides leading block storage performance with Hyperdisk Extreme. For more information, see M4N machine series and Available regions and zones.
This feature is Generally Available (GA).
Oracle on Google Cloud Compute offers in-depth documentation that describes how to deploy Oracle AI Database workloads using Google Cloud NetApp Volumes. For more information, see Overview of Oracle Database deployment using NetApp Volumes.
Preview stage support for the following integration:
]]>Gemini Data Analytics is generally available (GA).
Gemini Data Analytics is generally available (GA).
BigQuery data governance tags are supported in Terraform. This feature is in Preview.
Cloud Run instances are available in Preview. Instances are specifically designed for running long-lived and individually addressable workloads. To learn more, see the product overview, resource comparison, and instance lifecycle pages.
Use assessments (Preview) in Database Center to assess and test the performance impact of database recommendations before you apply them to your production database fleet.
The assessments workflow performs these operations:
For more information, see Assessments in Database Center.
Use assessments (Preview) in Database Center to assess and test the performance impact of database recommendations before you apply them to your production database fleet.
The assessments workflow performs these operations:
Database Center assessments are available only for Cloud SQL for PostgreSQL instances.
For more information, see Create an assessment of a recommendation.
Google Distributed Cloud (software only) for VMware 1.36.0-gke.532 is now available for download. To upgrade, see Upgrade a cluster. Google Distributed Cloud 1.36.0-gke.532 runs on Kubernetes v1.36.0-gke.2800.
If you use a third-party storage vendor, check the listing of our previously-qualified storage partners.
After a release, it takes approximately 7 to 14 days for the version to become available for use with GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.
Google Distributed Cloud (software only) for VMware includes the following feature enhancements:
gkectl to perform an empty reconciliation health check prior to
running the gkectl update or gkectl upgrade commands. The health check
prevents starting cluster lifecycle updates when a cluster is in an unhealthy
state.
status and conditions fields in OnPrem custom resources to
provide clearer visibility into cluster reconciliation phases and state
transitions during cluster management operations.
gkectl to provide more specific error messages and actionable
troubleshooting recommendations when operations encounter failures.
The following issues were fixed in 1.36.0-gke.532:
Reconciling state
after an admin cluster upgrade. The admin cluster controller skipped
reconciling legacy cluster lifecycle components during upgrades unless an initial
migration annotation was set. If legacy user clusters still existed on the
admin cluster, missing legacy API discovery (cluster.k8s.io/v1alpha1) caused
controller reconciliation to stall. With this fix, the controller preserves
legacy components as long as any legacy user clusters exist, and prunes them only
after all user clusters have migrated to advanced clusters.
gkectl prepare failed with a
permission denied error when attempting to read a private
registry CA certificate. The certificate file permissions
are now set to 644 so non-root processes can read it.
spec.selector fields on
existing ANG resources. The upgrade operator now preserves existing label
selectors during reconciliation so that V1 to V2 cluster migrations complete
successfully.
cluster-proportional-autoscaler to address security vulnerabilities.
PROVISIONING state
because of a missing k8s-health-check service account.
gkectl diagnose failed to run on non-advanced user
clusters managed by an advanced admin cluster.
gkectl restore quorum recreates missing
IPAddress objects for VSphereMachine resources before waiting for cluster
readiness.
stackdriver.disableVsphereResourceMetrics to
true caused cluster installations or upgrades to stall because the vsphere-ca-certificate ConfigMap was deleted, but still needed.
Google Distributed Cloud (software only) for bare metal 1.36.0-gke.532 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.36.0-gke.532 runs on Kubernetes v1.36.0-gke.2800.
After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.
If you use a third-party storage vendor, check the listing of our previously-qualified storage partners.
Google Distributed Cloud (software only) for bare metal includes the following feature enhancements:
bmctl backup cluster in Node Agent mode requires at least 12 GB of free
space in /tmp on the admin workstation and all target nodes to buffer backup
archives. You can configure a custom temporary directory by setting TMPDIR.
/tmp
directory on the admin node and all target nodes. For more information,
see Can't create a backup for a Node Agent node .
anthos-metadata-agent component that
kubestore-collector replaced.
csi-snapshot-validation-webhook component.
Upstream Kubernetes validation is now handled natively via Common
Expression Language (CEL) rules within the deployed Custom Resource
Definitions (CRDs). For more information, see Volume snapshots.
The following issues were fixed in 1.36.0-gke.532:
Ingress resources didn't update when
using bundled ingress.
kubelet flags.
cluster-proportional-autoscaler to address security vulnerabilities.
etcd-events installation entered an infinite retry loop
during machine initialization due to incomplete cleanup of the data directory
after a learner promotion failure.
NodePool controller prematurely updated Status.ManagedFields
on partial reconciliation failures, causing removed taints and labels to remain
stranded on affected nodes.
PROVISIONING state
because of a missing k8s-health-check Service account.
kube-apiserver during etcd encryption
updates abruptly terminates the container, causing stale service endpoints
and transient connection failures for in-cluster workloads.
kube-apiserver container termination check.
Fixed the issue in which GPUDirect-TCPX for a3-highgpu-8g machine types was
incompatible with the Linux kernel version that was used by Container-Optimized
OS in GKE version 1.34 and later. To prevent errors, GKE blocked creating or
upgrading node pools that used the a3-highgpu-8g machine type to version 1.34
or later. For more information about this issue, see GKE known
issues.
You can now create or upgrade node pools that use the a3-highgpu-8g machine
type to any of the following GKE versions. Automatic upgrades of these node
pools from version 1.33 to version 1.34 or later are no longer blocked.
In GKE version 1.34 and later, you must use version 3.1.9 or later of the
GPUDirect-TCPX installer and version 2.0.12 or later of the GPUDirect-TCPX
sidecar. If you previously installed these components, verify that the container
images use these versions or later. To avoid degraded performance or workload
failures, update your installer and sidecar image versions before the
a3-highgpu-8g node pools are manually or automatically upgraded to version
1.34 or later. These container image versions correspond to the upstream
definitions maintained in the gpudirect-tcpx GitHub
repository.
Managed Airflow remote Model Context Protocol (MCP) server is now generally available (GA).
Managed Airflow Agent is now available in Google Cloud Console. The agent can help you understand, diagnose, and resolve issues with failed Airflow tasks and DAG runs, optimize your environment's performance, identify existing or potential issues, bottlenecks, and areas for optimization.
Model Armor supports screening prompts and responses up to 65,536 tokens (262,144 characters) for prompt injection and jailbreak detection, responsible AI, and child sexual abuse material (CSAM) filters. Model Armor scans only the first 256 URLs found in prompts and responses.
For more information, see Token system limits.
Fraud Defense Mobile SDK v18.10.0-beta01 is available for iOS. This version includes the following:
Addressed multiple Common Vulnerabilities and Exposures (CVEs) by updating dependencies.
You can now disable monitoring for specific custom RootSync or RepoSync objects by setting the spec.monitoring.enabled field to false. This disables metric telemetry collection and exporting for that reconciler, which can help reduce cluster resource consumption. For more information, see Disable monitoring.
New minor engine versions released for the commercial line of business within the v004.009 and v004.010 version lines (aml-commercial.default.v004.009.202608-000 and aml-commercial.default.v004.010.202608-000). These versions extend support for the major engine version and include no significant changes compared to the previous minor versions.
Backup vault support for Filestore instances encrypted with customer-managed encryption keys (CMEK) is now generally available (GA). When you back up Filestore instances to a CMEK-enabled backup vault, the backups are encrypted using the backup vault CMEK key.
For more information, see Customer-managed encryption keys (CMEK), Back up Filestore instances to a backup vault, and Restore a Filestore instance from a backup vault.
You can now monitor the performance, adoption, latency, and costs of your data agents and their conversations by using Google Cloud Observability in BigQuery. This feature is in Preview.
An Incorrect Authorization vulnerability CVE-2026-19410, in GitHub Trigger Comment Control in Cloud Build, was fixed. No customer action is needed.
Cloud KMS supports deleting key rings in General Availability.
For more information about deleting Cloud KMS resources, see Delete Cloud KMS resources.
You can update the display name, description, and Cloud KMS key
applied to a _Trace observability bucket.
For more information, see Update observability buckets.
You can manually create the _Trace observability bucket before your project
receives trace data. When creating the bucket, you must specify a storage
location. Google Cloud Observability applies the Cloud KMS key defined in your
default settings unless you explicitly specify a different key in your create
request.
For more information, see the following documents:
The following remote MCP servers automatically generate a trace span for
tools/call operations.
These spans can help you understand the behavior of your agentic applications. For more information, see Investigate MCP calls using Trace.
Config Controller now uses the following versions of its included products:
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.6.143 | v27.5.1 | v2.0.10 | See List |
Added support for net-fs/lustre-client-drivers v2.14.0_p259.
Upgraded app-admin/google-guest-configs to v20260804.00.
Upgraded app-arch/zstd to v1.5.7-r1.
Upgraded app-shells/dash to v0.5.13.5.
Upgraded dev-libs/expat to v2.8.3.
Upgraded dev-libs/libverto to v0.3.2-r1.
Upgraded dev-libs/popt to v1.19-r1.
Upgraded dev-libs/xxhash to v0.8.3-r2.
Upgraded sys-apps/acl to v2.4.0-r2.
Upgraded sys-apps/xemu to v0.0.10.
Upgraded sys-process/lsof to v4.99.7.
Fixed CVE-2026-68096 in the Linux kernel.
Fixed CVE-2026-68096 in the Linux kernel.
Fixed CVE-2026-68096 in the Linux kernel.
Fixed CVE-2026-68129 in the linux kernel
Fixed CVE-2026-68146 in the Linux kernel.
Fixed CVE-2026-68149 in the Linux kernel.
Fixed CVE-2026-68171 in the Linux kernel.
Fixed CVE-2026-68299 in the Linux kernel.
Fixed CVE-2026-68329 in the Linux kernel.
Fixed KCTF-0650f1c in the Linux Kernel.
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.6.143 | v24.0.9 | v1.7.34 | See List |
Added support for net-fs/lustre-client-drivers v2.14.0_p259.
Upgraded sys-apps/xemu to v0.0.10.
Fixed CVE-2026-68096 in the Linux kernel.
Fixed CVE-2026-68096 in the Linux kernel.
Fixed CVE-2026-68096 in the Linux kernel.
Fixed CVE-2026-68116 in the Linux kernel.
Fixed CVE-2026-68129 in the linux kernel
Fixed CVE-2026-68146 in the Linux kernel.
Fixed CVE-2026-68147 in the Linux kernel.
Fixed CVE-2026-68149 in the Linux kernel.
Fixed CVE-2026-68171 in the Linux kernel.
Fixed CVE-2026-68325 in the Linux kernel.
Fixed CVE-2026-68386 in the Linux kernel.
Fixed CVE-2026-68428 in the Linux kernel.
Fixed KCTF-0650f1c in the Linux Kernel.
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.12.94 | v27.5.1 | v2.2.6 | See List |
Updated cos-gpu-installer to v2.7.7.
Added support for net-fs/lustre-client-drivers v2.14.0_p259.
Upgraded sys-apps/xemu to v0.0.10.
Fixed CVE-2026-68096 in the Linux kernel.
Fixed CVE-2026-68096 in the Linux kernel.
Fixed CVE-2026-68096 in the Linux kernel.
Fixed CVE-2026-68129 in the linux kernel
Fixed CVE-2026-68146 in the Linux kernel.
Fixed CVE-2026-68325 in the Linux kernel.
Fixed CVE-2026-68338 in the Linux kernel.
Fixed CVE-2026-68422 in the Linux kernel.
Fixed KCTF-0650f1c in the Linux Kernel.
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.12.94 | v27.5.1 | v2.2.7 | See List |
Updated cos-gpu-installer to v2.7.7.
Added support for net-fs/lustre-client-drivers v2.14.0_p259.
Upgraded sys-apps/xemu to v0.0.10.
Fixed CVE-2026-68093 in the Linux kernel.
Fixed CVE-2026-68096 in the Linux kernel.
Fixed CVE-2026-68096 in the Linux kernel.
Fixed CVE-2026-68096 in the Linux kernel.
Fixed CVE-2026-68129 in the linux kernel
Fixed CVE-2026-68296 in the Linux kernel.
Fixed CVE-2026-68386 in the Linux kernel.
Fixed KCTF-0650f1c in the Linux Kernel.
Runtime sysctl changes:
Gemini Enterprise: D&B Commercial Graph data store (Preview)
The D&B Commercial Graph data store is available in Public Preview in Gemini Enterprise. You can connect D&B Commercial Graph to search and import company data using natural language.
For more information, see Connect D&B Commercial Graph.
Gemini Enterprise: Cloud Monitoring observability for data connectors
Cloud Monitoring telemetry for Gemini Enterprise data connectors (also referred to as data stores) has been updated with support for new metric dimensions and a new latency metric:
discoveryengine.googleapis.com/dataconnector/request_count count
metric has been updated to include three new dimensions: tool_id (the
identifier of the connector tool invoked), engine_id (the Gemini
Enterprise app identifier), and response_code (the gRPC response status).
The existing status dimension remains supported.discoveryengine.googleapis.com/dataconnector/request_latencies (Beta), is
available to monitor the distribution of tool invocation latency in
milliseconds. It includes the dimensions status, response_code,
tool_id, and engine_id.For more information, see Access metrics.
GLM 5.2 is available in Public Preview
GLM 5.2 from Z.ai is available as a fully managed model (MaaS) in Model Garden. The model targets long-horizon agentic and coding tasks and supports a 1M-token context window.
For more information, see GLM 5.2.
VMware component updates: The VMware Engine operations team is updating vCenter Server and ESXi to version 8.0 Update 3k to address security vulnerabilities described in Broadcom Security Advisory VMSA-2026-0006. For details about the update and schedule, see the Latest service announcements.
Unroll Processor for Data Processing Pipelines
Google SecOps data processing pipelines now support the Unroll processor (event breaking). This processor allows you to split log entries containing arrays or slices of events into multiple individual log events prior to parsing and ingestion.
Key details:
set(body, ParseJSON(body))) positioned prior to the Unroll processor in the pipeline execution sequence.For details on configuring data processing pipelines and processors, see Set up and manage data processing pipelines.
[Spotlight Feature] Operations in Emerging Threats Center
Google SecOps now supports Operations in the Emerging Threats Center feed to provide rapid visibility into threat activity details involving the targeting of a single organization. Operations complement global Campaigns by providing granular threat intelligence derived from frontline investigations, such as Managed Threat Defense (MTD) engagements. For more information, see Operations in Emerging Threats.
Key capabilities include:
Unroll Processor for Data Processing Pipelines
Google SecOps data processing pipelines now support the Unroll processor (event breaking). This processor allows you to split log entries containing arrays or slices of events into multiple individual log events prior to parsing and ingestion.
Key details:
set(body, ParseJSON(body))) positioned prior to the Unroll processor in the pipeline execution sequence.For details on configuring data processing pipelines and processors, see Set up and manage data processing pipelines.
]]>Installed latest packages from upstream dependencies.
Installed latest packages from upstream dependencies.
Installed latest packages from upstream dependencies.
Installed latest packages from upstream dependencies.
Scheduled notebook executions now report their final status when the execution user's credentials stop working part way through a run, instead of continuing until the execution timeout.
Installed latest packages from upstream dependencies.
Scheduled notebook executions now report their final status when the execution user's credentials stop working part way through a run, instead of continuing until the execution timeout.
Installed latest packages from upstream dependencies.
]]>| Bug ID | Description |
|---|---|
| 543626585 |
ServiceCallout policy can now be added in the Apigee UI Adding a ServiceCallout policy in the Apigee UI no longer leaves the Create or Add button disabled. Previously, selecting Service Callout in the Create policy or Add policy panel could display only the Name and Display name fields and omit the required HTTP target field. With the required field missing, the form never became valid, so the Create or Add button stayed disabled no matter what you entered. This affected both API proxies and shared flows. The earlier workaround of creating a placeholder policy and replacing its XML in the code editor is no longer needed. For more information, see ServiceCallout policy and Attach and configure policies in the UI. |
| Bug ID | Description |
|---|---|
| 540008387 |
Developer custom attributes now save reliably in the Apigee UI Saving changes to a developer in the Apigee UI in Cloud console no longer intermittently fails to persist that developer's custom attributes. Previously, the UI reported the save as successful, but the previous attribute values reappeared when the page was reloaded. Developer updates made with the Apigee API were not affected. |
The Agent Identity auth manager and the Agent Identity APIs
(agentidentity.googleapis.com and agentidentitycredentials.googleapis.com)
are generally available.
Agent Identity auth manager provides a centralized credentials vault and
authentication broker that simplifies outbound tool authentication for 3-legged
OAuth, 2-legged OAuth, and API keys. The Agent Identity APIs replace the legacy
IAM Connectors API (iamconnectors.googleapis.com) for managing auth providers
and agent identities.
For more information, see the following documentation:
]]>AI Hypercomputer has expanded to cover all GPU machine series. Specifically, the documentation for AI Hypercomputer has been significantly updated as follows:
To learn more about the differences between general GPUs and clustered GPUs, see Choose your accelerator infrastructure. To view workload recommendations, see Choose between general GPUs and clustered GPUs.
Missing authorization in QueryEngineTask (CVE-2026-12710)
A missing authorization vulnerability (CVE-2026-12710) in QueryEngineTask in Application Integration was patched on April 4, 2026, and no customer action is needed.
The Switzerland Data Boundary with Access Justifications control package is now generally available.
The Data Boundary for ITAR supports the following products:
Rapid Cache supports prefix-level ingest-on-write filtering, allowing you to selectively ingest objects that match specific prefixes rather than ingesting all objects written to a bucket.
For more information, see Ingesting data on write.
Generally available: The network- and memory-optimized M4N machine series is generally available. Powered by 5th generation Intel Xeon Scalable processors (Emerald Rapids), M4N instances are purpose-built for network and block storage-intensive workloads such as:
The M4N machine series delivers the highest I/O performance available in Compute Engine, supporting up to 400 Gbps of network bandwidth. M4N also offers leading block storage performance with Hyperdisk Extreme that scales up to 25 GiB/s of bandwidth and 1M IOPS. M4N instances are available in predefined machine shapes, ranging in size from 16 to 224 vCPUs and up to 5,952 GB of DDR5 memory.
Gemini Enterprise: AI developer tools on Standard Emerging Market edition
The AI developer tools feature is available on the Gemini Enterprise Standard Emerging Market edition. Your project must be linked to an invoiced Cloud Billing account that receives an active monthly invoice to access the feature. This edition doesn't include bundled base quota or Antigravity credits.
For more information, see the following:
Gemini Enterprise: New data stores and support for new actions (Public Preview)
The following data stores are available in Public Preview in Gemini Enterprise:
You can search and read data from these data stores using natural language.
Additionally, the following data stores support new actions in Public Preview:
xAI's Grok 4.6
Grok 4.6 is available in Preview in Model Garden.
Google Cloud CCaaS 6.4
We've released version 6.4 of Google Cloud CCaaS.
The timing of the update to your instance depends on the deployment schedule that you have chosen. For more information, see Deployment schedules.
Automatic SIP parameter mapping in contact lists
Contact lists now support automatic SIP header mapping for outbound call destinations.
Administrators: In the Add Destination dialog at Settings > Call
> Contact Lists > Contact list management >
CREATE OR EDIT CONTACT LIST> Add
Destination, toggle Pass Data Parameters to the on position to see the
new Automatically Include and Pass all Inbound SIP Headers checkbox.
For more information, see Add a SIP URI address destination to a contact list.
Email OAuth profiles and Microsoft 365 client credentials
You can now create email OAuth profiles for Microsoft 365 using the client credentials grant type. This lets shared mailboxes authenticate through an app registration instead of relying on an individual user sign-in. OAuth IMAP setup is more resilient for support inboxes and other application-managed mailboxes.
For more information, see Email OAuth profiles and Microsoft 365 client credentials.
Improved connection times for predictive dialing
We reduced the connection time for predictive dialing to under two seconds to comply with CRTC and FTC regulations.
This release addresses the following issues:
Fixed an issue where a long delay occurred when an agent clicked Chat Shortcuts in the chat adapter.
Fixed an agent desktop issue where the Session Data Feed pane displayed data from the previous chat and the chat transcript stopped updating.
Fixed an issue where conversation history loaded slowly for agents using the CCaaS widget embedded in Salesforce.
Fixed an issue where outbound calls with zero duration time were missing from Individual Call History reports that were scoped to agents and teams.
Fixed an issue where customers couldn't leave a voicemail during a warm transfer.
Fixed an issue where the Queued Calls dashboard displayed the incorrect originating queue and transferring agent for a cold-transferred call.
Fixed an issue where the agent desktop experienced significant loading delays.
Fixed an issue where calls transferred from a virtual agent directly to a human agent bypassed the Keep Waiting overcapacity setting, causing callers to be incorrectly routed to a fallback queue or to voicemail.
Fixed a raw data export issue where file names for the MENU_PATH_ITEMS
dataset incorrectly contained path_items.
Fixed an issue where a parent queue was incorrectly marked as after-hours even though one or more of its child queues were in operation.
Fixed an issue with chats that were escalated from a virtual agent to a human agent and then reached a terminal status (canceled, finished, or failed). These chats mistakenly appeared in the Queued Chats dashboard.
Fixed an issue where the agent desktop froze and the Call Adapter pane displayed Call on hold after a call was terminated or dropped.
Fixed an issue where agents couldn't change their chat status while a call was in the wrap-up stage.
Fixed an issue where the call adapter displayed calls waiting when there were actually no calls waiting.
Fixed an issue where outbound calls that failed immediately caused the call adapter to be stuck in the In-call state with the timer running.
Per the June 10, 2026 release note, the configuration option to not enroll your cluster in a release channel is deprecated, and will be removed on June 14, 2027. In alignment with this deprecation, creating new clusters not enrolled in a release channel is now only allowed for existing customers. New customers can use a release channel, where you can achieve the same functionality as not enrolling your cluster in a release channel. For more information, see Clusters not enrolled in a release channel.
The Windows Server 2019 (LTSC) GKE node image doesn't receive updates after the December 2025 version. Windows Server 2019 (LTSC) is in the Extended Support period of the Microsoft fixed lifecycle policy and receives only security updates. To prevent stability issues, the GKE node image for Windows Server 2019 (LTSC) is pinned to the December 2025 version. If you use this node image, switch to Windows Server 2022 (LTSC), which is in the Mainstream Support period and receives updates from Microsoft and GKE. For more information, see Creating a cluster using Windows Server node pools.
[Spotlight Feature] Relative time filtering in Google SecOps
This feature is in public preview. Google SecOps has updated how relative time filters calculate data ranges. You can now choose from three distinct, mathematically precise operators: Past, Previous, and Current. This change eliminates ambiguity between rolling windows and calendar-aligned periods, ensuring consistent behavior across all time units (like seconds, minutes, hours, days, weeks, months, years) and aligning SecOps dashboards with Search and other Google tools (such as Looker).
For more information, see the Relative time range section of the Understand search guide.
The Personalized Service Health remote MCP server provides a secure environment that lets you send natural language prompts to your AI application so that it can retrieve incident information, audit incidents, and automate debugging on your behalf.
For more information, see Use the Personal Service Health remote MCP server.
]]>Starting from August 2026, to provide modern security patches and support for MySQL 8.4 and later, the App Engine flexible environment uses Cloud SQL Auth Proxy v2 as the built-in sidecar container for connections to Cloud SQL. To use the latest Cloud SQL Auth Proxy container immediately, restart your VMs or deploy a new version of your application.
Starting from August 2026, to provide modern security patches and support for MySQL 8.4 and later, the App Engine flexible environment uses Cloud SQL Auth Proxy v2 as the built-in sidecar container for connections to Cloud SQL. To use the latest Cloud SQL Auth Proxy container immediately, restart your VMs or deploy a new version of your application.
Starting from August 2026, to provide modern security patches and support for MySQL 8.4 and later, the App Engine flexible environment uses Cloud SQL Auth Proxy v2 as the built-in sidecar container for connections to Cloud SQL. To use the latest Cloud SQL Auth Proxy container immediately, restart your VMs or deploy a new version of your application.
Starting from August 2026, to provide modern security patches and support for MySQL 8.4 and later, the App Engine flexible environment uses Cloud SQL Auth Proxy v2 as the built-in sidecar container for connections to Cloud SQL. To use the latest Cloud SQL Auth Proxy container immediately, restart your VMs or deploy a new version of your application.
Starting from August 2026, to provide modern security patches and support for MySQL 8.4 and later, the App Engine flexible environment uses Cloud SQL Auth Proxy v2 as the built-in sidecar container for connections to Cloud SQL. To use the latest Cloud SQL Auth Proxy container immediately, restart your VMs or deploy a new version of your application.
Starting from August 2026, to provide modern security patches and support for MySQL 8.4 and later, the App Engine flexible environment uses Cloud SQL Auth Proxy v2 as the built-in sidecar container for connections to Cloud SQL. To use the latest Cloud SQL Auth Proxy container immediately, restart your VMs or deploy a new version of your application.
Starting from August 2026, to provide modern security patches and support for MySQL 8.4 and later, the App Engine flexible environment uses Cloud SQL Auth Proxy v2 as the built-in sidecar container for connections to Cloud SQL. To use the latest Cloud SQL Auth Proxy container immediately, restart your VMs or deploy a new version of your application.
Starting from August 2026, to provide modern security patches and support for MySQL 8.4 and later, the App Engine flexible environment uses Cloud SQL Auth Proxy v2 as the built-in sidecar container for connections to Cloud SQL. To use the latest Cloud SQL Auth Proxy container immediately, restart your VMs or deploy a new version of your application.
BigQuery supports the following table-valued functions in the query editor and as part of conversational analytics to help you analyze your time series data:
ML.TREND:
identify the directional trajectory of your data.ML.SEASONALITY:
identify repeating patterns in your data.ML.DETECT_CHANGE_POINTS:
identify intervals where structural shifts occur in your data.These functions are in preview.
Starting April 26, 2027, core graph processing for BigQuery Graph will be restricted to the BigQuery Enterprise and Enterprise Plus editions. Consequently, we are deprecating support for Standard edition and on-demand billing for core graph processing.
Graph measures will remain available in the Enterprise and Enterprise Plus editions and for queries run using on-demand pricing. Measures are not available in Standard edition.
For additional details and enforcement dates regarding Standard edition and on-demand billing support, see the August 27, 2026 release note.
The run_bq_command tool
exposes the bq command-line tool within the
Cloud CLI remote MCP server. AI agents can now execute advanced BigQuery
operations, such as job scheduling, job management, and reservation management,
through a managed MCP endpoint.
For more information, see
Use the Cloud CLI remote MCP server. This feature is in
Preview.
You can use the allow_incomplete_view query hint in SQL queries to read data
from a continuous materialized view before its initial population finishes. This
feature is generally available (GA).
For more information, see Read data during initial population.
The guidance for using proxy image types (default and distroless) with
Managed Cloud Service Mesh has been updated:
TRAFFIC_DIRECTOR implementation
use distroless proxy images by default, and other image types are not
supported.ISTIOD to TRAFFIC_DIRECTOR) default
to default images, but can opt in to distroless images via MeshConfig or
the sidecar.istio.io/proxyImageType: distroless Pod annotation.For more information, see Distroless proxy images and Identify the proxy image type used in the cluster.
The guidance for using proxy image types (default and distroless) with
Managed Cloud Service Mesh has been updated:
TRAFFIC_DIRECTOR implementation
use distroless proxy images by default, and other image types are not
supported.ISTIOD to TRAFFIC_DIRECTOR) default
to default images, but can opt in to distroless images via MeshConfig or
the sidecar.istio.io/proxyImageType: distroless Pod annotation.For more information, see Distroless proxy images and Identify the proxy image type used in the cluster.
Cluster Toolkit version v1.101.0 is available. This release adds
support for Persistent Disk storage pools to
the vm-instance module,
GKE node pools, and storage. The update also optimizes
dependency management to improve the user experience, and updates Cloud TPU v4
and TPU v5p shorthand mappings to use TensorCore counts. For more information,
see the release announcement on
GitHub.
Preview: Image Builder is available in allowlist-only Preview. Image Builder is a declarative operating system (OS) image customization tool that automates the process of building, customizing, and validating custom OS images within Google Cloud by using Cloud Build. For more information about Image Builder, see About Image Builder.
To onboard your project and request access, fill out the request form.
Config Connector version 1.155.1 is now available.
New Beta Resources (Direct Reconciler):
DiscoveryEngineLicenseConfig
StorageManagedFolder
VertexAITensorboardExperiment
New Fields:
spec.automatedBackupPolicy field.CertificateManagerDNSAuthorization
spec.type field.spec.target.redisClusterServiceAttachment field.spec.tests[].expectedOutputURL field.spec.tests[].expectedRedirectResponseCode field.spec.nodeConfig.kubeletConfig.imageGcLowThresholdPercent field.spec.nodeConfig.kubeletConfig.imageGcHighThresholdPercent field.spec.nodeConfig.kubeletConfig.imageMinimumGcAge field.spec.nodeConfig.kubeletConfig.imageMaximumGcAge field.spec.nodeConfig.containerdConfig field.spec.inTransitEncryptionConfig field.spec.disableL4LbFirewallReconciliation field.spec.nodeConfig.resourceManagerTags field.spec.nodePoolAutoConfig.resourceManagerTags field.spec.nodeConfig.kubeletConfig.imageGcLowThresholdPercent field.spec.nodeConfig.kubeletConfig.imageGcHighThresholdPercent field.spec.nodeConfig.kubeletConfig.imageMinimumGcAge field.spec.nodeConfig.kubeletConfig.imageMaximumGcAge field.spec.nodeConfig.containerdConfig field.spec.nodeConfig.resourceManagerTags field.spec.autoclass.terminalStorageClass field.status.observedState.storageClass field.New Features:
Reconciliation Improvements:
We have added support for direct reconciliation to more resources, with opt-in behavior. The API is unchanged. To use the direct reconciler, add the cnrm.cloud.google.com/reconciler: direct annotation to the corresponding Config Connector object.
NetworkServicesHTTPRoute
Bug Fixes:
ComposerEnvironment in the direct reconciler. (GitHub PR #12364)specificReservation.inUseCount to prevent infinite/unwanted reconciliations.MaintenanceSchedule field as output only to align with GCP's behavior.PscAutoConnectionPolicyEnabled.| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.12.94 | v27.5.1 | v2.2.7 | See List |
Updated containerd to v2.2.7.
Fixed CVE-2026-68329 in the Linux kernel.
Various bug fixes and minor product enhancements.
Credits for the first month of Gemini Code Assist usage are discontinued. Customers currently receiving these credits are unaffected by this change. Previously, these credits had been available to new customers with billing accounts if they had never had a Gemini Code Assist subscription.
Credits for the first month of Gemini Code Assist usage are discontinued. Customers currently receiving these credits are unaffected by this change. Previously, these credits had been available to new customers with billing accounts if they had never had a Gemini Code Assist subscription.
Gemini Enterprise: Antigravity for IDEs available in AI developer tools
Antigravity for IDEs is available as part of AI developer tools for Gemini Enterprise Standard, Plus, and Pay-as-you-go editions linked to an invoiced Cloud Billing account that receives an active monthly invoice. Antigravity for IDEs brings the power of Antigravity AI agents directly into your integrated development environment (IDE).
For more information, see the following:
Gemini Enterprise and Gemini Notebook Enterprise: Autocomplete for sharing notebooks and agents with Okta
If you use Okta as your external identity provider (IdP) with Workforce Identity Federation, you can configure System for Cross-domain Identity Management (SCIM).
Configuring SCIM enables autocomplete when sharing Gemini Notebook Enterprise notebooks and when sharing agents in Gemini Enterprise. With autocomplete, users can quickly search and select people or groups instead of entering full email addresses or group names.
This feature is generally available (GA).
For more information, see the following:
Gemini Enterprise: Google Identity support for third-party data stores
Google Identity is supported and recommended to manage access when connecting third-party data sources to Gemini Enterprise.
What's new: Gemini Enterprise supports Google Identity when connecting to third-party data sources with external identity providers (such as Microsoft Entra ID or Okta) using OIDC or SAML 2.0. This includes all third-party federated connectors and ingestion connectors, with the exception of Microsoft 365 data ingestion.
Recommendation: Google Identity is recommended for all new setups.
Existing setups: Customers already using Workforce Identity Federation can choose to remain on their existing configuration.
This feature is generally available (GA). For more information, see Configure identity provider.
GKE cluster versions have been updated.
New versions available for upgrades and new clusters.
The following versions are now available for new GKE clusters, and for manual control plane upgrades and node upgrades for existing clusters. For more information about versioning and upgrades, see GKE versioning and support and About GKE cluster upgrades.
This release includes new GKE versions that use updated Container-Optimized OS images. These updated images are cumulative, incorporating security fixes from all Container-Optimized OS versions released since the previous GKE release.
To identify the specific vulnerabilities that were resolved in each updated Container-Optimized OS image, see the Security release notes for that image. The following table includes links to the release notes for each updated Container-Optimized OS image:
| GKE version | Container-Optimized OS version | Details |
|---|---|---|
| 1.31.14-gke.2613000 | cos-117-18613-675-48 | cos-117-18613-675-48 release notes |
| 1.32.13-gke.2314000 | cos-121-18867-528-43 | cos-121-18867-528-43 release notes |
| 1.33.13-gke.1499000 | cos-121-18867-528-43 | cos-121-18867-528-43 release notes |
| 1.34.10-gke.1236000 | cos-125-19216-532-62 | cos-125-19216-532-62 release notes |
Side-by-side view on the Alerts & Detections tab in Cases
This feature is in public preview. The Alerts & Detections tab in the revamped Investigation Management experience now supports a Side-by-side view layout.
You can switch between the default List view and the Side-by-side view to inspect an alert or detection's detailed metadata, status, priority, creation date, and Gemini investigation insights in an adjacent side pane without navigating away from the main list.
For more information, see Investigation and case management overview.
A new Managed Service for Apache Airflow release has started on August 20, 2026. Get ready for upcoming changes and features as we roll out the new release to all regions. This release is in progress at the moment. Listed changes and features might not be available in some regions yet.
Airflow 3.3.1 is available in Managed Airflow (Gen 3).
Airflow 3.1.8 is no longer included in Managed Airflow images and builds.
Composer Local Development CLI tool now supports deployment with Podman in Linux and Windows.
(Airflow 3.2.2, 3.1.8, and 2.11.1)
The apache-airflow-providers-google package was upgraded to version 22.3.0.
For more information about changes, see the
apache-airflow-providers-google changelog.
New Airflow builds are available in Managed Airflow (Gen 3):
New images are available in Managed Airflow (Gen 2):
Network Security Integration in-band integration now supports the direct internet egress deployment model. In this model, the network security appliance in the producer VPC network inspects outbound traffic and sends it directly to the internet through its external network interface. The appliance then sends the internet response packet directly to the consumer VM using GENEVE, bypassing the return hop to the consumer VPC network.
For more information, see Direct internet egress.
Secure Web Proxy now supports the local intermediate CA signing certificate issuance mode for TLS inspection. By using this mode, Secure Web Proxy caches a single intermediate certificate authority (CA) certificate from your CA pool to sign leaf certificates locally for requested domains, reducing certificate issuance requests and transaction costs. To use this certificate issuance mode, you must make sure that your CA pool is configured to issue intermediate CA certificates.
For more information, see Certificate issuance modes and Configure a local intermediate CA signing. This feature is generally available (GA).
Image scanning is available in the following regions:
europe-north1us-central1For more information, see Locations that support image scanning.
Global Front End is a unified offering that combines Service Extensions, global external Application Load Balancer, Google Cloud Armor, and Cloud CDN into one solution to help deliver, scale, and secure your internet-facing applications. Service Extensions is included in the Global Front End Enterprise billing tier. This feature is available in Preview.
For more information, see the Global Front End section on the Service Extensions overview page.
]]>Support for the Go 1.27 runtime is in Preview.
Starting from Go runtime version 1.26 and later, the lifecycle support dates align more closely with the Go community release cycle. For more information, see Runtime support schedule.
Support for the Go 1.27 runtime is in Preview.
Starting from Go runtime version 1.26 and later, the lifecycle support dates align more closely with the Go community release cycle. For more information, see Runtime support schedule.
You can migrate your App Engine push queues to Cloud Tasks by updating the bundled services SDK. This method lets you upgrade your app without needing to modify your application code. For more information on how to migrate, see the push queues migration guide (Preview).
You can migrate your App Engine push queues to Cloud Tasks by updating the bundled services SDK. This method lets you upgrade your app without needing to modify your application code. For more information on how to migrate, see the push queues migration guide (Preview).
You can migrate your App Engine push queues to Cloud Tasks by updating the bundled services SDK. This method lets you upgrade your app without needing to modify your application code. For more information on how to migrate, see the push queues migration guide (Preview).
The Batch Debian 11 operating system (OS) image family has
reached end of development due to the
end of support (EOS) for Compute Engine Debian 11 images on August 31, 2026.
The last Batch Debian 11
images—any image versions with the batch-debian-11-official prefix—are
only supported until August 31, 2026. Before then, migrate any job that uses a
Batch Debian 11 image to a Batch Debian 12
image (or other image) as follows:
For job definitions that use the batch-debian image prefix (which is the
default image for jobs with any script runnables), the image that
Batch automatically selects during job creation is
gradually migrating to Debian 12 no later than August 31, 2026.
For any jobs created before August 31, 2026, you can check whether the job
uses Debian 11 or Debian 12 by describing the job.
For job definitions that specify either the batch-debian-11-official image
family or an image version with that prefix, specify a different image during
job creation. For example, to migrate to Debian 12, specify either the
batch-debian-12-official image family or an image version with that prefix.
Learn more about OS images, viewing OS images, and specifying OS images.
Starting from Go runtime version 1.26 and later, the lifecycle support dates align more closely with the Go community release cycle. For more information, see Runtime support schedule.
Global Front End is a unified offering that simplifies billing by consolidating pricing across networking products, including Cloud CDN, global external Application Load Balancer, Google Cloud Armor, and Service Extensions, into one solution to help deliver, scale, and secure your internet-facing applications. Cloud CDN is included in the Global Front End Enterprise billing tier. This feature is available in Preview.
For more information, see Global Front End.
Global Front End combines global external Application Load Balancers, Google Cloud Armor, Cloud CDN, and Service Extensions into one solution to help deliver, scale, and secure your internet-facing applications.
For more information, see Global Front End.
This feature is available in Preview.
Support for the Go 1.27 runtime is in Preview.
Starting from Go runtime version 1.26 and later, the lifecycle support dates align more closely with the Go community release cycle. For more information, see Runtime support schedule.
Support for the Go 1.27 runtime is in Preview.
Starting from Go runtime version 1.26 and later, the lifecycle support dates align more closely with the Go community release cycle. For more information, see Runtime support schedule.
Preview: Advanced Compute Images provide high-performance images to support your artificial intelligence (AI), machine learning (ML), and high-performance computing (HPC) workloads running on non-GPU instances on Google Cloud.
Advanced Compute Images optimized for CPUs provide a single source of trusted, performance-tuned OS images that remove the need for manual image building for specialized workloads. Each image version is pre-installed with the necessary drivers, network fabrics, and Slurm agents to help you run your workloads.
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.12.94 | v27.5.1 | v2.1.9 | See List |
Updated cos-gpu-installer to v2.7.6.
Fixed CVE-2026-68116 in the Linux kernel.
Fixed CVE-2026-68139 in the Linux kernel.
Fixed CVE-2026-68171 in the Linux kernel.
Fixed CVE-2026-68325 in the Linux kernel.
Fixed CVE-2026-68336 in the Linux kernel.
Fixed CVE-2026-68343 in the Linux kernel.
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.12.94 | v27.5.1 | v2.2.6 | See List |
Updated cos-gpu-installer to v2.7.6.
Fixed CVE-2026-68284 in the Linux kernel.
Fixed CVE-2026-68398 in the Linux kernel.
Runtime sysctl changes:
Global Front End is a unified offering that simplifies billing by consolidating pricing across networking products. Cloud Armor is included in the Global Front End Enterprise billing tier. Enabling Global Front End Enterprise in a project enables specific Cloud Armor Enterprise features for your global external Application Load Balancers. For more information, see Global Front End.This feature is available in Preview.
Google Cloud CCaaS 6.3
We've released version 6.3 of Google Cloud CCaaS.
The timing of the update to your instance depends on the deployment schedule that you have chosen. For more information, see Deployment schedules.
Agent desktop supports parameters in custom panel URLs
In the agent desktop, you can now configure fixed and dynamic parameters to include in the URLs of custom panels. This lets you pass relevant session, agent, and customer context into custom panels.
For more information, see Parameters.
Callback offer restrictions
You now have greater control over when callbacks are offered. You can configure the following:
Prevent callback offers from being made outside of callback hours.
Prevent callback offers that will likely occur outside of callback hours. If conditions improve (that is, EWT decreases), the system adjusts and can offer callbacks.
Administrators: We've added the following checkboxes to the CCAI Platform portal:
Restrict callback offer outside of callback window
Restrict callback offer that will exceed hours of operation. If queue condition improve offer callbacks
These checkboxes are available in the following locations:
The Settings > Call > Callback Settings pane (to configure globally).
The Settings > Queue > IVR (Interactive Voice
Response) > Edit / View >
QUEUE_NAME > Callback Settings
> Configure > Callback Management pane (to configure
a queue).
For more information, see Manage callbacks.
This release addresses the following issues:
Fixed an issue where chat transcripts incorrectly displayed undefined joined instead of the agent's name during a chat transfer when real-time redaction was enabled.
Fixed an issue where agents were incorrectly placed into Unresponsive status after answering a call if the customer declined the system's callback attempt.
Fixed an issue where overcapacity deflection didn't trigger when agent-initiated outbound or direct-inbound calls were transferred to a queue, causing users to wait indefinitely.
Fixed an issue where the Answer button didn't appear for incoming calls in the agent desktop, preventing agents from accepting calls.
Fixed an issue where live translation didn't activate (or translated in the wrong direction) after a chat was transferred between queues.
Fixed an issue where predictive campaign calls became stuck in a queued state, causing agents to appear available despite being unable to receive new calls.
Fixed an issue where web chats became stuck in a queued state and were never assigned to an agent.
Fixed an issue where previously closed chat sessions briefly reappeared and gained focus when launching agent desktop.
Fixed an issue where agents couldn't submit disposition codes and notes during wrap-up.
Fixed an issue where agents couldn't change their status after a call ended abnormally, causing them to remain stuck in the wrap-up state.
Fixed an issue where the Call History list incorrectly displayed the same customer phone number for all Acqueon campaign calls.
Fixed an issue where an agent's status incorrectly remained Available during outbound calls and wrap-up periods, allowing the routing engine to offer new inbound calls to occupied agents.
Fixed an issue where agents were forced to re-authenticate when opening the chat adapter or email adapter despite having an active session.
Fixed an issue where the text screen in the email adapter suddenly re-rendered while typing, causing characters to disappear or be displaced.
Fixed an issue where the headings in Generative AI session summaries in chat wrap-up notes lost their bold formatting when saved.
Fixed an issue where the global after-hours deflection message played despite a queue-level custom redirect to a phone number being configured.
Fixed an issue where calls abandoned by a customer while waiting in a transfer queue were incorrectly reported as queue failures.
Fixed an issue where transient CRM errors caused significant delays in retrieving ticket IDs during active calls.
Fixed an issue where the CCAI Platform portal incorrectly displayed a chat status as Unknown (instead of Check In Timeout) when a consumer didn't check in.
Fixed an issue where the call adapter incorrectly displayed Portuguese BR instead of Portuguese (Portugal) during call handoffs.
Fixed an issue where agents making outbound calls remained in an Available status, which incorrectly allowed new inbound calls to be routed to them while they were already engaged.
Fixed an issue where Agent Assist live transcription and generative summary stopped working mid-call following a transfer or a hold-and-resume cycle.
Fixed an issue where the transfer menu delayed loading queues.
Fixed an issue where the agent adapter incorrectly displayed an agent's status as Unavailable when a custom status, such as Break or Special Task, was selected.
Fixed an issue where chats escalated from a virtual agent to a human agent queue bypassed menu-level after-hours and over-capacity deflection messages.
Fixed an issue where the call adapter defaulted to English in the Outbound call screen regardless of the agent's system language.
Fixed an issue where Call and Chat each appeared twice in the Dashboard menu when using high browser zoom levels or small window resolutions.
Fixed an issue where legacy dashboards were restricted to English-only labels.
Fixed an issue where users in SAML-only or SSO-enabled environments received invitation emails directing them to a non-existent Forgot Password flow.
Fixed an issue where the user activity logs incorrectly recorded an end-user ID instead of the agent's ID when a chat disconnected.
Fixed an issue where customer calls were abandoned during payment transactions when DTMF inputs were provided.
Fixed an issue where agents could see and select outbound caller IDs that weren't assigned to their teams or queues.
Fixed an issue where post-session virtual agent transfers stalled if a customer left the chat while still in a queue for a human agent.
Fixed an issue where agents and end-users could hear each other's voices despite the agent putting the call on hold.
Fixed an issue where the agent adapter incorrectly reverted to displaying English when initiating an outbound call in a non-default language.
Fixed an issue where the Hide Agent Assist button wasn't appearing in the user interface during the call disposition phase.
Fixed an issue where cascade agent availability conditions weren't enforced, causing regional agents to be incorrectly routed into international queues and leaving local queues understaffed.
Fixed an issue where agents appeared available but weren't receiving calls.
Fixed an issue where administrators received multiple email notifications instead of a single notification after deactivating a call channel.
Fixed an issue where Telnyx error handling was incorrectly configured, causing system alerts to fail during call disconnect or hold actions.
Fixed an issue where inbound IVR calls were stuck in a queued state if a caller disconnected during initial call processing.
Fixed an issue where callbacks became permanently stuck in a queued state if an agent missed a projected call.
Fixed an issue where calls using Telnyx or Nexmo numbers received an "An Application error has occurred" message during overcapacity deflection or automatic redirection.
Fixed an issue where call recordings weren't delivered or processed correctly.
Fixed an issue under Settings > Operation Management > Localization > Manage Location Setting where configured locations with Portuguese (Portugal) or Spanish (Spain) selected incorrectly displayed as Unknown in the Language column, and locations with Spanish (Mexico) selected incorrectly displayed as Spanish (Spain).
Fixed an issue in iOS and Android SDKs where the end user's initial message and custom data weren't correctly passed to the routing API during the chat menu fetch.
Fixed an issue where inbound calls cancelled by the caller within the first second incorrectly remained active in the system for several hours.
Fixed an issue where custom SIP headers were dropped. This occurred when a directly dialed agent was over capacity, the call was redirected to the agent's queue, and that queue was configured to redirect to a SIP URI.
Fixed an agent desktop issue where the chat screen went blank when an agent accepted or dismissed a chat.
Fixed an issue where the Deflections - Calls dashboard incorrectly reported the queues that calls were redirected to when using percent allocation.
Fixed an issue where auto-answered interactions became stuck in a Queued status despite being accepted by an agent.
Fixed an issue where the chat adapter in a CRM integration didn't post outbound messages when using rich text formatting.
Fixed an issue where the agent_activity_logs endpoint experienced timeouts
and degraded performance when processing large data requests.
Fixed an agent desktop issue where outbound calls appeared to start successfully but didn't connect to the end-user.
Fixed an issue where New photo received notifications appeared whenever an agent switched between chat tabs.
Fixed an issue where short outbound calls incorrectly displayed a This call was abandoned by the customer message.
Fixed an issue where agents experienced significant delays when switching between multiple concurrent web chats.
Fixed an issue where attaching PDF or text files in the chat adapter failed or timed out.
Fixed an issue where calls transferred from a virtual agent to an agent extension were incorrectly deflected.
Fixed an issue where reordering queues in the CCAI Platform portal experienced extreme latency and didn't update visually without a manual page refresh.
Fixed an issue where chat history for added agents became unavailable after a page refresh.
Fixed an issue where calls to the user_activity_logs endpoint experienced
significant delays.
Fixed an issue where repeated voicemail re-reads caused duplicate participant entries and inflated session data.
Fixed an issue where callback sessions remained in a Connected status indefinitely after completion.
Fixed an issue where agents using IdP-initiated SAML SSO were automatically routed to the default home page instead of the agent desktop.
Fixed an issue where DTMF options in the softphone didn't register with external IVR systems during outbound calls.
Fixed an issue where agents were unable to receive or fetch incoming calls.
Fixed an issue where supervisors using Telnyx who ended a monitoring session were unable to monitor subsequent calls.
Fixed an issue where empty chat bubbles appeared in the chat adapter when an end-user used suggestion chips to respond to a virtual agent.
Fixed an issue where duplicated contact handle-duration events caused inaccurate reporting for call and chat interactions.
Fixed an issue where agents didn't receive the correct error messages when their microphone was disabled or inaccessible during a call.
Fixed an issue where incoming calls were incorrectly multicasted and didn't auto-answer when an agent was already in an active chat session.
Fixed an issue where calls deflected to external SIP or phone destinations
were missing the ends_at timestamp in call data.
Fixed an issue where the chat timeout event wasn't correctly emitted to the headless web SDK, causing sessions to remain active for up to 120 minutes, regardless of the configured settings.
Fixed an issue where agents using Salesforce-Lightning or Zendesk embeds couldn't maintain a stable presence connection.
Fixed an issue where headless web SDK client methods didn't work after a mid-session authentication update.
Fixed an issue where agents were unexpectedly logged out of all active sessions.
Fixed an issue where calls producing multiple recording segments resulted in duplicate entries in Customer Experience Insights.
Fixed an issue where the parent_id field was missing from callback call
responses in the manager API.
Fixed an issue where virtual agent transcripts were lost during escalations to human agents.
Fixed an issue in the agent desktop where the sentiment score appeared in the Call details panel despite sentiment analysis being turned off in the conversation profile.
Fixed an issue where the Escalated To Language column in the
Escalations table of the Virtual Agent - Calls dashboard incorrectly
displayed Unknown for French (Canada) calls.
Fixed an issue where calls didn't advance to the next cascade group after the timer threshold was reached.
Google Distributed Cloud (software only) for VMware 1.34.800-gke.90 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud 1.34.800-gke.90 runs on Kubernetes v1.34.7-gke.200.
If you use a third-party storage vendor, check the listing of our previously-qualified storage partners.
After a release, it takes approximately 7 to 14 days for the version to become available for use with GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.
The following issues were fixed in 1.34.800-gke.90:
Reconciling state
after an admin cluster upgrade. The admin cluster controller skipped
reconciling legacy cluster lifecycle components during upgrades unless an initial
migration annotation was set. If legacy user clusters still existed on the
admin cluster, missing legacy API discovery (cluster.k8s.io/v1alpha1) caused
controller reconciliation to stall. With this fix, the controller preserves
legacy components as long as any legacy user clusters exist, and prunes them only
after all user clusters have migrated to advanced clusters.
gkectl prepare failed with a
permission denied error when attempting to read a private
registry CA certificate. The certificate file permissions
are now set to 644 so non-root processes can read it.
Google Distributed Cloud (software only) for bare metal 1.34.800-gke.90 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.34.800-gke.90 runs on Kubernetes v1.34.7-gke.200.
After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.
If you use a third-party storage vendor, check the listing of our previously-qualified storage partners.
The following issues were fixed in 1.34.800-gke.90:
csi-snapshot-validation-webhook, the Snapshot validation webhook component.Wiz: Version 9.0
Added the following new job:
Exchange: Version 125.0
Updated the parsing logic for nested S/MIME email attachments (.eml) sent
from macOS and Windows in the following connector:
Microsoft Teams: Version 39.0
Updated error handling in the following job:
Palo Alto Cortex XDR: Version 32.0
Fixed an issue where the job repeatedly logged errors when a case was merged or deleted in Google SecOps in the following job:
Proofpoint Cloud Threat Response: Version 5.0
Fixed an issue where null, missing, or unmapped priority values in API payloads caused log ingestion errors in the following connector:
Pub/Sub: Version 4.0
Added support for pubsub_message_id in the Unique ID Field parameter in
the following connector:
Splunk: Version 67.0
Updated the lookback timestamp progression logic when all fetched alerts in a cycle have already been processed in the following connector:
Zscaler: Version 16.0
Key updates in these image versions include:
2.3 image version, 2.3 clusters with Lightning Engine now use Iceberg version 1.10 by default.2.2 and 2.3 image versions:
1.49 to support lineage for tables created using the Lakehouse Runtime catalog.Rollback Notice: The 2.2.86 image versions were rolled back on August 31, 2026.
Managed Service for Apache Spark (formerly Dataproc on Compute Engine): Fixed a segmentation fault when OpenLineage parses complex SQL query strings.
Oracle Database@Google Cloud supports provisioning VM file system storage (VM images) and VM backups on Exascale storage for Exadata VM Clusters. This feature lets you to offload VM artifacts to Exascale, freeing up capacity and reducing dependence on local DB Server storage. For more information, see Configure Exascale Storage Vault for Exadata Infrastructure and Create Exadata VM Clusters with Exascale Storage Vaults.
This feature is Generally Available (GA).
General Availability: You can use Private Service Connect
endpoints and
backends
to access multi-regional service endpoints such as
storage.us.rep.googleapis.com.
Support for migrating from the App Engine Images service to Cloud Run is in General Availability (GA).
Support for migrating from the App Engine Images service to Cloud Run is in General Availability (GA).
Application Design Center provides the
application-design-center-design-deploy agent skill to help AI agents design,
validate, deploy, and troubleshoot Google Cloud infrastructure. For more
information, see
App Design Center agent skills.
The default per-project limit of user-specific reservation assignments has been increased from 10 to 100.
Gemini Enterprise: Google Sites federated connector (GA)
The Google Sites federated connector is generally available (GA) on Gemini Enterprise. You can use the Gemini Enterprise app assistant to search across internal company websites, team sites, intranets, project hubs, and informational pages hosted on Google Sites, and get answers grounded in that content without needing to ingest the data.
For more information, see Connect to Google Sites.
Gemini Enterprise: Gemini 3.6 Flash available in US and EU multi-regions
Gemini 3.6 Flash is generally available in the us and eu multi-regions, and
an allowlist is no longer required to use Gemini 3.6 Flash in the us
multi-region.
To make Gemini 3.6 Flash available to users in the Gemini Enterprise app,
administrators must turn on the Gemini 3.6 Flash feature toggle in the
Google Cloud console.
If an administrator previously turned on the Gemini 3.6 Flash toggle for
an app in the us or eu multi-region and accepted the out-of-region routing
warning, traffic for that app automatically routes to the app's location
(us or eu). No action is required.
In regions where the model is not supported, administrators can still enable
the model by acknowledging a warning that traffic routes to the global
endpoint, which does not support regional data residency.
For more information, see:
Gemini Enterprise: Access and configure AI developer tools
AI developer tools is generally available (GA) for Gemini Enterprise Standard, Plus, and Pay-as-you-go editions with an invoiced Cloud Billing account. This launch includes access to Antigravity 2.0, Antigravity CLI, and Android Studio.
Key capabilities of AI developer tools include the following:
You can manage access to AI developer tools using a custom IAM role.
For more information, see the following:
CodeMender updates: Model support
This release introduces updates to CodeMender:
gemini-3-flash-preview) is no longer supported as a model backend for CodeMender. CodeMender supports Gemini 3.5 Flash (default) and Gemini 3.1 Pro Preview.For more information, see Specifying the model.
For node pools running on GKE versions 1.36.3-gke.1480000 and later, the minimum supported boot disk size is 15 GB. For earlier versions, the minimum supported boot disk size is 12 GB.
[Spotlight Feature] Evaluate threat coverage and generate rules with the Detection Engineering Agent
This feature is in public preview. You can now evaluate and strengthen your Google SecOps security posture against emerging threats using the Detection Engineering Agent. This AI-powered assistant helps you extract threat intelligence and automatically draft YARA-L detection rules, drastically improves time-to-value for custom security automation and accelerating risk mitigation. The agent is accessible using Model Context Protocol (MCP) tools operated by compatible AI clients (such as Google Antigravity or Claude Code). For more information, see Evaluate threat coverage with the Detection Engineering Agent.
[Spotlight Feature] Event simulation for detection coverage evaluation
This feature is in public preview. You can now programmatically deliver realistic threat sequences into the live ingestion pipeline using event simulation. Event simulation provides a full-funnel detection coverage evaluation framework embedded directly within Google SecOps, enabling detection engineering and SOC teams to verify the entire detection lifecycle—from UDM normalization to multi-event correlation and alerting—while preserving production SOC workflows.
As a core capability of the Detection Engineering Agent (DEA) architecture, event simulation connects Google SecOps MCP tools with AI assistance (such as Gemini) to automate threat intel processing, synthetic telemetry generation, and YARA-L 2.0 rule coverage evaluation.
For more information, see Use event simulation for detection coverage evaluation.
The latest versions in the Looker (Google Cloud core) release channels are beginning deployment as follows:
Google Cloud NetApp Volumes is now Canada Controlled Goods (CCG) compliant for the Standard, Premium, and Extreme service levels. For more information, see Compliance.
]]>You can now use the Model Context Protocol (MCP) Toolbox for Databases to access AlloyDB observability features and advanced query insights directly in your IDE.
The Data Boundary for Canada Controlled Goods Program (CGP) control package is now generally available.
Beginning November 1, 2026, Backup and DR will automatically apply a project-level lien to any project containing a backup vault with backups protected by enforced retention. To secure project liens against unauthorized removal and manage lien deletion securely, you can configure multi-party approval using Privileged Access Manager (PAM).
For more information, see Protect project liens by using Privileged Access Manager and Protect projects with liens.
Cloud CDN supports the targeted CDN-Cache-Control HTTP response
header RFC 9213. You can use
this header to specify caching directives specifically for Cloud CDN edge
caches without affecting browser-level caching.
For details, see Cache control header precedence.
Database Migration Service for MySQL homogeneous migrations now supports MySQL version 9.7. For more information, see Supported source and destination databases.
Support for the Advanced malware sandbox (WildFire) service is now restored. You can now use Advanced malware sandbox to perform deep inspection of network-routed file transfers and block zero-day malware before it reaches your workloads. Advanced malware sandbox is available in the Cloud Next Generation Firewall Enterprise tier.
For more information, see Advanced malware sandbox overview and Configure Advanced malware sandbox in your network. This feature is available in Preview.
If you delete your project, buckets that have soft delete enabled are now retained for a limited amount of time before being permanently deleted. If you restore a deleted project during this time period, these buckets are restored to the state that they were in when the project was deleted.
For more information about soft delete and the restoration window, see Soft delete.
The following limits associated with the Cloud Trace API,
cloudtrace.googleapis.com, have increased:
The new limits are consistent with those supported by the Telemetry API, which implements the OpenTelemetry Protocol (OTLP).
For more information, see Cloud Trace API quotas and limits.
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.18.39 | v29.4.3 | v2.3.2 | See List |
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.12.94 | v27.5.1 | v2.2.6 | See List |
Enabled CONFIG_UDMABUF on x86_64.
Enabled CONFIG_UDMABUF on x86_64.
Fixed CVE-2026-68081 in the Linux kernel.
Fixed CVE-2026-64561 in the Linux kernel.
Fixed CVE-2026-64562 in the Linux kernel.
Fixed CVE-2026-64567 in the Linux kernel.
Fixed CVE-2026-64572 in the Linux kernel.
Fixed CVE-2026-64576 in the Linux kernel.
Fixed CVE-2026-64579 in the Linux kernel.
Fixed CVE-2026-64590 in the Linux kernel.
Fixed CVE-2026-64593 in the Linux kernel.
Fixed CVE-2026-64597 in the Linux kernel.
Fixed CVE-2026-64598 in the Linux kernel.
Fixed CVE-2026-64604 in the Linux kernel.
Fixed CVE-2026-68092 in the Linux kernel.
Fixed CVE-2026-68093 in the Linux kernel.
Fixed CVE-2026-68116 in the Linux kernel.
Fixed CVE-2026-68119 in the Linux kernel.
Fixed CVE-2026-68136 in the Linux kernel.
Fixed CVE-2026-68139 in the Linux kernel.
Fixed CVE-2026-68142 in the Linux kernel.
Fixed CVE-2026-68145 in the Linux kernel.
Fixed CVE-2026-68147 in the Linux kernel.
Fixed CVE-2026-68149 in the Linux kernel.
Fixed CVE-2026-68171 in the Linux kernel.
Fixed CVE-2026-68184 in the Linux kernel.
Fixed CVE-2026-68186 in the Linux kernel.
Fixed CVE-2026-68187 in the Linux kernel.
Fixed CVE-2026-68296 in the Linux kernel.
Fixed CVE-2026-68299 in the Linux kernel.
Fixed CVE-2026-68329 in the Linux kernel.
Fixed CVE-2026-68336 in the Linux kernel.
Fixed CVE-2026-68343 in the Linux kernel.
Fixed CVE-2026-68386 in the Linux kernel.
Fixed CVE-2026-68388 in the Linux kernel.
Fixed CVE-2026-68396 in the Linux kernel.
Fixed CVE-2026-68425 in the Linux kernel.
Fixed CVE-2026-68428 in the Linux kernel.
Fixed CVE-2026-68432 in the Linux kernel.
Fixed CVE-2026-68442 in the Linux kernel.
Fixed CVE-2026-68450 in the Linux kernel.
Runtime sysctl changes:
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.12.94 | v27.5.1 | v2.1.9 | See List |
Enabled CONFIG_UDMABUF on x86_64.
Fixed CVE-2026-64380 in the Linux kernel.
Fixed CVE-2026-64561 in the Linux kernel.
Fixed CVE-2026-64562 in the Linux kernel.
Fixed CVE-2026-64567 in the Linux kernel.
Fixed CVE-2026-64572 in the Linux kernel.
Fixed CVE-2026-64576 in the Linux kernel.
Fixed CVE-2026-64579 in the Linux kernel.
Fixed CVE-2026-64580 in the Linux kernel.
Fixed CVE-2026-64590 in the Linux kernel.
Fixed CVE-2026-64593 in the Linux kernel.
Fixed CVE-2026-64597 in the Linux kernel.
Fixed CVE-2026-64598 in the Linux kernel.
Fixed CVE-2026-64604 in the Linux kernel.
Fixed CVE-2026-68092 in the Linux kernel.
Fixed CVE-2026-68119 in the Linux kernel.
Fixed CVE-2026-68136 in the Linux kernel.
Fixed CVE-2026-68142 in the Linux kernel.
Fixed CVE-2026-68145 in the Linux kernel.
Fixed CVE-2026-68146 in the Linux kernel.
Fixed CVE-2026-68147 in the Linux kernel.
Fixed CVE-2026-68149 in the Linux kernel.
Fixed CVE-2026-68184 in the Linux kernel.
Fixed CVE-2026-68186 in the Linux kernel.
Fixed CVE-2026-68187 in the Linux kernel.
Fixed CVE-2026-68284 in the Linux kernel.
Fixed CVE-2026-68338 in the Linux kernel.
Fixed CVE-2026-68388 in the Linux kernel.
Fixed CVE-2026-68396 in the Linux kernel.
Fixed CVE-2026-68398 in the Linux kernel.
Fixed CVE-2026-68422 in the Linux kernel.
Fixed CVE-2026-68425 in the Linux kernel.
Fixed CVE-2026-68428 in the Linux kernel.
Fixed CVE-2026-68432 in the Linux kernel.
Fixed CVE-2026-68442 in the Linux kernel.
Fixed CVE-2026-68450 in the Linux kernel.
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.6.143 | v27.5.1 | v2.0.10 | See List |
Fixed CVE-2026-64561 in the Linux kernel.
Fixed CVE-2026-64562 in the Linux kernel.
Fixed CVE-2026-64572 in the Linux kernel.
Fixed CVE-2026-64576 in the Linux kernel.
Fixed CVE-2026-64579 in the Linux kernel.
Fixed CVE-2026-64580 in the Linux kernel.
Fixed CVE-2026-64597 in the Linux kernel.
Fixed CVE-2026-64598 in the Linux kernel.
Fixed CVE-2026-64604 in the Linux kernel.
Fixed CVE-2026-68093 in the Linux kernel.
Fixed CVE-2026-68116 in the Linux kernel.
Fixed CVE-2026-68147 in the Linux kernel.
Fixed CVE-2026-68184 in the Linux kernel.
Fixed CVE-2026-68186 in the Linux kernel.
Fixed CVE-2026-68187 in the Linux kernel.
Fixed CVE-2026-68284 in the Linux kernel.
Fixed CVE-2026-68325 in the Linux kernel.
Fixed CVE-2026-68336 in the Linux kernel.
Fixed CVE-2026-68338 in the Linux kernel.
Fixed CVE-2026-68343 in the Linux kernel.
Fixed CVE-2026-68386 in the Linux kernel.
Fixed CVE-2026-68398 in the Linux kernel.
Fixed CVE-2026-68425 in the Linux kernel.
Fixed CVE-2026-68428 in the Linux kernel.
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.6.143 | v24.0.9 | v1.7.34 | See List |
Fixed CVE-2026-64227 in the Linux kernel.
Fixed CVE-2026-64476 in the Linux kernel.
Fixed CVE-2026-64561 in the Linux kernel.
Fixed CVE-2026-64562 in the Linux kernel.
Fixed CVE-2026-64572 in the Linux kernel.
Fixed CVE-2026-64576 in the Linux kernel.
Fixed CVE-2026-64579 in the Linux kernel.
Fixed CVE-2026-64580 in the Linux kernel.
Fixed CVE-2026-64597 in the Linux kernel.
Fixed CVE-2026-64598 in the Linux kernel.
Fixed CVE-2026-64604 in the Linux kernel.
Fixed CVE-2026-68093 in the Linux kernel.
Fixed CVE-2026-68184 in the Linux kernel.
Fixed CVE-2026-68186 in the Linux kernel.
Fixed CVE-2026-68187 in the Linux kernel.
Fixed CVE-2026-68284 in the Linux kernel.
Fixed CVE-2026-68299 in the Linux kernel.
Fixed CVE-2026-68329 in the Linux kernel.
Fixed CVE-2026-68336 in the Linux kernel.
Fixed CVE-2026-68338 in the Linux kernel.
Fixed CVE-2026-68343 in the Linux kernel.
Fixed CVE-2026-68388 in the Linux kernel.
Fixed CVE-2026-68398 in the Linux kernel.
Fixed CVE-2026-68425 in the Linux kernel.
You can now use the Dataform remote Model Context Protocol (MCP) server to manage data transformation workflows through AI agents. This feature is generally available (GA).
Gemini Enterprise: General availability for registering A2UI and A2A agents with Gemini Enterprise, including A2UI version v0.9 support
Gemini Enterprise administrators can register and manage agents using Agent to UI (A2UI) to build custom interfaces and the Agent2Agent (A2A) Protocol for communication with Gemini Enterprise.
With this release:
For more information, see:
Looker's Continuous Integration is based on the legacy standalone Spectacles service. Looker will continue to integrate and evolve the Spectacles features into Looker's Continuous Integration, and the legacy standalone Spectacles service itself will be discontinued starting November 30, 2026. Existing Spectacles customers will receive an email with details. If you have any questions or require assistance, please contact us at spectacles-support@google.com.
]]>Updated the bundled Ruby gems rexml and net-imap to patched versions, addressing known vulnerabilities.
Updated aiohttp, joblib and cryptography to patched versions, addressing known vulnerabilities including CVE-2022-21797 and CVE-2025-69223.
Installed latest packages from upstream dependencies.
Updated the CUDA base image from 12.8.1 to 12.9.2 (CUDA 12.9, cuDNN 9.10). This is a minor CUDA 12 update, binary compatible with the previous image, and also addresses known vulnerabilities in a bundled NVIDIA profiler component.
Updated the bundled Ruby gems rexml and net-imap to patched versions, addressing known vulnerabilities.
Removed the JupyterLab 3 environment from the Python 3.12 custom container; JupyterLab 4 is now the only JupyterLab environment and is always used. The Python 3.10 images are unaffected.
Updated aiohttp, joblib and cryptography to patched versions, addressing known vulnerabilities including CVE-2022-21797 and CVE-2025-69223.
Installed latest packages from upstream dependencies.
Installed latest packages from upstream dependencies.
Installed latest packages from upstream dependencies.
Installed latest packages from upstream dependencies.
Installed latest packages from upstream dependencies.
Fixed the Git panel's grayed out buttons, which were disabled due to an issue with the Jupyter Lab's Git plugin introduced in version 0.54.0.
Release 6.3.98 is being rolled out to the first phase of regions as listed here.
This release contains internal and customer bug fixes.
]]>Monitor semantic governance policies with built-in metrics (Preview)
Built-in Cloud Monitoring metrics for the semantic governance policy engine
are available in Preview. You can now observe request throughput, evaluation
counts, latencies, verdict distribution (ALLOW versus DENY), and LLM
token consumption for the policy engine directly in
Metrics Explorer, query them through
the Cloud Monitoring v3 API and PromQL, and use them in alerting policies.
For more information, see Monitor semantic governance policies.
AlphaFold 3 is generally available
AlphaFold 3 is now generally available (GA) and available for approved users for commercial research use.
AlphaFold 3 Google DeepMind's and Isomorphic Labs' deep learning model to predict the 3D structures and interactions of proteins, DNA, RNA, ligands, and ions. For more information, see AlphaFold 3.
Release 6.3.97 is now available for all regions.
The Secure Source Manager Model Context Protocol (MCP) server is available in Preview. You can use the Secure Source Manager MCP server to connect AI tools and coding assistants directly to your repositories, branch rules, pull requests, and issues.
For more information, see the Secure Source Manager MCP reference.
]]>To improve security, starting in August 2026, App Engine opts your application into TLS version 1.2 and later. You can opt out until the end of August 2026. Starting in September 2026, App Engine might permanently block insecure traffic with TLS version 1.1 and earlier. For more information, see Secure minimum TLS.
To improve security, starting in August 2026, App Engine opts your application into TLS version 1.2 and later. You can opt out until the end of August 2026. Starting in September 2026, App Engine might permanently block insecure traffic with TLS version 1.1 and earlier. For more information, see Secure minimum TLS.
To improve security, starting in August 2026, App Engine opts your application into TLS version 1.2 and later. You can opt out until the end of August 2026. Starting in September 2026, App Engine might permanently block insecure traffic with TLS version 1.1 and earlier. For more information, see Secure minimum TLS.
To improve security, starting in August 2026, App Engine opts your application into TLS version 1.2 and later. You can opt out until the end of August 2026. Starting in September 2026, App Engine might permanently block insecure traffic with TLS version 1.1 and earlier. For more information, see Secure minimum TLS.
To improve security, starting in August 2026, App Engine opts your application into TLS version 1.2 and later. You can opt out until the end of August 2026. Starting in September 2026, App Engine might permanently block insecure traffic with TLS version 1.1 and earlier. For more information, see Secure minimum TLS.
To improve security, starting in August 2026, App Engine opts your application into TLS version 1.2 and later. You can opt out until the end of August 2026. Starting in September 2026, App Engine might permanently block insecure traffic with TLS version 1.1 and earlier. For more information, see Secure minimum TLS.
To improve security, starting in August 2026, App Engine opts your application into TLS version 1.2 and later. You can opt out until the end of August 2026. Starting in September 2026, App Engine might permanently block insecure traffic with TLS version 1.1 and earlier. For more information, see Secure minimum TLS.
To improve security, starting in August 2026, App Engine opts your application into TLS version 1.2 and later. You can opt out until the end of August 2026. Starting in September 2026, App Engine might permanently block insecure traffic with TLS version 1.1 and earlier. For more information, see Secure minimum TLS.
To improve security, starting in August 2026, App Engine opts your application into TLS version 1.2 and later. You can opt out until the end of August 2026. Starting in September 2026, App Engine might permanently block insecure traffic with TLS version 1.1 and earlier. For more information, see Secure minimum TLS.
To improve security, starting in August 2026, App Engine opts your application into TLS version 1.2 and later. You can opt out until the end of August 2026. Starting in September 2026, App Engine might permanently block insecure traffic with TLS version 1.1 and earlier. For more information, see Secure minimum TLS.
To improve security, starting in August 2026, App Engine opts your application into TLS version 1.2 and later. You can opt out until the end of August 2026. Starting in September 2026, App Engine might permanently block insecure traffic with TLS version 1.1 and earlier. For more information, see Secure minimum TLS.
To improve security, starting in August 2026, App Engine opts your application into TLS version 1.2 and later. You can opt out until the end of August 2026. Starting in September 2026, App Engine might permanently block insecure traffic with TLS version 1.1 and earlier. For more information, see Secure minimum TLS.
To improve security, starting in August 2026, App Engine opts your application into TLS version 1.2 and later. You can opt out until the end of August 2026. Starting in September 2026, App Engine might permanently block insecure traffic with TLS version 1.1 and earlier. For more information, see Secure minimum TLS.
To improve security, starting in August 2026, App Engine opts your application into TLS version 1.2 and later. You can opt out until the end of August 2026. Starting in September 2026, App Engine might permanently block insecure traffic with TLS version 1.1 and earlier. For more information, see Secure minimum TLS.
As detailed in our 2026 Environmental Report (p. 22), Google is now using Granular Certificates purchased from the marketplace to strategically match more of our load on an hourly basis. To accurately incorporate these certificates into the Cloud customers' allocation of carbon intensity calculations, the July 2026 semi-annual methodology refresh will be delayed by one month. We will provide further updates once the revised data is available.
The Telemetry API for logs ingestion is generally available (GA). You can ingest OTLP logs into Cloud Logging by using an OpenTelemetry Collector, an OTLP exporter, and the Telemetry API. For more information, see OTLP ingestion overview.
Generally available: You can use zonal and global extension policies in VM Extension Manager to automatically install and manage extensions, such as the Ops Agent, on a fleet of VMs and to ensure consistent extension states across your project.
To improve observability of enforcement states and guest agent activities, you can view VM extension logs by using Cloud Logging. These logs help you identify and troubleshoot issues with VM extensions.
For more information, see About VM Extension Manager.
SapBdcProductBuilder incorrectly enforced SAP-versioned sections (ecc, s4, common) in table_settings.Developer Connect insights is now generally available.
VPC Service Controls support for Developer Connect is generally available. For instructions on using this feature, see Using VPC Service Controls.
Gemini Enterprise: Gemini 3.7 Flash available in the mobile app
Gemini 3.7 Flash is generally available (GA) in the Gemini Enterprise mobile app. Mobile app users can select and use the Gemini 3.7 Flash model for their conversations within the app. To make the model available, administrators must turn on the Gemini 3.7 Flash feature toggle in the Google Cloud console.
For more information, see:
GKE cluster versions have been updated.
New versions available for upgrades and new clusters.
The following versions are now available for new GKE clusters, and for manual control plane upgrades and node upgrades for existing clusters. For more information about versioning and upgrades, see GKE versioning and support and About GKE cluster upgrades.
This release includes new GKE versions that use updated Container-Optimized OS images. These updated images are cumulative, incorporating security fixes from all Container-Optimized OS versions released since the previous GKE release.
To identify the specific vulnerabilities that were resolved in each updated Container-Optimized OS image, see the Security release notes for that image. The following table includes links to the release notes for each updated Container-Optimized OS image:
| GKE version | Container-Optimized OS version | Details |
|---|---|---|
| 1.31.14-gke.2579000 | cos-117-18613-675-37 | cos-117-18613-675-37 release notes |
| 1.32.13-gke.2268000 | cos-117-18613-675-37 | cos-117-18613-675-37 release notes |
| 1.33.13-gke.1462000 | cos-121-18867-528-36 | cos-121-18867-528-36 release notes |
| 1.35.7-gke.1150000 | cos-125-19216-532-62 | cos-125-19216-532-62 release notes |
| 1.37.0-gke.1173000+preview | cos-129-19506-299-60 | cos-129-19506-299-60 release notes |
[Spotlight Feature] Monitor your data latency with the Health Hub
This feature is in public preview. The Health Hub now includes two new tables to track the ingestion latency at both the source level and the log-type level. In addition, you can select a specific source or log type to open the Data Health Deep Dive page and view detailed information about ingestion latency. For more information, see Monitor health of data sources.
Key capabilities include:
You can use custom constraints with Organization Policy to provide more
granular control over specific fields for Agent Identity resources, such as
agentidentity.googleapis.com/AuthProvider. For more information, see
Use custom organization policies for Agent Identity.
This feature is in
GA.
Agent Identity VPC Service Controls (VPC Service Controls) integration is generally available.
You can add the Agent Identity API (agentidentity.googleapis.com) and Agent Identity Credentials API (agentidentitycredentials.googleapis.com) to a service perimeter and specify agent identities in ingress and egress rules.
For more information, see Agent Identity overview.
Policy Controller version 1.24.1 is now available.
Generally available (GA) support for the following integrations:
General availability support for the following integration:
]]>On August 13th, 2026, we began maintenance updates of Apigee instances configured for maintenance windows.
If you set a preferred window for maintenance for your instance, and your instance version is below 1-18-0-apigee-2, your instance will be updated to 1-18-0-apigee-2 within the next seven to 21 days. A notification containing the expected date of upgrade will be sent within the next two business days.
For more information on participating in scheduled maintenance windows, see Maintenance overview and Manage Apigee instance maintenance windows.
On August 13th, 2026, we released an updated version of Apigee (1-18-0-apigee-3).
| Bug ID | Description |
|---|---|
| 532147587 | To fix forward proxy support. |
| 537657987 | Fixed a bug where watcher failed to reconcile all routes if an environment was not found in the control plane. |
| 543022076 | Google Cloud BOM upgrade (protobuf 4.x, gRPC 1.81, Guava 33.5). One user-visible change: a malformed inbound gRPC request frame is now reported to the client as grpc-status INTERNAL(13) and recorded in analytics as x-apigee.grpc.status=13, where it was previously an Apigee ServiceUnavailable fault seen as UNAVAILABLE(14) with no x-apigee.grpc.status recorded. Otherwise no user facing impact, but any prod issue related to gcp, protobuf or gRPC may relate to this. |
| 542242046 | Fixed LLMTokenQuota metering the request against an arbitrary quota bucket when the API Product declared multiple models and the request carried no model. |
| 531731614 | Apigee analytics fields ai_llm_response_token_count, ai_llm_prompt_token_count, ai_llm_model_name, and ai_llm_model_provider are available in the Custom Report when LLMTokenQuota and PromptTokenLimit policies are used in Apigee proxies. |
| 492044413 | LLMTokenQuota resolves the model from the API Product LLM Operation when LLMModelSource is omitted and the request body has no model field. |
| 67169710 | Adds an opt-in <DynamicClientIdSupported> boolean XML element to the OAuthV2 policy. When true, AbstractOAuthStepExecution.extractClientDetails() preserves any non-empty ClientID/ClientSecret already present on the OAuthClientContext. |
| 531731614 | Apigee auto identifies the providers and publishes them to analytics. |
| 537396574 | Added feature to rotate the apigee-ca certificate. |
| 540861752 | Aligned the ApigeeDeployment conversion hub with its v1alpha3 storage version. Internal change; no effect on existing ApigeeDeployment resources. |
| 540861752 | Aligned the ApigeeDeployment custom resource's conversion hub with its v1alpha3 storage version. This internal change does not affect existing ApigeeDeployment resources. |
| N/A | Updates to infrastructure and libraries. |
| Bug ID | Description |
|---|---|
| 535928300 | Security fix for Apigee. Fixed a security issue in JWT refresh token revocation handling. |
| 539515020 | Security fix for Apigee. Fixed a security issue in the MessageValidation policy. |
| 535928530 | Security fix for Apigee. Fixed a security issue in the OAuthV2 policy. |
| 535683286 | Security fix for Apigee. Fixed a security issue in HTTP target interim-response handling. |
| N/A | Security fix for Apigee infrastructure. |
You can now configure scheduled, application-consistent backups and point-in-time recovery (PITR) workflows for self-managed databases (including IBM Db2, SAP HANA, SAP ASE, SAP IQ, SAP MaxDB, PostgreSQL, MySQL, and MariaDB) running on Compute Engine Linux instances.
This feature uses the bring-your-own-script guest-flush framework to quiesce the database before snapshot creation, ensuring transaction consistency and eliminating data corruption risks. Additionally, you can configure dedicated Persistent Disk backups for database archive logs to enable point-in-time recovery.
For more information, see Configure application-consistent backups.
BigQuery pipelines now support automated metadata enrichment, allowing you to define semantic metadata directly in SQLX configurations for synchronization with Knowledge Catalog. In addition, the Data Engineering Agent proactively generates this metadata based on your intent or context. For more information, see Metadata enrichment and data quality scorecard integration. This feature is in Preview.
Cloud SQL for MySQL 9.7 is generally available (GA).
For more information about the differences between MySQL 9.7 and previous versions, review the MySQL 9.7 Release Notes.
By default, if you specify MySQL 9.7 as the version when you create a Cloud SQL instance (either primary or replica) using the gcloud CLI, the Google Cloud console, or the REST API, then the Cloud SQL edition is Cloud SQL Enterprise Plus edition.
This release introduces support for key MySQL 9.7 capabilities, including:
Additionally, this release introduces several database flag changes.
| MySQL database flag | Action | Details |
|---|---|---|
activate_mandatory_roles |
Added / Supported | Exposes mandatory roles configuration. Default is ON. |
innodb_native_foreign_keys |
Added / Supported | Exposes SQL layer foreign key handling configuration. |
table_open_cache_triggers |
Added / Supported | Configures trigger cache size limits. |
connection_memory_status_limit |
Added / Supported | Sets limit configurations on connection memory. |
global_connection_memory_status_limit |
Added / Supported | Sets global limit configurations on connection memory. |
performance_schema_max_logger_classes |
Added / Supported | Sets limits for performance schema logger classes. |
caching_sha2_password_proxy_users |
Added / Supported | Configures proxy users support for caching SHA-2. |
caching_sha2_password_enforce_storage_format |
Added / Supported | Enforces storage format rules for caching SHA-2. |
caching_sha2_password_storage_format |
Added / Supported | Sets storage format defaults for caching SHA-2. |
innodb_log_file_size |
Removed | Flag not supported in MySQL 9.7 and later. |
innodb_log_files_in_group |
Removed | Flag not supported in MySQL 9.7 and later. |
innodb_undo_tablespaces |
Removed | Flag not supported in MySQL 9.7 and later. |
mysql_native_password_proxy_users |
Removed | Flag not supported in MySQL 9.7 and later. |
replica_parallel_type |
Removed | Flag not supported in MySQL 9.7 and later. |
slave_parallel_type |
Removed | Flag not supported in MySQL 9.7 and later. |
temptable_use_mmap |
Removed | Flag not supported in MySQL 9.7 and later. |
For more information about MySQL database flags, see Configure database flags.
Cluster Toolkit v1.100.0 is available. This release adds the
--gke-namespace flag to enable namespace-aware operations, enables sauth by
default in the Slurm module, and removes topology labels from the nodeLabels resources in Kueue
ResourceFlavor objects. For details, see the release announcement on
GitHub.
The following features are rolling out over the next week.
Fullscreen charts
You can view individual charts in fullscreen mode. Click the fullscreen button in the chart header to expand the chart. This feature is not available for scorecards and gauge charts.
Rotate components
You can rotate text boxes, images, and shapes in Data Studio. Report creators can rotate these components on a non-responsive canvas and can reset the rotation to 0 degrees.
Center labels on stacked bar charts
You can position labels in the center of stacked bar charts. If insufficient space is available to center the label within the bar, the label is displayed outside the bar.
For more information, see the Bar chart and column chart reference.
Search for settings
You can search for settings in the Setup and Style tabs of the properties panel.
Copy chart as image
You can copy a chart as a PNG image to your clipboard.
Bubble chart border color
You can modify the border color of bubbles in bubble charts.
Dataform workflows and BigQuery pipelines now support automated metadata enrichment for BigQuery tables and views, allowing you to define semantic metadata directly in SQLX configurations for synchronization with the Knowledge Catalog. For more information, see Add metadata for Knowledge Catalog. This feature is in Preview.
Error Reporting can report stack traces collected from Rust applications
using std::backtrace.
To enable, set the RUST_BACKTRACE=1 environment variable and
make sure debug symbols are enabled.
For more information, see ReportedErrorEvent.
Gemini Enterprise: Create, upload, and share custom skills
Skills are reusable custom instructions that help the Gemini Enterprise assistant perform specific tasks. End users can create, upload, and share skills. To enable this feature, administrators must turn on the skills and skill-sharing settings in Feature Management. Administrators can also configure skill availability and approve skill-sharing requests.
This feature is generally available (GA). For more information, see the following:
Gemini Enterprise: Use Gemini 3.7 Flash
Gemini 3.7 Flash is generally available (GA) in the global, us, and eu
regions. To make Gemini 3.7 Flash available to users in the Gemini Enterprise
app, administrators must turn on the Gemini 3.7 Flash feature toggle in the
Google Cloud console.
For in-country regions where the model isn't supported, administrators
can still enable the model by confirming a warning that traffic is routed
to the global endpoint, which doesn't support regional data residency.
Gemini 3.7 Flash is also available in Agent Designer workflow agents. Updates take up to a day to appear in workflow agents.
For more information, see:
Gemini Enterprise: Gemini 3.7 Flash availability in mobile app
Gemini 3.7 Flash is not available in the Gemini Enterprise mobile app. A new release note will be added when the Gemini 3.7 Flash rollout for the Gemini Enterprise mobile app is complete.
Gemini 3.7 Flash is generally available
Gemini 3.7 Flash is now generally available (GA) and available for production use.
For more information on 3.7 Flash, see the model page.
Agent Runtime: ADK telemetry metrics
Agents deployed to Agent Runtime with Agent Development Kit (ADK) 2.6.0 or later
can emit gen_ai application metrics that follow OpenTelemetry's generative AI
semantic conventions. Set the GOOGLE_CLOUD_AGENT_ENGINE_ENABLE_TELEMETRY
environment variable to export these metrics to Cloud Monitoring as
user-defined metrics, alongside agent traces and logs.
For more information, see Set up monitoring.
Scheduled Maintenance
SOAR database and infrastructure maintenance is scheduled to take place during the standard maintenance window on Sunday, August 16. During this window, your system will experience a brief period of downtime. No customer action is required.
Scheduled Maintenance
SOAR database and infrastructure maintenance is scheduled to take place during the standard maintenance window on Sunday, August 16. During this window, your system will experience a brief period of downtime. No customer action is required.
You can migrate workloads from self-managed Redis and Valkey instances running on Google Cloud to Memorystore for Valkey. This feature is Generally Available.
AI Protection supports data residency in the Kingdom of Saudi Arabia (KSA) for all Security Command Center service tiers.
For more information, see Planning for data residency.
The ANTHROPIC_API_KEY, GEMINI_API_KEY, and OPENAI_API_KEY infoType detectors are available in all regions. For more information about all built-in infoTypes, see the InfoType detector reference.
VPC Service Controls feature (Status: Preview): Support for optimizing service perimeters using the VPC Service Controls recommender is available.
The recommender detects architectural risks and perimeter misconfigurations, including the following:
Critical resources at risk of exfiltration: Identifies active and sensitive services (such as BigQuery and Cloud Storage) operating outside service perimeters.
Unconfigured VPC accessible services: Identifies perimeters that leave APIs unrestricted from within the security boundary.
Misconfigured VPC accessible services: Identifies mismatches between allowed accessible APIs and restricted services inside a perimeter.
For more information, see Optimize perimeters with recommender.
Agent Search: Gemini 3.5 Flash answer generation
You can generate answers with the Gemini 3.5 Flash model.
For more information, see Answer generation model versions and lifecycle and Gemini 3.5 Flash.
]]>Agent Identity is generally available (GA).
Agent Identity is generally available (GA).
Configure and deploy MCP servers with gcloud CLI
You can use the gcloud apihub locations configure-and-deploy-server command to configure and deploy API hub Model Context Protocol (MCP) servers to an attached Apigee runtime.
Define MCP tools inline or by referencing a YAML or JSON specification file to expose your API hub operations for agent integrations.
For more information, see gcloud CLI for API hub.
Table Explorer behavior has moved to the Reference panel. Table Explorer has been deprecated. For more information, see "Use the Reference panel" in Run a query.
You can use parameterized views in Bigtable to dynamically filter data ranges for logical views based on application context and mitigate SQL injection risks. This feature is generally available (GA). For more information, see Parameterized views overview.
You can use the CLUSTER_ATTRIBUTE() filter to restrict continuous materialized
view processing to specific clusters. This function lets you isolate views
within an instance. This feature is generally available (GA).
For more information, see Non-deterministic SQL functions.
The following remote MCP servers automatically generate a trace span for
tools/call operations. These spans can help you understand the behavior of
your agentic applications. For more information, see
Investigate MCP calls using Trace.
Google Cloud Observability automatically generates trace exemplars for charts on custom dashboards that display the result of a SQL query when the query runs against your trace data and satisfies some constraints. The exemplars link the SQL query result to specific traces. This feature is in Preview.
For more information, see Generate and display trace exemplars.
Cloud Workstations supports Compute Engine suspend and resume in Preview. You can configure workstation VMs to suspend when they reach their idle timeouts, referred to as auto-sleep in the Google Cloud Console, rather than shutting down and deleting the VM, by using the IdleAction workstation configuration setting.
Generally available: The U4 Ultra Low Latency (ULL) network-optimized machine family is generally available with allowlist for ULL Solution customers. Designed for financial exchange ecosystems, the U4 machine family provides industry-specific networking capabilities and ultra-low latency unicast and multicast communication. All U4 instances leverage Google's Titanium IPU.
The U4 machine family includes the following machine series:
For more information, see the U4 machine family overview in the ULL Solution documentation.
Gemini Enterprise: GitHub connector with data federation
The GitHub connector with data federation is generally available (GA) in Gemini Enterprise. The connector lets you search and act on GitHub repositories, issues, and pull requests directly from the Gemini Enterprise agent, with tool actions such as creating branches, adding issue comments, merging pull requests, and pushing files.
For more information, see the Connect GitHub with data federation documentation.
Gemini Enterprise: AlphaEvolve HPC solution
The AlphaEvolve HPC solution provides a distributed, containerized infrastructure for running large-scale evolutionary code optimization experiments on Google Cloud. If your evaluations require specialized hardware or exceed the resource limits of a single machine, use the AlphaEvolve HPC solution.
For more information, see AlphaEvolve for HPC use cases.
CodeMender CLI: Sandbox enabled by default
This release updates the CodeMender CLI default behavior:
config.yaml, by passing --sandbox=false to CLI commands, or bypass it using the --unrestricted flag.For more information, see Install the CLI and configure.
GKE cluster versions have been updated.
New versions available for upgrades and new clusters.
The following versions are now available for new GKE clusters, and for manual control plane upgrades and node upgrades for existing clusters. For more information about versioning and upgrades, see GKE versioning and support and About GKE cluster upgrades.
This release includes new GKE versions that use updated Container-Optimized OS images. These updated images are cumulative, incorporating security fixes from all Container-Optimized OS versions released since the previous GKE release.
To identify the specific vulnerabilities that were resolved in each updated Container-Optimized OS image, see the Security release notes for that image. The following table includes links to the release notes for each updated Container-Optimized OS image:
| GKE version | Container-Optimized OS version | Details |
|---|---|---|
| 1.31.14-gke.2543000 | cos-117-18613-675-28 | cos-117-18613-675-28 release notes |
| 1.32.13-gke.2231000 | cos-117-18613-675-28 | cos-117-18613-675-28 release notes |
| 1.33.13-gke.1414000 | cos-121-18867-528-21 | cos-121-18867-528-21 release notes |
| 1.34.10-gke.1079000 | cos-125-19216-532-42 | cos-125-19216-532-42 release notes |
| 1.35.7-gke.1027000 | cos-125-19216-532-25 | cos-125-19216-532-25 release notes |
| 1.36.3-gke.1244000 | cos-129-19506-299-60 | cos-129-19506-299-60 release notes |
[Spotlight Feature] Analyze feed activity with Cloud Logging
This feature is in public preview. To use this feature, your Google SecOps instance must be configured with a Bring Your Own Project (BYOP) Google Cloud project. You can now monitor, debug, and troubleshoot Google SecOps ingestion pipelines and feeds using Cloud Logging. By sending, viewing, and querying ingestion and feed activity logs in the Logs Explorer, you can diagnose log delivery issues, such as, missing, delayed, or failing logs, and decrease the time required to resolve ingestion anomalies.
This visibility into push- and pull-based ingestion mechanisms provides the following capabilities:
For more information, see Analyze feed activity with Cloud Logging.
CyberArk Credential Provider: Version 5.0
The following new job has been added:
Microsoft Graph Mail: Version 45.0
The following new actions have been added:
Microsoft Graph Mail Delegated: Version 22.0
The following new actions have been added:
Active Directory: Version 45.0
Fixed an issue in the following action where entity properties were incorrectly reset on update:
AWS WAF: Version 14.0
Cisco Umbrella: Version 21.0
Fixed an issue in the following action where entity attachment failed due to a bytes object serialization error:
CrowdStrike Falcon: Version 81.0
Added the ability to use device IDs as input parameters in the following actions:
Enrichment
Fixed an issue in the following action where unsupported entity types were selected during enrichment:
GitSync
Fixed an issue in the following action where the Include Playbook Blocks parameter was ignored when a folder allowlist was used:
Microsoft 365 Defender: Version 30.0
Added support for GCC High tenants by dynamically constructing API token scopes and adding a configurable API Root parameter in the following connector:
Improved error handling and alert processing mechanisms in the following job:
Microsoft Graph Mail: Version 45.0
Fixed an issue in the following action where an unhandled exception occurred when a user mailbox was not found:
Microsoft Graph Mail Delegated: Version 22.0
Fixed an issue in the following action where an unhandled exception occurred when a user mailbox was not found:
[Spotlight Feature] Analyze feed activity with Cloud Logging
This feature is in public preview. To use this feature, your Google SecOps instance must be configured with a Bring Your Own Project (BYOP) Google Cloud project. You can now monitor, debug, and troubleshoot Google SecOps SIEM ingestion pipelines and feeds using Cloud Logging. By sending, viewing, and querying ingestion and feed activity logs in Logs Explorer, you can diagnose log delivery issues, such as, missing, delayed, or failing logs, and decrease the time required to resolve ingestion anomalies.
This visibility into push- and pull-based ingestion mechanisms provides the following capabilities:
For more information, see Analyze feed activity with Cloud Logging.
The workflow for creating workforce identity pool providers in the Google Cloud console changed. After submitting the initial provider configuration, the console directs you to a centralized page to configure provider attributes, including attribute mappings, attribute conditions, and extra attributes.
For more information, see Manage workforce identity pools and providers.
Key updates in these runtime versions include:
2.3 runtime:
1.49 to support lineage for tables created using the Lakehouse Runtime catalog.Connectivity Tests supports using a Cloud Run job as a source endpoint for connectivity testing.
For more information, see Test from a Cloud Run job to a destination.
Parameter Manager enforces the location organization policy
(constraints/gcp.resourceLocations) on resources in the global location.
If your organization policy restricts allowed resource locations, you must
explicitly allow the global location in the policy. Otherwise, attempts to
create global resources fail.
This helps ensure that Parameter Manager consistently applies the location organization policy checks to global resources.
For more information, see Defining resource locations.
]]>Datastream is generally available (GA).
Datastream is generally available (GA).
On August 11, 2026 we released an updated version of the Apigee hybrid software, v1.16.9.
| Bug ID | Description |
|---|---|
| 514973778 | Fixed an issue where the SanitizeUserPrompt and SanitizeModelResponse policies failed to tolerate unknown fields while parsing responses from the Model Armor Service. |
| 543171828 | Fixed an issue where the apigee-logger DaemonSet failed to schedule on cluster nodes without custom node labels due to a default logger.nodeSelector in the Helm chart. |
Various security and CVE fixes are included in this release.
Query templates for data clean rooms are generally available (GA). Query templates allow data clean room owners and publishers to share predefined queries without exposing the underlying tables and views.
Additionally,
table parameters
in table-valued functions (TVFs) are
generally available
(GA). You can use the ANY TABLE type as a table parameter to create
generic functions that accept tables of any structure.
Cloud Run NVIDIA L4 GPU driver version 580.x.x is available for services, jobs, and worker pools.
The Cloud SQL remote MCP server now supports specialized endpoint URLs (toolsets) for /readonly, /instance_manage, and /query_execution. Specialized toolset URLs let you restrict the set of exposed MCP tools based on your security and workflow requirements.
For more information, see Available toolsets.
You can now use the create_instance tool in the Cloud SQL remote MCP server to provision free trial instances for testing and development by setting the free_trial parameter to true.
For more information, see Create a free trial instance.
When executing SQL queries using the execute_sql or execute_sql_readonly tool, setting the sql_commenter_enabled parameter to true automatically appends sqlcommenter tags (mcp.tool, mcp.server, user.identity, mcp.client) to SQL statements for enhanced database observability.
For more information, see sqlcommenter tags.
The Cloud SQL remote MCP server now supports specialized endpoint URLs (toolsets) for /readonly, /instance_manage, and /query_execution. Specialized toolset URLs let you restrict the set of exposed MCP tools based on your security and workflow requirements.
For more information, see Available toolsets.
You can now use the create_instance tool in the Cloud SQL remote MCP server to provision free trial instances for testing and development by setting the free_trial parameter to true.
For more information, see Create a free trial instance.
When executing SQL queries using the execute_sql or execute_sql_readonly tool, setting the sql_commenter_enabled parameter to true automatically appends sqlcommenter tags (mcp.tool, mcp.server, user.identity, mcp.client) to SQL statements for enhanced database observability.
For more information, see sqlcommenter tags.
You can now use the update_user tool in the Cloud SQL remote MCP server to update passwords for Cloud SQL for SQL Server database users.
For more information, see Available tools.
The Cloud SQL remote MCP server now supports specialized endpoint URLs (toolsets)
for /readonly and /instance_manage. Specialized toolset URLs let you restrict
the set of exposed MCP tools based on your security and workflow requirements.
For more information, see Available toolsets.
Generally available: Compute flexible committed use discounts (CUDs) are available for G2 and G4 GPU accelerator-optimized machine series. The supported resources include vCPUs, memory, Local SSD disks, and GPUs.
Compute flexible CUDs are spend-based CUDs that apply to eligible Google Cloud spend across Compute Engine, GKE, and Cloud Run. For G2 and G4 machine series, compute flexible commitments provide the flexibility to switch between eligible machine series and regions depending on your workload needs. For GPUs that belong to these machine series, compute flexible commitments don't require attached reservations.
For more information, see Compute flexible CUDs.
A vulnerability (CVE-2026-6726) in the Trusted Computing Group's TPM 2.0 reference implementation code was discovered and is being addressed. For more information, see the GCP-2026-054 security bulletin.
A vulnerability affecting Intel TDX firmware was discovered and is being addressed. For more information, see the GCP-2026-053 security bulletin.
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.18.39 | v29.4.3 | v2.3.2 | See List |
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.12.94 | v27.5.1 | v2.2.6 | See List |
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.18.41 | v29.4.3 | v2.3.2 | See List |
Added support for installing the Vast 4.5.8 NFS client drivers with cos-dkms.
Added kernel patch to reduce bcache garbage collection sleep interval to prevent I/O stalls.
Added support for installing the Vast 4.5.8 NFS client drivers with cos-dkms.
Added kernel patch to reduce bcache garbage collection sleep interval to prevent I/O stalls.
Fixed CVE-2026-33186 in google-guest-agent.
Added kernel patch to reduce bcache garbage collection sleep interval to prevent I/O stalls.
Mask nfttables-restore.service to address time to ssh regression.
Fixed CVE-2026-64227 in the Linux kernel.
Mask nfttables-restore.service to address time to ssh regression.
Fixed KCTF-8173f7e in the Linux Kernel.
Fixed CVE-2026-64279 in the Linux kernel.
Updated app-admin/node-problem-detector to v0.8.25.
Fixed CVE-2026-64286 in the Linux kernel.
Fixed KCTF-8173f7e in the Linux Kernel.
Fixed CVE-2026-64287 in the Linux kernel.
Upgraded net-libs/nghttp2 to 1.69.0 and fixed CVE-2026-58055.
Fixed CVE-2026-64352 in the Linux kernel.
Fixed CVE-2026-64375 in the Linux kernel.
Fixed CVE-2026-64401 in the Linux kernel.
Fixed CVE-2026-64413 in the Linux kernel.
Fixed CVE-2026-64416 in the Linux kernel.
Fixed CVE-2026-64476 in the Linux kernel.
Fixed CVE-2026-64508 in the Linux kernel.
Fixed CVE-2026-64530 in the Linux kernel.
Fixed CVE-2026-64532 in the Linux kernel.
Fixed CVE-2026-64533 in the Linux kernel.
Fixed CVE-2026-64534 in the Linux kernel.
Fixed CVE-2026-64535 in the Linux kernel.
Fixed CVE-2026-64538 in the Linux kernel.
Fixed CVE-2026-64542 in the Linux kernel.
Fixed CVE-2026-64545 in the Linux kernel.
Fixed CVE-2026-64546 in the Linux kernel.
Fixed CVE-2026-64548 in the Linux kernel.
Fixed CVE-2026-64552 in the Linux kernel.
Fixed CVE-2026-64554 in the Linux kernel.
Fixed CVE-2026-64555 in the Linux kernel.
Fixed KCTF-8173f7e in the Linux Kernel.
Runtime sysctl changes:
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.6.143 | v27.5.1 | v2.0.10 | See List |
Update dev-lang/go to 1.25.12.
Fixed CVE-2026-64279 in the Linux kernel.
Fixed CVE-2026-64319 in the Linux kernel.
Fixed CVE-2026-64352 in the Linux kernel.
Fixed CVE-2026-64375 in the Linux kernel.
Fixed CVE-2026-64401 in the Linux kernel.
Fixed CVE-2026-64413 in the Linux kernel.
Fixed CVE-2026-64474 in the Linux kernel.
Fixed CVE-2026-64476 in the Linux kernel.
Fixed CVE-2026-64535 in the Linux kernel.
Fixed KCTF-8173f7e in the Linux Kernel.
| Kernel | Docker | Containerd | GPU Drivers |
| COS-6.6.143 | v24.0.9 | v1.7.34 | See List |
Update dev-lang/go to 1.25.12.
Fixed CVE-2026-64279 in the Linux kernel.
Fixed CVE-2026-64319 in the Linux kernel.
Fixed CVE-2026-64352 in the Linux kernel.
Fixed CVE-2026-64375 in the Linux kernel.
Fixed CVE-2026-64401 in the Linux kernel.
Fixed CVE-2026-64413 in the Linux kernel.
Fixed CVE-2026-64535 in the Linux kernel.
Fixed CVE-2026-64548 in the Linux kernel.
Fixed CVE-2026-64556 in the Linux kernel.
Fixed KCTF-8173f7e in the Linux Kernel.
google-auth, google-cloud-bigquery, google-cloud-dataform, google-cloud-resource-manager, google-cloud-service-usage and google-cloud-storage.Firestore now supports the asia-southeast3 Bangkok region.
For a full list of supported locations, see Locations.
Firestore in Datastore mode (Datastore) now supports the asia-southeast3 Bangkok
region.
For a full list of supported locations, see Locations.
Gemini Enterprise: New data stores and support for new actions (Public Preview)
The following data stores are available in Public Preview in Gemini Enterprise:
You can search and read data from these data stores using natural language.
Additionally, the following data stores support new actions in Public Preview:
Gemini Enterprise: Manage overages, spend limits, and costs for invoiced Cloud Billing accounts
If your project has an invoiced Cloud Billing account and at least one active, non-free-trial subscription, administrators can enable overages, configure monthly spend limits, and monitor feature usage and costs in Gemini Enterprise:
For more information, see:
Google Distributed Cloud (software only) for VMware 1.35.400-gke.81 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud 1.35.400-gke.81 runs on Kubernetes v1.35.3-gke.400.
If you use a third-party storage vendor, check the listing of our previously-qualified storage partners.
After a release, it takes approximately 7 to 14 days for the version to become available for use with GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.
The following issues were fixed in 1.35.400-gke.81:
Reconciling state
after an admin cluster upgrade. The admin cluster controller skipped
reconciling legacy cluster lifecycle components during upgrades unless an initial
migration annotation was set. If legacy user clusters still existed on the
admin cluster, missing legacy API discovery (cluster.k8s.io/v1alpha1) caused
controller reconciliation to stall. With this fix, the controller preserves
legacy components as long as any legacy user clusters exist, and prunes them only
after all user clusters have migrated to advanced clusters.
gkectl prepare failed with a permission denied error
when authenticating against a private container registry.
Google Distributed Cloud (software only) for bare metal 1.35.400-gke.81 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.35.400-gke.81 runs on Kubernetes v1.35.3-gke.400.
After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.
If you use a third-party storage vendor, check the listing of our previously-qualified storage partners.
The following issues were fixed in 1.35.400-gke.81:
For DML statements, Spanner now enforces the 80,000 mutation limit (including indexes) per statement rather than cumulatively across the transaction. This allows a transaction to execute multiple DML statements that collectively exceed the limit, as long as each individual statement remains under it. For the Mutation API, the 80,000 limit applies to all mutations in the commit. All transactions are still subject to the 100 MiB commit size limit.
]]>