Google Cloud release notes

Conversational analytics in BigQuery is now available in the following locations:

• northamerica-northeast1 (Montréal)
• northamerica-northeast2 (Toronto)

For more information, see Locations.

gemini-3.5-flash-lite has become generally available (GA). See Generative quotas for how to request quota for Gemini 3 and later models.

Gemini Enterprise: Configure citations for custom MCP data stores

You can configure the citation_mappings parameter for custom Model Context Protocol (MCP) data stores using the REST API to display source citation chips when Gemini Enterprise answers questions using tools on your custom MCP server. This feature is generally available (GA).

For more information, see Configure citations for custom MCP data stores.

Gemini Enterprise: Connect workflows in Workflow Builder to Confluence Data Center and Jira Data Center

You can connect workflows in Workflow Builder to Confluence Data Center and Jira Data Center to search data and automate actions across these third-party apps.

For more information, see Workflows overview.

Advanced reporting dashboards prerelease notes 6.16

Here are the pre-release notes for updates to the advanced reporting dashboards and other reporting in CCAI Platform. When we release these updates, we expect the new capabilities to be as shown here.

This release addresses the following issues:

• Fixed an issue where the Agent Performance tile on the Real-time Agent Monitoring dashboard executed redundant database queries during auto-refreshes.

• Updated advanced reporting filter prompts so they behave consistently across all dashboards and display the complete list of configured values:

  • List-backed filters now open directly into a searchable list on the first click.

  • Dropdowns that previously returned empty or partial lists now display the full configured list, including Agent Name, Agent Email, Agent Custom ID, Agent Teams, Location, Language, Answered By, and Projection Result.

  • Disposition Codes and Disposition List filters now display the codes configured for your instance.

  • Agent Teams and Team Name filters now match agents in any of their assigned teams.

  • Configuration renames (Queue Group, Queue, Agent Team, Disposition Code, Location, Role, and Skill) now appear in filter dropdowns within 30 minutes instead of up to six hours.

  • The Projecting filter on the live Queued dashboards is now clearable, so you can reset it to show all queued interactions, and offers only Yes.

  • Fields without a predefined list of values (such as consumer phone numbers and ID fields) now display a plain text box with an operator so you can type a value directly.

  • Call Status and Deflection Type filters now display values that existed in the data but were previously missing from the list.

  • Channel now reports a value on the live Voice and Chat dashboards, and on historical Chat dashboards, for interaction types that previously appeared blank (including internal, API-initiated, campaign, UCaaS, callback, and extension calls).

  • On the Agent Audit dashboard, the Change Details table now displays its timestamp column and sorts it correctly.

  • Consumer phone number filters now accept a single value instead of multiple values. Saved filters or links that pass multiple numbers apply only one.

  • On the Missed Interactions dashboards, the Activity Status column and filter are renamed to Projection Result.

  • Actor values describing who answered, ended, or disconnected an interaction are now standardized as Human Agent, Virtual Agent, End User, and System. Saved filters, Looks, and schedules that used the previous wording must be reselected.

For GKE Standard CPU node pools, GKE can now upgrade nodes by updating the existing Compute Engine VM in place, instead of deleting the VM and creating a new one. Because the node keeps its underlying VM, it also keeps its compute capacity during the upgrade. This lowers the risk that a node upgrade fails or stalls because resources aren't available.

To enable this type of upgrade, use surge upgrades with the maxUnavailable field set to a value greater than 0. For more details about when GKE reuses the same Compute Engine instance, including exceptions, see maxUnavailable: GKE makes an existing node unavailable to recreate it.

This change applies to all GKE versions. To opt out, contact Cloud Customer Care.

Agent Search: Update to the stable model

The stable model for answer generation is updated to gemini-3.5-flash/answer_gen/v1 from gemini-2.5-flash/answer_gen/v1.

For more information, see Answer generation model versions and lifecycle.

Released Apigee Edge for Private Cloud 4.54.00.

Designated Apigee Edge for Private Cloud 4.54.00.00 a long-term support (LTS) release: 18 months of full support ending April 2028, then 18 months of maintenance ending October 2029. After October 2029, 4.54.00.00 receives no software updates, security mitigations, or technical support.

Installing a later 4.54 minor release or patch does not change those dates. To extend the support lifecycle, upgrade to the next LTS release.

For the support lifecycle phases, release cadences, and version numbering, see Apigee Edge for Private Cloud release and lifecycle policy.

This release replaces Java 8 with Java 17 and Java 21, removes the Classic UI and the apigee-sso component, and updates the bundled Cassandra, Postgres, OpenLDAP, ZooKeeper, Qpid Broker-J, Nginx, and Consul versions. These changes are not backward-compatible.

For the 4.54.00 versions and the 4.53.01 versions they replace, see Supported software and supported versions.

Before upgrading, read Changes in Edge for Private Cloud 4.54.00, then Update Apigee Edge 4.53.00 or 4.53.01 to 4.54.00 or New installation overview. For known issues, see Known issues with Edge for Private Cloud.

Replaced the Classic UI (edge-ui) with the New Edge UI (edge-management-ui).

The New Edge UI is the only management UI in 4.54.00 and is installed by default. Deployments running the Classic UI must transition to it before upgrading. Custom Classic UI properties do not carry over automatically. The default port also changes from 9000 to 3001, configurable with conf_uebe_port, so firewall rules and load balancer target ports that point at 9000 fail until they are updated.

For the migration steps and the supported feature list, see Migrate to the New Edge UI and What features are supported?.

In deployments with Apigee SSO enabled, an integrated OIDC identity broker in apigee-openldap replaces the standalone apigee-sso component and Apache Tomcat 9.0.x. Before upgrading, take a complete and validated LDAP backup; existing apigee-sso configurations do not migrate automatically. Deployments not using Apigee SSO require no action.

For migration prerequisites, validation checks, and rollback constraints, see Option 2: Upgrade UI (with Apigee SSO).

4.54.00 runs Java in mixed mode: Java 17 for Cassandra and ZooKeeper, Java 21 for the Management Server, Message Processor, Router, and Qpid Broker-J. Both Oracle JDK and OpenJDK are supported at those versions.

Oracle JDK 8 and OpenJDK 8 are no longer supported.

API proxies with custom JavaCallout policies or custom resource JARs can break on Java 21. For details, see Changes in Edge for Private Cloud 4.54.00.

Upgraded Nginx on the Edge Router to 1.30.0.

If you are upgrading from Nginx 1.20.x, see Nginx 1.30 changes in Apigee Edge 4.54.00 for the full list of changes.

Changed the TLS defaults on Message Processors to the Java 21 cryptographic baseline.

Message Processors run on Java 21, which enables TLS 1.3 by default (JEP 332) and prefers it for outbound backend connections, falling back to TLS 1.2. No configuration change is required if your target servers and load balancers negotiate TLS 1.3, or negotiate TLS 1.2 with forward-secret (ECDHE) cipher suites.

Java 21 also disables the non-forward-secret static RSA key-exchange suites (TLS_RSA_*). If you have overridden conf_http_HTTPTransport.ssl.cipher.suites.whitelist or conf_message-processor-communication_local.http.ssl.ciphers with static RSA suites only, backend calls fail with no cipher suites in common and the Router cannot complete a TLS handshake with the Message Processor. Replace the TLS_RSA_* entries with modern cipher suites and restart the Message Processor.

For the remediation path, see Legacy backend requirements and remediation.

Added Basic authentication to the New Edge UI, which lets you sign in without configuring an identity provider.

The New Edge UI supports Basic authentication without additional configuration. You can also configure Apigee SSO, or an external identity provider such as SAML or OIDC. This feature is generally available in 4.54.00.

Added automated pre-flight validation checks to apigee-setup and apigee-service, which surface environment configuration problems before a component is installed.

This feature is generally available in 4.54.00.

Fixed multiple security vulnerabilities in Apigee Edge for Private Cloud 4.54.00.

These fixes ship as part of the component upgrades in this release; see Changes in Edge for Private Cloud 4.54.00.

Changed the default garbage collector on Message Processors to the Garbage-First garbage collector.

Message Processors set useG1GC=true and useStringDeduplication=true by default in 4.54.00. In 4.53.01 neither was set by default. To configure garbage collection, see Configure the garbage collector for Message Processors.

On October 15, 2026, we began releasing Single Sign-On (SSO) updates for Apigee Edge for Public Cloud.

On October 15, 2026, we released a new version of the Apigee integrated portal.

You can copy tables across regions. This feature is now generally available (GA).

You can now use column aliases in GoogleSQL. This feature lets you define an alias for an expression in the SELECT clause of a SQL query and immediately reference that alias within the same SELECT list or in the WHERE clause of the same query block.

Column aliases also streamline the migration of workloads from other data warehouses such as Snowflake and Teradata, by supporting their syntax.

This feature is generally available, and is opt-in only. To use column aliases, you must first enable the feature.

You can export a conversational analytics agent's answer, including text, visualizations, tables, and citations, to a PDF or CSV file. This feature is generally available (GA).

Face detection model update

The emotion label response in the Cloud Vision API is deprecated. Going forward, the Cloud Vision API face detection (FACE_DETECTION feature) will return UNKNOWN for all emotion-related labels.

Preview: You can create regional disks, including Hyperdisk Balanced High Availability volumes, by cloning a zonal boot disk.

For more information, see Duplicate a disk with clones.

If you try to create an on-demand reservation or increase the number of reserved Compute Engine instances in a reservation when the zone has reached its reservation capacity limit for your requested machine family, then the request fails with a RESERVATION_CAPACITY_LIMIT_EXCEEDED error. For more information, see Reservation capacity limit exceeded.

Generally available: The storage-optimized Z4M machine series is generally available for Compute Engine. Powered by fifth generation Intel Emerald Rapids Xeon Scalable processors and Titanium offload processors, Z4M instances are purpose-built for workloads that require larger storage capacity, such as:

• Parallel file systems to support AI/ML workloads
• I/O intensive workloads such as SQL, NoSQL, and vector databases
• AI/ML training and inference workloads such as checkpointing and distributed Key-Value (KV) cache

The Z4M machine series delivers up to 1,536 GB of memory and 168,000 GiB of local Titanium SSD capacity. Z4M also supports up to 400 Gbps of network bandwidth using two physical NICs. Z4M instances use Titanium and Cloud RDMA to help enable higher levels of networking performance, isolation, and security.

For more information, see Storage-optimized machine family.

Dataflow Auto VM Selection now supports 4th generation Compute Engine machine series. When Auto VM Selection is enabled, the service prioritizes these newer generation VMs for improved performance. If 4th generation VMs are unavailable at startup, the service automatically falls back to widely available 2nd generation machine families to ensure that your jobs can start without unnecessary delays.

For more information, see Auto VM Selection.

Gemini Enterprise: Anthropic models are available in the Gemini Enterprise app

Administrators can make Anthropic models—Claude Opus 5.5 and Claude Sonnet 5.5—available to users in the Gemini Enterprise app. After an administrator turns on a model in the Enable third-party models section of the Feature Management tab, users can select the model in the model selector. Claude models are available in the global location and the us and eu multi-regions, and are charged on a pay-as-you-go basis.

This feature is generally available. For more information, see Enable third-party models.

The Looker 26.18 features have begun to be enabled for Looker (Google Cloud core) instances.

Google Cloud NetApp Volumes now supports the Flex Unified service level, including custom performance, in the following region:

• europe-west8 (Milan)

For more information about available regions, see Supported regions.

To increase the precision of attack path analysis and provide attack exposure scores that help you prioritize confirmed internet exposures, Risk Engine attack path simulations support the EXTERNALLY_EXPOSED_VM_INSTANCE External Exposure finding category (Preview). This finding category identifies Compute Engine or Google Kubernetes Engine (GKE) resources with a direct public IP address that allows host OS access.

For more information, see Detect exposed resources, Risk Engine feature support, and Overview of attack exposure scores and attack paths.

We are deprecating the emotion label response in the API. Going forward, the API will return UNKNOWN for all emotion related labels.

New minor engine version released for the commercial line of business within the v004.011 version line (aml-commercial.default.v004.011.202610-000). This version extends support for the major engine version and includes no significant changes compared to the previous minor version.

v1.16.11

On October 14, 2026 we released an updated version of the Apigee hybrid software, v1.16.11.

• For information on upgrading, see Upgrading Apigee hybrid to version v1.16.11.
• For information on new installations, see The big picture.

Fixed in this release

An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Application Integration versions prior to August 27, 2026. For more information, see the GCP-2026-068 security bulletin.

The Apache Hive catalog endpoint in the Lakehouse runtime catalog is now generally available (GA). This integration lets you use the metastore as a serverless, central metadata layer, enabling seamless data sharing and unified querying across Apache Spark, Apache Hive, and BigQuery.

For more information, see About the Hive catalog endpoint and Set up Spark and Hive with the Lakehouse runtime catalog.

Metadata migration from Dataproc Metastore to Lakehouse is now generally available (GA). You can perform a one-time backfill migration or dry run to migrate metadata from a Dataproc Metastore service to an Apache Iceberg REST catalog endpoint or a Hive catalog endpoint using the Google Cloud console, the gcloud CLI, or the REST API.

For more information, see Migrate metadata from Dataproc Metastore to Lakehouse.

Conversational analytics now lets you create a conversation with all of the data sources in multiple projects, or create a conversation with a dataset. These features are generally available (GA).

You can publish a BigQuery Conversational Analytics agent in Gemini Enterprise. This feature is now generally available (GA).

The AI.AGG function now supports the output_schema argument, which lets you specify the schema of the function output as a comma-separated list of fields. This feature is generally available (GA).

Google-managed public SSL certificates signed by Google Public CA (pki.goog) are gradually transitioning from a 90-day validity period to a 45-day validity period to improve security.

To align with modern industry-wide security standards and promote shorter certificate lifespans, Google-managed public certificates now rotate more frequently. This proactive rotation enhances the overall security posture of load balancers. The transition requires no manual intervention or configuration changes as Certificate Manager automatically manages both issuance and renewal.

For more information, see Google-managed certificates and Use Google-managed certificates.

Google-managed public SSL certificates signed by Public Certificate Authority (pki.goog) are gradually transitioning from a 90-day validity period to a 45-day validity period to improve security.

To align with modern industry-wide security standards and promote shorter certificate lifespans, Google-managed public certificates signed by Public Certificate Authority now rotate more frequently.

This proactive rotation enhances the overall security posture of load balancers. Transition requires no manual intervention or configuration changes as Google Cloud automatically manages issuance and renewal for both Certificate Manager and Compute Engine SSL certificates.

For more information, see Renew a Google-managed SSL certificate.

Service rate limiting policies are now available in Preview for regional internal Application Load Balancers and Secure Web Proxies.

Service rate limiting policies let you maintain service availability among trusted clients that might consume an inordinate amount of resources.

For more information, see the Service rate limiting overview.

When you enable the Knowledge Catalog (formerly Dataplex Universal Catalog) integration on a Cloud SQL for MySQL instance created before April 18, 2026, the integration defaults to once a day instead of near real-time.

Near real-time updates upon Knowledge Catalog enablement aren't yet available for all existing instances. A new announcement will be published when this feature becomes available.

When you enable the Knowledge Catalog (formerly Dataplex Universal Catalog) integration on a Cloud SQL for PostgreSQL instance created before April 18, 2026, the integration defaults to once a day instead of near real-time.

Near real-time updates upon Knowledge Catalog enablement aren't yet available for all existing instances. A new announcement will be published when this feature becomes available.

Generally available: When you reserve capacity by using future reservation requests, you can specify that Compute Engine delivers your reserved capacity as specifically targeted reservations. Specifically targeted reservations help you track and control which Compute Engine instances consume your reserved capacity. For more information, see About future reservation requests.

Generally available: You can increase the size of a Google Cloud Hyperdisk volume that's in multi-writer mode while the volume is attached to multiple instances. Previously, you had to detach the volume from all instances before you could resize it.

For more information, see Share disks between instances and Change the size or provisioned performance of a Hyperdisk volume.

You can automatically preserve BigQuery data policies and data governance tags (Preview) applied to tables across Dataform executions by enabling the preserveGovernanceControls option in your table or workflow configuration. For more information, see Preserve access controls metadata. This feature is generally available (GA).

Gemini Enterprise: Gemini 3.8 Flash regional availability in the United Kingdom

Gemini 3.8 Flash is generally available (GA) in the United Kingdom.

• Location availability: Supported in the UK (europe-west2) in-country region with in-region at-rest data residency (DRZ) and machine learning processing (MLP).
• App availability: Turned on by default in the web app for the UK region. Administrators can manage access with the Gemini 3.8 Flash toggle under Model availability.

For more information, see Data residency for Gemini Enterprise.

Gemini Enterprise: Gemini 4 Argon available in Workflow Builder

Gemini 4 Argon is generally available (GA) for Workflow Builder. Gemini 4 Argon is also available in Workflow Builder workflow agents. Updates take up to a day to appear in workflow agents.

• Location availability: Supported in global, us, and eu multi-regions, with data residency and ML processing support in us and eu. For more information, see Data residency for Gemini Enterprise.
• App availability: Turned off by default. The toggle defaults to on beginning October 27, 2026. For instructions to turn on the model, see Manage features on the web app.

For more information, see Workflow Builder.

Priority PayGo support for Gemini Nano Banana 2.1

Priority Pay-as-you-go (PayGo) is available in General Availability (GA) for Gemini Nano Banana 2.1 (gemini-nano-banana-2.1) on the global endpoint.

CodeMender updates (v0.15.0)

This release introduces updates to CodeMender:

• Enhanced SARIF 2.1.0 reporting: Updated cm report SARIF output with standardized rule descriptors, severity properties, and repository-relative artifact locations for improved GitHub Code Scanning compatibility.
• Model invocation metrics: Added model invocation tracking to cm stats --json, providing total, per-session, and per-turn invocation counts.
• Bug fixes:
  • Fixed an issue where token usage from completed turns was omitted from session logs during error or cancellation exit paths.

For more information, see the CodeMender documentation.

DeepSeek-V4.1-Flash is available in Public Preview

DeepSeek-V4.1-Flash from DeepSeek is available as a fully managed model (MaaS) in Model Garden. The model accepts text and image input, targets agentic and coding tasks, and supports a context window of up to 1M tokens.

For more information, see DeepSeek-V4.1-Flash.

Cloud Armor supports service rate limiting. For more information, see Cloud Armor and service rate limiting. This feature is available in Preview.

Performance of the Cloud Storage Sink connector has been improved. The improvements include reduced out-of-memory errors, higher maximum throughput, and avoiding creating a large number of small files.

(2026-R44) Version updates

GKE cluster versions have been updated.

New versions available for upgrades and new clusters.

The following versions are now available for new GKE clusters, and for manual control plane upgrades and node upgrades for existing clusters. For more information about versioning and upgrades, see GKE versioning and support and About GKE cluster upgrades.

(2026-R44) Security updates

This release includes new GKE versions that use updated Container-Optimized OS images. These updated images are cumulative, incorporating security fixes from all Container-Optimized OS versions released since the previous GKE release.

To identify the specific vulnerabilities that were resolved in each updated Container-Optimized OS image, see the Security release notes for that image. The following table includes links to the release notes for each updated Container-Optimized OS image:

Fixed an issue in GKE Sandbox where Pods using the Cloud Storage FUSE CSI driver could become indefinitely stuck in a Terminating state.

To resolve this issue, upgrade your node pools to GKE version 1.37.1-gke.1552000 or later and add the dev.gvisor.fuse.abort-on-teardown: "true" annotation to your Pod or Deployment metadata.

For more information, see About Cloud Storage FUSE CSI driver for GKE and GKE Known Issues.

(2026-R44) Version updates

• The following versions are now available in the Stable channel:
  • 1.34.11-gke.1102000
  • 1.35.8-gke.1439001
• Version 1.34.9-gke.1655001 is deprecated in the Stable channel. This version will be removed in 90 days, or at the end of support, if sooner.
• Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release:
  • GKE upgrades clusters to the following new minor versions if there are no factors, such as maintenance exclusions or deprecated APIs, preventing upgrades:
    • 1.33 to 1.34.11-gke.1056000
  • GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has maintenance exclusions or other factors preventing minor version upgrades:
    • 1.34 to 1.34.11-gke.1056000

(2026-R44) Version updates

• Version 1.36.4-gke.1495002 is now the default version for cluster creation in the Regular channel.
• The following versions are now available in the Regular channel:
  • 1.34.12-gke.1011000
  • 1.35.8-gke.1796000
  • 1.36.4-gke.1495003
  • 1.36.4-gke.2046002
  • 1.36.4-gke.2046003
• The following versions are no longer available in the Regular channel:
  • 1.34.11-gke.1102000
  • 1.35.8-gke.1439001
  • 1.36.4-gke.1391002
• Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release:
  • GKE upgrades clusters to the following new minor versions if there are no factors, such as maintenance exclusions or deprecated APIs, preventing upgrades:
    • 1.33 to 1.34.11-gke.1209000
    • 1.34 to 1.35.8-gke.1626001
  • GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has maintenance exclusions or other factors preventing minor version upgrades:
    • 1.34 to 1.34.11-gke.1209000
    • 1.35 to 1.35.8-gke.1626001
    • 1.36 to 1.36.4-gke.1495003

(2026-R44) Version updates

• Version 1.37.1-gke.1552000 is now the default version for cluster creation in the Rapid channel.
• The following versions are now available in the Rapid channel:
  • 1.34.12-gke.1209000
  • 1.35.8-gke.1975000
  • 1.36.4-gke.2377000
  • 1.37.1-gke.1697000
• Alpha version 1.38.0-gke.2884000+preview is now available for GKE alpha clusters in the Rapid channel.
• The following versions are no longer available in the Rapid channel:
  • 1.34.12-gke.1011000
  • 1.35.8-gke.1796000
  • 1.36.4-gke.2046002
  • 1.36.4-gke.2202002 is deprecated in the Rapid channel. This version will be removed in 90 days, or at the end of support, if sooner.
  • 1.36.4-gke.2304000 is deprecated in the Rapid channel. This version will be removed in 90 days, or at the end of support, if sooner.
  • 1.37.0-gke.3503000
• Alpha version 1.38.0-gke.1002000+preview is no longer available in the Rapid channel.
• Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release:
  • GKE upgrades clusters to the following new minor versions if there are no factors, such as maintenance exclusions or deprecated APIs, preventing upgrades:
    • 1.33 to 1.34.12-gke.1153000
    • 1.34 to 1.35.8-gke.1919000
    • 1.35 to 1.36.4-gke.2326000
  • GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has maintenance exclusions or other factors preventing minor version upgrades:
    • 1.34 to 1.34.12-gke.1153000
    • 1.35 to 1.35.8-gke.1919000
    • 1.36 to 1.36.4-gke.2326000
    • 1.37 to 1.37.1-gke.1552000

(2026-R44) Version updates

• Version 1.36.4-gke.1495002 is now the default version for cluster creation.
• The following versions are now available:
  • 1.34.12-gke.1209000
  • 1.35.8-gke.1975000
  • 1.36.4-gke.1495003
  • 1.36.4-gke.2046003
  • 1.36.4-gke.2377000
• The following node versions are now available:
  • 1.31.14-gke.2963000
  • 1.32.13-gke.2701000
  • 1.33.13-gke.1952000
  • 1.34.12-gke.1209000
  • 1.35.8-gke.1975000
  • 1.36.4-gke.1495003
  • 1.36.4-gke.2046003
  • 1.36.4-gke.2377000
• The following versions are no longer available:
  • 1.34.9-gke.1655001 is deprecated. This version will be removed in 90 days, or at the end of support, if sooner.
  • 1.35.8-gke.1225000 is deprecated. This version will be removed in 90 days, or at the end of support, if sooner.
  • 1.36.4-gke.1495000 is deprecated. This version will be removed in 90 days, or at the end of support, if sooner.
  • 1.36.4-gke.2202002 is deprecated. This version will be removed in 90 days, or at the end of support, if sooner.
  • 1.36.4-gke.2304000 is deprecated. This version will be removed in 90 days, or at the end of support, if sooner.
• Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release:
  • GKE upgrades clusters to the following new minor versions if there are no factors, such as maintenance exclusions or deprecated APIs, preventing upgrades:
    • 1.33 to 1.34.11-gke.1209000
  • GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has maintenance exclusions or other factors preventing minor version upgrades:
    • 1.34 to 1.34.11-gke.1209000
    • 1.36 to 1.36.4-gke.1495002

(2026-R44) Version updates

• Version 1.36.4-gke.1495002 is now the default version for cluster creation in the Extended channel.
• The following versions are now available in the Extended channel:
  • 1.31.14-gke.2825000
  • 1.31.14-gke.2963000
  • 1.32.13-gke.2567000
  • 1.32.13-gke.2701000
  • 1.33.13-gke.1815000
  • 1.33.13-gke.1952000
  • 1.34.12-gke.1011000
  • 1.35.8-gke.1796000
  • 1.36.4-gke.1495003
  • 1.36.4-gke.2046002
  • 1.36.4-gke.2046003
• The following versions are no longer available in the Extended channel:
  • 1.31.14-gke.2704000 is deprecated in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner.
  • 1.31.14-gke.2925000 is deprecated in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner.
  • 1.32.13-gke.2427000 is deprecated in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner.
  • 1.32.13-gke.2662000 is deprecated in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner.
  • 1.33.13-gke.1647000 is deprecated in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner.
  • 1.33.13-gke.1915000 is deprecated in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner.
  • 1.34.11-gke.1102000
  • 1.35.8-gke.1439001
  • 1.36.4-gke.1391002
• Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release:
  • GKE upgrades clusters to the following new minor versions if there are no factors, such as maintenance exclusions or deprecated APIs, preventing upgrades:
    • 1.30 to 1.31.14-gke.2759000
    • 1.31 to 1.32.13-gke.2504000
  • GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has maintenance exclusions or other factors preventing minor version upgrades:
    • 1.31 to 1.31.14-gke.2759000
    • 1.32 to 1.32.13-gke.2504000
    • 1.33 to 1.33.13-gke.1721000
    • 1.34 to 1.34.11-gke.1209000
    • 1.35 to 1.35.8-gke.1626001
    • 1.36 to 1.36.4-gke.1495003

SentinelOneV2: Version 52.0

• Fixed an issue to properly handle merged cases during threat synchronization in the following job:

  • SentinelOne V2 - Sync Threats Job

Microsoft Graph Mail Delegated: Version 26.0

• Updated the Folder Name parameter to be optional, allowing searches across the entire mailbox when no folder is specified in the following action:

  • Search Emails

• Improved S/MIME processing to support multi-layered encrypted, clear-signed, and opaque-signed messages, and resolved an issue where the Bypass Signature Verification parameter didn't bypass verification for malformed or unsupported S/MIME signatures in the following connector:

  • Microsoft Graph Mail Delegated Connector

Okta: Version 18.0

• Fixed a pagination issue to retrieve all available roles and user groups in the following actions:

  • List Roles

  • List User Groups

Google Threat Intelligence: Version 21.0

• Improved issue ingestion to adaptively scan the configured Max Hours Backwards time range and skip periods without new issues in the following connector:

  • Google Threat Intelligence - ASM Issues Connector

• Added the Anonymize Credential parameter to optionally mask compromised passwords with asterisks in ingested alerts and events in the following connector:

  • Google Threat Intelligence - DTM Alerts Connector

Email Utilities: Version 17.0

• Resolved an issue causing entities to not be created when Create Observed Entities was configured for specific entity types in the following action:

  • Parse Case Wall Email

Microsoft Graph Mail: Version 49.0

• Updated the Folder Name parameter to be optional, allowing searches across the entire mailbox when no folder is specified in the following action:

  • Search Emails

• Improved S/MIME processing to support multi-layered encrypted, clear-signed, and opaque-signed messages, and resolved an issue where the Bypass Signature Verification parameter didn't bypass verification for malformed or unsupported S/MIME signatures in the following connector:

  • Microsoft Graph Mail Connector

Splunk: Version 68.0

• Added the Alert Start Time Field parameter to specify a custom field for determining the alert start time in the following connector:

  • Splunk Query Connector

Google Chronicle: Version 98.0

• Added the Use Cache and Cache TTL parameters to enable caching of data table responses in the following actions:

  • Get Data Tables

  • Is Value In Data Table

  • Is Value In Data Table Async

• Fixed an issue where environment extraction only checked the first event in multi-event alerts in the following connector:

  • Chronicle Alerts Connector

All Managed Airflow environment's GKE clusters will be set up with maintenance exclusions from November 16, 2026 to December 2, 2026. For more information, see Maintenance exclusions.

Google Cloud NetApp Volumes now lets you test Active Directory policy connections for the Flex Unified service level in Preview. You can use the Google Cloud console to verify that a policy is properly connected to the Active Directory service and troubleshoot configuration errors. For more information, see Test the Active Directory policy connection.

Secure Web Proxy supports service rate limiting policies. Use these policies to protect external destinations from traffic overloads and manage the costs of your outbound web traffic.

You can attach a service rate limiting policy to your Secure Web Proxy gateways, whether they use an authorization policy or a gateway security policy. For more information, see Configure service rate limiting policies.

This feature is available in Preview.

VPC Service Controls feature (Status: Preview): Support for using Workload Identity Federation for GKE in ingress and egress rules to allow access to resources protected by a service perimeter is available in Preview.

You can specify the following Workload Identity Federation for GKE principals in ingress and egress rules:

• All GKE Pods that use a Kubernetes service account (by service account name or ID)
• All GKE Pods in a Kubernetes namespace
• All GKE Pods in a cluster

For more information, see Configure identity groups and third-party identities in ingress and egress rules and Supported identities for ingress and egress rules.

The AI.AGG function is generally available (GA). You can use this function to semantically aggregate unstructured input data based on natural language instructions.

BigQuery generative AI functions now support the gemini-4-argon model. This model is generally available.

The following resource types are publicly available through the ExportAssets, ListAssets, BatchGetAssetsHistory, QueryAssets, Feed, and Search (SearchAllResources, SearchAllIamPolicies) APIs.

• Cloud Service Mesh: networkservices.googleapis.com/AgentGateway

Spend cap budgets are now generally available for a limited set of services

For eligible services, you can configure a spend cap budget to automatically pause usage when your estimated spend exceeds the budget amount you set. You can manage spend cap budgets in the Budgets page in the Google Cloud console and using the Cloud Billing Budget API.

Spend caps are a cost control mechanism. A spend cap is enforced when usage costs exceed your budget target amount. When enforced, any new request to the eligible services, within the specified project, are paused and no further usage costs are accrued until the spend cap is lifted. You can manually lift an enforced spend cap, or wait until the start of the next month when the spend cap is automatically lifted.

Spend caps use gross, estimated costs to trigger the alerts and caps, enforcing a cap much faster than the actual costs are processed and appear on billing reports. Even though faster than reports, the enforcement of spend caps isn't instant and any cost overages are billed as normal.

More information about spend cap budgets

For managing spend cap budgets in the Google Cloud console, see:

• How spend cap budgets work to help you control spend
• Limitations of spend cap budgets
• Configure a spend cap budget
• Lift an enforced spend cap

For managing spend cap budgets using the Cloud Billing Budget API, see:

• Using the Cloud Billing Budget API for spend cap budgets
• Spend cap budget concepts and limitations
• Create a spend cap budget
• Lift an enforced spend cap
• Cloud Billing Budget API REST reference

Private Service Connect is now the default private IP connectivity option when you create a Cloud SQL for MySQL instance in a new Google Cloud project. Private Service Connect lets you connect to your instance from multiple Virtual Private Cloud (VPC) networks across different groups, projects, or organizations, and supports automatic endpoint and DNS record provisioning. When you configure private IP for an instance, you can still choose to use private services access or both connectivity options.

For more information, see Private IP configuration options and Configure Private Service Connect.

Private Service Connect is now the default private IP connectivity option when you create a Cloud SQL for PostgreSQL instance in a new Google Cloud project. Private Service Connect lets you connect to your instance from multiple Virtual Private Cloud (VPC) networks across different groups, projects, or organizations, and supports automatic endpoint and DNS record provisioning. When you configure private IP for an instance, you can still choose to use private services access or both connectivity options.

For more information, see Private IP configuration options and Configure Private Service Connect.

Private Service Connect is now the default private IP connectivity option when you create a Cloud SQL for SQL Server instance in a new Google Cloud project. Private Service Connect lets you connect to your instance from multiple Virtual Private Cloud (VPC) networks across different groups, projects, or organizations, and supports automatic endpoint and DNS record provisioning. When you configure private IP for an instance, you can still choose to use private services access or both connectivity options.

For more information, see Private IP configuration options and Configure Private Service Connect.

Object enrichments is now available in Preview. When you configure object enrichments, Cloud Storage applies Google's pre-trained machine learning models to eligible images and PDF documents in your buckets and attaches the resulting metadata to your objects as object contexts. You can inspect enrichments on individual objects or query them at scale in BigQuery by using Storage Insights datasets. For more information, see About object enrichments and Configure object enrichments.

Object contexts with extended data are available in Preview. Google services attach these contexts to your objects during automated analysis, such as machine learning labeling. To retrieve a context and its extended data, use the viewFullContext JSON API method.

Storage Insights datasets include the Object Contexts Catalog view (object_contexts_catalog_view), which you can use to analyze object contexts in BigQuery. For more information, see Object contexts catalog and Analyze object contexts.

Cluster Toolkit v1.106.0 is available. This release adds support for flexible managed instance groups on static compute nodes, multiple network interfaces (multi-NIC) for Google Cloud Managed Lustre instances, and parallelism controls for Terraform to accelerate cluster deployment and teardown.

This release also introduces the cloud-build community module to build container images with Cloud Build.

Additionally, this release adds preflight checks for storage profiles when you submit jobs and cleans up gateways when you cancel jobs.

This update also scopes the --main-only flag in the gcluster job logs command to the main Pod and its default container.

For more information, see the release announcement on GitHub.

Generally available: You can query regional views of global Compute Engine project and OS image resources by using the regional read-only projectViews and imageViews endpoints. Querying regional views isolates your control-plane read requests to a specific region, helping your workloads stay available during global API disruptions. For more information, see Use regional views for resilient control-plane reads and Access global resources regionally for high availability.

Config Connector version 1.159.0 is now available.

New Alpha Resources (Direct Reconciler):

• AIPlatformReasoningEngine

  • Manage Gemini Enterprise Agent Platform reasoning engines to deploy and run customized reasoning applications.

• CloudDeployCustomTargetType

  • Manage Cloud Deploy custom target types to define custom deployment targets and rendering actions.

• EventarcPipeline

  • Manage Eventarc pipelines to transform and route events across Google Cloud services.

• LiveStreamChannel

  • Manage Live Stream channels to ingest, encode, and distribute live video streams.

• LiveStreamInput

  • Manage Live Stream inputs to configure video ingestion endpoints.

• MapManagementStyleConfig

  • Manage Map Management API style configurations to define custom map styles.

• NetworkSecurityDNSThreatDetector

  • Manage Network Security DNS threat detectors to monitor and mitigate DNS-based threats.

New Features:

• Added support for Cloud SQL Enterprise Plus edition disaster recovery (DR) pair setup and drift suppression for SQLInstance by using the cnrm.cloud.google.com/sqlinstance-advanced-dr: "enabled" annotation.
• Manager Pods now restart automatically when resourceSettings changes in the operator configuration.
• Added a guide for managing Config Connector by using GitOps tools (such as Argo CD).

Bug Fixes:

• BigQueryDataset (#13352)

  • Fixed false-positive diffs for access entries and avoided redundant PATCH requests when the resource is already up to date.

• ComputeRouterNAT (#13472)

  • Fixed false drift and steady-state reconciliation issues during direct controller takeover.

• MonitoringDashboard (#13574)

  • Fixed reconciliation errors caused by unrecognized enum values by migrating the direct controller to the Google REST client.

You can use Developer Connect to connect Dataform repositories to Secure Source Manager repositories. This feature is in Preview.

Gemini Enterprise: Gemini 4 Argon available in web app, mobile app, and AI developer tools

Gemini 4 Argon is generally available (GA) for the Gemini Enterprise web app, mobile app, and AI developer tools.

• Location availability: Supported in global, us, and eu multi-regions, with data residency and ML processing support in us and eu. For more information, see Data residency for Gemini Enterprise.
• App availability: Turned off by default. The toggle defaults to on beginning October 27, 2026. Gemini 4 Argon is supported in the web app and mobile app. For more information about turning on the model, see Manage features on the web app.
• AI developer tools: Enabled by default for licensed users when Antigravity authorized models uses the default selection. If your organization specifies a custom model list, an administrator must manually select Gemini 4 Argon. For more information, see Configure AI developer tools settings.

Gemini Enterprise: Connect workflows in Workflow Builder to Microsoft Teams, Notion, and Salesforce

You can connect workflows in Workflow Builder to Microsoft Teams, Notion, and Salesforce to search data and automate actions across these third-party apps.

For more information, see Workflows overview.

Gemini Enterprise: Gemini 4 Argon is available in AlphaEvolve

AlphaEvolve experiments can generate candidate programs with Gemini 4 Argon in the global, us, and eu regions. To use it, specify gemini-4-argon in the models field of generationSettings. Gemini 3.8 Flash remains the default model.

For more information, see Supported models and AlphaEvolve limitations.

Gemini 4 Argon in CodeMender (Preview)

CodeMender now supports Gemini 4 Argon. To use it, pass --model gemini-4-argon to cm find, cm verify, or cm fix. Gemini 3.8 Flash remains the default model.

For more information, see Specifying the model.

Gemini 4 Argon and Gemini 4 Argon Cyber Permissive

Gemini 4 Argon (gemini-4-argon) is available in General Availability (GA). Gemini 4 Argon is Google's frontier model that excels at deep work in complex, real-world tasks across domains including coding, finance, legal, cybersecurity, and science. It supports a unified 1,048,576-token input and output limit, configurable thinking levels (LOW, MEDIUM, HIGH), long decodes up to 1,048,576 tokens using continuation tokens on the GenerateContent API, and agentic video understanding in GA.

Gemini 4 Argon Cyber Permissive (gemini-4-argon-cyber-permissive), a version of Gemini 4 Argon for defensive cybersecurity use cases, is also available in GA behind the Fairwind Program allowlist.

• Known issue (long decodes): Long decoding (continuation_token) on the GenerateContent API (generateContent and streamGenerateContent) is supported only in the v1beta1 API (not v1). The Google Gen AI SDK uses v1beta1 by default unless api_version='v1' is specified in http_options; for direct REST calls, use the v1beta1 endpoint path.

For more information, see Get started with Gemini 4 and the developer's guide to Gemini 4 Argon.

Google Cloud CCaaS prerelease notes 6.22

Here are the pre-release notes for what we expect to be the next version of Google Cloud CCaaS. When we release this version, we expect the new capabilities to be as shown here.

Campaign-based scheduled callbacks

Agents can now schedule a callback during an outbound campaign call. The callback belongs to the campaign, not to an individual agent, and the dialer calls the consumer back in the time slot they chose. Administrators set slot length, capacity, booking window, and expiry for each campaign, and supervisors can track upcoming, completed, and expired callbacks from the campaign list.

Transcript separation for chat

You can now configure Google Cloud CCaaS to deliver a separate transcript file for each participant segment in a chat, instead of one combined transcript per session. Under Settings > Chat > Chat Transcript, select Per Segment in Transcript Separation to generate individual transcript files for each agent, virtual agent, or supervisor who joins the chat—helpful for identifying which participant handled each part of a transferred or escalated conversation. Your consumers still receive a single, full-chat transcript regardless of this setting.

By default, this capability is inactive. Contact Google Cloud Support to turn it on for your instance.

This release addresses the following issues:

• Fixed an issue where direct access point (DAP) greeting messages played twice when a call was deflected to an internal phone number due to queue overcapacity.

• Fixed an issue where session metadata for top-level menu paths and selected menus was incorrectly displayed in English instead of the user's configured language.

• Fixed an issue where a failed Salesforce lookup was incorrectly treated as having no matches, which resulted in the creation of duplicate records.

• Fixed an issue where inbound transfer restrictions remained in force even after being hidden in the administrator interface, causing queues to become silently unreachable for transfers.

• Fixed an issue where hold music continued to play throughout a call recording after a warm transfer was completed.

• Fixed an issue where outbound virtual agent audio was prematurely truncated during multi-message turns.

• Fixed an issue where the Real-time Monitoring Queues report didn't accurately count skill-matched agents for skills-based queues, often displaying zero available agents despite their availability.

• Fixed an issue where calls deflected to an external phone number after entering a queue were incorrectly recorded as abandoned by the customer.

• Fixed an issue where the credit card tokenizer was missing from the SmartActions menu during outbound callback calls.

• Fixed an issue where mandatory call dispositions were discarded if an agent's voice connection dropped but their session remained active.

• Fixed an issue where the text resize menu in the chat widget wasn't scrollable at 400% browser zoom, which prevented users from accessing all available text size options.

• Fixed an issue where the system incorrectly prevented saving automatic call redirection settings when the target was a virtual agent-operated queue.

• Fixed an issue where duplicate call records were created for a single inbound call, causing incorrect wait times to appear in the real-time queue view.

• Fixed an issue where empty data attributes caused an error in the agent interface during call connections.

• Fixed an issue where the Transfer Restrictions destination picker provided no feedback when a queue was ineligible, making it indistinguishable from a typo or search error.

• Fixed an issue where incoming calls were rejected with a SIP 603 error due to high database latency and connection timeouts.

• Fixed an issue where the documentation for the Apps API and call session metadata schema didn't define the top-level parentId and finishReason fields.

• Fixed an issue where certain inbound call failures were incorrectly reported as a busy signal.

• Fixed an issue where the event processor service crashed during scaling or rebalancing of the system.

• Fixed an issue where the conversation ID was missing from chat events during active sessions.

• Fixed an issue where report exports didn't download or remained stuck in a processing state indefinitely.

• Fixed an issue where agents could transfer calls to queues that were already closed if their transfer list was loaded while the queue was still open.

• Fixed an issue where queued chats were assigned to agents after the end-user had become unresponsive without being prompted to check in.

• Fixed an issue where voice calls cold-transferred to an over-capacity queue generated duplicate reporting records and incorrect queue wait times if the callback leg failed.

• Fixed an issue where direct inbound calls deflected to voicemail during after-hours played three separate audio prompts sequentially.

• Fixed an issue where a single call was simultaneously assigned to two different agents if the pickup coincided with the cascade timer expiry.

• Fixed an issue where direct inbound calls weren't projected to agents in a breakthrough-enabled status if another call was already waiting in their queue.

• Fixed an issue where a gray empty area appeared below the chat container in the agent adapter when the iframe width was narrower than 449px.

• Fixed an issue where several Kubernetes and Google Cloud service accounts were granted overly broad permissions, which could have allowed for unauthorized privilege escalation.

• Fixed an issue where an agent's status sequence was recorded in the incorrect order following a brief connection loss during an active chat.

• Fixed an issue where selecting a contact during a native campaign call didn't automatically open the corresponding record in the CRM.

• Fixed an issue where AI-generated Smart Disposition suggestions were inconsistently displayed for outbound calls during the wrap-up period.

• Fixed an issue where call recordings became distorted or garbled when multiple holds were placed during a call.

• Fixed an issue where audio uploads were accepted based on the file extension rather than the actual file content, which caused call disconnections when incompatible formats were played.

• Fixed an issue where the call duration timer in the external call adapter didn't match the In-call status timer in the agent desktop for inbound calls.

• Fixed an issue where the sentiment score was incorrectly displayed in the call adapter for calls escalated from a virtual agent, even when the Sentiment Analysis setting was disabled.

• Fixed an issue where duplicate reporting rows were generated for call and wrap-up durations due to concurrent system events.

• Fixed an issue where agents couldn't sign in or refresh their status if their account was linked to a deleted or unknown status.

• Fixed an issue where the Manager API documentation for agent activity logs omitted 17 chat routing and activity values, leading to incomplete reporting data for customers.

• Fixed an issue where IVR custom callback numbers for certain international regions, including Norway and Denmark, were incorrectly dialed with a +1 prefix.

• Fixed an issue where metadata for calls deflected between virtual agent assignment and connection wasn't exported to the Cloud Storage bucket.

• Fixed an issue where virtual agent to human chat escalations experienced delays of up to 300 seconds during agent assignment.

• Fixed an issue where the Answer button didn't appear for dial-by-extension calls when other calls were already waiting in an agent's queue.

• Fixed an issue where a supervisor's name didn't appear in the chat widget when joining a conversation using the monitor then barge workflow.

• Fixed an issue where ending a chat session in one browser tab didn't automatically close the chat widget in other open tabs.

Google Distributed Cloud (software only) for VMware 1.35.600-gke.141 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud 1.35.600-gke.141 runs on Kubernetes v1.35.8-gke.100.

If you use a third-party storage vendor, check the listing of our previously-qualified storage partners.

After a release, it takes approximately 7 to 14 days for the version to become available for use with GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

The following issues were fixed in 1.35.600-gke.141:

• Fixed vulnerabilities listed in Vulnerability fixes.

Google Distributed Cloud (software only) for bare metal 1.35.600-gke.141 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.35.600-gke.141 runs on Kubernetes v1.35.8-gke.100.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the listing of our previously-qualified storage partners.

The following issues were fixed in 1.35.600-gke.141:

• Fixed vulnerabilities listed in Vulnerability fixes.

A new Managed Service for Apache Airflow release has started on October 13, 2026. Get ready for upcoming changes and features as we roll out the new release to all regions. This release is in progress at the moment. Listed changes and features might not be available in some regions yet.

Development mode environments and Environment hibernation are now generally available (GA).

You can now create Managed Airflow (Gen 3) environments with Airflow 3 in development mode to test and develop DAGs before publishing them to production. You can hibernate development mode environments when you no longer need them. Hibernation reduces most environment costs to zero.

Upgrade rollbacks are available in Managed Airflow (Gen 3). You can roll back an environment upgrade if you encounter degraded performance, Airflow bugs, or compatibility issues with your DAGs, plugins, or dependencies.

This feature is gradually rolling out over several releases. In this release, it's available in the following regions: europe-north1, europe-west3, us-east1, and us-west2.

New Managed Airflow (Gen 3) environments created while the Restrict Endpoint Usage (constraints/gcp.restrictEndpointUsage) organization policy is active now use regional endpoints for services like Cloud Storage, Cloud Logging, Pub/Sub, and Data Lineage.

(Managed Airflow Gen 3) Added the scheduler loop duration metric:

• composer.googleapis.com/workload/scheduler/loop_duration: time spent running one Scheduler loop.

Database retention in Managed Airflow (Gen 3) now includes new Airflow 3 metadata tables, and updated retention logs to report the exact number of removed rows.

This feature is gradually rolling out over several releases. In this release, it's available in the following regions: europe-north1, europe-west3, us-east1, and us-west2.

Managed Airflow (Gen 3) environments now report Airflow workloads startup failure logs for issues such as internal quota limits, insufficient capacity, or internal errors (excluding failures related to KubernetesPodOperator or KubernetesExecutor).

This fix is available without an upgrade and will gradually roll out to all Managed Airflow Gen 3 environments. You can upgrade your environment to receive this update immediately.

Fixed an issue where a redundant image-version property set in the API request body could sometimes cause a long-running operation to fail.

(Managed Airflow Gen 2) Fixed an issue where the airflow-monitoring pod could run out of memory (OOMKilled) when calculating scheduled snapshot metrics in environments with a large number of files in their environment's bucket.

The apache-airflow-providers-google package was upgraded to version 22.6.0. For more information about changes, see the apache-airflow-providers-google changelog.

The following Managed Airflow versions and builds have reached their end of support period: composer-3-airflow-2.9.3-build.35, composer-3-airflow-2.10.5-build.15, composer-3-airflow-2.9.3-build.36, composer-3-airflow-2.10.5-build.16, composer-2.14.3-airflow-2.9.3, composer-2.14.3-airflow-2.10.5, composer-2.14.4-airflow-2.9.3, and composer-2.14.4-airflow-2.10.5.

The apache-airflow-providers-cncf-kubernetes package was upgraded to version 10.23.0. For changes in other packages, see the preinstalled packages changelog.

New images are available in Managed Airflow (Gen 2):

• composer-2.17.15-airflow-2.11.1 (default)

New Airflow builds are available in Managed Airflow (Gen 3):

• composer-3-airflow-3.3.1-build.4
• composer-3-airflow-3.2.2-build.8
• composer-3-airflow-2.11.1-build.21 (default)

20261011.00_p0 Release

Installed latest packages from upstream dependencies.

Fixed an issue where gcloud and gsutil failed to load with an AttributeError in OpenSSL.crypto due to a version mismatch between pyOpenSSL and cryptography.

20261011.00_p0 Release

Installed latest packages from upstream dependencies.

Fixed an issue where gcloud and gsutil failed to load with an AttributeError in OpenSSL.crypto due to a version mismatch between pyOpenSSL and cryptography.

Starting October 15, 2026, Application Integration enforces security fixes for IAM, run-as service accounts, and iam.serviceAccounts.actAs checks, requiring the correct permissions for the test feature and any new integrations. For more information, see the GCP-2026-067 security bulletin and Prepare for upcoming authorization changes.

Backup for GKE is now available in the following region: asia-southeast3 (Bangkok, Thailand). For more information, see Backup for GKE locations.

Incremental data transfers for the BigQuery Data Transfer Service for PostgreSQL and ServiceNow are now generally available (GA).

You can now choose the release channel for your build config or private pool. The release channel determines how frequently the underlying versions of Debian and Docker are updated.

Outbound Endpoints for Cloud DNS is available in Preview.

Attach Outbound Endpoints to forwarding zones or server policies to enable direct DNS query forwarding from VPC networks to external and on-premises DNS resolvers using private IP addresses. For more information, see Outbound Endpoints overview.

Regular expression matchers in host and route rules in URL maps are now generally available (GA).

You can now use regular expressions (regex) matchers to configure more flexible and precise traffic routing rules within URL maps for Application Load Balancers. This feature allows you to leverage the power of RE2 syntax for matching on:

• URL Paths: Using the regexMatch field within routeRules.
• HTTP Headers: Using the regexMatch field within headerMatches in routeRules.
• HTTP Query Parameters: Using the regexMatch field within queryParameterMatches in routeRules.

This feature is available in:

• Global external Application Load Balancers
• Regional internal Application Load Balancers
• Cross-region internal Application Load Balancers
• Regional external Application Load Balancers

For more information, see URL map concepts: Regular expressions matchers in host and route rules.

Support for Budget spend caps to pause your Cloud Run workloads is in General Availability (GA).

1.31.1-asm.16 is now available for in-cluster Cloud Service Mesh.

You can now download 1.31.1-asm.16 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.31.1 subject to the list of supported features.

The following are not supported:

• PILOT_NODE_UNTAINT_CONTROLLERS_TAINT_NAME
• prefix_rewrite field in HTTPRedirect
• ALLOW_ANY_DYNAMIC_DNS in outboundTrafficPolicy
• connectionSettings in ProxyConfig
• defaultTrafficPolicy in MeshConfig
• zoneAwareLbSetting in DestinationRule and MeshConfig
• trustDomains and notTrustDomains fields in source field of AuthorizationPolicy
• fips-140-3 for the COMPLIANCE_POLICY
• PILOT_ENABLE_REMOTE_CREDENTIALS_CONTROLLER
• External SDS provider for gateways
• PILOT_AGENT_MERGE_ENVOY_STATS
• prometheus.istio.io/scrape-targets
• ENVOY_SECURE_METRICS_PORT and ENVOY_SECURE_MERGED_METRICS_PORT
• istioctl manifest generate with -o/--output

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh version 1.31.1-asm.16 uses Envoy v1.39.3.

1.30.5-asm.8 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.30.5-asm.8 uses Envoy v1.38.7-dev.

This release resolves the security vulnerability listed in Security Bulletin GCP-2026-067.

Patch 1.30.5-asm.8 contains the fix for the following platform CVEs:

1.29.8-asm.8 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.29.8-asm.8 uses Envoy v1.37.9-dev.

This release resolves the security vulnerability listed in Security Bulletin GCP-2026-067.

Patch 1.29.8-asm.8 contains the fix for the following platform CVEs:

1.28.10-asm.49 is now available for in-cluster Cloud Service Mesh.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh. Cloud Service Mesh 1.28.10-asm.49 uses Envoy v1.36.10-dev.

Patch 1.28.10-asm.49 contains the fix for the following platform CVEs: