#517 Issue
Aug. 24, 2026
Welcome to issue #516 August 17th, 2026
News
InfrastructureOfficial BlogExpanding connectivity in the Americas: Introducing Alisios, Canoa, and OlaLuz subsea cables - The new Alisios, Canoa, and OlaLuz subsea cables represent a major expansion of Google’s global network infrastructure in the Americas.
Developer Device PlatformOfficial BlogIntroducing the Developer Device Platform for agentic mobile app development - We’re excited to announce the Developer Device Platform (DDP) on Google Cloud. DDP is a fully managed cloud platform that provides instant, on-demand access to multiple hardware profiles across real physical devices and high-concurrency virtual emulators.
Database Migration ServiceDatabasesOfficial BlogAccelerate PostgreSQL migrations using Gemini in Database Migration Service - Learn how Gemini in Database Migration Service automates stored procedure conversion to speed up your move to PostgreSQL.
AIOfficial BlogQuadrantGoogle named a Leader in The Forrester Wave™: AI Platforms, Q3 2026 - Google has been named a Leader in The Forrester Wave™: AI Platforms. Q3 2026 report.
Articles, Tutorials
Infrastructure, Networking, Security, Kubernetes
Cloud KMS Official Blog SecurityPQC in Plaintext: Google Cloud’s post-quantum cryptography roadmap - We’ve long been actively working on and rolling out PQC in our infrastructure. Here’s our updated Google Cloud roadmap to migrate to PQC by 2029.
AI Official Blog SecurityIntroducing Credentio: Open Source C++ Library for C2PA Content Credentials from Google - Credentio is a newly released, open-source C++ library from Google that allows developers to integrate high-performance, local-first validation of C2PA Content Credentials into their client and server applications. By processing assets entirely locally with a highly optimized memory footprint, the library delivers instant validation verdicts for multi-gigabyte media files without incurring cloud latency, bandwidth costs, or data privacy risks. The library currently features deep manifest parsing alongside configurable trust list integration, and is available now on Google Source with future plans to support full credential generation and embedding.
DevOps Python SecurityOpen-Source GCP Auditing Tools: 8 Scanners for Security, IAM, Cost, and Reliability (2026) - This article provides a comprehensive roundup of eight open-source Google Cloud Platform auditing tools, categorized by whether they require live API credentials or operate offline.
SecurityNew to Google SecOps: Drilling Down the House - This technical guide explains how to build and configure interactive drilldowns within Google Security Operations (SecOps) dashboards to streamline case management and analysis. It covers practical steps for creating custom chart queries, utilizing match and outcome variables, and applying dashboard filters to seamlessly navigate between metrics and detailed case data.
Google Kubernetes Engine Networking Official BlogClusterNetworkPolicy in GKE: Balancing control and autonomy for your microservices - With ClusterNetworkPolicy (CNP) in GKE, administrators can manage network security centrally and implement consistent, non-bypassable policies.
Cloud Filestore Cloud Storage KubernetesDecoupling File Storage Performance from Capacity & Ensuring Node-Level Resiliency on GKE - This article explores how developers running stateful applications on Google Kubernetes Engine (GKE) can use the VolumeAttributesClass API to decouple file storage performance from capacity, avoiding the costs of over-provisioning.
DevOps Kubernetes NetworkingSecuring Kubernetes: How to Build a Private GKE Cluster on Google Cloud - This practical guide explains how to enhance Kubernetes security on Google Cloud Platform by building a private Google Kubernetes Engine (GKE) cluster. It walks through isolating worker nodes with private IP addresses, securing the control plane using Master Authorized Networks, and implementing both automatic and enterprise-grade custom VPC subnetting.
Agent Substrate Google Kubernetes EngineInside GKE Agent Sandbox: gVisor, Warm Pools, and Snapshots - How GKE turns AI agent execution into a fast, isolated, and reusable workload.
App Development, Serverless, Databases, DevOps
AI BigQuery Cloud Storage GCP Experience Official BlogHow WPP operationalizes platform and data engineering for AI marketing - WPP built a unified custom platform engineering path, standardizing its serverless compute patterns and data processing workflows.
AI Generative AI GoWhy Go is an Ideal Language for AI-Assisted Software Engineering - As AI coding assistants shift the developer's primary role from writing boilerplate to reviewing and maintaining systems, language choice becomes critical for long-term architectural integrity. Go directly addresses this new paradigm by utilizing its strict compiler, integrated toolchain, and uncompromising readability to provide deterministic guardrails that help AI models self-correct and generate highly standardized code. By enforcing ecosystem-wide consistency and strict backward compatibility, the Go platform empowers engineering teams to efficiently verify, optimize, and maintain high-velocity, AI-generated output in production environments.
Agents Firebase MCPEval-driven development: How we build better agent skills for Firebase - Discover how Firebase is using eval-driven development to build specialized agent skills, CLI tools, and MCP servers that help coding assistants write better, more accurate code.
Cloud Functions FirebaseServing a site from a seed bundle inside a Cloud Function - This text is a curated feed from the DEV Community focused on Google Cloud, showcasing a wide range of developer-written articles, tutorials, and project logs. It covers trending discussions on cloud infrastructure, security practices, and practical implementations of artificial intelligence and machine learning tools within the Google Cloud ecosystem.
Agents Cloud Run SecurityCloud Run Sandboxes: Building Secure Execution Plane for AI Agents - How ephemeral isolated execution changes the architecture of production agentic systems.
Cloud SpannerWhen Your Database Engine Changes the Rules - Migrating legacy applications to Google Cloud Spanner often exposes hidden concurrency bugs and unexamined transaction isolation assumptions in the codebase. Because Spanner defaults to strict serializable isolation, workloads that previously ran safely on databases like Postgres or MySQL may suddenly experience lock contention or transaction aborts under concurrent load. The article details how developers can navigate these underlying database contract changes and provides a practical checklist for managing isolation levels during cloud migrations.
Compute Engine Infrastructure NetworkingOne core, nearly 6 Mpps: testing AF_XDP on Google Cloud C4N - This article tests the performance of the Linux AF_XDP network socket family on Google Cloud’s network-optimized C4N virtual machines using the Wireblast packet generator. The benchmarks demonstrate that even the smallest two-vCPU instance can deliver exceptionally high packet processing rates and throughput on a single physical core. Ultimately, the results highlight C4N as an efficient, high-performance foundation for building dense network functions and specialized data planes without overprovisioning compute resources.
Agents GeminiDemystifying AI Agent Authentication & Authorization: OAuth 2.0, Proof Key for Code Grant (PKCE), and Dynamic Client Registration (DCR) - This guide takes a first principles approach to learning the fundamental concepts of AI Agent Security and maps it to Gemini Enterprise.
Cloud Functions OracleCalling Cloud Run functions from Autonomous Database@Google Cloud - This article demonstrates how to build a multicloud architecture by calling a private Google Cloud Run function directly from an Oracle Autonomous Database@Google Cloud using standard SQL. It details a step-by-step implementation covering secure IAM authentication, network configuration via Direct VPC egress, and creating a database wrapper to bridge transactional data with cloud-native decision-making logic.
Cloud Functions Firebase SecurityEnterprise Identity Meets Cloud-Native: Securing Firebase & Firestore with Keycloak OIDC - A guide to integrating enterprise SSO, Keycloak roles, and Cloud Firestore Security Rules using Firebase Auth v2 Blocking Functions.
Big Data, Analytics, ML&AI
AI Data Analytics GCP Experience Official Blog RetailHow Malachyte solves retail’s cold-start problem with managed real-time AI - Malachyte needed secure, scalable, reliable and leading-edge AI infrastructure to continue building its unique personalization algorithm.
Looker MCPLooker’s Native MCP Server with Claude Code - This article explores Looker's new native Model Context Protocol (MCP) server, which eliminates the need to run local binaries by exposing an MCP endpoint directly on Looker instances. It walks developers through setting up the connection with Claude Code, pairing it with the Looker CLI, and establishing a workflow where the AI handles data discovery and judgment while the CLI manages execution and persistence.
Data Analytics Gemini Looker Official BlogLooker’s semantic layer governs Gemini Enterprise data for user trust - Looker’s governed semantic layer brings structured data to Gemini Enterprise, enabling trusted self-service business intelligence to the organization.
Agents Data Analytics DatabasesUsing BigQuery Graphs with measures for trusted agentic workloads - Discover how BigQuery Graph with measures grounds autonomous AI agents in unified enterprise truth, enabling precise reasoning across complex data relationships.
AI BigQuery GeminiBigQuery Is More Than a Warehouse Now. It’s an AI Runtime - BigQuery Can Now Search, Reason, Generate, and Forecast by running AI Directly in SQL.
BigQueryStop Writing Self-Joins: 14 BigQuery Window Functions Every Data Engineer Should Know - Every self-join you’ve ever written to answer “compared to what?” can probably be deleted. Here’s the replacement.
Apache Beam BigQueryApache Beam to BigQuery CDC in Python - This article demonstrates how to implement Change Data Capture (CDC) from an AlloyDB database into Google Cloud BigQuery using Debezium Server, Cloud Pub/Sub, and Apache Beam. It provides a step-by-step guide on capturing database mutations, formatting them with custom metadata schemas, and processing the stream through Google Cloud Dataflow.
AI DevOps SecurityFive things I found in Google's Agent Registry and Agent Gateway that aren't in the docs - This text provides a curated collection of community-driven articles and technical guides focused on Google Cloud development. It covers a wide range of practical topics, including MLOps control centers, enterprise API management with Apigee X, serverless architectures, and advanced AI agent implementations using Google tools.
AI TPUHeyGen x Google Cloud: Bringing Avatar IV to TPUs - HeyGen ported their 18B+ parameter Avatar IV video generation model to Google Cloud's Trillium (v6e) TPUs via torchax and XLA, utilizing FSDP and Ulysses sequence parallelism across an eight-chip mesh. To achieve a 1.86x speedup for real-time streaming, the engineering team pipelined exposed all-to-all collectives, aligned sparse attention block sizes to eliminate mask padding, and bypassed softmax serial dependencies using a precomputed Cauchy-Schwarz upper bound.
AI GemmaMastering Edge AI on Raspberry Pi with LiteRT and Gemma - Deploying secure, real-time Edge AI on Raspberry Pi is now simplified using LiteRT and lightweight Gemma open models. LiteRT optimizes CPU and GPU performance, delivering fast token speeds for models like Gemma4, enabling real-time local reasoning for robotics. Developers can quickly convert, quantize, and run these models using the lightweight LiteRT CLI tool. Support for Hailo AI accelerators is also coming very soon.
Gemma LLMHow to effectively serve MTP-based Gemma 4 models for inference performance
BigQuery Generative AI LLMFuture-Proofing Your Vector Search: Swapping Open Source Models in BigQuery with Zero Friction - This article explores how to future-proof vector search workflows by integrating Hugging Face's open-source embedding models directly into Google Cloud's BigQuery using SQL.
BigQuery Data Analytics LookerImplementing dynamic period selection (YTD/MTD) in Looker using Liquid parameters and BigQuery SQL - Dashboards often fall short when users need to constantly request new static views just to switch between YTD and MTD metrics.
Antigravity BigQueryStop Flying Blind: Enterprise Observability for Antigravity with Gemini Enterprise - Using Antigravity with Gemini Enterprise.
GeminiI built the same agent three ways: Interactions API, ADK, and the Antigravity SDK - This technical article compares three different approaches for building AI agents using Google's stack—the Interactions API, the Agent Development Kit (ADK), and the Antigravity SDK—by implementing the exact same Hacker News analysis agent for each. It walks through the distinct code structures, tool integration methods, and authentication requirements for every framework before deploying them on Google Cloud Run.
Generative AI Machine LearningHow to Deploy and Personalize Gemma 4 on Agent Platform - Stand up an open Gemma 4 model as your own private endpoint, then make it yours with RAG and fine-tuning: a practical, end-to-end guide.
Slides, Videos, Audio
Kubernetes Podcast - #270 Measuring Sustainability via Project Kepler, with Niki Manoledaki.
GCP Bytes Podcast - #47 In this episode we discuss; Slop Squatting,Sega Master System II, Pixel 11, Galaxy Tab, GDG, Francis Desouze, AWS and MS Surge, Anthropic Spend, GCVE Placement Groups, Tech Giant Levy, Mobile Roaming, Cables Damaged, Word Worm, Cold Card Hack, Gauntlet Looping, Qwen 3.8, GPT5.6 Luna, Deepmind Shake Up, EU Gigafactories, AI Threat Defence, Colibri.
Releases
Apigee API Hub - Configure and deploy MCP servers with gcloud CLI You can use the gcloud apihub locations configure-and-deploy-server command to configure and deploy API hub Model Context Protocol (MCP) servers to an attached Apigee runtime. Define MCP tools inline or by referencing a YAML or JSON specification file to expose your API hub operations for agent integrations. For more information, see gcloud CLI for API hub.
Apigee Hybrid - Various security and CVE fixes are included in this release. Fixed in this release Bug ID Description 514973778 Fixed an issue where the SanitizeUserPrompt and SanitizeModelResponse policies failed to tolerate unknown fields while parsing responses from the Model Armor Service. 543171828 Fixed an issue where the apigee-logger DaemonSet failed to schedule on cluster nodes without custom node labels due to a default logger.nodeSelector in the Helm chart. v1.16.9 On August 11, 2026 we released an updated version of the Apigee hybrid software, v1.16.9. For information on upgrading, see Upgrading Apigee hybrid to version v1.16.9. For information on new installations, see The big picture. Note: This is a patch release: The container images used in patch releases are integrated with the Apigee hybrid Helm charts. Upgrading to a patch via the Helm chart automatically updates the images. No manual image changes are typically needed. For information on container image support in Apigee hybrid releases, see Apigee release process.
AppEngine - To improve security, starting in August 2026, App Engine opts your application into TLS version 1.2 and later. You can opt out until the end of August 2026. Starting in September 2026, App Engine might permanently block insecure traffic with TLS version 1.1 and earlier. For more information, see Secure minimum TLS.
BigQuery - BigQuery now supports the gemini-3.1-flash-lite and gemini-3.5-flash GA models, which are available for the us, eu, and global multi-regional endpoints. You can use these models in all generative AI functions. For information about how to specify a multi-regional endpoint and how endpoints are selected, read about locations in the generative AI overview. Query templates for data clean rooms are generally available (GA). Query templates allow data clean room owners and publishers to share predefined queries without exposing the underlying tables and views. Additionally, table parameters in table-valued functions (TVFs) are generally available (GA). You can use the ANY TABLE type as a table parameter to create generic functions that accept tables of any structure. Table Explorer behavior has moved to the Reference panel. Table Explorer has been deprecated. For more information, see "Use the Reference panel" in Run a query.
Bigtable - You can use parameterized views in Bigtable to dynamically filter data ranges for logical views based on application context and mitigate SQL injection risks. This feature is generally available (GA). For more information, see Parameterized views overview. You can use the CLUSTER_ATTRIBUTE() filter to restrict continuous materialized view processing to specific clusters. This function lets you isolate views within an instance. This feature is generally available (GA). For more information, see Non-deterministic SQL functions.
Carbon Footprint - As detailed in our 2026 Environmental Report (p. 22), Google is now using Granular Certificates purchased from the marketplace to strategically match more of our load on an hourly basis. To accurately incorporate these certificates into the Cloud customers' allocation of carbon intensity calculations, the July 2026 semi-annual methodology refresh will be delayed by one month. We will provide further updates once the revised data is available.
Chronicle SOAR - Scheduled Maintenance SOAR database and infrastructure maintenance is scheduled to take place during the standard maintenance window on Sunday, August 16. During this window, your system will experience a brief period of downtime. No customer action is required. Release 6.3.97 is now available for all regions. Scheduled Maintenance SOAR database and infrastructure maintenance is scheduled to take place during the standard maintenance window on August 16. During this window, your system will experience a brief period of downtime. No customer action is required. Release 6.3.98 is being rolled out to the first phase of regions as listed here. This release contains internal and customer bug fixes.
Chronicle Security Operations - [Spotlight Feature] Analyze feed activity with Cloud Logging This feature is in public preview. To use this feature, your Google SecOps instance must be configured with a Bring Your Own Project (BYOP) Google Cloud project. You can now monitor, debug, and troubleshoot Google SecOps ingestion pipelines and feeds using Cloud Logging. By sending, viewing, and querying ingestion and feed activity logs in Logs Explorer, you can diagnose log delivery issues, such as, missing, delayed, or failing logs, and decrease the time required to resolve ingestion anomalies. This visibility into push- and pull-based ingestion mechanisms provides the following capabilities: Investigate telemetry: Use Gemini Cloud Assist to investigate logging and metrics telemetry directly from the Google SecOps console. Debug feeds: Use the Debug with logs option on the Feed management page to open Logs Explorer pre-filtered for a specific feed. Filter routed logs: Configure exclusion filters in the Log Router to exclude specific logs, such as Storage Transfer Service (STS) logs, from being routed to Cloud Logging. For more information, see Analyze feed activity with Cloud Logging. Scheduled Maintenance SOAR database and infrastructure maintenance is scheduled to take place during the standard maintenance window on Sunday, August 16. During this window, your system will experience a brief period of downtime. No customer action is required. [Spotlight Feature] Monitor your data latency with the Health Hub This feature is in public preview. The Health Hub now includes two new tables to track the ingestion latency at both the source level and the log-type level. In addition, you can select a specific source or log type to open the Data Health Deep Dive page and view detailed information about ingestion latency. For more information, see Monitor health of data sources. Key capabilities include: Improve end-to-end visibility and reduce mean time to debug (MTTD): Google SecOps calculates latency at both the source level and the log type level to improve end-to-end visibility and help reduce the mean time to debug (MTTD) for delayed logs. Monitor ingestion latency by source: View the ingestion latency for each individual data source. Monitor ingestion latency by log type: View the ingestion latency for each individual log type. View detailed information about ingestion latency: Select a specific source or log type to open the Data Health Deep Dive page and view detailed information about ingestion latency. Note: The Lookback Window will be fully rolled out next week. Scheduled Maintenance SOAR database and infrastructure maintenance is scheduled to take place during the standard maintenance window on August 16. During this window, your system will experience a brief period of downtime. No customer action is required.
Cloud Architecture Center - (New guide) Microsoft SQL Server Always On availability group in Google Cloud: A reference architecture for deploying high-availability (HA) Microsoft SQL Server databases in Google Cloud by using Always On availability groups.
Cloud Composer - New images are available in Managed Airflow (Gen 2): composer-2.17.10-airflow-2.11.1 (default) composer-2.17.10-airflow-2.10.5 New Airflow builds are available in Managed Airflow (Gen 3): composer-3-airflow-3.2.2-build.2 composer-3-airflow-3.1.8-build.4 composer-3-airflow-2.11.1-build.15 (default) composer-3-airflow-2.10.5-build.48 (Airflow 3.2.2 and 2.11.1) The [api]rbac_bindings Airflow configuration option is blocked and it isn't possible to override its value. (Managed Airflow Gen 3) Adjusted the formula used to calculate the number of Airflow web server workers based on allocated CPU and memory resources. This update aligns with resource consumption changes in recent Airflow versions, improving web server stability. A new Managed Service for Apache Airflow release has started on August 10, 2026. Get ready for upcoming changes and features as we roll out the new release to all regions. This release is in progress at the moment. Listed changes and features might not be available in some regions yet.
Cloud Firestore - Firestore now supports the asia-southeast3 Bangkok region. For a full list of supported locations, see Locations.
Cloud Functions - The Cloud Run functions upgrade tool is in General Availability. Use this tool to upgrade 1st gen functions to Cloud Run functions.
Cloud Run - Cloud Run NVIDIA L4 GPU driver version 580.x.x is available for services, jobs, and worker pools.
Cloud SQL MySQL - Cloud SQL for MySQL 9.7 is generally available ( GA ). For more information about the differences between MySQL 9.7 and previous versions, review the MySQL 9.7 Release Notes. By default, if you specify MySQL 9.7 as the version when you create a Cloud SQL instance (either primary or replica) using the gcloud CLI, the Google Cloud console, or the REST API, then the Cloud SQL edition is Cloud SQL Enterprise Plus edition. This release introduces support for key MySQL 9.7 capabilities, including: Vector search: support for the community-standard vector storage format combined with advanced approximate nearest neighbor (ANN) vector indexing in Cloud SQL. Hypergraph optimizer: an alternative join-planning framework designed for complex, multi-table queries. You can enable the hypergraph optimizer using an optimizer switch. JSON Duality Views: a feature that bridges relational SQL and hierarchical JSON document models to interact with the same underlying data. Upgrade and migration paths: support for in-place major version upgrade from Cloud SQL for MySQL 8.4 and migrations from MySQL 8.4 using the Database Migration Service (DMS). Note: The legacy mysql_native_password authentication plugin is no longer supported starting in Cloud SQL for MySQL 9.7. You must update all clients that use built-in authentication user accounts to use the caching_sha2_password plugin instead. For more information, see MySQL authentication. Flag updates for MySQL 9.7 Additionally, this release introduces several database flag changes. MySQL database flag Action Details activate_mandatory_roles Added / Supported Exposes mandatory roles configuration. Default is ON. innodb_native_foreign_keys Added / Supported Exposes SQL layer foreign key handling configuration. table_open_cache_triggers Added / Supported Configures trigger cache size limits. connection_memory_status_limit Added / Supported Sets limit configurations on connection memory. global_connection_memory_status_limit Added / Supported Sets global limit configurations on connection memory. performance_schema_max_logger_classes Added / Supported Sets limits for performance schema logger classes. caching_sha2_password_proxy_users Added / Supported Configures proxy users support for caching SHA-2. caching_sha2_password_enforce_storage_format Added / Supported Enforces storage format rules for caching SHA-2. caching_sha2_password_storage_format Added / Supported Sets storage format defaults for caching SHA-2. innodb_log_file_size Removed Flag not supported in MySQL 9.7 and later. innodb_log_files_in_group Removed Flag not supported in MySQL 9.7 and later. innodb_undo_tablespaces Removed Flag not supported in MySQL 9.7 and later. mysql_native_password_proxy_users Removed Flag not supported in MySQL 9.7 and later. replica_parallel_type Removed Flag not supported in MySQL 9.7 and later. slave_parallel_type Removed Flag not supported in MySQL 9.7 and later. temptable_use_mmap Removed Flag not supported in MySQL 9.7 and later. For more information about MySQL database flags, see Configure database flags.
Cloud Spanner - Dynamic channel pooling (DCP) for gRPC channels in the Spanner Go and Java client libraries is generally available ( GA ). DCP prevents performance issues from under-provisioned or over-provisioned channels and reduces configuration overhead. DCP is disabled by default. For more information, see Configure the number of sessions and gRPC channels in the pools.
Cloud Trace - Google Cloud Observability automatically generates trace exemplars for charts on custom dashboards that display the result of a SQL query when the query runs against your trace data and satisfies some constraints. The exemplars link the SQL query result to specific traces. This feature is in Preview. For more information, see Generate and display trace exemplars. The following remote MCP servers automatically generate a trace span for tools/call operations. These spans can help you understand the behavior of your agentic applications. For more information, see Investigate MCP calls using Trace. Cloud Billing Personalized Service Health
Compute Engine - A vulnerability (CVE-2026-6726) in the Trusted Computing Group's TPM 2.0 reference implementation code was discovered and is being addressed. For more information, see the GCP-2026-054 security bulletin. Generally available: Compute flexible committed use discounts (CUDs) are available for G2 and G4 GPU accelerator-optimized machine series. The supported resources include vCPUs, memory, Local SSD disks, and GPUs. Compute flexible CUDs are spend-based CUDs that apply to eligible Google Cloud spend across Compute Engine, GKE, and Cloud Run. For G2 and G4 machine series, compute flexible commitments provide the flexibility to switch between eligible machine series and regions depending on your workload needs. For GPUs that belong to these machine series, compute flexible commitments don't require attached reservations. For more information, see Compute flexible CUDs.
Confidential VM - A vulnerability affecting Intel TDX firmware was discovered and is being addressed. For more information, see the GCP-2026-053 security bulletin.
Contact Center AI Platform - Full details on the release page.
Dataform - Dataform workflows and BigQuery pipelines now support automated metadata enrichment for BigQuery tables and views, allowing you to define semantic metadata directly in SQLX configurations for synchronization with the Knowledge Catalog. For more information, see Add metadata for Knowledge Catalog. This feature is in Preview.
Dataproc - Managed Service for Apache Spark (formerly Dataproc on Compute Engine): A critical bug related to Conda channels has been fixed in-place in image versions 1.4.81, 1.5.92, 2.1.117, and 2.2.85. These image versions were released without pre-configured Conda channels. Required customer actions: To comply with Google requirements, recreate the following resources if they were created using these image versions on or before August 10, 2026: Custom images Clusters New Managed Service for Apache Spark (formerly Google Cloud Serverless for Apache Spark) subminor runtime versions: 1.2.86 2.2.86 2.3.39 Key updates in these runtime versions include: OpenLineage updates: In the 2.3 runtime: Upgraded OpenLineage to version 1.49 to support lineage for tables created using the Lakehouse Runtime catalog. Fixed a segmentation fault when OpenLineage parses complex SQL query strings.
Datastore - Firestore in Datastore mode (Datastore) now supports the asia-southeast3 Bangkok region. For a full list of supported locations, see Locations.
Error Reporting - Error Reporting can report stack traces collected from Rust applications using std::backtrace. To enable, set the RUST_BACKTRACE=1 environment variable and make sure debug symbols are enabled. For more information, see ReportedErrorEvent.
Eventarc - When configuring Eventarc triggers for Cloud Run destinations (including Cloud Run functions), you can specify a single delivery attempt with no retries. For more information, see Retries for Cloud Run destinations.
GKE - Full details on the release page
IAM - The workflow for creating workforce identity pool providers in the Google Cloud console changed. After submitting the initial provider configuration, the console directs you to a centralized page to configure provider attributes, including attribute mappings, attribute conditions, and extra attributes. For more information, see Manage workforce identity pools and providers. You can use custom constraints with Organization Policy to provide more granular control over specific fields for Agent Identity resources, such as agentidentity.googleapis.com/AuthProvider. For more information, see Use custom organization policies for Agent Identity. This feature is in GA.
Memorystore for Redis Cluster - You can use the Google Cloud console to secure access to your clusters by using basic token-based authentication. This feature is available in Preview.
Network Intelligence Center - Connectivity Tests supports using a Cloud Run job as a source endpoint for connectivity testing. For more information, see Test from a Cloud Run job to a destination.
Secret Manager - Parameter Manager enforces the location organization policy ( constraints/gcp.resourceLocations ) on resources in the global location. If your organization policy restricts allowed resource locations, you must explicitly allow the global location in the policy. Otherwise, attempts to create global resources fail. This helps ensure that Parameter Manager consistently applies the location organization policy checks to global resources. For more information, see Defining resource locations.
Security Command Center - The integration of Security Command Center with Application Design Center for application lifecycle security assessments is generally available ( GA ). Design-time findings are sent to Security Command Center on demand during deployment. This feature lets you filter findings by App Hub application at the app-enabled folder and project levels. For more information, see Application lifecycle security assessments. Vulnerability Assessment for Google Cloud is available in General Availability. AI Protection supports data residency in the Kingdom of Saudi Arabia (KSA) for all Security Command Center service tiers. For more information, see Planning for data residency.
Sensitive Data Protection - The ANTHROPIC_API_KEY, GEMINI_API_KEY, and OPENAI_API_KEY infoType detectors are available in all regions. For more information about all built-in infoTypes, see the InfoType detector reference.
VPC Service Controls - VPC Service Controls feature (Status: Preview ): Support for optimizing service perimeters using the VPC Service Controls recommender is available. The recommender detects architectural risks and perimeter misconfigurations, including the following: Critical resources at risk of exfiltration: Identifies active and sensitive services (such as BigQuery and Cloud Storage) operating outside service perimeters. Unconfigured VPC accessible services: Identifies perimeters that leave APIs unrestricted from within the security boundary. Misconfigured VPC accessible services: Identifies mismatches between allowed accessible APIs and restricted services inside a perimeter. For more information, see Optimize perimeters with recommender.
Workstation - Cloud Workstations supports Compute Engine suspend and resume in Preview. You can configure workstation VMs to suspend when they reach their idle timeouts, referred to as auto-sleep in the Google Cloud Console, rather than shutting down and deleting the VM, by using the IdleAction workstation configuration setting.