Everything Google Cloud Shipped This Week, Ranked

The week in one paragraph

245 notes across 47 products, and the first week in this series with no security bulletins whatsoever. That absence is the headline, because it is not an absence of security work — Container Optimized OS still shipped 85 notes fixing 27 distinct CVEs across four releases. It means nothing crossed the threshold Google uses for a bulletin. What arrived instead was administrative: four separate deprecations, each with a date attached, all of them landing in 2027. For a week with no emergencies, it generated an unusual amount of calendar.

Policy Troubleshooter grows a principal type

The most consequential item for anyone running IAM at scale: Policy Troubleshooter now supports troubleshooting access for agent identities. Concretely, you can troubleshoot IAM allow policies, deny policies, and principal access boundary policies for agents acting under their own authority, either by entering the principal identifier or by using an error ID from an access denial event.

Two things make this worth more than its one-line entry. First, the coverage: allow, deny and principal access boundary policies in a single answer. Those three are evaluated by different machinery with different condition languages, and until you can see all three together, tracing a denial means reasoning about their interaction by hand.

Second, the error ID route. Pasting the identifier from a denial event and getting the evaluation back is a materially different workflow from reconstructing the question afterwards — it removes the step where you guess which resource and which permission were actually involved, which is the step most likely to send an investigation to the wrong place.

Four deprecation clocks, all set in 2027

Nothing here needs action this quarter. All four need a calendar entry, and two need a migration plan that is not trivial.

• Data Security Posture Management — deprecated, and it will be shut down on February 1, 2027. The earliest of the four, and the one most likely to be load-bearing in a compliance story.
• Google SecOps legacy Mandiant feeds — after March 18, 2027, Google will be removing the MANDIANT_ACTIVE_BREACH_IOC, MANDIANT_FUSION_IOC and OPEN_SOURCE_INTEL_IOC feeds, in favour of the consolidated GTI_IOC feed. Detection content referencing the old feed names is what breaks.
• Cloud SQL for SQL Server 2017 — from April 12, 2027 you cannot create new instances, and starting on October 13, 2027 SQL Server 2017 reaches end of life and Microsoft stops releasing security updates. Note the ordering: the ability to create new instances is withdrawn six months before the engine itself expires, so the practical deadline is the earlier one.
• Gemini 2.5 Flash Image — deprecated and scheduled for retirement on March 15, 2027, extended from October 2, 2026. A deprecation clock being pushed back by roughly seventeen months, which is worth noticing precisely because it runs opposite to the usual direction.

The pattern across all four is the one worth internalising: a deprecation note is not a task, it is a date. The failure mode is not missing the announcement — it is reading it in September 2026 and having nowhere to put "April 2027" where anyone will see it again.

Apigee makes the least-privilege argument in production

Apigee hybrid v1.17.0 reduced the IAM permissions its own service accounts require, and the specifics are a cleaner illustration of the principle than most documentation manages. Service accounts that use Cloud Storage now require only the storage.objects.get and storage.objects.create permissions rather than the broader Storage Admin role. Separately, the Cassandra components also no longer run with the privileged: true security context.

That is the entire least-privilege case in one release note: two object-level permissions replacing a role that could also delete buckets, and a container dropping a privilege flag it did not need. Both are the kind of change that is invisible when it works and expensive to retrofit after an incident. If you run Apigee hybrid, the upgrade is a permissions reduction you get for free; if you do not, it is a template for the question to ask about your own service accounts.

Platform, data and the rest

• Container Optimized OS shipped 85 notes fixing 27 distinct CVEs across four releases. The note count exceeds the CVE count because each CVE is patched once per release — these are separate notes, not duplicates, and the inventory below counts them as such.
• BigQuery gained a WHERE clause inside aggregate function calls, filtering aggregate input with a boolean expression. In preview, and the kind of syntax addition that quietly removes a subquery from a lot of existing SQL.
• Cloud SQL for PostgreSQL added the pg_textsearch extension for full-text search using BM25 scoring — relevance ranking without leaving the database.
• Compute Engine can now create regional disks, including Hyperdisk Balanced High Availability volumes, from custom and public OS images. Preview.
• Ops Agent 2.71.0 can export metrics, logs and traces through the OpenTelemetry-based telemetry pipeline — published under both Cloud Logging and Cloud Monitoring, which is why it appears once in the cross-product bucket below rather than twice.
• Cloud Number Registry now requires you to designate a management project before organisation setup — flagged Breaking, and the only note this week carrying that label with a configuration consequence.

What I would act on

1. Put the four 2027 dates somewhere you actually read. February 1, March 18, April 12 and October 13 — the first two are platform shutdowns, the second two a database engine expiring in stages.
2. Check whether Data Security Posture Management appears in any compliance narrative you have written down. Sixteen months is enough time to replace it and not enough to discover the dependency late.
3. Grep detection content for the three retiring SecOps feed names before the migration to GTI_IOC becomes urgent.
4. If you run Apigee hybrid, take the v1.17.0 permission reduction and use it as the prompt to audit what your other service accounts hold.
5. Note the Policy Troubleshooter change even if you run no agents yet — troubleshooting allow, deny and boundary policies in one place earns its keep the first time a denial is not where you expected.

Complete inventory — all 245 notes

How this inventory reconciles

Google Cloud published 245 notes across 47 products and 5 days in this window, read from 4 feeds. Every one of them is accounted for below, in exactly one place:

Repeating runs, rolled up

• Container Optimized OS (85 notes) — Security85 notes, across 4 releases (cos-117-18613-731-21, cos-121-18867-584-23, cos-125-19216-655-28, cos-129-19506-448-36). They fix 27 distinct CVEs. A CVE is patched once per release, so the note count is higher than the CVE count — these are separate notes, not duplicates, and are counted as such: CVE-2026-56391, CVE-2026-58055, CVE-2026-58470, CVE-2026-59890, CVE-2026-80590, CVE-2026-80737, CVE-2026-80788, CVE-2026-80789, CVE-2026-80791, CVE-2026-80792, CVE-2026-80793, CVE-2026-80805, CVE-2026-80806, CVE-2026-80808, CVE-2026-80837, CVE-2026-80838, CVE-2026-80839, CVE-2026-80842, CVE-2026-80843, CVE-2026-80845, CVE-2026-80852, CVE-2026-80854, CVE-2026-80855, CVE-2026-80856, CVE-2026-80862, CVE-2026-80916, CVE-2026-80917.

One change, published under several products

• FixedThe following issues were fixed in 1.33.1200-gke.83: Fixed vulnerabilities listed in Vulnerability fixes .Published under 2 products: Google Distributed Cloud (software only) for VMware, Google Distributed Cloud (software only) for bare metal.
• FeatureGrok filter match_all option in parser syntax The Google SecOps parser syntax is updated to support the match_all option within the Grok filter. This allows par…Published under 2 products: Google SecOps, Google SecOps SIEM.
• FeatureStarting with version 2.71.0, you can use an Ops Agent configuration option to export your metrics, logs, and traces by using the OpenTelemetry-based Telemetry…Published under 2 products: Cloud Logging, Cloud Monitoring.
• DeprecatedMANDIANT_ACTIVE_BREACH_IOC , MANDIANT_FUSION_IOC , and OPEN_SOURCE_INTEL_IOC` feeds are being removed The MANDIANT_ACTIVE_BREACH_IOC , MANDIANT_FUSION_IOC , and…Published under 2 products: Google SecOps, Google SecOps SIEM.

Everything else, by product

Apigee hybrid — 14

• Announcementhybrid v1.17.0 On September 14, 2026 we released an updated version of the Apigee hybrid software, 1.17.0. For information on upgrading, see Upgrading Apigee hy…Mon 14 Sep · hybrid
• FeatureModel Context Protocol (MCP) support Apigee hybrid now supports Model Context Protocol (MCP) , an open protocol that lets agentic AI applications use your APIs…Mon 14 Sep · hybrid
• FeatureRoot CA certificate rotation Apigee hybrid v1.17.0 lets you rotate the root certificate authority (CA) certificate that anchors trust for TLS communication betw…Mon 14 Sep · hybrid
• FeatureTLS 1.3 support Apigee hybrid v1.17.0 adds support for TLS 1.3, a newer version of the Transport Layer Security (TLS) protocol that offers faster connection han…Mon 14 Sep · hybrid
• FeatureForward proxy support for AI policies Apigee hybrid v1.17.0 adds forward proxy support for AI policies, such as the Model Armor and semantic caching policies. O…Mon 14 Sep · hybrid
• FeatureSemantic cache Private Service Connect (PSC) endpoint support Apigee hybrid v1.17.0 adds Private Service Connect (PSC) endpoint support for semantic caching. Th…Mon 14 Sep · hybrid
• FeatureSemantic cache distance measure support Apigee hybrid v1.17.0 adds support for non-default Vertex AI Vector Search distance measures in the SemanticCacheLookup…Mon 14 Sep · hybrid
• FeatureReduced service account permissions Apigee hybrid v1.17.0 reduces the Google Cloud IAM permissions that Apigee service accounts require. Service accounts that u…Mon 14 Sep · hybrid
• SecurityVarious security and CVE fixes are included in this release.Mon 14 Sep · hybrid
• Announcementv1.16.10 On September 17, 2026 we released an updated version of the Apigee hybrid software, v1.16.10. For information on upgrading, see Upgrading Apigee hybrid…Thu 17 Sep · v1.16.10
• FeatureKubernetes 1.36 support Apigee hybrid v1.16.10 adds support for Kubernetes 1.36 on Google Kubernetes Engine (GKE), Google Distributed Cloud Virtual for VMware (…Thu 17 Sep · v1.16.10
• FeatureForward proxy support for AI policies Apigee hybrid v1.16.10 adds forward proxy support for AI policies, such as the Model Armor and semantic caching policies.…Thu 17 Sep · v1.16.10
• FixedFixed in this release Bug ID Description 556750755 Fixed an issue where EventFlow (Server-Sent Events) dropped or truncated events following a large (>16 KB) ev…Thu 17 Sep · v1.16.10
• SecurityBug ID Description N/A Security fixes for apigee-asm-ingress . This addresses the following vulnerabilities: CVE-2026-33818 CVE-2026-39821 CVE-2026-56853 CVE-20…Thu 17 Sep · v1.16.10

Artifact Registry — 1

• FeatureArtifact Registry support for managing Conda packages with Artifact Registry repositories is in Preview . For more information, see Get started with Conda packa…Tue 15 Sep

Backup and DR — 2

• FeatureYou can now monitor restore jobs for Filestore instances directly from the Backup and DR Jobs page in the Google Cloud console. When you trigger a restore on a…Mon 14 Sep
• FeatureYou can now use auto-protection policies and resource labels to automatically protect Compute Engine instances and Persistent Disks at scale in Backup and DR. T…Wed 16 Sep

Batch — 1

• IssueA workaround has been added for the known issue that jobs might fail when specifying Compute Engine (or custom) VM OS images with outdated kernels .Tue 15 Sep

BigQuery — 5

• ChangeAn updated version of the Simba ODBC driver for BigQuery is now available.Mon 14 Sep
• FeatureMetadata for BigQuery Graph is automatically ingested and searchable in Knowledge Catalog . This feature is available in preview .Mon 14 Sep
• FeatureYou can now include a WHERE clause inside of an aggregate function call to filter your aggregate function input using a boolean expression. This feature is in P…Mon 14 Sep
• FeatureYou can use the migration lineage service to visualize the data flow and connections in your source database and help you plan a BigQuery data warehouse migrati…Wed 16 Sep
• FeatureYou can add unit tests to pipelines to validate your SQL transformation logic against mock datasets. Unit tests for pipelines are generally available (GA).Thu 17 Sep

Bigtable — 1

• FeatureYou can use the Google Cloud console to create, list, and query parameterized views for your Bigtable instances. You can also configure view parameters and run…Mon 14 Sep

Blog — 20

• PostAgent-ready analytics: Unlocking insights with BigQuery augmented analyticsMon 14 Sep
• PostIntroducing new session management tools with native, granular controlsTue 15 Sep
• PostBest practices for handling cloud reliability incidentsTue 15 Sep
• PostScaling Telco Autonomy: Leveraging GNNs with Distributed GraphFlowTue 15 Sep
• PostAgent Substrate brings high-density, scalable, trusted infrastructure to GKETue 15 Sep
• PostIntroducing Filestore agent volumes: fully managed storage for agent workspacesTue 15 Sep
• PostFor SeaVerse, GKE Agent Sandbox reduces infrastructure costs by 60%Wed 16 Sep
• PostM4N VM family, now GA: Highest per-core IOPS and throughput for I/O and memory-bound workloadsWed 16 Sep
• PostHow Orange built FinOps accountability, and why agents are nextWed 16 Sep
• PostCloud CISO Perspectives: How Google monitors AI threats and advances AI defensesWed 16 Sep
• PostGoogle named a Leader in the External Threat Intelligence Service Forrester Wave™Thu 17 Sep
• PostThe future of orchestration: Pine59’s journey to Airflow 3 on Google CloudThu 17 Sep
• PostHow a solo founder runs a five-continent tender platform on AlloyDB and MCPThu 17 Sep
• PostAnnouncing Native BM25 Ranking in AlloyDB and Cloud SQLFri 18 Sep
• PostReimagining service delivery in the agentic era with Google Public SectorFri 18 Sep
• PostThe DevFest Community Workshop Experience: Building Real Agents TogetherFri 18 Sep
• PostHow to upskill enterprise AI builders by using daily micro habitsFri 18 Sep
• PostAccelerating the borderless Lakehouse: Announcing preview of cross-cloud cachingFri 18 Sep
• PostWhat’s new with Google CloudFri 18 Sep
• PostChanging the game: Using agentic AI to secure infrastructure codeFri 18 Sep

Carbon Footprint — 1

• ChangeFor the July 2026 data release (published mid-September 2026), we have upgraded the carbon model to version 17 and implemented the following updates: Updating S…Tue 15 Sep

Cloud Asset Inventory — 2

• FeatureThe following resource type is publicly available through the ExportAssets , ListAssets , BatchGetAssetsHistory , QueryAssets , and Feed APIs. Network Managemen…Tue 15 Sep
• FeatureThe following resource type is publicly available through the ExportAssets , ListAssets , BatchGetAssetsHistory , QueryAssets , and Feed APIs. Cloud TPU API tpu…Thu 17 Sep

Cloud Load Balancing — 1

• FeatureManaged workload identity for backend mTLS is generally available for the following Application Load Balancers: Global external Application Load Balancers Regio…Fri 18 Sep

Cloud Number Registry — 1

• BreakingYou must designate a project to manage Cloud Number Registry before you can set up Cloud Number Registry for an organization.Wed 16 Sep

Cloud SQL for MySQL — 1

• ChangeCloud SQL for MySQL now automatically enables point-in-time recovery (PITR) in a separate, asynchronous operation after disaster recovery (DR) switchover and re…Thu 17 Sep

Cloud SQL for PostgreSQL — 2

• FeatureYou can use the pg_textsearch extension in Cloud SQL for PostgreSQL to perform full-text search using the industry-standard BM25 (Best Matching 25) scoring algo…Mon 14 Sep
• ChangeCloud SQL for PostgreSQL now automatically enables point-in-time recovery (PITR) in a separate, asynchronous operation after disaster recovery (DR) switchover a…Thu 17 Sep

Cloud SQL for SQL Server — 1

• DeprecatedBeginning April 12, 2027, you won't be able to create new instances of Cloud SQL for SQL Server 2017. Starting on October 13, 2027, SQL Server 2017 will reach e…Mon 14 Sep

Cloud Scheduler — 1

• ChangeCloud Scheduler is available in the following location : asia-southeast3 (Bangkok, Thailand)Fri 18 Sep

Cloud Workstations — 1

• FeatureCloud Workstations supports customizing provisioned IOPS and throughput for Hyperdisk Balanced High Availability disks. This customization feature is in Preview…Mon 14 Sep

Compute Engine — 3

• FeaturePreview : You can create regional disks, including Hyperdisk Balanced High Availability volumes, from custom and public OS images. For more information, see Cre…Mon 14 Sep
• FeaturePublic preview : Network-optimized C4N machine type with 375 GiB to 12,000 GiB of attached Titanium SSD are now available in Preview . You don't have to request…Tue 15 Sep
• FeatureGenerally available : The storage-optimized Z4D machine series is generally available for Compute Engine. Powered by AMD EPYC Turin processors and Titanium offl…Thu 17 Sep

Confidential Space — 1

• AnnouncementA new Confidential Space image (260800) is available. Support for Confidential Space on H100 GPU ( a3-highgpu-1g machine family) with Intel Trust Authority (ITA…Tue 15 Sep

Container Optimized OS — 9

• Changecos-beta-133-19999-44-44 Kernel Docker Containerd GPU Drivers COS-6.18.48 v29.4.3 v2.3.4 See ListThu 17 Sep · cos-beta-133-19999-44-44
• Changecos-129-19506-448-36 Kernel Docker Containerd GPU Drivers COS-6.12.105 v27.5.1 v2.2.7 See ListThu 17 Sep · cos-129-19506-448-36
• ChangeFixed CVE-2026-56391 in sys-apps/coreutils.Thu 17 Sep · cos-129-19506-448-36
• Changecos-125-19216-655-28 Kernel Docker Containerd GPU Drivers COS-6.12.105 v27.5.1 v2.2.7 See ListThu 17 Sep · cos-125-19216-655-28
• ChangeRuntime sysctl changes: Changed: net.ipv4.udp_mem: 188034 250714 376068 -> 188034 250715 376068Thu 17 Sep · cos-125-19216-655-28
• Changecos-117-18613-731-21 Kernel Docker Containerd GPU Drivers COS-6.6.153 v24.0.9 v1.7.34 See ListThu 17 Sep · cos-117-18613-731-21
• Changecos-121-18867-584-23 Kernel Docker Containerd GPU Drivers COS-6.6.153 v27.5.1 v2.0.10 See ListThu 17 Sep · cos-121-18867-584-23
• FeatureFixed a performance issue in the GVE driver on multi-NUMA systems.Thu 17 Sep · cos-125-19216-655-28
• FixedUpgraded net-libs/libnftnl to v1.2.9.Thu 17 Sep · cos-125-19216-655-28

Dataform — 1

• FeatureYou can use unit tests to test Dataform actions against mock data with an expected result set. Dataform unit tests are generally available (GA).Thu 17 Sep

Datastream — 1

• FeatureDatastream now supports MongoDB extended JSON canonical mode as the default format for new streams from MongoDB sources to BigQuery destinations. Canonical mode…Wed 16 Sep

Filestore — 1

• FeatureSmall capacity Filestore instances for the Regional service tier are generally available (GA) . Small capacity instances start at 100 GiB and scale in 1 GiB inc…Wed 16 Sep

Gemini Enterprise — 3

• AnnouncementGemini Enterprise: Gemini Code Assist availability update for subscriptions If you're getting a new Gemini Enterprise Standard or Plus subscription or renewing…Thu 17 Sep
• FeatureGemini Enterprise: Voice input for the chat box You can speak your queries and prompts to Gemini Enterprise. Use the microphone button to record your voice, rev…Thu 17 Sep
• FeatureGemini Enterprise: Support for new actions (Public Preview) Support for new actions is available in Public Preview for the following data stores: Microsoft OneD…Fri 18 Sep

Gemini Enterprise Agent Platform — 8

• DeprecatedGemini model deprecation and retirement date updates The retirement and deprecation dates for the following Gemini models have been updated: Gemini 2.5 Flash Im…Mon 14 Sep
• FeatureCyber Verification Program for Claude is available in Preview Anthropic's Cyber Verification Program (CVP) is available in Preview on Gemini Enterprise Agent Pl…Mon 14 Sep
• FixedCodeMender updates (v0.7.0) This release introduces updates to CodeMender: Network stream resilience : Improved CLI session stability with automatic reconnectio…Mon 14 Sep
• FeatureReinforcement learning fine-tuning in the Google Cloud console (Preview) You can create, monitor, and test reinforcement learning fine-tuning jobs for Gemini mo…Tue 15 Sep
• FeatureCodeMender updates (v0.8.0) This release introduces updates to CodeMender: Gemini 3.8 Flash default : Gemini 3.8 Flash ( gemini-3.8-flash ) is now supported and…Wed 16 Sep
• FeatureGemini Omni Flash supports stateful and streaming video generation (Preview) Gemini Omni Flash supports stateful ( store: true ) and server-sent event (SSE) str…Thu 17 Sep
• BreakingAgent Platform SDK for Python version 2.0.1 is available Version 2.0.1 of the Agent Platform SDK for Python ( google-cloud-agentplatform ) is now available. Thi…Fri 18 Sep
• FeaturexAI's Grok 4.6 is generally available Grok 4.6 is now generally available (GA) and available for production use on the global endpoint and the US multi-region e…Fri 18 Sep

Google Cloud Armor — 1

• FeatureCloud Armor managed rulesets protect your backend services and APIs from a wide range of web application threats using threat signatures which are automatically…Thu 17 Sep

Google Cloud Contact Center as a Service — 13

• AnnouncementMobile SDKs 2.16.2 We've released version 2.16.2 of the mobile SDKs.Tue 15 Sep
• FeatureChat check-in for the Mobile SDKs Chat check-in is now available for the mobile SDKs. Chat check-in ensures that end-users are present and ready to engage befor…Tue 15 Sep
• FeatureNew "is typing" indicator in the Mobile SDKs The mobile SDKs now display an "is typing" indicator to the end-user when an agent is typing.Tue 15 Sep
• FixedWe've addressed the following issues. Android and iOS SDKs: Fixed an issue that occurred after force-closing a mobile app while the check-in timeout dialog was…Tue 15 Sep
• AnnouncementGoogle Cloud CCaaS 6.13 We've released version 6.13 of Google Cloud CCaaS. The timing of the update to your instance depends on the deployment schedule that you…Fri 18 Sep
• AnnouncementAdvanced reporting dashboards 6.4 We've released version 6.4 of the advanced reporting dashboards.Fri 18 Sep
• FeatureReal-time Agent Monitoring dashboard: new Active call ID(s) column The Real-time Agent Monitoring dashboard now has an Active Call ID(s) column in the Live Agen…Fri 18 Sep
• FeatureImproved filtering by team We made the following changes to team-based filtering: Renamed the Teams filter to Agent Teams to clarify that it filters by the agen…Fri 18 Sep
• FeatureImproved the Real-time Calls and Real-time Chats dashboards We made the following dashboard improvements: Real-time Calls - Calls Connected dashboard . Added th…Fri 18 Sep
• FeatureReal-time Calls - Calls Queued dashboard: new Projecting column The Real-time Calls - Calls Queued dashboard has a new Projecting column in the Call Queued tabl…Fri 18 Sep
• FeatureAdvanced reporting available in French Canadian All advanced reporting dashboards and Explores are now available in French Canadian. When you select French Cana…Fri 18 Sep
• FixedThis release addresses the following issues: Fixed an issue where session metadata and data feed files were missing from external storage for chats that ended b…Fri 18 Sep
• FixedThis release addresses the following issues: Fixed an issue where the formatting of numeric values was inconsistent across tiles. Fixed an issue where column he…Fri 18 Sep

Google Distributed Cloud (software only) for VMware — 3

• AnnouncementGoogle Distributed Cloud (software only) for VMware 1.33.1200-gke.83 is now available for download. To upgrade, see Upgrade clusters . Google Distributed Cloud…Tue 15 Sep
• AnnouncementGoogle Distributed Cloud (software only) for VMware 1.34.900-gke.135 is now available for download. To upgrade, see Upgrade a cluster . Google Distributed Cloud…Thu 17 Sep
• FixedThe following issues were fixed in 1.34.900-gke.135: Fixed vulnerabilities listed in Vulnerability fixes . Fixed an issue where user clusters repeatedly alterna…Thu 17 Sep

Google Distributed Cloud (software only) for bare metal — 3

• AnnouncementGoogle Distributed Cloud (software only) for bare metal 1.33.1200-gke.83 is now available for download. To upgrade, see Upgrade clusters . Google Distributed Cl…Tue 15 Sep
• AnnouncementGoogle Distributed Cloud (software only) for bare metal 1.34.900-gke.135 is now available for download. To upgrade, see Upgrade clusters . Google Distributed Cl…Thu 17 Sep
• FixedThe following issues were fixed in 1.34.900-gke.135: Fixed vulnerabilities listed in Vulnerability fixes . Fixed an issue where the status for Ingress resources…Thu 17 Sep

Google Kubernetes Engine — 12

• Change(2026-R39) Version updates GKE cluster versions have been updated. New versions available for upgrades and new clusters. The following versions are now availabl…Thu 17 Sep
• Change(2026-R39) Version updates Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and…Thu 17 Sep
• Change(2026-R39) Version updates Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and…Thu 17 Sep
• Change(2026-R39) Version updates Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and…Thu 17 Sep
• Change(2026-R39) Version updates Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and…Thu 17 Sep
• Change(2026-R39) Version updates Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and…Thu 17 Sep
• Extended channelNote : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to…Thu 17 Sep
• No channel (deprecated)Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to…Thu 17 Sep
• Rapid channelNote : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to…Thu 17 Sep
• Regular channelNote : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to…Thu 17 Sep
• Security(2026-R39) Security updates This release includes new GKE versions that use updated Container-Optimized OS images. These updated images are cumulative, incorpor…Thu 17 Sep
• Stable channelNote : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to…Thu 17 Sep

Google SecOps — 1

• Feature[Spotlight Feature] GoogleSQL query support in Search This feature is in public preview. You can now use GoogleSQL in Search to query your security data in Goog…Mon 14 Sep

Knowledge Catalog — 1

• FeatureMetadata for BigQuery Graph is now automatically ingested and searchable in Knowledge Catalog. This feature is available in preview . For more information, see…Mon 14 Sep

Looker — 20

• AnnouncementLooker 26.18 will roll out to Looker (original) instances on the following schedule: Expected deployment start: Monday, September 21, 2026 Expected final deploy…Thu 17 Sep
• FixedAn issue has been fixed where custom content theme fonts were improperly applied to the Look edit mode bar. This feature now performs as expected.Thu 17 Sep
• FixedAn issue has been fixed where downloading a dashboard as a CSV or ZIP file could result in a 500 error if any dashboard elements lacked an explicit title. This…Thu 17 Sep
• FixedAn issue has been fixed where links created using the LookML link parameter could return a 500 error if no label was specified. This feature now performs as exp…Thu 17 Sep
• FixedAn issue has been fixed where dashboard filter token chips didn't display an active highlighted background when a filter value was selected. This feature now pe…Thu 17 Sep
• FixedAn issue has been fixed where the Git connection test could fail to recognize Git credentials as sufficient if a branch protection rule on the Git provider rest…Thu 17 Sep
• FixedAn issue has been fixed where analytic models that referenced cross-database, schema-qualified, or dot-delimited table names failed to compile in BigQuery and S…Thu 17 Sep
• FixedAn issue has been fixed where custom tooltips in Single Record visualizations appeared at the bottom of the Explore panel rather than directly beneath the selec…Thu 17 Sep
• FixedAn issue has been fixed where dashboard filter tokens and popover menus could fail to inherit fonts from custom themes. This feature now performs as expected.Thu 17 Sep
• FixedAn issue has been fixed where dragging series between Y-axes on pivoted Cartesian charts could cause the Explore page to crash or prevent visualization configur…Thu 17 Sep
• FixedAn issue has been fixed in Explores where you couldn't scroll within the Chart Config Editor dialog when editing JSON visualization configurations. This feature…Thu 17 Sep
• FixedAn issue has been fixed where scheduled PDF deliveries to Cloud Storage could produce corrupted files and unexpectedly replace spaces in filenames with undersco…Thu 17 Sep
• FixedAn issue has been fixed where attempting to visualize pivoted query results in SQL Runner resulted in a TypeError configuration error. This feature now performs…Thu 17 Sep
• FixedAPI requests that target a LookML project whose files or directories aren't found on the instance now return a 404 Not Found error instead of a 500 Internal Ser…Thu 17 Sep
• FixedIn Conversational Analytics, the Open in Explore button and sidebar exploration links are now hidden or disabled with explanatory tooltips when you lack explore…Thu 17 Sep
• FixedThe embed preload page now supports custom theming using the theme URL query parameter.Thu 17 Sep
• FixedDonut Multiples visualizations now automatically hide overlapping value labels.Thu 17 Sep
• FixedAn issue has been fixed in self-service analytics where CSV and Excel uploads to BigQuery and Snowflake could fail or corrupt data when files contained multilin…Thu 17 Sep
• FixedAn issue has been fixed where creating a shared branch based on the production branch in a bare repository project could initialize from stale remote commits, c…Thu 17 Sep
• FixedAn issue has been fixed where scheduled deliveries intermittently failed with permission errors such as Cannot send all results because user permissions were in…Thu 17 Sep

Memorystore for Valkey — 1

• FeatureThe basic token-based authentication feature is generally available .Fri 18 Sep

Model Armor — 1

• FeatureFilter version v4 is available and set as the default for the Latest alias. Filter version v3 is promoted to the Stable alias in all supported regions except th…Fri 18 Sep

NetApp Volumes — 2

• AnnouncementEffective September 15, 2026, you can't create new Flex File storage pools, but existing pools remain supported. Support for the Flex File service level of Goog…Tue 15 Sep
• FeatureOrganization Policy Service custom constraints are available for Google Cloud NetApp Volumes. You can use custom constraints to control how NetApp Volumes is us…Thu 17 Sep

Network Intelligence Center — 1

• FeatureWhen adding a new Google Cloud Compute Engine, container, or VM Monitoring Point, Cloud Network Insights lets you generate Google Cloud CLI commands in the Goog…Mon 14 Sep

Oracle Database@Google Cloud — 1

• FeatureFor Exadata Database Service, Oracle Database@Google Cloud is available in europe-west12 (Turin, Italy) region. For a list of supported locations, see Supported…Thu 17 Sep

Policy Intelligence — 1

• FeaturePolicy Troubleshooter now supports troubleshooting access for agent identities . You can troubleshoot IAM allow policies, deny policies, and principal access bo…Tue 15 Sep

Secret Manager — 1

• FeatureParameter Manager supports CRC32C checksums to verify data integrity when you add or access parameter versions. For more information, see Data integrity assuran…Mon 14 Sep

Secure Source Manager — 1

• FeatureSecure Source Manager webhooks now support Pull request comment trigger events. You can configure webhooks to trigger notifications whenever a comment is added,…Wed 16 Sep

Security Command Center — 2

• DeprecatedData Security Posture Management is deprecated. It will be shut down on February 1, 2027. Learn more about the controls and alternative detection capabilities .Mon 14 Sep
• FeatureYou can use the following MCP server endpoints to enable LLM agents to perform investigative and management tasks in Security Command Center. Security Command C…Wed 16 Sep

Spanner — 1

• FeatureSpanner queues are generally available (GA) . Spanner queues provide transactional messaging to help you manage asynchronous work. The feature pairs this capabi…Thu 17 Sep

Vertex AI Search — 1

• FeatureAgent Search: Search query add-ons for configurable pricing (GA) Search query add-on specifications ( searchAddonSpec ) for configurable pricing are generally a…Mon 14 Sep

Virtual Private Cloud — 3

• FeatureGeneral Availability : You can add Dynamic NICs to the same VPC network used by other network interfaces of a Compute Engine instance. For more information, see…Wed 16 Sep
• FeatureGeneral Availability : VPC Flow Logs supports logging for App Engine resources that are configured with Direct VPC egress . For more information, see Serverless…Wed 16 Sep
• FeatureGeneral Availability : VPC Flow Logs adds the following metadata annotations for Private Service Connect: src_psc_interface and dest_psc_interface psc.consumer_…Wed 16 Sep

Official Google Cloud references

• Google Cloud release notes
• Google Cloud security bulletins
• Google Cloud blog
• Troubleshooting access
• Cloud SQL database versions and version policies