The week in one paragraph
A week with more structural change in it than the note count suggests. Google announced that from November it will start applying project liens on your behalf when a backup vault has enforced retention, which turns a control most estates never used into something they will meet whether they chose it or not. Cloud Storage closed part of the gap between "the project is restorable" and "the data is restorable". Networking got Global Front End, a Preview that packages the load balancer, Cloud Armor, Cloud CDN and Service Extensions as one product with consolidated pricing. Compute got the M4N series at GA. And BigQuery raised a limit tenfold while putting a 2027 restriction on graph processing.
1 November 2026 — Backup and DR begins automatically applying a project-level lien to any project containing a backup vault with enforced retention.
26 April 2027 — core graph processing for BigQuery Graph becomes restricted to the Enterprise and Enterprise Plus editions.
Two changes that update what this series said days ago
Both landed on Monday, and both narrow a gap described in an architecture post published within the last week. That is unusual enough to lead with.
Cloud Storage now keeps soft-deleted buckets through a project deletion. If you delete a project, buckets with soft delete enabled are retained for a limited time before being permanently deleted — and if you restore the project during that window, those buckets are restored to the state they were in when the project was deleted.
That directly addresses the sharpest edge in #6, on deleting a project. The documented position there is that the 30-day window protects the project record while some services, Cloud Storage named among them, might delete resources much sooner. This does not remove that caveat, and it does substantially improve the most common instance of it. The qualifier that still matters is soft delete enabled: a bucket without it is not covered, and the retention window is described as limited rather than as matching the project's 30 days.
Backup and DR will start creating liens for you. From 1 November 2026, the service automatically applies a project-level lien to any project containing a backup vault whose backups are protected by enforced retention. Google also points at securing those liens against unauthorised removal with multi-party approval through Privileged Access Manager.
#7 made the point that liens are not only a control you apply but one you encounter — Google's own services create them, and the origin field exists to tell you which. This is that mechanism arriving on a schedule, for a service many estates run. The practical consequence: from November, a project deletion that used to fail for mysterious reasons will fail for a documented one, and the team that meets it will need to know that lifting a lien is a separate permission from deleting a project.
Networking and the edge
Global Front End is the week's largest single change and it is a packaging one. It combines global external Application Load Balancers, Google Cloud Armor, Cloud CDN and Service Extensions into one solution for delivering, scaling and securing internet-facing applications, with pricing consolidated across those products. It is in Preview, and it showed up in the release notes of three separate products on the same day — Cloud CDN, Cloud Load Balancing and Cloud Armor — which is itself a signal about how Google intends the edge to be bought.
Worth watching rather than acting on. A unified offering that consolidates billing across four products changes cost modelling for anyone who currently reasons about them separately, and Preview is the wrong moment to rebuild a cost model.
Private Service Connect reached GA for multi-regional service endpoints. PSC endpoints and backends can now access multi-regional service endpoints. For estates using PSC as the private path to managed services, this removes a regional constraint that previously had to be designed around.
Cloud CDN added support for the targeted CDN-Cache-Control response header from RFC 9213, and Cloud NGFW restored support for the Advanced malware sandbox service.
Compute and data
The M4N machine series is generally available — network- and memory-optimized, on 5th generation Intel Xeon Scalable processors. A new memory-optimized family at GA is worth a look for anyone sizing databases or in-memory workloads, and worth checking per zone before designing around it, since machine types are zonal.
BigQuery raised the default per-project limit of user-specific reservation assignments from 10 to 100 — a tenfold increase, and a real constraint removed for anyone doing fine-grained slot allocation across teams.
BigQuery Graph is being restricted. From 26 April 2027, core graph processing moves to the Enterprise and Enterprise Plus editions only. Eight months of notice, which is generous, and exactly the kind of item that gets forgotten for seven of them.
Also this week: Bigtable added an allow_incomplete_view query hint for reading continuous materialized views before they are fully populated; AlloyDB improved memory estimation to prevent out-of-memory errors during index builds, and gained MCP Toolbox access to its observability features; and Database Migration Service added MySQL 9.7 support for homogeneous migrations.
Platform, runtimes and compliance
App Engine had a busy week. Go 1.27 is in Preview on the flexible environment; migrating from the App Engine Images service to Cloud Run reached GA; push queues can be migrated to Cloud Tasks by updating the bundled services SDK; and the flexible environment is moving to newer MySQL support. The direction is consistent and has been for a while — the supported path off App Engine's bundled services is being paved one service at a time.
Batch's Debian 11 image family has reached end of development, following the end of support for Debian 11 itself.
Canada compliance landed twice. Assured Workloads made the Data Boundary for the Canada Controlled Goods Program generally available, and NetApp Volumes became Canada Controlled Goods compliant for its Standard, Premium and Extreme service levels. Two independent notes in one week is usually a coordinated push rather than a coincidence.
Gemini Code Assist first-month credits are discontinued for customers currently receiving them — a small change that will show up as a bill increase for anyone who budgeted on the credited rate.
The routine remainder
Of 224 distinct changes, 155 were routine image and version notes, listed here as a group rather than individually:
- 147 Container-Optimized OS notes — overwhelmingly CVE fixes and package bumps across image families, and the reason the week's raw count looks larger than its substance. Relevant if you pin COS images; otherwise they arrive on their own.
- 8 Google SecOps Marketplace integration updates — the usual version bumps and action additions across third-party connectors.
Security notes made up 132 of the 242 raw notes this week, the great majority of them within that Container-Optimized OS batch.
What I would act on
- Diarise 1 November and find your backup vaults now. If any project holds a vault with enforced retention, it will acquire a lien automatically. That is a good outcome and a surprising one if it is discovered during a decommission. Check who holds
roles/resourcemanager.lienModifierbefore you need them. - Check whether soft delete is enabled on buckets you would miss. The new project-deletion protection applies only to buckets that have it. This is the cheapest item in the week and it closes the gap that makes project deletion genuinely dangerous.
- Put 26 April 2027 against BigQuery Graph. If you use core graph processing outside Enterprise editions, the eight months of notice is the whole budget for either upgrading or moving.
- Re-check the Gemini Code Assist line on next month's bill if you were on first-month credits, so the increase is expected rather than investigated.
- Read Global Front End, do not adopt it yet. Preview, and it changes how four products are priced together. Understanding it before it reaches GA is worth more than being early.
Comments