Everything Google Cloud Shipped This Week, Ranked

The week in one paragraph

A week with more structural change in it than the note count suggests. Google announced that from November it will start applying project liens on your behalf when a backup vault has enforced retention, which turns a control most estates never used into something they will meet whether they chose it or not. Cloud Storage closed part of the gap between "the project is restorable" and "the data is restorable". Networking got Global Front End, a Preview that packages the load balancer, Cloud Armor, Cloud CDN and Service Extensions as one product with consolidated pricing. Compute got the M4N series at GA. And BigQuery raised a limit tenfold while putting a 2027 restriction on graph processing.

Two changes that update what this series said days ago

Both landed on Monday, and both narrow a gap described in an architecture post published within the last week. That is unusual enough to lead with.

Cloud Storage now keeps soft-deleted buckets through a project deletion. If you delete a project, buckets with soft delete enabled are retained for a limited time before being permanently deleted — and if you restore the project during that window, those buckets are restored to the state they were in when the project was deleted.

That directly addresses the sharpest edge in #6, on deleting a project. The documented position there is that the 30-day window protects the project record while some services, Cloud Storage named among them, might delete resources much sooner. This does not remove that caveat, and it does substantially improve the most common instance of it. The qualifier that still matters is soft delete enabled: a bucket without it is not covered, and the retention window is described as limited rather than as matching the project's 30 days.

Backup and DR will start creating liens for you. From 1 November 2026, the service automatically applies a project-level lien to any project containing a backup vault whose backups are protected by enforced retention. Google also points at securing those liens against unauthorised removal with multi-party approval through Privileged Access Manager.

#7 made the point that liens are not only a control you apply but one you encounter — Google's own services create them, and the origin field exists to tell you which. This is that mechanism arriving on a schedule, for a service many estates run. The practical consequence: from November, a project deletion that used to fail for mysterious reasons will fail for a documented one, and the team that meets it will need to know that lifting a lien is a separate permission from deleting a project.

Networking and the edge

Global Front End is the week's largest single change and it is a packaging one. It combines global external Application Load Balancers, Google Cloud Armor, Cloud CDN and Service Extensions into one solution for delivering, scaling and securing internet-facing applications, with pricing consolidated across those products. It is in Preview, and it showed up in the release notes of three separate products on the same day — Cloud CDN, Cloud Load Balancing and Cloud Armor — which is itself a signal about how Google intends the edge to be bought.

Worth watching rather than acting on. A unified offering that consolidates billing across four products changes cost modelling for anyone who currently reasons about them separately, and Preview is the wrong moment to rebuild a cost model.

Private Service Connect reached GA for multi-regional service endpoints. PSC endpoints and backends can now access multi-regional service endpoints. For estates using PSC as the private path to managed services, this removes a regional constraint that previously had to be designed around.

Cloud CDN added support for the targeted CDN-Cache-Control response header from RFC 9213, and Cloud NGFW restored support for the Advanced malware sandbox service.

Compute and data

The M4N machine series is generally available — network- and memory-optimized, on 5th generation Intel Xeon Scalable processors. A new memory-optimized family at GA is worth a look for anyone sizing databases or in-memory workloads, and worth checking per zone before designing around it, since machine types are zonal.

BigQuery raised the default per-project limit of user-specific reservation assignments from 10 to 100 — a tenfold increase, and a real constraint removed for anyone doing fine-grained slot allocation across teams.

BigQuery Graph is being restricted. From 26 April 2027, core graph processing moves to the Enterprise and Enterprise Plus editions only. Eight months of notice, which is generous, and exactly the kind of item that gets forgotten for seven of them.

Also this week: Bigtable added an allow_incomplete_view query hint for reading continuous materialized views before they are fully populated; AlloyDB improved memory estimation to prevent out-of-memory errors during index builds, and gained MCP Toolbox access to its observability features; and Database Migration Service added MySQL 9.7 support for homogeneous migrations.

Platform, runtimes and compliance

App Engine had a busy week. Go 1.27 is in Preview on the flexible environment; migrating from the App Engine Images service to Cloud Run reached GA; push queues can be migrated to Cloud Tasks by updating the bundled services SDK; and the flexible environment is moving to newer MySQL support. The direction is consistent and has been for a while — the supported path off App Engine's bundled services is being paved one service at a time.

Batch's Debian 11 image family has reached end of development, following the end of support for Debian 11 itself.

Canada compliance landed twice. Assured Workloads made the Data Boundary for the Canada Controlled Goods Program generally available, and NetApp Volumes became Canada Controlled Goods compliant for its Standard, Premium and Extreme service levels. Two independent notes in one week is usually a coordinated push rather than a coincidence.

Gemini Code Assist first-month credits are discontinued for customers currently receiving them — a small change that will show up as a bill increase for anyone who budgeted on the credited rate.

The routine remainder

Of 224 distinct changes, 155 were routine image and version notes, listed here as a group rather than individually:

• 147 Container-Optimized OS notes — overwhelmingly CVE fixes and package bumps across image families, and the reason the week's raw count looks larger than its substance. Relevant if you pin COS images; otherwise they arrive on their own.
• 8 Google SecOps Marketplace integration updates — the usual version bumps and action additions across third-party connectors.

Security notes made up 132 of the 242 raw notes this week, the great majority of them within that Container-Optimized OS batch.

What I would act on

1. Diarise 1 November and find your backup vaults now. If any project holds a vault with enforced retention, it will acquire a lien automatically. That is a good outcome and a surprising one if it is discovered during a decommission. Check who holds roles/resourcemanager.lienModifier before you need them.
2. Check whether soft delete is enabled on buckets you would miss. The new project-deletion protection applies only to buckets that have it. This is the cheapest item in the week and it closes the gap that makes project deletion genuinely dangerous.
3. Put 26 April 2027 against BigQuery Graph. If you use core graph processing outside Enterprise editions, the eight months of notice is the whole budget for either upgrading or moving.
4. Re-check the Gemini Code Assist line on next month's bill if you were on first-month credits, so the increase is expected rather than investigated.
5. Read Global Front End, do not adopt it yet. Preview, and it changes how four products are priced together. Understanding it before it reaches GA is worth more than being early.

Complete inventory — all 282 notes

How this inventory reconciles

Google Cloud published 282 notes across 56 products and 5 days in this window, read from 4 feeds. Every one of them is accounted for below, in exactly one place:

Repeating runs, rolled up

• Container Optimized OS (131 notes) — Security131 notes, across 7 releases (cos-117-18613-675-56, cos-121-18867-528-65, cos-125-19216-532-108, cos-125-19216-532-121, cos-125-19216-532-123, cos-129-19506-299-137, cos-129-19506-299-148). They fix 49 distinct CVEs. A CVE is patched once per release, so the note count is higher than the CVE count — these are separate notes, not duplicates, and are counted as such: CVE-2026-64227, CVE-2026-64380, CVE-2026-64476, CVE-2026-64561, CVE-2026-64562, CVE-2026-64567, CVE-2026-64572, CVE-2026-64576, CVE-2026-64579, CVE-2026-64580, CVE-2026-64590, CVE-2026-64593, CVE-2026-64597, CVE-2026-64598, CVE-2026-64604, CVE-2026-68081, CVE-2026-68092, CVE-2026-68093, CVE-2026-68116, CVE-2026-68119, CVE-2026-68136, CVE-2026-68139, CVE-2026-68142, CVE-2026-68145, CVE-2026-68146, CVE-2026-68147, CVE-2026-68149, CVE-2026-68171, CVE-2026-68184, CVE-2026-68186, CVE-2026-68187, CVE-2026-68284, CVE-2026-68296, CVE-2026-68299, CVE-2026-68325, CVE-2026-68329, CVE-2026-68336, CVE-2026-68338, CVE-2026-68343, CVE-2026-68386, CVE-2026-68388, CVE-2026-68396, CVE-2026-68398, CVE-2026-68422, CVE-2026-68425, CVE-2026-68428, CVE-2026-68432, CVE-2026-68442, CVE-2026-68450.

One change, published under several products

• FeatureStarting from August 2026, to provide modern security patches and support for MySQL 8.4 and later, the App Engine flexible environment uses Cloud SQL Auth Proxy…Published under 8 products: App Engine flexible environment .NET, App Engine flexible environment Go, App Engine flexible environment Java, App Engine flexible environment Node.js, App Engine flexible environment PHP, App Engine flexible environment Python, App Engine flexible environment Ruby, App Engine flexible environment custom runtimes.
• FeatureStarting from Go runtime version 1.26 and later, the lifecycle support dates align more closely with the Go community release cycle . For more information, see…Published under 5 products: App Engine flexible environment Go, App Engine standard environment Go, Buildpacks, Cloud Run, Cloud Run functions.
• FeatureSupport for the Go 1.27 runtime is in Preview .Published under 4 products: App Engine flexible environment Go, App Engine standard environment Go, Cloud Run, Cloud Run functions.
• FeatureYou can migrate your App Engine push queues to Cloud Tasks by updating the bundled services SDK. This method lets you upgrade your app without needing to modify…Published under 3 products: App Engine standard environment Go, App Engine standard environment Java, App Engine standard environment Python.
• AnnouncementCredits for the first month of Gemini Code Assist usage are discontinued. Customers currently receiving these credits are unaffected by this change. Previously…Published under 2 products: Gemini, Gemini Code Assist.
• FeatureSupport for migrating from the App Engine Images service to Cloud Run is in General Availability (GA) .Published under 2 products: App Engine standard environment Java, App Engine standard environment Python.

Everything else, by product

AI Hypercomputer — 1

• ChangeAI Hypercomputer has expanded to cover all GPU machine series. Specifically, the documentation for AI Hypercomputer has been significantly updated as follows: D…Fri 21 Aug

AlloyDB for PostgreSQL — 2

• FeatureYou can now use the Model Context Protocol (MCP) Toolbox for Databases to access AlloyDB observability features and advanced query insights directly in your IDE…Mon 17 Aug
• FixedAlloyDB now provides more accurate memory usage estimation, and it prevents out-of-memory (OOM) errors when you build a ScaNN four-level tree index . This featu…Fri 21 Aug

Application Integration — 1

• SecurityMissing authorization in QueryEngineTask (CVE-2026-12710) A missing authorization vulnerability ( CVE-2026-12710 ) in QueryEngineTask in Application Integration…Fri 21 Aug

Assured Workloads — 3

• FeatureThe Data Boundary for Canada Controlled Goods Program (CGP) control package is now generally available.Mon 17 Aug
• FeatureThe Switzerland Data Boundary with Access Justifications control package is now generally available.Fri 21 Aug
• FeatureThe Data Boundary for ITAR supports the following products: Apigee Artifact Analysis Backup and DR Service Cloud Billing API Cloud Deploy Spanner Eventarc GKE I…Fri 21 Aug

Backup and DR — 1

• AnnouncementBeginning November 1, 2026, Backup and DR will automatically apply a project-level lien to any project containing a backup vault with backups protected by enfor…Mon 17 Aug

Batch — 1

• DeprecatedThe Batch Debian 11 operating system (OS) image family has reached end of development due to the end of support (EOS) for Compute Engine Debian 11 images on Aug…Wed 19 Aug

BigQuery — 4

• FeatureThe default per-project limit of user-specific reservation assignments has been increased from 10 to 100.Tue 18 Aug
• DeprecatedStarting April 26, 2027, core graph processing for BigQuery Graph will be restricted to the BigQuery Enterprise and Enterprise Plus editions . Consequently, we…Thu 20 Aug
• FeatureBigQuery supports the following table-valued functions in the query editor and as part of conversational analytics to help you analyze your time series data: ML…Thu 20 Aug
• FeatureThe run_bq_command tool exposes the bq command-line tool within the Cloud CLI remote MCP server. AI agents can now execute advanced BigQuery operations, such as…Thu 20 Aug

Bigtable — 1

• FeatureYou can use the allow_incomplete_view query hint in SQL queries to read data from a continuous materialized view before its initial population finishes. This fe…Thu 20 Aug

Blog — 6

• PostExpanding Google Antigravity for enterprise customersThu 20 Aug
• PostGoogle is a Leader in the 2026 Gartner® Magic Quadrant™ for Cloud-Native Application PlatformsThu 20 Aug
• PostHow AlloyDB ScaNN scales vector search to 10 billion vectorsThu 20 Aug
• Post10 questions every startup should answer before moving to production with their AI prototypeThu 20 Aug
• PostCloud CISO Perspectives: Sticking to security fundamentals in the AI eraFri 21 Aug
• PostHow agents can delegate betterFri 21 Aug

Cloud CDN — 2

• FeatureCloud CDN supports the targeted CDN-Cache-Control HTTP response header RFC 9213 . You can use this header to specify caching directives specifically for Cloud C…Mon 17 Aug
• FeatureGlobal Front End is a unified offering that simplifies billing by consolidating pricing across networking products, including Cloud CDN, global external Applica…Wed 19 Aug

Cloud Database Migration Service — 1

• AnnouncementDatabase Migration Service for MySQL homogeneous migrations now supports MySQL version 9.7. For more information, see Supported source and destination databases…Mon 17 Aug

Cloud Load Balancing — 1

• FeatureGlobal Front End combines global external Application Load Balancers, Google Cloud Armor, Cloud CDN, and Service Extensions into one solution to help deliver, s…Wed 19 Aug

Cloud NGFW — 1

• FeatureSupport for the Advanced malware sandbox (WildFire) service is now restored. You can now use Advanced malware sandbox to perform deep inspection of network-rout…Mon 17 Aug

Cloud Service Mesh — 1

• FeatureThe guidance for using proxy image types ( default and distroless ) with Managed Cloud Service Mesh has been updated: Directly onboarded clusters using the TRAF…Thu 20 Aug

Cloud Storage — 2

• FeatureIf you delete your project, buckets that have soft delete enabled are now retained for a limited amount of time before being permanently deleted. If you restore…Mon 17 Aug
• FeatureRapid Cache supports prefix-level ingest-on-write filtering, allowing you to selectively ingest objects that match specific prefixes rather than ingesting all o…Fri 21 Aug

Cloud Trace — 1

• FeatureThe following limits associated with the Cloud Trace API, cloudtrace.googleapis.com , have increased: Maximum attributes per span: 1,024 Maximum attribute value…Mon 17 Aug

Compute Engine — 2

• FeaturePreview : Image Builder is available in allowlist-only Preview. Image Builder is a declarative operating system (OS) image customization tool that automates the…Thu 20 Aug
• FeatureGenerally available : The network- and memory-optimized M4N machine series is generally available. Powered by 5th generation Intel Xeon Scalable processors (Eme…Fri 21 Aug

Config Connector — 6

• AnnouncementConfig Connector version 1.155.1 is now available.Thu 20 Aug
• ChangeReconciliation Improvements: We have added support for direct reconciliation to more resources, with opt-in behavior. The API is unchanged. To use the direct re…Thu 20 Aug
• FeatureNew Beta Resources (Direct Reconciler): DiscoveryEngineLicenseConfig Manage Discovery Engine license configurations to manage application licenses. StorageManag…Thu 20 Aug
• FeatureNew Fields: BigtableTable Added spec.automatedBackupPolicy field. CertificateManagerDNSAuthorization Added spec.type field. ComputeForwardingRule Added spec.tar…Thu 20 Aug
• FeatureNew Features: Configurable metrics server address : Made the manager's built-in metrics server bind address configurable. Brownfield state comparison : Added a…Thu 20 Aug
• FixedBug Fixes: ComposerEnvironment Improved reconciliation, diffing, and update logic for ComposerEnvironment in the direct reconciler. ( GitHub PR #12364 ) Skip th…Thu 20 Aug

Container Optimized OS — 16

• Changecos-beta-133-19999-0-46 Kernel Docker Containerd GPU Drivers COS-6.18.39 v29.4.3 v2.3.2 See ListMon 17 Aug · cos-beta-133-19999-0-46
• Changecos-129-19506-299-137 Kernel Docker Containerd GPU Drivers COS-6.12.94 v27.5.1 v2.2.6 See ListMon 17 Aug · cos-129-19506-299-137
• ChangeRuntime sysctl changes: Changed: net.ipv4.udp_mem: 188034 250715 376068 -> 188034 250714 376068Mon 17 Aug · cos-129-19506-299-137
• Changecos-125-19216-532-108 Kernel Docker Containerd GPU Drivers COS-6.12.94 v27.5.1 v2.1.9 See ListMon 17 Aug · cos-125-19216-532-108
• Changecos-121-18867-528-65 Kernel Docker Containerd GPU Drivers COS-6.6.143 v27.5.1 v2.0.10 See ListMon 17 Aug · cos-121-18867-528-65
• Changecos-117-18613-675-56 Kernel Docker Containerd GPU Drivers COS-6.6.143 v24.0.9 v1.7.34 See ListMon 17 Aug · cos-117-18613-675-56
• FeatureEnabled CONFIG_UDMABUF on x86_64.Mon 17 Aug · cos-129-19506-299-137
• FeatureEnabled CONFIG_UDMABUF on x86_64.Mon 17 Aug · cos-129-19506-299-137
• FeatureEnabled CONFIG_UDMABUF on x86_64.Mon 17 Aug · cos-125-19216-532-108
• Changecos-125-19216-532-121 Kernel Docker Containerd GPU Drivers COS-6.12.94 v27.5.1 v2.1.9 See ListWed 19 Aug · cos-125-19216-532-121
• Changecos-129-19506-299-148 Kernel Docker Containerd GPU Drivers COS-6.12.94 v27.5.1 v2.2.6 See ListWed 19 Aug · cos-129-19506-299-148
• ChangeRuntime sysctl changes: Changed: net.ipv4.udp_mem: 188034 250714 376068 -> 188034 250715 376068Wed 19 Aug · cos-129-19506-299-148
• FixedUpdated cos-gpu-installer to v2.7.6.Wed 19 Aug · cos-125-19216-532-121
• FixedUpdated cos-gpu-installer to v2.7.6.Wed 19 Aug · cos-129-19506-299-148
• Changecos-125-19216-532-123 Kernel Docker Containerd GPU Drivers COS-6.12.94 v27.5.1 v2.2.7 See ListThu 20 Aug · cos-125-19216-532-123
• ChangeUpdated containerd to v2.2.7.Thu 20 Aug · cos-125-19216-532-123

Dataform — 1

• FeatureYou can now use the Dataform remote Model Context Protocol (MCP) server to manage data transformation workflows through AI agents. This feature is generally ava…Mon 17 Aug

Gemini — 1

• OtherBug fixes in IntelliJ Various bug fixes and minor product enhancements.Thu 20 Aug · Bug

Gemini Enterprise — 10

• FeatureGemini Enterprise: General availability for registering A2UI and A2A agents with Gemini Enterprise, including A2UI version v0.9 support Gemini Enterprise admini…Mon 17 Aug
• FeatureGemini Enterprise: Show new team member announcements on the app home page Gemini Enterprise can display new team member announcement cards on the app home page…Tue 18 Aug
• FeatureGemini Enterprise: Gemini 3.6 Flash available in US and EU multi-regions Gemini 3.6 Flash is generally available in the us and eu multi-regions, and an allowlis…Tue 18 Aug
• FeatureGemini Enterprise: Access and configure AI developer tools AI developer tools is generally available (GA) for Gemini Enterprise Standard, Plus, and Pay-as-you-g…Tue 18 Aug
• ChangeGemini Enterprise: Subscription seat quantity limits If you purchase or modify a seat-based subscription directly through the Google Cloud console, the number o…Wed 19 Aug
• FeatureGemini Enterprise: Antigravity for IDEs available in AI developer tools Antigravity for IDEs is available as part of AI developer tools for Gemini Enterprise St…Thu 20 Aug
• FeatureGemini Enterprise and Gemini Notebook Enterprise: Autocomplete for sharing notebooks and agents with Okta If you use Okta as your external identity provider (Id…Thu 20 Aug
• FeatureGemini Enterprise: Google Identity support for third-party data stores Google Identity is supported and recommended to manage access when connecting third-party…Thu 20 Aug
• FeatureGemini Enterprise: AI developer tools on Standard Emerging Market edition The AI developer tools feature is available on the Gemini Enterprise Standard Emerging…Fri 21 Aug
• FeatureGemini Enterprise: New data stores and support for new actions (Public Preview) The following data stores are available in Public Preview in Gemini Enterprise:…Fri 21 Aug

Gemini Enterprise Agent Platform — 2

• FeatureCodeMender updates: Model support This release introduces updates to CodeMender: Gemini 3 Flash removal : Gemini 3 Flash ( gemini-3-flash-preview ) is no longer…Tue 18 Aug
• FeaturexAI's Grok 4.6 Grok 4.6 is available in Preview in Model Garden.Fri 21 Aug

Google Cloud Armor — 1

• FeatureGlobal Front End is a unified offering that simplifies billing by consolidating pricing across networking products. Cloud Armor is included in the Global Front…Wed 19 Aug

Google Cloud Contact Center as a Service — 9

• AnnouncementGoogle Cloud CCaaS 6.3 We've released version 6.3 of Google Cloud CCaaS. The timing of the update to your instance depends on the deployment schedule that you h…Wed 19 Aug
• FeatureAgent desktop supports parameters in custom panel URLs In the agent desktop, you can now configure fixed and dynamic parameters to include in the URLs of custom…Wed 19 Aug
• FeatureCallback offer restrictions You now have greater control over when callbacks are offered. You can configure the following: Prevent callback offers from being ma…Wed 19 Aug
• FixedThis release addresses the following issues: Fixed an issue where chat transcripts incorrectly displayed undefined joined instead of the agent's name during a c…Wed 19 Aug
• AnnouncementGoogle Cloud CCaaS 6.4 We've released version 6.4 of Google Cloud CCaaS. The timing of the update to your instance depends on the deployment schedule that you h…Fri 21 Aug
• FeatureAutomatic SIP parameter mapping in contact lists Contact lists now support automatic SIP header mapping for outbound call destinations. Administrators: In the A…Fri 21 Aug
• FeatureEmail OAuth profiles and Microsoft 365 client credentials You can now create email OAuth profiles for Microsoft 365 using the client credentials grant type. Thi…Fri 21 Aug
• FeatureImproved connection times for predictive dialing We reduced the connection time for predictive dialing to under two seconds to comply with CRTC and FTC regulati…Fri 21 Aug
• FixedThis release addresses the following issues: Fixed an issue where a long delay occurred when an agent clicked Chat Shortcuts in the chat adapter. Fixed an agent…Fri 21 Aug

Google Distributed Cloud (software only) for VMware — 2

• AnnouncementGoogle Distributed Cloud (software only) for VMware 1.34.800-gke.90 is now available for download. To upgrade, see Upgrade clusters . Google Distributed Cloud 1…Wed 19 Aug
• FixedThe following issues were fixed in 1.34.800-gke.90: Fixed vulnerabilities listed in Vulnerability fixes . Fixed an issue where user clusters remained stuck in a…Wed 19 Aug

Google Distributed Cloud (software only) for bare metal — 2

• AnnouncementGoogle Distributed Cloud (software only) for bare metal 1.34.800-gke.90 is now available for download. To upgrade, see Upgrade clusters . Google Distributed Clo…Wed 19 Aug
• FixedThe following issues were fixed in 1.34.800-gke.90: Fixed vulnerabilities listed in Vulnerability fixes . Removed csi-snapshot-validation-webhook , the Snapshot…Wed 19 Aug

Google Kubernetes Engine — 15

• ChangeFor node pools running on GKE versions 1.36.3-gke.1480000 and later, the minimum supported boot disk size is 15 GB. For earlier versions, the minimum supported…Tue 18 Aug
• Change(2026-R35) Version updates GKE cluster versions have been updated. New versions available for upgrades and new clusters. The following versions are now availabl…Thu 20 Aug
• Change(2026-R35) Version updates Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and…Thu 20 Aug
• Change(2026-R35) Version updates Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and…Thu 20 Aug
• Change(2026-R35) Version updates Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and…Thu 20 Aug
• Change(2026-R35) Version updates Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and…Thu 20 Aug
• Change(2026-R35) Version updates Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and…Thu 20 Aug
• Extended channelNote : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to…Thu 20 Aug
• No channel (deprecated)Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to…Thu 20 Aug
• Rapid channelNote : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to…Thu 20 Aug
• Regular channelNote : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to…Thu 20 Aug
• Security(2026-R35) Security updates This release includes new GKE versions that use updated Container-Optimized OS images. These updated images are cumulative, incorpor…Thu 20 Aug
• Stable channelNote : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to…Thu 20 Aug
• ChangePer the June 10, 2026 release note , the configuration option to not enroll your cluster in a release channel is deprecated, and will be removed on June 14, 202…Fri 21 Aug
• ChangeThe Windows Server 2019 (LTSC) GKE node image doesn't receive updates after the December 2025 version. Windows Server 2019 (LTSC) is in the Extended Support per…Fri 21 Aug

Google SecOps — 4

• Feature[Spotlight Feature] Evaluate threat coverage and generate rules with the Detection Engineering Agent This feature is in public preview. You can now evaluate and…Tue 18 Aug
• Feature[Spotlight Feature] Event simulation for detection coverage evaluation This feature is in public preview. You can now programmatically deliver realistic threat…Tue 18 Aug
• FeatureSide-by-side view on the Alerts & Detections tab in Cases This feature is in public preview. The Alerts & Detections tab in the revamped Investigation Managemen…Thu 20 Aug
• Feature[Spotlight Feature] Relative time filtering in Google SecOps This feature is in public preview. Google SecOps has updated how relative time filters calculate da…Fri 21 Aug

Google SecOps Marketplace — 8

• ChangeExchange : Version 125.0 Updated the parsing logic for nested S/MIME email attachments ( .eml ) sent from macOS and Windows in the following connector: Exchange…Wed 19 Aug
• ChangeMicrosoft Teams : Version 39.0 Updated error handling in the following job: Refresh Token Renewal JobWed 19 Aug
• ChangePalo Alto Cortex XDR : Version 32.0 Fixed an issue where the job repeatedly logged errors when a case was merged or deleted in Google SecOps in the following jo…Wed 19 Aug
• ChangeProofpoint Cloud Threat Response : Version 5.0 Fixed an issue where null, missing, or unmapped priority values in API payloads caused log ingestion errors in th…Wed 19 Aug
• ChangePub/Sub : Version 4.0 Added support for pubsub_message_id in the Unique ID Field parameter in the following connector: Pub/Sub - Messages ConnectorWed 19 Aug
• ChangeSplunk : Version 67.0 Updated the lookback timestamp progression logic when all fetched alerts in a cycle have already been processed in the following connector…Wed 19 Aug
• ChangeZscaler : Version 16.0 Fixed an issue where legacy API key and password authentication failed due to URL path normalization issues.Wed 19 Aug
• FeatureWiz : Version 9.0 Added the following new job: Wiz and Google SecOps Bi-directional Sync JobWed 19 Aug

Looker — 2

• AnnouncementLooker's Continuous Integration is based on the legacy standalone Spectacles service. Looker will continue to integrate and evolve the Spectacles features into…Mon 17 Aug
• AnnouncementThe latest versions in the Looker (Google Cloud core) release channels are beginning deployment as follows: Latest version in the Rapid channel: Looker 26.14 La…Tue 18 Aug

Managed Service for Apache Airflow — 7

• AnnouncementA new Managed Service for Apache Airflow release has started on August 20, 2026 . Get ready for upcoming changes and features as we roll out the new release to…Thu 20 Aug
• ChangeAirflow 3.1.8 is no longer included in Managed Airflow images and builds.Thu 20 Aug
• Change(Airflow 3.2.2, 3.1.8, and 2.11.1) The apache-airflow-providers-google package was upgraded to version 22.3.0. For more information about changes, see the apach…Thu 20 Aug
• ChangeNew Airflow builds are available in Managed Airflow (Gen 3): composer-3-airflow-3.3.1-build.0 composer-3-airflow-3.2.2-build.4 composer-3-airflow-2.11.1-build.1…Thu 20 Aug
• ChangeNew images are available in Managed Airflow (Gen 2): composer-2.17.11-airflow-2.11.1 (default) composer-2.17.11-airflow-2.10.5Thu 20 Aug
• FeatureAirflow 3.3.1 is available in Managed Airflow (Gen 3).Thu 20 Aug
• FeatureComposer Local Development CLI tool now supports deployment with Podman in Linux and Windows.Thu 20 Aug

Managed Service for Apache Spark — 2

• AnnouncementNew Managed Service for Apache Spark (formerly Dataproc on Compute Engine) subminor cluster image versions : 2.1.118-debian11, 2.1.118-rocky8, 2.1.118-ubuntu20,…Wed 19 Aug
• FixedManaged Service for Apache Spark (formerly Dataproc on Compute Engine): Fixed a segmentation fault when OpenLineage parses complex SQL query strings.Wed 19 Aug

NetApp Volumes — 1

• AnnouncementGoogle Cloud NetApp Volumes is now Canada Controlled Goods (CCG) compliant for the Standard, Premium, and Extreme service levels. For more information, see Comp…Tue 18 Aug

Network Security Integration — 1

• FeatureNetwork Security Integration in-band integration now supports the direct internet egress deployment model. In this model, the network security appliance in the…Thu 20 Aug

Oracle Database@Google Cloud — 1

• FeatureOracle Database@Google Cloud supports provisioning VM file system storage (VM images) and VM backups on Exascale storage for Exadata VM Clusters. This feature l…Wed 19 Aug

Secure Web Proxy — 1

• FeatureSecure Web Proxy now supports the local intermediate CA signing certificate issuance mode for TLS inspection. By using this mode, Secure Web Proxy caches a sing…Thu 20 Aug

Sensitive Data Protection — 1

• ChangeImage scanning is available in the following regions: europe-north1 us-central1 For more information, see Locations that support image scanning .Thu 20 Aug

Service Extensions — 1

• FeatureGlobal Front End is a unified offering that combines Service Extensions, global external Application Load Balancer, Google Cloud Armor, and Cloud CDN into one s…Thu 20 Aug

Service Health — 1

• FeatureThe Personalized Service Health remote MCP server provides a secure environment that lets you send natural language prompts to your AI application so that it ca…Fri 21 Aug

Virtual Private Cloud — 1

• FeatureGeneral Availability : You can use Private Service Connect endpoints and backends to access multi-regional service endpoints such as storage.us.rep.googleapis.c…Wed 19 Aug

Official Google Cloud references

• Google Cloud release notes (all products)
• Backup and DR Service release notes
• Cloud Storage release notes
• Cloud Load Balancing release notes
• Compute Engine release notes
• BigQuery release notes
• Virtual Private Cloud release notes
• Protecting projects with liens
• Cloud Storage soft delete