Everything Google Cloud Shipped This Week, Ranked

The week in one paragraph

The security news is the news. GCP-2026-058 is rated Critical and describes a missing project permission check in the GKE Multi-Cloud APIs that let an attacker register an attached cluster into an arbitrary target project's Workload Identity Federation — and then mint Workload Identity tokens and impersonate Kubernetes service accounts inside that project. That is a cross-project privilege escalation reached through an API that was not checking who owned the destination. Alongside it, GCP-2026-059 disclosed a project-takeover path in Integration Connectors that was patched on 11 December 2025 — a nine-month gap between fix and disclosure, and the second time in three weeks this series has covered a bulletin whose entire remediation is "no customer action is required". Away from security, BigQuery Graph reached general availability, closing a thread that started as a pricing restriction in roundup #2. Cloud SQL gained Workforce Identity Federation, so database authentication can now come from Okta or Active Directory. And in-cluster Cloud Service Mesh 1.27 went end of life eight days after roundup #3 named one of its patch releases as the fix for thirteen Envoy CVEs.

Three bulletins, and a nine-month gap

GCP-2026-058 — a permission check that was not there

The mechanism is worth reading slowly. A missing project permission check in the GKE Multi-Cloud APIs — CreateAttachedCluster, CreateAwsCluster, CreateAzureCluster — allowed an attacker to register an attached cluster into an arbitrary target project's Workload Identity Federation for GKE. That registration then allowed unauthorized creation of Workload Identity tokens and impersonation of Kubernetes service accounts holding bindings in the target project.

Every step after the first is the system working correctly. Workload Identity Federation is supposed to let a registered cluster obtain tokens; service account impersonation is supposed to follow from a binding. The flaw is only that nobody verified the caller had any right to the destination project. It is the clearest example this series has covered of why the boundary checks matter more than the capabilities they guard: the capability was fine, and one absent check turned it into a route between tenants.

GCP-2026-059 — fixed in December, told in September

A Missing Authorization vulnerability in the HTTP Connector in Integration Connectors versions prior to 11 December 2025. An authenticated attacker could use an unauthorized service account attachment to escalate privileges and take over a Google Cloud project. Google's instruction is one line: no customer action is required, the vulnerability was patched on 11 December 2025.

Roundup #3 covered a bulletin with the same shape — a Critical in the BigQuery Data Transfer Service JDBC driver, patched 1 May, disclosed 26 August. That gap was four months. This one is nine. Both are the managed-service bargain working as designed, and both are worth noticing rather than filing: the window in which you had a project-takeover path and no way to know about it was three quarters long, and the only artefact of it is a paragraph published afterwards saying it was handled.

GCP-2026-060 — Slurm, and a reminder about what you inherit

A security flaw in the Slurm sbcast tool, CVE-2026-65107, lets shared library files bypass security checks and can crash nodes in your cluster. It reaches Google Cloud through Cluster Director, and it is a useful reminder that a managed HPC service carries the upstream scheduler's vulnerabilities along with its convenience.

Two things this series told you days ago

Cloud Service Mesh 1.27 is no longer supported. Roundup #3, eight days ago, covered GCP-2026-057 — thirteen Envoy CVEs — and named 1.27.9-asm.34 as one of the three patch releases published alongside it. Anyone who took that patch and stopped there is now on an unsupported line. 1.30.4-asm.1 is available for in-cluster deployments.

The lesson is not that the advice was wrong; it was the correct fix for that bulletin. It is that a patch on a line approaching end of life buys weeks, and the upgrade is the actual remediation. Worth checking which line you are on rather than which patch you applied.

BigQuery Graph is generally available. Roundup #2 covered the restriction of core graph processing to Enterprise and Enterprise Plus editions from April 2027; roundup #3 deliberately left the re-announcement alone as a repeat. GA is a genuine new milestone, and it arrives with support for the CALL graph query statement and path inspection functions including IS_ACYCLIC, IS_SIMPLE and IS_TRAIL. The edition restriction still applies on the timetable already published, so the planning consequence from #2 is unchanged — GA makes it real rather than making it free.

Data platform: BigQuery had the week

• Identity columns. You can now create an identity column, sometimes referred to as an auto-incrementing column, on a table, in Preview. A small feature with a long tail: it removes one of the standard reasons a migration from a relational warehouse needs rewriting rather than porting.
• A Rust SDK is now in Preview. Notable less for Rust than for what the client-library roster says about who Google thinks is writing data pipelines now.
• Pipelines in Git folders reached general availability, with pipeline storage and management in folders alongside it.
• TabFM, a pre-trained foundation model for tabular data, is supported for zero-shot use.

Identity reaches the database

Cloud SQL supports Workforce Identity Federation authentication, letting you authenticate to an instance using identities from an external identity provider such as Microsoft Active Directory or Okta. Published across PostgreSQL and MySQL.

This is the more consequential of the week's non-security items for anyone running a platform. Database credentials are the last place local accounts survive in an estate that has otherwise moved to federated identity, and they are the accounts least likely to be deprovisioned when somebody leaves. Moving them onto the same identity provider as everything else closes a gap that is normally handled by a spreadsheet and good intentions.

Runtimes and the rest

• Go 1.27 reached general availability across Cloud Run, Cloud Run functions and App Engine in both the standard and flexible environments — one runtime landing in four places on the same day.
• Container Optimized OS had an unusual week. Its largest run was 69 Fixed notes rather than security ones, against 18 security and 16 change notes. The inventory rolls all three up with their counts intact.
• Two Looker deprecations with dates. OpenJDK 11 support ends 14 January 2027 and customer-hosted instances must move to OpenJDK 21; the Looker Mobile (Legacy) app is gone from both app stores and support is discontinued.
• Confidential VM reached GA for Intel TDX on c3-standard-*-lssd machine types.

What I would act on

1. Read GCP-2026-058 against your own GKE Multi-Cloud usage first. It is the only Critical of the week and the only one describing a path into a project the attacker did not own. If you register attached clusters, the GKE security bulletin is the document, not this one.
2. Check which Cloud Service Mesh line you are on, not which patch you took. 1.27 is now unsupported. If you applied 1.27.9-asm.34 after last week's Envoy bulletin, that fix is still correct and the line underneath it is not.
3. Put the Looker OpenJDK 11 deadline in a calendar. 14 January 2027 is far enough away to forget and close enough that customer-hosted instances need a plan this quarter.
4. Evaluate Workforce Identity Federation for Cloud SQL. This is the week's best opportunity to remove a class of standing local credentials, and it is the kind of change that is much cheaper before the estate grows around the old accounts.

Complete inventory — all 252 notes

Everything Google Cloud published between 31 August and 4 September 2026, from four feeds. Nothing is omitted; where a run of notes repeats the same text once per release, it is rolled up with its count intact and its identifiers listed, never deduplicated.

How this inventory reconciles

Google Cloud published 252 notes across 45 products and 5 days in this window, read from 4 feeds. Every one of them is accounted for below, in exactly one place:

Repeating runs, rolled up

• Container Optimized OS (69 notes) — Fixed69 notes, across 4 releases (cos-117-18613-731-2, cos-121-18867-584-3, cos-125-19216-655-6, cos-dev-138-20085-0-0). 46 distinct texts, each repeated once per release and counted individually:
  • Added support for net-fs/lustre-client-drivers v2.14.0_p259.
  • LTS Refresh from main-R117-cos-6.6 to release-R117-cos-6.6
  • LTS Refresh from main-R121-cos-6.6 to release-R121-cos-6.6
  • LTS Refresh from main-R125-cos-6.12 to release-R125-cos-6.12
  • LTS Refresh from main-R129-cos-6.12 to release-R129-cos-6.12
  • Updated cos-gpu-installer to v2.7.6.
  • Updated net-misc/openssh to version 10.4_p1.
  • Upgraded app-admin/fluent-bit to v4.2.8.
  • Upgraded app-admin/google-guest-configs to v20260819.00.
  • Upgraded app-admin/node-problem-detector to v0.8.25.
  • Upgraded app-admin/oslogin to v20260814.00.
  • Upgraded app-admin/sosreport to v4.12.0.
  • Upgraded app-arch/unzip to v6.0_p31.
  • Upgraded app-arch/zstd to v1.5.7-r1.
  • Upgraded app-containers/cni-plugins to v1.9.1.
  • Upgraded app-containers/docker-credential-helpers to v0.9.9.
  • Upgraded app-containers/docker-registry-test to v2.8.3.
  • Upgraded app-shells/dash to v0.5.13.5.
  • Upgraded chromeos-base/chromeos-dbus-bindings to v0.0.1-r2802.
  • Upgraded chromeos-base/power_manager-client to v0.0.1-r2975.
  • Upgraded chromeos-base/session_manager-client to v0.0.1-r2837.
  • Upgraded dev-db/sqlite to v3.53.4.
  • Upgraded dev-lang/luajit to v2.1.1780076327.
  • Upgraded dev-libs/expat to v2.8.3.
  • Upgraded dev-libs/gmp to v6.3.0-r2.
  • Upgraded dev-libs/inih to v62.
  • Upgraded dev-libs/libaio to v0.3.113_p8.
  • Upgraded dev-libs/libgpg-error to v1.61.
  • Upgraded dev-libs/libltdl to v2.5.4.
  • Upgraded dev-libs/libpcre2 to v10.47.
  • Upgraded dev-libs/libverto to v0.3.2-r1.
  • Upgraded dev-libs/popt to v1.19-r1.
  • Upgraded dev-libs/userspace-rcu to v0.15.6.
  • Upgraded dev-libs/xxhash to v0.8.3-r2.
  • Upgraded dev-python/oauthlib to v3.3.1.
  • Upgraded net-dns/c-ares to v1.34.8.
  • Upgraded net-libs/nghttp2 to v1.70.0.
  • Upgraded sys-apps/acl to v2.4.0-r2.
  • Upgraded sys-apps/ethtool to v7.0.
  • Upgraded sys-apps/pciutils to v3.15.0.
  • Upgraded sys-apps/xemu to v0.0.10.
  • Upgraded sys-auth/passwdqc to v2.0.3-r1.
  • Upgraded sys-auth/passwdqc to v2.1.0-r1.
  • Upgraded sys-fs/e2fsprogs to v1.47.4.
  • Upgraded sys-libs/libcap-ng to v0.9.5-r1.
  • Upgraded sys-process/lsof to v4.99.7.
• Container Optimized OS (18 notes) — Security18 notes, across 4 releases (cos-117-18613-731-2, cos-121-18867-584-3, cos-125-19216-655-6, cos-dev-138-20085-0-0). They fix 8 distinct CVEs. A CVE is patched once per release, so the note count is higher than the CVE count — these are separate notes, not duplicates, and are counted as such: CVE-2026-0989, CVE-2026-35177, CVE-2026-39827, CVE-2026-59995, CVE-2026-64371, CVE-2026-68142, CVE-2026-68293, CVE-2026-68432.
• Container Optimized OS (16 notes) — Change16 notes, across 6 releases (cos-117-18613-731-2, cos-121-18867-584-3, cos-125-19216-655-6, cos-129-19506-448-8, cos-beta-133-19999-44-21, cos-dev-138-20085-0-0). 13 distinct texts, each repeated once per release and counted individually:
  • LTS Refresh from main-R133-cos-6.18 to release-R133-cos-6.18
  • Runtime sysctl changes: Changed: net.ipv4.udp_mem: 188034 250714 376068 -> 188034 250715 376068
  • Runtime sysctl changes: Changed: net.ipv4.udp_mem: 188034 250715 376068 -> 188034 250714 376068
  • Updated containerd and containerd-test to v2.2.7.
  • Updated cos-gpu-installer to v2.7.7.
  • Updated the Linux kernel to v6.18.45.
  • Updated the Linux kernel to v6.18.46.
  • cos-117-18613-731-2 Kernel Docker Containerd GPU Drivers COS-6.6.153 v24.0.9 v1.7.34 See List
  • cos-121-18867-584-3 Kernel Docker Containerd GPU Drivers COS-6.6.153 v27.5.1 v2.0.10 See List
  • cos-125-19216-655-6 Kernel Docker Containerd GPU Drivers COS-6.12.105 v27.5.1 v2.2.7 See List
  • cos-129-19506-448-8 Kernel Docker Containerd GPU Drivers COS-6.12.105 v27.5.1 v2.2.7 See List
  • cos-beta-133-19999-44-21 Kernel Docker Containerd GPU Drivers COS-6.18.46 v29.4.3 v2.3.2 See List
  • cos-dev-138-20085-0-0 Kernel Docker Containerd GPU Drivers COS-6.18.46 v29.4.3 v2.3.2 See List

One change, published under several products

• FeatureSupport for the Go 1.27 runtime is in General Availability (GA) .Published under 4 products: App Engine flexible environment Go, App Engine standard environment Go, Cloud Run, Cloud Run functions.
• FeatureCloud SQL supports in-place upgrades and downgrades to your instance's infrastructure. You can change all of the following in place: The edition that your Cloud…Published under 3 products: Cloud SQL for MySQL, Cloud SQL for PostgreSQL, Cloud SQL for SQL Server.
• FeatureSelf-service Bindplane Enterprise license download This feature is currently in Preview for Google Security Operations tenants in the US and EU regions. Google…Published under 2 products: Google SecOps, Google SecOps SIEM.
• FeatureCloud SQL supports Workforce Identity Federation authentication. This lets you authenticate to your Cloud SQL instance using identities from an external identit…Published under 2 products: Cloud SQL for MySQL, Cloud SQL for PostgreSQL.

Everything else, by product

API Gateway — 1

• ChangeNew model routing gateways might use a gateway.dev default hostname If you create a gateway that uses model routing on or after September 3, 2026, it might rece…Thu 03 Sep

AlloyDB for PostgreSQL — 1

• FeatureAlloyDB real-time data access to BigQuery (in Preview ) now offers limit pushdown and runtime projects: Limit pushdown: when you query foreign tables, some LIMI…Wed 02 Sep

Apigee UI — 2

• AnnouncementOn September 1, 2026, we released an updated version of the Apigee UI.Tue 01 Sep
• FixedBug ID Description 547582067 Revisions can now be imported for API proxies and shared flows in a space Importing a revision in the Apigee UI now works for an AP…Tue 01 Sep

Application Design Center — 1

• FeatureApplication Design Center supports the following components in General Availability : Firebase AI Logic Firebase AI Logic Prompt Template Firebase App Check Fir…Wed 02 Sep

Backup and DR — 1

• FeatureBackup vault support for AlloyDB for PostgreSQL instances encrypted with customer-managed encryption keys (CMEK) is generally available (GA), providing immutabl…Tue 01 Sep

BigQuery — 9

• FeatureYou can now create, store , and manage pipelines in Git folders. This feature is in Preview .Mon 31 Aug
• FeatureBigQuery now supports TabFM , Google's pre-trained foundation model for tabular data. TabFM enables zero-shot regression and classification through in-context l…Mon 31 Aug
• FeatureUsing folders to create, store, and manage pipelines is generally available .Mon 31 Aug
• FeatureYou can now create an identity column , sometimes referred to as an auto-incrementing column, on a table. You can use identity columns to create and maintain pr…Mon 31 Aug
• FeatureBigQuery Graph is generally available (GA). BigQuery Graph now includes support for the CALL graph query statement , and the following path inspection GQL funct…Mon 31 Aug
• FixedSupport for configuring daily token quotas for BigQuery generative AI functions has been restored.Mon 31 Aug
• FeatureThe Rust SDK for BigQuery is now in Preview .Tue 01 Sep
• ChangeAn updated version of the Simba JDBC driver for BigQuery is now available.Wed 02 Sep
• FeatureConversational analytics now supports questions about market basket analysis . This feature is generally available (GA).Thu 03 Sep

Bigtable — 1

• FeatureYou can use the Google Cloud console to create and manage aggregate column families for your Bigtable tables. You can also view and query aggregate column famil…Tue 01 Sep

Blog — 17

• PostBigQuery Graph is now GA: the knowledge foundation for the agentic eraMon 31 Aug
• PostCloud CISO Perspectives: Tips on securing the water sector in the AI eraMon 31 Aug
• PostWhat’s new in AI infrastructure and orchestration in AugustMon 31 Aug
• PostFrom weeks to minutes: The new agentic era of data pipelinesMon 31 Aug
• PostWhat Google Cloud announced in AI this monthTue 01 Sep
• PostIntroducing TabFM in BigQuery: Predictive analytics reimaginedTue 01 Sep
• PostHow BlackLine simplifies perimeter policy intelligence with VPC Service ControlsTue 01 Sep
• PostFinancially Motivated Threat Actor BREEZE COMET Targets BrazilTue 01 Sep
• PostGetting started with Mantis, our open-source bug finding-and-fixing harnessWed 02 Sep
• PostSimplify pipelines with new BigQuery identity columnsWed 02 Sep
• PostWhat’s new with Google Data CloudThu 03 Sep
• PostAnnouncing the Google Gen AI SDK for Kotlin 1.0: Idiomatic multiplatform access to GeminiThu 03 Sep
• PostGoogle named a Leader in 2026 Gartner® Magic Quadrant™ for Strategic Cloud Platform ServicesThu 03 Sep
• PostHow Yahoo optimizes resources with flexible VMs in Managed Service for Apache SparkFri 04 Sep
• PostSpanner migrations: Automating dual-write with Antigravity CLI for minimal disruptionFri 04 Sep
• PostNot All LLM Workloads Are Equal: Benchmarking TPU Performance on Classification vs. GenerationFri 04 Sep
• PostWhat’s new with Google CloudFri 04 Sep

Cloud Billing — 1

• ChangeIntroducing the Incentives page, for tracking spend-based milestone credits, RaMP, and other conditional incentives If you have a custom pricing contract, you m…Fri 04 Sep

Cloud Monitoring — 1

• FeatureYou can opt out of alert notifications from an SMS notification channel by sending a text message to the phone number associated with the notification channel.…Tue 01 Sep

Cloud Run — 1

• FeatureConfigure Agent Platform features on your Cloud Run services and jobs to securely authenticate AI agents and MCP servers using system-managed Agent Identities.…Tue 01 Sep

Cloud SQL for MySQL — 1

• FeatureThe C4 machine series is now available for Cloud SQL for MySQL Enterprise Plus instances in the following regions: africa-south1 — Johannesburg asia-northeast3…Fri 04 Sep

Cloud SQL for PostgreSQL — 2

• FeatureYou can use the pgAudit extension to prevent string literals that might indicate sensitive information, such as passwords and secrets, from appearing in your lo…Mon 31 Aug
• FeatureThe C4 machine series is now available for Cloud SQL for PostgreSQL Enterprise Plus instances in the following regions: africa-south1 — Johannesburg asia-northe…Fri 04 Sep

Cloud SQL for SQL Server — 2

• FeatureCloud SQL for SQL Server now supports connecting to instances with write endpoints using the Cloud SQL Auth Proxy or Cloud SQL language connectors. When you con…Fri 04 Sep
• FeatureThe C4 machine series is now available for Cloud SQL for SQL Server Enterprise Plus instances in the following regions: africa-south1 — Johannesburg asia-northe…Fri 04 Sep

Cloud Service Mesh — 3

• Announcement1.30.4-asm.1 is now available for in-cluster Cloud Service Mesh. You can now download 1.30.4-asm.1 for in-cluster Cloud Service Mesh. It includes the features o…Mon 31 Aug
• AnnouncementIn-cluster Cloud Service Mesh 1.27 is no longer supported. For more information and to view the earliest end-of-life dates for other versions, see Supported ver…Mon 31 Aug
• SecurityManaged Cloud Service Mesh will start using proxy version csm_mesh_proxy.20260819_RC00 for Gateway API on GKE clusters. This proxy version maps closest to Envoy…Tue 01 Sep

Cloud Storage — 1

• FeatureYou can use Storage batch operations to do the following: Select objects dynamically across a project by using Common Expression Language (CEL) filters based on…Thu 03 Sep

Cloud Trace — 1

• BreakingStarting August 31, 2026, you can no longer create or edit trace sinks . Trace sinks were deprecated on February 18, 2026. For more information, see Export trac…Mon 31 Aug

Confidential VM — 1

• FeatureSupport for Intel TDX on c3-standard-*-lssd machine types is generally available ( GA ).Wed 02 Sep

Cortex Framework — 4

• AnnouncementRelease 7.0.5Tue 01 Sep · Release
• FixedRemoved obsolete review items checklist from tests.Tue 01 Sep · Release
• AnnouncementRelease 7.0.6Wed 02 Sep · Release
• FixedAdded support for logical SAP table remapping in SAP Data Foundation. Added custom/ directory scaffolding across all developer skills for local extensions.Wed 02 Sep · Release

Datastream — 1

• FeatureYou can now create a Datastream stream directly from the overview page of your Cloud SQL instances using the automated flow. For more information, see Create a…Mon 31 Aug

GKE security bulletin — 1

• GCP-2026-058Published: 2026-09-02 Description Severity A missing project permission check in GKE Multi-Cloud (CreateAttachedCluster, CreateAwsCluster, CreateAzureCluster) A…Wed 02 Sep

Gemini — 3

• OtherBug fixes in IntelliJ Various bug fixes and minor product enhancements.Tue 01 Sep · Bug
• AnnouncementNew subscriptions for Gemini Code Assist can no longer be purchased through the Google Cloud console using billing accounts that don't have an active Gemini Cod…Fri 04 Sep
• AnnouncementNew subscriptions for Gemini Code Assist can no longer be purchased through the Google Cloud console using billing accounts that don't have an active Gemini Cod…Fri 04 Sep

Gemini Enterprise — 10

• FeatureGemini Enterprise: Support for federated data stores in Assured Workloads with FedRAMP High compliance Gemini Enterprise now supports connecting Google Workspac…Mon 31 Aug
• FeatureGemini Enterprise: Gemini 3.5 Flash regional availability in Canada Gemini 3.5 Flash is available in Canada ( ca ) with in-region at-rest data residency (DRZ) a…Mon 31 Aug
• FeatureGemini Enterprise: Gemini 3.1 Flash image available in US and EU multi-regions Gemini 3.1 Flash image (Nano Banana 2) for image generation is generally availabl…Mon 31 Aug
• FeatureGemini Enterprise: Protect sensitive data with content policies You can apply Sensitive Data Protection content policies to your Gemini Enterprise connectors, a…Mon 31 Aug
• FeatureGemini Enterprise: Overage controls available for all invoiced Cloud Billing accounts Configuring overage controls in Gemini Enterprise is available to all proj…Tue 01 Sep
• FeatureGemini Enterprise: Gemini 3.8 Flash available in Global, US, and EU regions Gemini 3.8 Flash is generally available (GA) in the global , us , and eu regions. Fo…Wed 02 Sep
• FeatureGemini Enterprise: Latency and error rate views for agents To monitor operational telemetry for your agents, use the two new views on the Observability tab: Lat…Thu 03 Sep
• FeatureGemini Enterprise: General availability of Workflow Builder (formerly Agent Designer) Workflow Builder (formerly known as Agent Designer) is generally available…Thu 03 Sep
• FeatureGemini Enterprise: Monday federated data store (GA) Connecting a Monday data source with Gemini Enterprise using data federation is generally available (GA). Yo…Fri 04 Sep
• FeatureGemini Enterprise: Create and manage projects You can create and manage projects in the Gemini Enterprise web app to build a dedicated knowledge base for your o…Fri 04 Sep

Gemini Enterprise Agent Platform — 8

• FeatureGemini 3.1 Flash Image and Gemini 3 Pro Image updates This release introduces feature updates and expanded endpoint availability for Gemini 3.1 Flash Image and…Mon 31 Aug
• FeatureIAM Unified Access Policies are generally available (GA) IAM Unified Access Policies (Access policies) for Gemini Enterprise Agent Platform are generally availa…Mon 31 Aug
• ChangeEmbedding SKUs are changing Memory bank uses the following embedding model SKUs: 6E46-5623-C0B6 C15D-A68F-5C1E 2D07-D52C-A93B For detailed information about ind…Tue 01 Sep
• ChangePricing updates for agent metering Session and memory bank compute metering is in effect for the Agent Platform compute SKU. For more information, see Gemini Ag…Tue 01 Sep
• FeatureAnthropic's Claude Fable 5.1 is now available Claude Fable 5.1 is available in Model Garden.Tue 01 Sep
• FeatureGemini 3.8 Flash is generally available Gemini 3.8 Flash is now generally available (GA) and available for production use. For more information on 3.8 Flash, se…Wed 02 Sep
• FeatureDeferred tier for autonomous agent scheduling (Preview) The deferred tier is available in Preview. The deferred tier automatically queues non-latency-sensitive…Wed 02 Sep · Deferred
• FixedCodeMender updates This release introduces updates to CodeMender: Machine-readable metrics : Added the --json flag to cm stats to export aggregate and per-sessi…Wed 02 Sep · Deferred

Google Cloud Contact Center as a Service — 3

• AnnouncementGoogle Cloud CCaaS 6.9 We've released version 6.9 of Google Cloud CCaaS. The timing of the update to your instance depends on the deployment schedule that you h…Thu 03 Sep
• FeatureAgent desktop supports email The agent desktop now supports email. Agents can handle email interactions using the email adapter in a desktop layout. Administrat…Thu 03 Sep
• FixedThis release addresses the following issues: Fixed an issue where agents couldn't send new outbound emails. Fixed an issue where the disposition panel in the ca…Thu 03 Sep

Google Kubernetes Engine — 16

• FeatureSession affinity support using GCPTrafficDistributionPolicy for GKE Gateway is generally available. This release currently supports single-cluster GKE Gateway l…Mon 31 Aug
• ChangeGKE version 1.35.1-gke.1031000 and later include the following changes to automatically created firewall rules for Services : Changes the priority of multiple e…Tue 01 Sep
• FeatureThe bare metal machine types from the C3 machine series are now generally available with GKE clusters. You can now provision machine types such as c3-standard-1…Tue 01 Sep
• Change(2026-R37) Version updates GKE cluster versions have been updated. New versions available for upgrades and new clusters. The following versions are now availabl…Wed 02 Sep
• Change(2026-R37) Version updates Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and…Wed 02 Sep
• Change(2026-R37) Version updates Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and…Wed 02 Sep
• Change(2026-R37) Version updates Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and…Wed 02 Sep
• Change(2026-R37) Version updates Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and…Wed 02 Sep
• Change(2026-R37) Version updates Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and…Wed 02 Sep
• Extended channelNote : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to…Wed 02 Sep
• No channel (deprecated)Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to…Wed 02 Sep
• Rapid channelNote : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to…Wed 02 Sep
• Regular channelNote : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to…Wed 02 Sep
• Security(2026-R37) Security updates This release includes new GKE versions that use updated Container-Optimized OS images. These updated images are cumulative, incorpor…Wed 02 Sep
• Stable channelNote : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to…Wed 02 Sep
• FeatureGKE support for using the c3-standard-*-lssd machine types as Confidential GKE Nodes with Intel TDX is generally available. For more information, see the follow…Thu 03 Sep

Google SecOps — 1

• Feature[Spotlight Feature] Customizable schedules for multi-event rules general availability The customizable schedules for multi-event rules feature is now in General…Mon 31 Aug

Looker — 29

• DeprecatedThe Looker Mobile (Legacy) application is no longer available for download from the App Store or Play Store and support for the app has been discontinued. Altho…Mon 31 Aug
• DeprecatedOpenJDK 11 will no longer be supported as of January 14, 2027 . Customer-hosted instances must upgrade to OpenJDK 21 .Wed 02 Sep
• AnnouncementLooker 26.16 will roll out to Looker (original) instances on the following schedule: Expected deployment start: Tuesday, September 8, 2026 Expected final deploy…Fri 04 Sep
• FeatureThe Semantic Search feature is now generally available.Fri 04 Sep
• FeatureNow available in preview, the Admin Assistant helps you use natural language to manage Looker roles.Fri 04 Sep
• FixedAn issue has been fixed where logging in with a Google Cloud Workforce Identity within an embedded iframe could fail as a result of frame restrictions or becaus…Fri 04 Sep
• FixedAn issue has been fixed where switching to a histogram visualization in an Explore could fail or revert unexpectedly. Additionally, stack resolution on pivoted…Fri 04 Sep
• FixedAn issue has been fixed where the alert creation and edit modal displayed Method instead of defaulting to Email as the notification method. This feature now per…Fri 04 Sep
• FixedAn issue has been fixed where embedded dashboards with numerous filters caused horizontal container overflow, prevented filters from wrapping across rows, and r…Fri 04 Sep
• FixedAn issue has been fixed where custom themes configured as the instance default were not applied to dashboards in view-only mode or during dashboard navigation.…Fri 04 Sep
• FixedAn issue has been fixed where LookML dashboard URLs that were opened from the search page contained encoded colons ( %3A%3A ), which prevented filter interactio…Fri 04 Sep
• FixedAn issue has been fixed where Single Value visualizations and KPI visualizations would not allow creating a comparison against a non-measure table calculation.…Fri 04 Sep
• FixedAn issue has been fixed where visualization-level filters could not be edited or deleted because of missing popover menus. This feature now performs as expected…Fri 04 Sep
• FixedAn issue has been fixed where resizing an Explore that contained a Word Cloud visualization could cause the Explore to crash. This feature now performs as expec…Fri 04 Sep
• FixedAn issue has been fixed where generating LookML for analytic models without selecting any database tables could cause Looker to create views for all database ta…Fri 04 Sep
• FixedAn issue has been fixed where filter context banners and timezone settings were not preserved when generating PNG downloads from drill menus. This feature now p…Fri 04 Sep
• FixedAn issue has been fixed where applying pivots to merge queries could cause visualization errors and blank column headers in the results table. This feature now…Fri 04 Sep
• FixedAn issue has been fixed where standalone tile exports from embedded dashboards with filter context could render off-screen or with clipped visualizations in PDF…Fri 04 Sep
• FixedAn issue has been fixed where clearing all text from a dashboard note tile failed to persist upon page refresh. This feature now performs as expected.Fri 04 Sep
• FixedThe BigQuery High Throughput API has been disabled by default to prevent connection errors for environments without bigquery.readsessions.create permissions. Ad…Fri 04 Sep
• FixedAn issue has been fixed where multi-line prompt text in dashboard chat views caused action buttons (such as the Thinking toggle and Send button) and vertical sc…Fri 04 Sep
• FixedAn issue has been fixed where pinned Looks on boards generated broken URLs that redirected to the home page and failed to dynamically reflect title updates. Thi…Fri 04 Sep
• FixedAn issue has been fixed where selecting a suggestion could reset the dropdown to a loading spinner. This feature now performs as expected.Fri 04 Sep
• FixedAn issue has been fixed where collapsible navigation items in the Admin panel and the main navigation pane rendered rectangular focus outlines rather than round…Fri 04 Sep
• FixedAn issue has been fixed where typed search strings persisted after you selected an autocomplete suggestion in multi-select filters. This feature now performs as…Fri 04 Sep
• FixedWhen you duplicate a user-defined dashboard, associated Looker data agent instructions, configurations, and sources are now preserved on the copied dashboard.Fri 04 Sep
• FixedSelf-service models have been restricted to only their assigned user database connections, preventing unintended instance-wide database connection access.Fri 04 Sep
• FixedBoxplot visualizations now render transparent median dividers and borders properly in inverted and dark theme layouts.Fri 04 Sep
• FixedAn issue has been fixed where IAM administrators on Looker (Google Cloud core) instances failed authentication when the auth_requires_role and strict Group Role…Fri 04 Sep

Memorystore for Redis — 1

• FeatureYou can use client-side metrics to troubleshoot why your application might experience high latency. This feature is generally available .Thu 03 Sep

Memorystore for Redis Cluster — 1

• FeatureYou can use access control list (ACL) policies to secure access to your clusters. You can enable fine-grained security by restricting user and service access to…Mon 31 Aug

Memorystore for Valkey — 1

• FeatureYou can use access control list (ACL) policies to secure access to your instances. You can enable fine-grained security by restricting user and service access t…Mon 31 Aug

Network Connectivity Center — 1

• FeatureIPv6 dynamic routes support for include and exclude spoke filters for hybrid spokes is available in Preview . Export filters control which subnets or routes a s…Mon 31 Aug

Policy Intelligence — 1

• FeatureThe Policy Analyzer MCP server is generally available . To learn about using the Policy Analyzer MCP server to let agents and AI applications analyze and audit…Tue 01 Sep

Security bulletin — 3

• GCP-2026-058Published: 2026-09-02 Description Description Severity Notes A missing project permission check in GKE Multi-Cloud (CreateAttachedCluster, CreateAwsCluster, Cre…Wed 02 Sep
• GCP-2026-059Published: 2026-09-04 Description Description Severity Notes A Missing Authorization vulnerability was discovered in the HTTP Connector in Integration Connector…Fri 04 Sep
• GCP-2026-060Published: 2026-09-04 Description Description Severity Notes A security flaw in the Slurm sbcast tool (CVE-2026-65107) lets shared library files bypass security…Fri 04 Sep

Sensitive Data Protection — 1

• FeatureSensitive Data Protection content policies are in General Availability . You can use content policies to evaluate content and return an ALLOW or BLOCK verdict b…Mon 31 Aug

Service Extensions — 1

• FeatureAgent Gateway now supports Service Extensions to evaluate requests and delegate authorization decisions for agent traffic to either Google services or custom au…Mon 31 Aug

Spanner — 2

• FeatureSpanner supports using the TABLESAMPLE operator in PostgreSQL-dialect databases to select a random sample of a dataset. For more information, see TABLESAMPLE op…Wed 02 Sep
• FeatureSpanner supports the following PostgreSQL-dialect database operators: ILIKE ( ~~* ) NOT ILIKE ( !~~* ) Spanner supports the following PostgreSQL-dialect databas…Thu 03 Sep

VPC Service Controls — 1

• FeatureVPC Service Controls feature (Status: Preview ) : VPC Service Controls supports retrieving and updating service perimeters that contain deleted IAM principals.…Thu 03 Sep

Virtual Private Cloud — 1

• FeatureGeneral Availability : You can create Compute Engine instances that have multiple virtual network interfaces (vNICs) in the same VPC network. For more informati…Mon 31 Aug

reCAPTCHA — 1

• ChangeFraud Defense Mobile SDK v18.9.3 is available for Android. This version includes detection and performance enhancements.Tue 01 Sep

Official Google Cloud references

• Google Cloud security bulletins
• BigQuery release notes
• Cloud SQL for PostgreSQL release notes
• Cloud SQL for MySQL release notes
• Cloud Service Mesh release notes
• Cloud Run release notes
• Looker release notes
• Google Cloud release notes, all products