GCP Weekly Intelligence #14

The week in one paragraph

Three hundred and twenty-one notes across Monday to Friday and only two security bulletins, which makes this the quietest security week in a while and the most interesting deprecation week. The bulletin that matters is a processor-level side channel on fifth-generation AMD EPYC hardware, and its structure is worth reading carefully because Google has fixed one boundary and explicitly left another to you. The deprecation that matters is Policy Controller, which now carries four dates and a hard coupling to GKE version upgrades — meaning a product being retired can block your clusters from moving forward. Underneath, the volume was ordinary: Container-Optimized OS accounted for 123 of the 321 notes, GKE for 19, and the agent platforms for most of the rest.

The AMD bulletin, and the half that is yours

GCP-2026-081, published Monday, is the week's substantive security item. AMD has disclosed three vulnerabilities that affect 5th generation AMD EPYC processors (code-named Turin) — specifically CVE-2024-36350 and CVE-2024-36357, which AMD previously disclosed for earlier EPYC processors, and a new vulnerability, CVE-2026-0004.

The mechanism is a classic microarchitectural leak: under certain conditions, an attacker could infer data from the store queue or the L1 data cache, potentially leaking sensitive information across privilege boundaries.

Check your fleet against the list rather than guessing, because it is specific: affected Compute Engine machine series: C4D, N4D, H4D, Z4D, and G4, including C4D and Z4D bare metal instances. The letter D is doing a lot of work in that list.

Two boundaries, one of them already handled

This is the part to read twice, because it determines whether you have work to do. Google has applied mitigations that protect against attacks between VMs and between VMs and the host. So the multi-tenancy boundary — the one most people worry about first with a CPU vulnerability — is closed, and closed without you doing anything.

The other boundary is not: to protect against attacks inside a VM, such as between processes, you need to update your guest operating system. If a VM of yours runs more than one trust level — multiple tenants' code, untrusted user submissions, a CI runner executing arbitrary build steps — that is the boundary this leaks across, and it is yours to close.

The remediation has two steps and the second is the one that will be skipped. First, update your guest operating system when your OS vendor releases fixes. Then the enabling condition, which is on Google's side: starting November 10th, Google will update the CPU information that VMs report so that patched guest kernels can turn on their mitigations. A patched kernel does nothing until it can see that the CPU supports the mitigation.

Two cases get their own instructions. For your own stacks: if you run your own OS or hypervisor on a bare metal instance, apply your vendor's fixes when they're available, with the same stop-and-start requirement for nested hypervisors. And for managed Kubernetes, updated GKE node images for Turin-based bare metal instances will be made available — so the GKE path is an image upgrade rather than anything hand-rolled.

Policy Controller is deprecated, and it blocks GKE upgrades

The week's most consequential non-security item, because it has dates and a dependency. Policy Controller is deprecated as of November 12, 2026, and reaches end of support on December 31, 2027.

Before that, two earlier gates. The first closes new adoption: starting January 31, 2027, you can't enable Policy Controller in fleet host projects that don't already have Policy Controller enabled. So if it is in a landing-zone blueprint or a platform standard, that standard has a deadline on it — after January it cannot be applied to anything new.

The second is the one that turns a deprecation into an operational constraint: Google Kubernetes Engine (GKE) blocks upgrades to version 1.39 and later for clusters that have Policy Controller installed. And correspondingly, clusters that run GKE version 1.39 and later don't support Policy Controller.

Istio, Looker and the rest

The other bulletin is brief but was revised mid-week, which is itself worth noting — GCP-2026-080 Published: 2026-11-09 Updated: 2026-11-12. The content: security vulnerabilities were discovered in Istio ( ISTIO-SECURITY-2026-009 ), rated High, tracked as CVE-2026-31836 alongside five GitHub advisories. If you run Cloud Service Mesh this is a version bump, and the Thursday revision is a reason to re-read it rather than relying on Monday's copy.

On Looker, a security default flipped: two-factor authentication (2FA) is now enabled by default for all new and existing Looker (original) instances that use email and password authentication and that didn't opt out during the advance opt-out window. Note the scope — existing instances, not just new ones, and only those using email and password authentication. The escape hatch remains: administrators retain full control to manage or disable 2FA by using the Admin > Authentication > Two-Factor panel. If you have service-style logins on email and password, this is the week they started needing a second factor.

One more that will surprise a build pipeline: in Managed Service for Apache Airflow, upgraded the pip package from version 23.2.1 to version 26.2.2. That is not an increment, it is three years of pip in one step, and pip's resolver behaviour and deprecation warnings have changed considerably across that span. Any DAG that installs dependencies at runtime should be tested against it rather than assumed compatible.

Elsewhere the week was volume and AI. Container-Optimized OS shipped 123 notes on its usual run of kernel and package rebuilds; the inventory below rolls those up and lists every distinct CVE identifier rather than collapsing the count. GKE contributed 19, including an experiment with ClusterNetworkPolicy. Two blog items are worth a click for anyone who followed the last fortnight of this series: one on Cross-Cloud Interconnect with a partner carrier, which is #88 and #89's material in practice, and one on what is new in Organization Policy, which is where the governance thread from the #74 to #82 run continues.

What I would act on

Three things, in order.

One: list your C4D, N4D, H4D, Z4D and G4 instances, then ask which of them run more than one trust level. Google has closed the VM-to-VM and VM-to-host boundaries for you. The in-VM boundary is the one you own, and it only matters where a single VM runs code of differing trust — CI runners, multi-tenant workers, anything executing user-supplied code. That intersection is usually much smaller than the machine list, and it is the actual work.

Two: when you patch those guests, plan a stop and start rather than a reboot. The bulletin is explicit that rebooting the guest OS is not enough, so the rollout is a maintenance window with instance restarts, not a package update. Budget for that before promising a date.

Three: find out which clusters have Policy Controller installed. It is deprecated, it cannot be newly enabled after January 2027, and it blocks GKE upgrades to 1.39 and later. The deadline that will actually bind is your next required cluster upgrade, not the December 2027 end of support.

Complete inventory — all 321 notes

Built from the combined release-notes feed, the security bulletins feed, the GKE bulletins feed and the Cloud Blog feed by build_weekly_inventory_gcp.py, for the news window Monday 9 to Friday 13 November 2026. Every raw note lands in exactly one bucket and the buckets are asserted to sum to the raw total; every link was fetched and every day anchor confirmed present.

How this inventory reconciles

Google Cloud published 321 notes across 73 products and 5 days in this window, read from 4 feeds. Every one of them is accounted for below, in exactly one place:

Repeating runs, rolled up

• Container Optimized OS (74 notes) — Security74 notes, across 5 releases (cos-121-18867-652-49, cos-125-19216-801-29, cos-129-19506-625-25, cos-133-19999-44-197, cos-dev-138-20309-0-0). They fix 43 distinct CVEs. A CVE is patched once per release, so the note count is higher than the CVE count — these are separate notes, not duplicates, and are counted as such: CVE-2024-25621, CVE-2024-41110, CVE-2025-31133, CVE-2025-45582, CVE-2025-52565, CVE-2025-9230, CVE-2026-0799, CVE-2026-102266, CVE-2026-103111, CVE-2026-106583, CVE-2026-111497, CVE-2026-116587, CVE-2026-118669, CVE-2026-119196, CVE-2026-14456, CVE-2026-15146, CVE-2026-18924, CVE-2026-29181, CVE-2026-30922, CVE-2026-32285, CVE-2026-33186, CVE-2026-33747, CVE-2026-34986, CVE-2026-35189, CVE-2026-35469, CVE-2026-39833, CVE-2026-39883, CVE-2026-41567, CVE-2026-4438, CVE-2026-44973, CVE-2026-53488, CVE-2026-53489, CVE-2026-63076, CVE-2026-63209, CVE-2026-6368, CVE-2026-77214, CVE-2026-78663, CVE-2026-84304, CVE-2026-84445, CVE-2026-86145, CVE-2026-92392, CVE-2026-93990, CVE-2026-97032.

One change, published under several products

• FeatureThe App Engine Migration hub lets you check compatibility and migrate services in the App Engine flexible environment to Cloud Run. For more information, see De…Published under 8 products: App Engine flexible environment .NET, App Engine flexible environment Go, App Engine flexible environment Java, App Engine flexible environment Node.js, App Engine flexible environment PHP, App Engine flexible environment Python, App Engine flexible environment Ruby, App Engine flexible environment custom runtimes.
• FeatureSupport for Direct VPC egress in the App Engine standard environment is in General Availability (GA) . For more information, see Configure Direct VPC egress and…Published under 6 products: App Engine standard environment Go, App Engine standard environment Java, App Engine standard environment Node.js, App Engine standard environment PHP, App Engine standard environment Python, App Engine standard environment Ruby.
• FeatureYou can deploy an active version in the App Engine standard environment to Cloud Run directly from the Migration hub in the Google Cloud console. You don't need…Published under 6 products: App Engine standard environment Go, App Engine standard environment Java, App Engine standard environment Node.js, App Engine standard environment PHP, App Engine standard environment Python, App Engine standard environment Ruby.
• FeatureCloud SQL enhanced backups support instances with disaster recovery (DR) replica instances. You can associate a Backup and DR backup plan directly with a primar…Published under 3 products: Cloud SQL for MySQL, Cloud SQL for PostgreSQL, Cloud SQL for SQL Server.
• FeatureCreating SQL-based alerting policies to monitor your Observability Analytics query results in Cloud Monitoring is generally available (GA) . You can create SQL-…Published under 3 products: Cloud Logging, Cloud Monitoring, Cloud Trace.
• FeatureCloud Quotas is generally available ( GA ).Published under 2 products: Access Approval, Access Transparency.
• FeatureThe following changes were added in 1.34.1100-gke.125: Updated system components and container base images to remove the distrusted eMudhra (emSign) and AAA Cer…Published under 2 products: Google Distributed Cloud (software only) for VMware, Google Distributed Cloud (software only) for bare metal.
• FixedThe following issues were fixed in 1.34.1100-gke.125: Fixed vulnerabilities listed in Vulnerability fixes . Fixed an issue where deleting a user cluster left an…Published under 2 products: Google Distributed Cloud (software only) for VMware, Google Distributed Cloud (software only) for bare metal.
• FeatureVM Extension Manager extension policies for the Ops Agent are now available at the folder and organization levels in Preview . Extension policies provide zonal…Published under 2 products: Cloud Logging, Cloud Monitoring.

Everything else, by product

AI Hypercomputer — 1

• FeatureGenerally available : Pathways on Cloud is now generally available on Google Kubernetes Engine (GKE). Major features include the following: Single-controller ex…Mon 09 Nov

API Gateway — 1

• FeatureTLS 1.3 for connections to backends API Gateway is rolling out support for TLS 1.3 on connections to backend services. Once the rollout reaches a gateway, it us…Tue 10 Nov

API Keys API — 1

• FeatureThe API Keys remote Model Context Protocol (MCP) server is generally available (GA) . You can use the API Keys remote MCP server in your AI applications to crea…Thu 12 Nov

Agent Platform Workbench — 1

• FeatureAntigravity CLI in Agent Platform Workbench instances Preview : The Antigravity CLI is available in Agent Platform Workbench instances that use a Debian 12 ( wo…Tue 10 Nov

AlloyDB for PostgreSQL — 1

• FeatureThe following AlloyDB AI features and improvements are generally available ( GA ): Smart batching for AI functions: AI function acceleration is generally availa…Mon 09 Nov

Anthos Config Management — 3

• ChangeAddressed multiple Common Vulnerabilities and Exposures (CVEs) by updating dependencies.Mon 09 Nov
• ChangeUpgraded the git-sync dependency from v4.4.2 to v4.5.0 to pick up vulnerability fixes. For more details, see git-sync releases .Mon 09 Nov
• ChangeUpgraded the Open Telemetry image from 0.152.0 to 0.159.0 to pick up vulnerability fixes. To understand the changes in each release, review the full changelog f…Mon 09 Nov

Anti Money Laundering AI — 2

• AnnouncementNew minor engine version released for the commercial line of business within the v004.009 version line ( aml-commercial.default.v004.009.202610-000 ). This vers…Mon 09 Nov
• AnnouncementNew minor engine version released for the commercial line of business within the v004.010 version line ( aml-commercial.default.v004.010.202610-000 ). This vers…Mon 09 Nov

Apigee Edge for Private Cloud — 3

• AnnouncementReleased Apigee Edge for Private Cloud 4.54.00.01. For the list of updated RPM packages and the patch update procedure, see Install 4.54.00.x patch updates .Mon 09 Nov
• FixedResolved the following issues in Apigee Edge for Private Cloud 4.54.00.01: Fixed an issue in the New Edge UI where creating an OpenAPI Specification in the OASV…Mon 09 Nov
• SecurityFixed multiple security vulnerabilities in Apigee Edge for Private Cloud, including security hardening across Edge runtime, management, New Edge UI, OpenLDAP, A…Mon 09 Nov

Apigee Edge for Public Cloud — 2

• AnnouncementOn November 11, 2026, we began releasing Edge UI updates for Apigee Edge for Public Cloud.Wed 11 Nov
• FixedBug ID Component Description 392653797, 399185014 Edge UI Fixed an issue where navigating to the App Details or New App pages in organizations with a large numb…Wed 11 Nov

Apigee X — 3

• AnnouncementOn November 13, 2026, we released an updated version of Apigee (1-18-0-apigee-9). Note: Rollouts of this release began today and can take four or more business…Fri 13 Nov
• FixedBug ID Description 582789138 Added the response.event.stream.state and response.event.stream.content.length flow variables on SSE EventFlow responses, readable…Fri 13 Nov
• SecurityBug ID Description 579640924 Security fix for Apigee. Hardened the JavaCallout, Script, and JavaScript policy sandboxes. 579642864 Security fix for Apigee. Fixe…Fri 13 Nov

Apigee hybrid — 4

• Announcementv1.16.14 On November 11, 2026 we released an updated version of the Apigee hybrid software, v1.16.14. For information about upgrading, see Upgrading Apigee hybr…Wed 11 Nov · v1.16.14
• FeatureSanitizeUserPrompt and SanitizeModelResponse policies now support function calling The SanitizeUserPrompt and SanitizeModelResponse policies now handle LLM func…Wed 11 Nov · v1.16.14
• FixedFixed in this release Bug ID Description 575563262 Updated the Google Cloud client library stack to match Apigee hybrid 1.17 (protobuf 4.x, gRPC 1.82, GAX 2.83,…Wed 11 Nov · v1.16.14
• SecurityBug ID Description N/A Security fixes for apigee-asm-ingress . This addresses the following vulnerabilities: CVE-2026-116587 CVE-2026-5450 CVE-2026-5928 N/A Sec…Wed 11 Nov · v1.16.14

Backup and DR — 1

• AnnouncementDocumentation for Backup and DR for the management console uses a dedicated navigation structure to separate appliance management console guides from Google Clo…Wed 11 Nov

Batch — 1

• FeatureJobs that use TPUs are generally available . You can use Tensor Processing Units (TPUs) to accelerate machine learning (ML) and artificial intelligence (AI) wor…Thu 12 Nov

BigQuery — 12

• FeatureTo support your FinOps practices, you can now opt in to compute cost attribution in BigQuery editions. This feature attributes billed compute charges directly t…Mon 09 Nov
• FeatureQuery performance troubleshooting and job and system performance comparison in the BigQuery jobs explorer are generally available (GA). For more information, se…Mon 09 Nov
• FeatureWhen you create or schedule a pipeline, you can specify the maximum number of concurrently executed pipeline tasks. This feature is generally available (GA).Mon 09 Nov
• FeatureYou can use compression functions in GoogleSQL to compress or decompress bytes or string values by using the Zstandard (Zstd) lossless data compression algorith…Mon 09 Nov
• FeatureYou can use graph measures to lock an aggregation to a key in order to perform complex aggregations without overcounting. Measure expressions can include the fo…Tue 10 Nov
• FeatureBigQuery generative AI functions now support the gemini-4-carbon model. This model is generally available .Tue 10 Nov
• FeatureProject caps (also known as scheduling policies) let you limit maximum slots and concurrency per project within a BigQuery reservation. This feature is only sup…Wed 11 Nov
• FeatureYou can specify an optional principal property on BigQuery reservation assignments to route queries to specific reservations based on the identity of the user,…Wed 11 Nov
• FeatureYou can use the JSON_FLATTEN function to extract all non-array values that are either directly in the input JSON value or children of one or more consecutively…Wed 11 Nov
• FeatureYou can track table-level data lineage in Knowledge Catalog for BigQuery pipelines. For more information, see Track data lineage . This feature is generally ava…Thu 12 Nov
• FeatureBigQuery generative AI functions now support the gemini-4-hydrogen model. This model is generally available .Thu 12 Nov
• FeatureBigQuery connections to MySQL , Oracle , and PostgreSQL are now available and can be used to run MySQL federated queries , Oracle federated queries , and Postgr…Fri 13 Nov

Bigtable — 3

• FeatureYou can use the Google Cloud console to create and manage Apache Avro schema bundles for your Bigtable tables. You can also view Avro schema bundle definitions…Mon 09 Nov
• LibrariesJava 1.95.0 (2026-11-02) Bug Fixes bigtable: avoid mutating Query in-place in createPointReadCallable ( #14797 ) ( 1b1c6a7 ) bigtable: check isOk and getRejecte…Mon 09 Nov
• FeatureYou can use the Google Cloud console to view and analyze read and write access patterns for your Bigtable instances and clusters, including request volume, late…Fri 13 Nov

Blog — 20

• PostInside the Gemini factory: Accelerating partner solutionsTue 10 Nov
• PostDon't just flag it, fix it: How to run CodeMender in your pull requestsTue 10 Nov
• PostBigQuery measures is now GA: Unifying BI metrics and knowledge graphs for AI accuracyTue 10 Nov
• PostIntroducing Gemini for healthcareTue 10 Nov
• PostThe Blueprint: How Authentic Brands Group expands creativity with AuthOSTue 10 Nov
• PostExperimenting with ClusterNetworkPolicy in GKETue 10 Nov
• PostThe open AI-native stack on Kubernetes: From open models to distributed inference and agentsTue 10 Nov
• PostIntroducing new AI functions for AlloyDB: ai.classify and ai.extractWed 11 Nov
• PostDon’t just prompt AI — architect it: Introducing the Professional Agentic Architect CertificationWed 11 Nov
• PostHow lemonflow built real-time agents for EV charging using Gemma and TPUsWed 11 Nov
• PostChrome Enterprise brings more protections to healthcare technologiesThu 12 Nov
• PostPowering agentic cloud governance: What's new in Organization PolicyThu 12 Nov
• PostWhat’s new with Google Data CloudThu 12 Nov
• PostAutonomous defense at cloud speed with SentinelOne and Google Security OperationsThu 12 Nov
• PostSimplifying last mile cloud connectivity with Lumen and partner Cross-Cloud InterconnectThu 12 Nov
• PostGoogle named the furthest in vision for the Gartner Magic Quadrant for Data Lakehouse PlatformsThu 12 Nov
• PostNew AI agent observability and governance across BigQuery and LookerFri 13 Nov
• PostWhere supercomputing meets agentic AI: What’s new in Google Cloud HPC and AI at SC26Fri 13 Nov
• PostFrom OLAP to OLTP: How Copel Simplified Reverse ETL Using BigQuery's Native Export to AlloyDBFri 13 Nov
• PostWhat’s new with Google CloudFri 13 Nov

Cloud Asset Inventory — 4

• FeatureThe following resource type is publicly available through the ExportAssets , ListAssets , BatchGetAssetsHistory , QueryAssets , Feed , SearchAllResources , and…Mon 09 Nov
• FeatureThe following resource types are publicly available through the ExportAssets , ListAssets , BatchGetAssetsHistory , QueryAssets , Feed , and Search ( SearchAllR…Mon 09 Nov
• FeatureThe following resource type is publicly available through the ExportAssets , ListAssets , BatchGetAssetsHistory , QueryAssets , and Feed APIs. Cloud Key Managem…Tue 10 Nov
• FeatureThe following resource type is publicly available through the ExportAssets , ListAssets , BatchGetAssetsHistory , QueryAssets , and Feed APIs. Google Security O…Thu 12 Nov

Cloud Billing — 1

• FeatureEstimate costs for AI agents using the new cost estimator agent (Preview) Cloud Billing is introducing cost estimation directly inside the Billing section of th…Tue 10 Nov

Cloud Build — 1

• ChangeWhen storing build logs in Cloud Storage, a user-owned, regional bucket is now used by default.Wed 11 Nov

Cloud Load Balancing — 1

• FeatureServer Name Indication (SNI)-based routing with TLS routes for Proxy Network Load Balancers is now in General Availability . You can route TLS traffic to backen…Mon 09 Nov

Cloud Run — 3

• FeatureDetect vulnerabilities and exposed secrets in the container images of your Cloud Run services, jobs, and worker pools with Vulnerability Assessment for Cloud Ru…Mon 09 Nov
• FeatureAmbient networking in Cloud Run simplifies workload traffic management, security, and observability by routing through a fully managed, per-instance Envoy sidec…Fri 13 Nov
• FeatureUse express links with Cloud Run ambient networking to connect Cloud Run services without writing authentication code or configuring a service mesh ( Preview ).Fri 13 Nov

Cloud SQL for MySQL — 1

• FeatureThe C4D machine series is available for Cloud SQL for MySQL Enterprise Plus instances in the following regions: africa-south1 — Johannesburg asia-northeast1 — T…Mon 09 Nov

Cloud SQL for PostgreSQL — 1

• FeatureThe C4D machine series is available for Cloud SQL for PostgreSQL Enterprise Plus instances in the following regions: africa-south1 — Johannesburg asia-northeast…Mon 09 Nov

Cloud SQL for SQL Server — 2

• FeatureStarting November 9, 2026, newly created Cloud SQL for SQL Server instances send metadata and schema updates to Knowledge Catalog (formerly Dataplex Universal C…Mon 09 Nov
• FeatureThe C4D machine series is available for Cloud SQL for SQL Server Enterprise Plus instances in the following regions: africa-south1 — Johannesburg asia-northeast…Mon 09 Nov

Cloud Service Mesh — 8

• Announcement1.31.3-asm.7 is now available for in-cluster Cloud Service Mesh. For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh . Cloud Service Mes…Mon 09 Nov
• Announcement1.30.7-asm.7 is now available for in-cluster Cloud Service Mesh. For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh . Cloud Service Mes…Mon 09 Nov
• FixedPatch 1.31.3-asm.7 contains the fix for the following platform CVEs: CVE Proxy Control Plane Distroless CNI Severity CVE-2026-89161 Yes Yes No Yes Medium (7.8)…Mon 09 Nov
• FixedPatch 1.30.7-asm.7 contains the fix for the following platform CVEs: CVE Proxy Control Plane Distroless CNI Severity CVE-2026-89161 Yes Yes No Yes Medium (7.8)…Mon 09 Nov
• Announcement1.31.3-asm.9 is now available for in-cluster Cloud Service Mesh. For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh . Cloud Service Mes…Thu 12 Nov
• Announcement1.30.7-asm.9 is now available for in-cluster Cloud Service Mesh. For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh . Cloud Service Mes…Thu 12 Nov
• Announcement1.29.10-asm.4 is now available for in-cluster Cloud Service Mesh. For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh . Cloud Service Me…Thu 12 Nov
• FixedPatch 1.29.10-asm.4 contains the fix for the following platform CVEs: CVE Proxy Control Plane Distroless CNI Severity CVE-2026-89161 Yes Yes No Yes Medium (7.8)…Thu 12 Nov

Colab Enterprise — 1

• FeaturePython 3.13 is now available in Colab Enterprise and is the latest Python version. Runtime templates that are configured to use the latest Python version, inclu…Mon 09 Nov

Compute Engine — 3

• FeaturePreview : To enforce VM extension configurations across multiple projects, you can create and manage global and zonal VM extension policies by using VM Extensio…Mon 09 Nov
• FeatureFor your regional managed instance groups (MIGs), you can view planned instance allocations across zones and machine types, check the number of instances waitin…Tue 10 Nov
• FeatureGenerally available : In a managed instance group (MIG) with instance flexibility, you can override the instance template's disk and minimum CPU platform proper…Thu 12 Nov

Container Optimized OS — 49

• Changecos-dev-138-20309-0-0 Kernel Docker Containerd GPU Drivers COS-6.18.60 v29.4.3 v2.4.1 See ListWed 11 Nov · cos-dev-138-20309-0-0
• ChangeAdded 64k page size support for iRDMA.Wed 11 Nov · cos-dev-138-20309-0-0
• ChangeEnabled kernel configs CONFIG_I2C_TEGRA=m, CONFIG_IOMMU_DEFAULT_DMA_LAZY=y and CONFIG_RTC_DRV_NCT3018Y=m.Wed 11 Nov · cos-dev-138-20309-0-0
• ChangeUpdated app-admin/google-guest-configs to v20261025.00.Wed 11 Nov · cos-dev-138-20309-0-0
• ChangeUpdated the Linux kernel to v6.18.60.Wed 11 Nov · cos-dev-138-20309-0-0
• Changecos-121-18867-652-49 Kernel Docker Containerd GPU Drivers COS-6.6.159 v27.5.1 v2.0.10 See ListWed 11 Nov · cos-121-18867-652-49
• Changecos-125-19216-801-29 Kernel Docker Containerd GPU Drivers COS-6.12.114 v27.5.1 v2.2.7 See ListWed 11 Nov · cos-125-19216-801-29
• Changecos-129-19506-625-25 Kernel Docker Containerd GPU Drivers COS-6.12.114 v27.5.1 v2.2.7 See ListWed 11 Nov · cos-129-19506-625-25
• Changecos-133-19999-44-197 Kernel Docker Containerd GPU Drivers COS-6.18.55 v29.4.3 v2.4.1 See ListWed 11 Nov · cos-133-19999-44-197
• FeatureAdded RTC support in A4X-Max images.Wed 11 Nov · cos-dev-138-20309-0-0
• FeatureAdded support for net-fs/lustre-client-driver v2.16.0_p60.Wed 11 Nov · cos-dev-138-20309-0-0
• FeatureEnabled PCI peer to peer direct memory access for 64k kernels.Wed 11 Nov · cos-dev-138-20309-0-0
• FeatureThe ext4 journal of the stateful partition is now resized appropriately with the rest of the stateful partition.Wed 11 Nov · cos-dev-138-20309-0-0
• FeatureAdded suppport for lustre-client-driver 2.16 in new lustre package lustre-client-drivers-2_16.Wed 11 Nov · cos-121-18867-652-49
• FeatureAdded suppport for lustre-client-driver 2.16 in new lustre package lustre-client-drivers-2_16.Wed 11 Nov · cos-125-19216-801-29
• FeatureAdded suppport for lustre-client-driver 2.16 in new lustre package lustre-client-drivers-2_16.Wed 11 Nov · cos-129-19506-625-25
• FixedAdded support for NVIDIA driver v580.196.07.Wed 11 Nov · cos-dev-138-20309-0-0
• FixedAdded support for NVIDIA driver v595.112.07.Wed 11 Nov · cos-dev-138-20309-0-0
• FixedEnabled periodic fstrim.timer to reclaim unused disk blocks on thin-provisioned storage.Wed 11 Nov · cos-dev-138-20309-0-0
• FixedUpdated cos-gpu-installer to v2.7.12. It installs ucodes firmwares for r615 and newer GPU driver versions.Wed 11 Nov · cos-dev-138-20309-0-0
• FixedUpgraded app-admin/oslogin to v20261021.00.Wed 11 Nov · cos-dev-138-20309-0-0
• FixedUpgraded app-arch/bzip2 to v1.0.8-r5.Wed 11 Nov · cos-dev-138-20309-0-0
• FixedUpgraded app-arch/gzip to v1.15.Wed 11 Nov · cos-dev-138-20309-0-0
• FixedUpgraded app-containers/docker-credential-helpers to v0.9.12.Wed 11 Nov · cos-dev-138-20309-0-0
• FixedUpgraded app-editors/nano to v9.2.Wed 11 Nov · cos-dev-138-20309-0-0
• FixedUpgraded app-editors/vim to v9.2.1229, Upgraded app-editors/vim-core to v9.2.1229.Wed 11 Nov · cos-dev-138-20309-0-0
• FixedUpgraded app-misc/ca-certificates to v20260816.3.131.1.Wed 11 Nov · cos-dev-138-20309-0-0
• FixedUpgraded app-misc/jq to v1.8.2.Wed 11 Nov · cos-dev-138-20309-0-0
• FixedUpgraded chromeos-base/google-breakpad to v2026.10.15.232609-r285.Wed 11 Nov · cos-dev-138-20309-0-0
• FixedUpgraded chromeos-base/minijail to v18-r200.Wed 11 Nov · cos-dev-138-20309-0-0
• FixedUpgraded dev-db/sqlite to v3.54.1.Wed 11 Nov · cos-dev-138-20309-0-0
• FixedUpgraded dev-libs/json-c to v0.19-r3.Wed 11 Nov · cos-dev-138-20309-0-0
• FixedUpgraded dev-libs/libffi to v3.1-r9.Wed 11 Nov · cos-dev-138-20309-0-0
• FixedUpgraded dev-libs/libltdl to v2.6.2.Wed 11 Nov · cos-dev-138-20309-0-0
• FixedUpgraded dev-libs/nspr to v4.40.Wed 11 Nov · cos-dev-138-20309-0-0
• FixedUpgraded dev-libs/nss to v3.132.Wed 11 Nov · cos-dev-138-20309-0-0
• FixedUpgraded dev-libs/re2 to v0.2024.07.02-r1.Wed 11 Nov · cos-dev-138-20309-0-0
• FixedUpgraded net-dns/c-ares to v1.34.9.Wed 11 Nov · cos-dev-138-20309-0-0
• FixedUpgraded net-fs/cifs-utils to v7.8, Upgraded sys-libs/talloc to v2.5.0.Wed 11 Nov · cos-dev-138-20309-0-0
• FixedUpgraded net-libs/gnutls to v3.8.13.Wed 11 Nov · cos-dev-138-20309-0-0
• FixedUpgraded net-misc/openssh to v10.6_p1.Wed 11 Nov · cos-dev-138-20309-0-0
• FixedUpgraded net-misc/rsync to v3.5.1.Wed 11 Nov · cos-dev-138-20309-0-0
• FixedUpgraded sys-apps/less to v710.Wed 11 Nov · cos-dev-138-20309-0-0
• FixedUpgraded sys-apps/rootdev to v0.0.1-r52.Wed 11 Nov · cos-dev-138-20309-0-0
• FixedUpgraded sys-fs/e2fsprogs to v1.47.4.Wed 11 Nov · cos-dev-138-20309-0-0
• FixedUpgraded sys-fs/mdadm to v4.6-r1.Wed 11 Nov · cos-dev-138-20309-0-0
• FixedUpgraded sys-libs/libcap-ng to v0.9.6.Wed 11 Nov · cos-dev-138-20309-0-0
• FixedUpgraded sys-libs/libxcrypt to v4.5.2.Wed 11 Nov · cos-dev-138-20309-0-0
• FixedUpgraded virtual/pkgconfig to v3.Wed 11 Nov · cos-dev-138-20309-0-0

Dataform — 2

• FeatureYou can limit how many actions run concurrently within a single workflow execution or workflow configuration schedule . This feature is generally available (GA)…Mon 09 Nov
• FeatureYou can track table-level data lineage in Knowledge Catalog for Dataform workflows and BigQuery pipelines. For more information, see Track data lineage in Knowl…Thu 12 Nov

Firestore with MongoDB compatibility — 1

• FeatureFirestore with MongoDB compatibility offers conversational analytics, which lets you query operational data using natural language. This feature is powered by t…Mon 09 Nov

Gemini — 1

• OtherBug fixes in IntelliJ Various bug fixes and minor product enhancements.Wed 11 Nov · Bug

Gemini Enterprise — 7

• FeatureGemini Enterprise: Gemini 4 Carbon available in web app, mobile app, Workflow Builder, and AI developer tools Gemini 4 Carbon is generally available (GA) for th…Tue 10 Nov
• ChangeGemini Notebook for business: Gemini Notebook Enterprise renamed to Gemini Notebook for business Gemini Notebook Enterprise is renamed to Gemini Notebook for bu…Thu 12 Nov
• FeatureGemini Enterprise: Gemini 4 Hydrogen available in web app, mobile app, Workflow Builder, and AI developer tools Gemini 4 Hydrogen is generally available (GA) fo…Thu 12 Nov
• FeatureGemini Enterprise: Gemini 3.8 Flash regional availability in Canada and Japan Gemini 3.8 Flash is generally available (GA) in Canada and Japan. Location availab…Thu 12 Nov
• FeatureGemini Enterprise: View and restore skill versions Skill owners can view the version history of a skill, inspect the instructions and files of earlier versions…Thu 12 Nov
• FeatureGemini Enterprise: 3-legged OAuth authentication with Agent Identity auth manager for A2A agents Support for 3-legged OAuth (3LO) authentication with Agent Iden…Fri 13 Nov
• FeatureGemini Enterprise: Single-user quota limits for AI developer tools Single-user quota limits apply to AI developer tools, including Google Antigravity, in the Ge…Fri 13 Nov

Gemini Enterprise Agent Platform — 14

• FeatureGemini 3.8 Flash regional support in Canada and Japan Gemini 3.8 Flash ( gemini-3.8-flash ) is generally available (GA) in Canada ( northamerica-northeast1 ) an…Mon 09 Nov
• FeatureFast mode for Anthropic Claude models is generally available Fast mode for supported Anthropic Claude models, starting with Claude Fable 5.2 ( claude-fable-5-2…Mon 09 Nov
• FeatureAnthropic's Claude Fable 5.2 Claude Fable 5.2 ( claude-fable-5-2 ) is available in General Availability (GA) in Model Garden, including support for fast mode (…Mon 09 Nov
• FeatureMeta Muse models in Preview Muse Wonder from Meta ( meta/muse-wonder-1.0 ), Muse Ember from Meta ( meta/muse-ember-1.0 ), and Muse Spark 1.3 from Meta ( meta/mu…Mon 09 Nov
• FeatureCross-project governance for semantic governance policies You can use semantic governance policies in a multi-project (hub-and-spoke) architecture to centrally…Tue 10 Nov
• FeatureProvisioned Throughput supports more detailed order statuses Provisioned Throughput supports more granular order statuses in the Google Cloud console in General…Tue 10 Nov
• FeatureGemini 4 Carbon and Gemini 4 Carbon for cyber (GA) Gemini 4 Carbon ( gemini-4-carbon ) and Gemini 4 Carbon for cyber ( gemini-4-carbon-cyber-permissive ) are ge…Tue 10 Nov
• FixedCodeMender updates (v0.20.0) This release introduces updates to CodeMender: Bug fixes : Fixed patch application failures during validation on large repositories…Tue 10 Nov
• FeatureEnd-user safety identifier labels for abuse monitoring End-user safety_identifier request labels are available in General Availability (GA) for Gemini ( generat…Wed 11 Nov
• FeatureGemini 4 Carbon in CodeMender (Preview) CodeMender now supports Gemini 4 Carbon. To use it, pass --model gemini-4-carbon to cm find , cm verify , or cm fix . Ge…Wed 11 Nov
• FeatureGovern agents on any CNCF-conformant Kubernetes cluster with Agent Gateway for cross-cloud (Limited Preview) Agent Gateway for cross-cloud is available in Limit…Wed 11 Nov
• FixedCodeMender updates (v0.21.0) This release introduces updates to CodeMender: Sandboxed build commands and patch refresh : When sandboxing is enabled, cm build an…Wed 11 Nov
• FeatureAgent Gateway for GKE in Preview Agent Gateway for GKE is now in Preview for clusters on GKE version 1.37.2-gke.1042000 or higher. (This GKE version is accessib…Thu 12 Nov
• FeatureGemini 4 Hydrogen (GA) Gemini 4 Hydrogen ( gemini-4-hydrogen ) is generally available (GA) in Gemini Enterprise Agent Platform as a short-term release (subject…Thu 12 Nov

Google Cloud Contact Center as a Service — 2

• AnnouncementGoogle Cloud CCaaS prerelease notes 6.33 Here are the prerelease notes for what we expect to be the next version of Google Cloud CCaaS. When we release this ver…Tue 10 Nov
• FixedThis release addresses the following issues: Fixed an issue where numbers on the inbound blocklist weren't blocked when calling a direct line. Fixed an issue wh…Tue 10 Nov

Google Distributed Cloud (software only) for VMware — 1

• AnnouncementGoogle Distributed Cloud (software only) for VMware 1.34.1100-gke.125 is now available for download. To upgrade, see Upgrade clusters . Google Distributed Cloud…Wed 11 Nov

Google Distributed Cloud (software only) for bare metal — 1

• AnnouncementGoogle Distributed Cloud (software only) for bare metal 1.34.1100-gke.125 is now available for download. To upgrade, see Upgrade clusters . Google Distributed C…Wed 11 Nov

Google Kubernetes Engine — 19

• FeatureGKE Gateway now supports Server Name Indication (SNI)-based routing with TLS passthrough. You can use TLS protocol-specific rules to route incoming TLS streams…Mon 09 Nov
• FeatureAgent Substrate on GKE is now Generally Available (GA) for GKE Standard clusters running version 1.37 or later. Agent Substrate is an infrastructure layer desig…Mon 09 Nov
• Change(2026-R47) Version updates GKE cluster versions have been updated. New versions available for upgrades and new clusters. The following versions are now availabl…Tue 10 Nov
• Change(2026-R47) Version updates Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and…Tue 10 Nov
• Change(2026-R47) Version updates Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and…Tue 10 Nov
• Change(2026-R47) Version updates Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and…Tue 10 Nov
• Change(2026-R47) Version updates Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and…Tue 10 Nov
• Change(2026-R47) Version updates Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and…Tue 10 Nov
• Extended channelNote : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to…Tue 10 Nov
• No channel (deprecated)Note : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to…Tue 10 Nov
• Rapid channelNote : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to…Tue 10 Nov
• Regular channelNote : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to…Tue 10 Nov
• Security(2026-R47) Security updates This release includes new GKE versions that use updated Container-Optimized OS images. These updated images are cumulative, incorpor…Tue 10 Nov
• Stable channelNote : Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to…Tue 10 Nov
• FeatureCapacity buffers, including active and standby capacity buffers, are generally available for GKE Standard and Autopilot clusters running version 1.37.1-gke.3020…Wed 11 Nov
• IssueOn nodes that have Linux syscall auditing enabled, such as Container-Optimized OS nodes where you enabled Linux auditd logging , mounting Cloud Storage FUSE CSI…Wed 11 Nov
• ChangeIn GKE version 1.35.1-gke.1516000 or later, GKE Dataplane V2 clusters use a unified cilium-cni configuration instead of a chained CNI setup. With this change, C…Thu 12 Nov
• FeatureAgent Sandbox on GKE is generally available and runs on any supported GKE version. Agent Sandbox on GKE is optimized for running isolated, stateful, single-repl…Thu 12 Nov
• FeatureAgent Gateway for GKE is now available in Preview in the Rapid channel on clusters running GKE version 1.37.2-gke.1042000 or later. Agent Gateway provides a cen…Thu 12 Nov

Looker — 10

• AnnouncementThe latest versions in the Looker (Google Cloud core) release channels are beginning deployment as follows: Latest version in the Rapid channel: Looker 26.24 La…Wed 11 Nov
• AnnouncementBeginning November 9, 2026, the following features will be automatically enabled for Looker (original) and Looker (Google Cloud core) instances running Looker 2…Fri 13 Nov
• BreakingTwo-factor authentication (2FA) is now enabled by default for all new and existing Looker (original) instances that use email and password authentication and th…Fri 13 Nov
• ChangeWe will begin billing for usage of Gemini-assisted features that exceeds their instance token allocation. Gemini-assisted features are a set of agentic capabili…Fri 13 Nov
• ChangeWhen you download a dashboard as a PDF or set up a PDF dashboard delivery , selecting Expand tables to show all rows makes the Fit Page to Dashboard option unav…Fri 13 Nov
• FeatureLooker (original) now supports Google Group mirroring , which lets administrators automatically assign Looker roles and groups that are based on Google Groups m…Fri 13 Nov
• FeatureLooker visualizations now support grouping rows or pivot columns that are outside of row or column limits into a consolidated "Other" category. When you use Lim…Fri 13 Nov
• FeatureWhen you download Looks, Explores, or dashboard tiles , you can include filter and query information in the downloaded file. PNG images can include a filter ban…Fri 13 Nov
• FeatureLooker administrators can now opt in to the official Google BigQuery JDBC driver ( Preview ) on BigQuery connections . The new driver is built and supported by…Fri 13 Nov
• FeatureThe Sankey chart type is now generally available. Sankey charts visualize the flow and distribution of data between categories, stages, or states. Sankey charts…Fri 13 Nov

Managed Service for Apache Airflow — 2

• FixedResolved the Python 3.11 google-api-core (versions 2.28.0 to 2.43.0) performance degradation issue for new environments and image updates: Images released on or…Thu 12 Nov
• Breaking(Airflow 3.3.1, 3.2.2, and 2.11.1) Upgraded the pip package from version 23.2.1 to version 26.2.2. This update is available in Managed Airflow (Gen 3) builds co…Fri 13 Nov

Managed Service for Apache Spark — 1

• AnnouncementManaged Service for Apache Spark (formerly Google Cloud Serverless for Apache Spark): Runtime version 4.0 is generally available ( GA ). This version includes t…Mon 09 Nov

Memorystore for Redis — 1

• FeatureMemorystore for Redis supports the CLIENT command and the following subcommands: CLIENT | CACHING CLIENT | GETNAME CLIENT | GETREDIR CLIENT | HELP CLIENT | ID C…Mon 09 Nov

Model Armor — 2

• FeatureModel Armor image screening is generally available (GA) . You can extract and screen images embedded within supported rich text documents (PDF, Word, Excel, and…Tue 10 Nov
• FeatureFilter version v4 under the Latest alias includes an updated prompt injection and jailbreak detection filter with the following improvements: Higher recall for…Thu 12 Nov

Network Connectivity Center — 1

• FixedIPv6 dynamic routes (Preview) traffic sent to hybrid spokes from VPC spokes will incur Advanced Data Networking (ADN) charges at the same rate as IPv4 traffic.…Tue 10 Nov

Oracle Database@Google Cloud — 1

• FeatureFor Exadata VM Clusters and Exascale VM Clusters, you can now choose to create a cluster without an Identity Connector, and enable or disable the Identity Conne…Wed 11 Nov

Policy Controller — 1

• DeprecatedPolicy Controller is deprecated as of November 12, 2026, and reaches end of support on December 31, 2027. Starting January 31, 2027, you can't enable Policy Con…Thu 12 Nov

Resource Manager — 1

• ChangeEssential Contacts write operations ( CreateContact , UpdateContact , DeleteContact , and SendTestMessage ) in the v1 API now generate Admin Activity audit logs…Fri 13 Nov

SAP on Google Cloud — 1

• AnnouncementGoogle Cloud's Agent for SAP version 3.16 Version 3.16 of Google Cloud's Agent for SAP is generally available (GA). This version introduces enhancements for the…Mon 09 Nov

Secure Web Proxy — 1

• FeatureYou can deploy Secure Web Proxy as an Agent Gateway to centrally secure, govern, and monitor outbound traffic from AI agents that run on Google Kubernetes Engin…Thu 12 Nov

Security Command Center — 2

• FeatureSecurity Command Center predefined roles are modified. For information about the changes and how to migrate your custom roles, see Migrating custom roles .Mon 09 Nov
• FeaturePreview : Security Command Center Vulnerability Assessment for Google Cloud helps you detect vulnerabilities and exposed secrets in the container images of your…Mon 09 Nov

Security bulletin — 2

• GCP-2026-080Published: 2026-11-09 Updated: 2026-11-12 Description Description Severity Notes Security vulnerabilities were discovered in Istio ( ISTIO-SECURITY-2026-009 ).…Mon 09 Nov
• GCP-2026-081Published: 2026-11-10 Description Description Severity Notes AMD has disclosed three vulnerabilities that affect 5th generation AMD EPYC processors (code-named…Tue 10 Nov

Service Health — 1

• FeaturePersonalized Service Health supports resource-level impact in Preview for supported products through the Service Health v1beta API and the gcloud beta CLI. For…Tue 10 Nov

Spanner — 2

• LibrariesJava 1.95.0 (2026-11-02) Bug Fixes spanner: attach routing hints to read-write transaction requests ( #14786 ) ( 54e0585 ) spanner: cancel queries promptly on c…Mon 09 Nov
• FeatureSpanner parameterized views are now generally available ( GA ). Parameterized views let you dynamically filter data based on session context parameters passed w…Tue 10 Nov

Vertex AI Search — 1

• FeatureAgent Search: Search-as-you-type for custom search apps (Preview) You can configure schema fields to support search-as-you-type in custom search apps. Search-as…Tue 10 Nov

Virtual Private Cloud — 1

• FeatureGeneral Availability : You can create an internal range with the INTERNAL_ADDRESS purpose to allocate global internal IPv4 addresses for Private Service Connect…Mon 09 Nov

Official Google Cloud references

• Google Cloud security bulletins — GCP-2026-080 and GCP-2026-081
• Google Cloud release notes (all products)
• Google Kubernetes Engine release notes
• Compute Engine release notes
• Looker release notes
• Cloud Composer release notes
• Cloud Service Mesh release notes