Google Cloud release notes

The following release notes cover the most recent changes over the last 60 days. For a comprehensive list of product-specific release notes, see the individual product release note pages.

You can also see and filter all release notes in the Google Cloud console or you can programmatically access release notes in BigQuery.

To get the latest product updates delivered to you, add the URL of this page to your feed reader, or add the feed URL directly.

April 03, 2025

BigQuery

BigQuery migration assessment now includes support for Amazon Redshift Serverless. This feature is in preview.

You can now generate structured data by using BigQuery ML's AI.GENERATE_TABLE function with Gemini 1.5 Pro, Gemini 1.5 Flash, and Gemini 2.0 Flash models. You can use the AI.GENERATE_TABLE function's output_schema argument to more easily format the model's response. The output_schema argument lets you specify a SQL schema for formatting, similar to the schema used in the CREATE TABLE statement. By creating structured output, you can more easily convert the function output into a BigQuery table.

Try this feature with the Generate structured data by using the AI.GENERATE_TABLE function tutorial.

This feature is in preview.

Cloud Composer

The unification of Cloud Composer 3 billing with BigQuery is paused until further notice. The change was previously scheduled for April 13, 2025.

In recently released Airflow builds of Cloud Composer 3, the Airflow web server requires more CPU to finish its initialization when an environment is created or updated. This might lead to longer operation times or failures to perform these operations.

As a workaround, when you create a new Cloud Composer 3 environment or upgrade an existing environment, provide at least 1 CPU to the Airflow web server.

This issue currently affects composer-3-airflow-2.10.2-build.12 and composer-3-airflow-2.9.3-build.19 Airflow builds.

April 02, 2025

API Gateway

On April 2, 2025, we released an updated version of API Gateway.

With this release, API Gateway meets the regulatory and compliance requirements for support of data residency for data at rest.

For more information, see Google Cloud Platform Services with Data residency.

AlloyDB Omni

When the ScaNN index creation updates the reltuples statistics of a heap table, performance might be degraded for queries involving that table. For information to mitigate the issue, see Analyze your indexed table.

AlloyDB for PostgreSQL

When the ScaNN index creation updates the reltuples statistics of a heap table, performance might be degraded for queries involving that table. For information to mitigate the issue, see "Analyze your indexed table" in the documentation for AlloyDB for PostgreSQL and AlloyDB Omni.

Apigee API hub

VPC Service Controls (VPC-SC) integration (Preview)

API hub now integrates with VPC Service Controls, providing enhanced network security for your API hub instance provisioned in Google Cloud. Establish service perimeters to control ingress and egress traffic. For more information, see VPC Service Controls for API hub.

Data Residency Zone (DRZ) compliance

API hub is now compliant with Data Residency Zone (DRZ) C3 requirements. For more information, see API hub locations.

Terraform support for provisioning

You can now provision API hub instances programmatically using Terraform for Google Cloud within Cloud Shell, enabling infrastructure-as-code practices. For more information, see Provision API hub using Terraform.

Plugin Framework

API hub now uses a plugin framework to connect and ingest API metadata from various Google Cloud services and external sources where your APIs are managed or defined. This provides a flexible and extensible way to integrate with your existing API landscape. For more information, see Plugins overview.

API Metadata Curations

API hub introduces a curation process to transform and enrich API metadata ingested by plugins. This ensures consistency across different sources, enabling effective governance, discovery, and management of your APIs. For more information, see Curations overview.

API Supply chain graph view

Visualize and understand the dependencies within your API ecosystem with the new interactive API supply chain graph view. This directed graph allows you to explore the relationships between your APIs and API operations. For more information, see API Supply chain views.

Enhancements to the Operations entity [API only]

You can now add, edit, or delete operations for an API version even if it lacks a specification file or has an unparsable one. For more information, see Manage operations.

Attach API documents

You can now enhance your API documentation by attaching additional relevant files, such as requirements, design documents, and functionality details, directly to your APIs in API hub.

Deprovision an API hub instance [API only]

You can now delete an API hub instance from your Google Cloud project using the ApiHubInstance API. For more information, see Deprovision Apigee API hub.

Application Integration

Build Conversational Agents with Dialogflow CX (Preview)

Application Integration now simplifies the creation of conversational experiences with direct integration with Conversational Agents (Dialogflow CX). Using API triggers, you can now build intelligent chatbots and automated tools directly within your integration workflows, enhancing user interactions and automating tasks.

For more information, see Build conversational agents with Application Integration.

Enhancements to Replay Execution

Application Integration Replay Execution now provides the following enhancements:

  • Modify input parameters on replay: You can now modify the input parameters of an integration execution when initiating a replay. This provides greater flexibility in fixing failed executions.
  • Continue execution from point of failure: When replaying an integration, you can now choose to continue the execution from the point of the last failure. This will retry the failed task and, upon success, continue the execution from that point, saving time and effort.

For more information, see Introduction to replay executions.

BigQuery

You can now create and use Python user-defined functions (UDFs) in BigQuery. Python UDFs support the use of additional libraries and external APIs. This feature is in preview.

The Python code that you generate using Gemini in BigQuery Notebooks is now much more likely to leverage your data. With this change, BigQuery Notebooks can intelligently pull relevant table names directly from your BigQuery project, resulting in personalized, executable Python code.

You can now generate Dataframes code in BigQuery Notebooks that use BigFrames libraries. In your code generation prompt, include the word BigFrames to generate code that uses BigQuery DataFrames. This feature is in preview.

Cloud Run

Deploying multiple containers (sidecars) to a Cloud Run job is now generally available. (GA)

Compute Engine

Generally available: You can manage OS policy assignments across projects and zones at scale in large organizations using the OS policy orchestrator feature in VM Manager. OS policy assignment was previously available only for zonal resources in a project. For more information, see About OS Policy Orchestrator.

Google Cloud Contact Center as a Service

Version 3.33 pre-release announcement

Version 3.33 of Google Cloud CCaaS is not yet released, but we expect the capabilities of version 3.33 to closely match the capabilities described in this announcement. We will update this announcement when we release version 3.33.

Salesforce CRMs: attach a CCaaS session object to a CRM record if a matching CRM record is found

For Salesforce CRMs, when you append a call or chat session to the latest open record, you have the option to attach a CCaaS session object to a CRM record if a matching CRM record is found.

New options for CRM comments when saving call recordings and chat transcripts to external storage

When you save call recordings and chat transcripts to external storage, you can control how these are referenced in the CRM record. You now have the following options:

  • Add a call recording or chat transcript link as a comment in the CRM record.
  • Add the call recording or chat transcript filename as a comment in the CRM record.
  • Don't add any reference to the call recording or chat transcript in the CRM record.

Note: to make comments consistent across CRM platforms, we've standardized on the following phrases in CRM comments: Chat Transcripts, Call Recordings, and Voicemails.

New call type in reports: Voice Outbound (UCaaS)

We've added the Voice Outbound (UCaaS) report type to the Create Reports page for calls and chats so you can generate reports that contain this type of call.

Conditional overcapacity deflections

You can now enable conditional overcapacity deflections for calls. You can choose from a number of wait-time conditions or time-of-day conditions, and you can create a distinct deflection message for each each condition that you configure.

New post events for virtual task assistants

The following new virtual task assistant post events are available:

  • Virtual task assistant joined
  • Virtual task assistant left
  • Virtual task assistant session variables received

The agent adapter can use the browser's postMessage() method to send events to the parent iFrame to trigger various actions in your custom CRM application.

Bulk agent status import improvements

When you import agent statuses in bulk, the Import Statuses dialog now indicates when the upload is complete and sends you a confirmation email.

Configure a contact list destination to pass data parameters to a SIP header

You can configure a contact list destination to pass data parameters to a SIP URI when an agent uses the destination to make an outbound call or transfer a call.

View transcripts for completed chats

If you save chat transcripts in external storage, you can view them from the Completed Chats dashboard.

The following issues were addressed in this release:

  • Fixed an issue where users couldn't deactivate a disposition code or list that was assigned to a queue when the queue was deleted prior to the deactivation.
  • Fixed an issue in Kustomer integrations where an outbound call to a number that wasn't in the CRM wasn't creating a record.
  • Fixed an issue where the button to assign a record ID to a session was missing from the agent adapter.
  • Fixed an issue for the Customer End User Dial '0' Behavior queue settings. After a user selected and saved the Dialing '0' moves user back up one level in IVR setting, an error was returned when they attempted to select a different setting.
  • Fixed an issue where NICE call recordings failed and returned an Exception 12 error.
  • Fixed an issue where agents couldn't transfer call or chat sessions to another queue. This occurred when all assigned agents in the destination queue were unavailable or at the concurrency limit.
  • Fixed an issue where searches for chat shortcuts were case sensitive. These searches are now case insensitive.
  • Fixed an issue where the option to select the account ID and record ID for a session appeared in the agent adapter even when they were configured in the platform to not appear.
  • Fixed an issue where the call flexible inbound record ID for a session was not automatically suggested in the agent adapter.
  • Fixed an issue where no records were displayed in the Record ID field during wrap up.
  • Fixed an issue where the first open record created by the end-user was selected instead of Create New Record being selected.
  • Fixed an issue where the default value for the record ID for a session was not the most recently closed and updated record.
  • Fixed an issue in Salesforce integrations where the Answer button in the agent adapter didn't appear for incoming calls. This happened after the agent clicked the Assign button multiple times while attempting to assign a record ID or account ID to a session during wrap up.
  • Fixed an issue where the Assign button appeared in the agent adapter during wrap-up even when the account ID and record ID were already assigned to the session.
  • Fixed an issue where the Assign button in the agent adapter was clickable multiple times during wrap up. Now, after an agent assigns a record ID or account ID to a session, the Assign button is no longer active.
  • Fixed an issue where the option to assign a record ID or account ID to a session didn't appear during wrap up even though the agent didn't make these assignments during the call.
  • Fixed an issue where the Next button for assigning a record ID or account ID to a session was inactive until the agent made a different selection.
  • Fixed an issue where the Agent Assist icon didn't appear in the agent adapter when an agent returned to an inactive chat.
  • Fixed an issue where an error was returned when a user attempted to assign an email session to another user.
  • Fixed an issue in workforce management where the day planner didn't display the green checkmark after a file was imported.
  • Fixed an issue in workforce management where the green success message didn't appear for some forecast types.
Google Kubernetes Engine

(2025-R13) Version updates

GKE cluster versions have been updated.

New versions available for upgrades and new clusters.

The following Kubernetes versions are now available for new clusters and for opt-in control plane upgrades and node upgrades for existing clusters. For more information on versioning and upgrades, see GKE versioning and support and Upgrades.

Rapid channel

Regular channel

There are no new releases in the Regular channel.

Stable channel

There are no new releases in the Stable channel.

Extended channel

No channel

(2025-R13) Version updates

(2025-R13) Version updates

There are no new releases in the Regular channel.

(2025-R13) Version updates

There are no new releases in the Stable channel.

(2025-R13) Version updates

(2025-R13) Version updates

Automatic application monitoring is now generally available in GKE versions 1.28 and later. When configured on GKE clusters, this feature automatically collects key metrics with Google Cloud Managed Service for Prometheus and provides out-of-the-box dashboards for monitoring the supported workloads. Automatic application monitoring supports six new AI model servers (NVIDIA Triton, vLLM, TGI, JetStream, TorchServe and TensorFlow Serving). For more information, see Configure automatic application monitoring.

Google SecOps

Medium Priority rule set

Google SecOps has introduced a new rule set, Medium Priority, in Applied Threat Intelligence (ATI). This rule set extends the capabilities of the ATI indicator prioritization model and expands prioritization logic to include commodity malware. For more information, see Applied Threat Intelligence priority overview.

Google SecOps SIEM

Medium Priority rule set

Google SecOps has introduced a new rule set, Medium Priority, in Applied Threat Intelligence (ATI). This rule set extends the capabilities of the ATI indicator prioritization model and expands prioritization logic to include commodity malware. For more information, see Applied Threat Intelligence priority overview.

Memorystore for Valkey

Memorystore for Valkey is now Generally Available (GA).

Multi-VPC support for Memorystore for Valkey is now Generally Available (GA). This functionality enables you to create Private Service Connect endpoints in multiple VPCs to connect to the same Memorystore for Valkey instance. This provides you with enhanced flexibility and resilience for your network architecture. For more information, see About multiple VPC networking.

Security Command Center

When activating Security Command Center Enterprise, you can monitor the provisioning status and progress of initial scans. This capability is in Preview.

Text-to-Speech

Chirp 3: HD voices with 8 speakers and 31 locales is now GA. It offers real-time streaming and batch processing capabilities and is accessible in global, us, eu, and asia-southeast1 regions.

Explore the latest Chirp 3: HD voices capabilities. Find out their full potential by visiting our updated documentation, specifically the voice controls section.

VPC Service Controls

General availability support for the following integration:

April 01, 2025

BigQuery

Pipe syntax supports a linear query structure designed to make your queries easier to read, write, and maintain. This feature is generally available (GA).

You can use a CREATE MODEL statement to create a contribution analysis model in BigQuery ML. The top_k_insights_by_apriori_support and pruning_method model options are now supported. You can use a contribution analysis model with the ML.GET_INSIGHTS function to generate insights about changes to key metrics in your multi-dimensional data. The following metric types are supported:

This feature is generally available (GA).

Dataproc

New Dataproc on Compute Engine subminor image versions:

  • 2.2.51-debian12, 2.2.51-rocky9, 2.2.51-ubuntu22

Dataproc on Compute Engine: Hyperdisk-Balanced is now the default primary disk type when creating a cluster from the console.

Dataproc on Compute Engine: Fixed incorrectly attributed Dataproc job logs in Cloud Logging for clusters created with 2.2+ image versions. This happened when multiple Dataproc jobs were running concurrently on the same cluster.

Gemini Code Assist

Code customization for chat is now generally available for VS Code and IntelliJ Gemini Code Assist. This feature provides contextually relevant code suggestions and insights in your IDE's Gemini Code Assist chat interface. Code customization for chat is available without any additional configuration required. For more information on how to use code customization for chat effectively, see Use code customization.

Looker

The following features have been added to Studio in Looker, which is available in preview:

March 31, 2025

AlloyDB for PostgreSQL

If your cluster is encrypted with a customer-managed encryption key (CMEK), and no specific CMEK key is configured for continuous or automated backups, then backups will be created with the cluster CMEK. For more information, see About CMEK and Configure backup plans.

Apigee X

On March 31, 2025, we released an updated version of Apigee (1-15-0-apigee-2).

Bug ID Description
N/A Updates to security infrastructure and libraries.
BigQuery

Iceberg external tables now support merge-on-read. You can query Iceberg tables with position deletes and equality deletes. This feature is generally available (GA).

A weekly digest of client library updates from across the Cloud SDK.

Python

Changes for google-cloud-bigquery

3.31.0 (2025-03-20)

Features
  • Add query text and total bytes processed to RowIterator (#2140) (2d5f932)
  • Add support for Python 3.13 (0842aa1)
Bug Fixes
  • Add property setter for table constraints, #1990 (#2092) (f8572dd)
  • Allow protobuf 6.x (0842aa1)
  • Avoid "Unable to determine type" warning with JSON columns in to_dataframe (#1876) (968020d)
  • Remove setup.cfg configuration for creating universal wheels (#2146) (d7f7685)
Dependencies
  • Remove Python 3.7 and 3.8 as supported runtimes (#2133) (fb7de39)

On the Scheduling page, you can now view existing schedules, create new schedules, and perform other actions for data preparations, notebooks, BigQuery pipelines, and scheduled queries. For more information, see Create a pipeline schedule. This feature is generally available (GA).

You can build BigQuery pipelines (formerly workflows), composed of SQL queries or notebooks, in BigQuery Studio. You can then run these pipelines on a schedule. You can also configure notebook runtimes for a pipeline, share a pipeline, or share a pipeline link. This feature is generally available (GA).

You can now define a _CHANGE_SEQUENCE_NUMBER for BigQuery change data capture (CDC) to manage streaming UPSERT ordering for BigQuery. This feature is generally available (GA).

BigQuery now supports subqueries in row level access policies. It also includes support for BigLake managed tables and the BigQuery Storage Read API. This feature is now generally available (GA).

You can now use BigQuery Data Transfer Service for Search Ads to view Performance Max (PMax) campaign data for the following tables:

  • CartDataSalesStats
  • ProductAdvertised
  • ProductAdvertisedDeviceStats
  • ProductAdvertisedConversionActionAndDeviceStats

This feature is generally available (GA).

You can now configure the repeat frequency of BigQuery Data Transfer Service for Google Ad Manager. This option has a default of every 8 hours and a minimum of every 4 hours. This feature is generally available (GA).

You can now skip loading match tables for BigQuery Data Transfer Service for Google Ad Manager. If match tables are not needed, you can set parameter load_match_tables to FALSE. This feature is generally available (GA).

You can include data preparation tasks in BigQuery pipelines that execute your code assets in sequence at a scheduled time. This feature is in Preview.

Bigtable

A weekly digest of client library updates from across the Cloud SDK.

Java

Changes for google-cloud-bigtable

2.57.1 (2025-03-24)

Bug Fixes
  • Handling of totalTimeout on SQL plan refresh (#2541) (bf49cf9)

2.57.0 (2025-03-24)

Features
  • Add PreparedStatement and update ExecuteQuery API to use it (#2534) (49d4d09)
Cloud Deploy

Cloud Deploy support for timed promote is now generally available.

Cloud Deploy support for deploy policies is now generally available.

Cloud Deploy support for repair rollout automation is now generally available.

Cloud SQL for MySQL

Cloud SQL now supports Managed Connection Pooling (MCP) in Preview, which lets you scale your workloads by optimizing resource utilization for your Cloud SQL instances using pooling. For more information, see Managed Connection Pooling overview.

Cloud SQL for PostgreSQL

Cloud SQL now supports Managed Connection Pooling (MCP) in Preview, which lets you scale your workloads by optimizing resource utilization for your Cloud SQL instances using pooling. For more information, see Managed Connection Pooling overview.

Cloud Storage

Additional functionality is now available for the bucket IP filtering feature:

Storage batch operations for Cloud Storage is now generally available (GA). Using storage batch operations, you can perform operations on billions of Cloud Storage objects in a serverless manner. To learn more about storage batch operations, see Overview of storage batch operations.

You can now use metrics to monitor Cloud Storage FUSE performance. For more information, see Cloud Storage FUSE metrics.

Cloud TPU

Flex-start for Cloud TPU, powered by Dynamic Workload Scheduler, is available in Preview. Flex-start is a flexible and cost-effective consumption option for AI workloads. Flex-start enables you to dynamically provision TPUs for up to 7 days using the queued resources API, without long-term reservations. This option is ideal for quick experimentation, small-scale testing, dynamic inference provisioning, and model fine-tuning. For more information about Flex-start for Cloud TPU, see Request Cloud TPUs using Flex-start.

Colab Enterprise

Preview: You can switch to a default runtime with GPUs by using a button in your Colab Enterprise notebook. To enable a default runtime with GPUs for your users, see Enable default runtimes with GPUs.

Compute Engine

Compute Engine provides the interactive serial console for troubleshooting malfunctioning instances. The serial console SSH key endpoint is deprecated and a new serial SSH key endpoint is available. For more information, see Serial console SSH host key endpoint deprecation.

Confidential Space

Support for Confidential Space on Intel CPUs (C3 machine family) with Intel TDX is now generally available.

Confidential Space now allows adding specific Linux capabilities, including CAP_SYS_ADMIN, and provides a namespaced read or write cgroup.

New Confidential Space images (250300 and 250301) are now available.

Container Optimized OS

cos-105-17412-535-98

Kernel Docker Containerd GPU Drivers
COS-5.15.173 v23.0.3 v1.7.23 See List

Updated dev-go/net to v0.33.0. This fixed CVE-2023-45288.

Fixed CVE-2025-21763 in the Linux kernel.

Fixed CVE-2025-21764 in the Linux kernel.

Fixed CVE-2025-21762 in the Linux kernel.

Fixed CVE-2025-21760 in the Linux kernel.

Fixed CVE-2025-21726 in the Linux kernel.

Fixed KCTF-fcdd224 in the Linux kernel.

Fixed CVE-2024-53174 in the Linux kernel.

Fixed CVE-2024-53194 in the Linux kernel.

Fixed CVE-2024-56558 in the Linux kernel.

Fixed CVE-2024-57979 in the Linux kernel.

Fixed CVE-2025-21727 in the Linux kernel.

Fixed CVE-2025-21796 in the Linux kernel.

Fixed CVE-2024-58005 in the Linux kernel.

Fixed CVE-2025-21846 in the Linux kernel.

Fixed CVE-2025-21844 in the Linux kernel.

Fixed CVE-2024-57977 in the Linux kernel.

Fixed CVE-2024-57977 in the Linux kernel.

Fixed CVE-2025-21745 in the Linux kernel.

Fixed CVE-2025-21814 in the Linux kernel.

Runtime sysctl changes:

  • Changed: fs.file-max: 812690 -> 812692

cos-109-17800-436-91

Kernel Docker Containerd GPU Drivers
COS-6.1.124 v24.0.9 v1.7.24 See List

Updated dev-go/net to v0.33.0. This fixed CVE-2023-45288.

Fixed CVE-2025-21763 in the Linux kernel.

Fixed CVE-2025-21764 in the Linux kernel.

Fixed CVE-2025-21760 in the Linux kernel.

Fixed CVE-2025-21762 in the Linux kernel.

Fixed CVE-2025-21726 in the Linux kernel.

Fixed KCTF-fcdd224 in the Linux kernel.

Fixed CVE-2024-57979 in the Linux kernel.

Fixed CVE-2025-21727 in the Linux kernel.

Fixed CVE-2025-21796 in the Linux kernel.

Fixed CVE-2025-21812 in the Linux kernel.

Fixed CVE-2024-56549 in the Linux kernel.

Fixed CVE-2023-52927 in the Linux kernel.

Fixed CVE-2024-57977 in the Linux kernel.

Fixed CVE-2024-57977 in the Linux kernel.

Fixed CVE-2024-58005 in the Linux kernel.

Runtime sysctl changes:

  • Changed: fs.file-max: 812224 -> 812258

cos-117-18613-164-98

Kernel Docker Containerd GPU Drivers
COS-6.6.72 v24.0.9 v1.7.24 See List

Updated dev-libs/expat to v2.7.0. This fixes CVE-2024-8176.

Fixed CVE-2025-21762 in the Linux kernel.

Fixed CVE-2025-21759 in the Linux kernel.

Fixed CVE-2025-21764 in the Linux kernel.

Fixed CVE-2025-21760 in the Linux kernel.

Fixed CVE-2025-21726 in the Linux kernel.

Fixed CVE-2024-56549 in the Linux kernel.

Fixed KCTF-0c3057a in the Linux kernel.

Fixed CVE-2024-57979 in the Linux kernel.

Fixed CVE-2025-21727 in the Linux kernel.

Fixed CVE-2025-21796 in the Linux kernel.

Fixed CVE-2025-21812 in the Linux kernel.

Fixed CVE-2024-50138 in the Linux kernel.

Fixed CVE-2024-57977 in the Linux kernel.

Fixed CVE-2024-57977 in the Linux kernel.

Runtime sysctl changes:

  • Changed: fs.file-max: 811744 -> 811785

cos-113-18244-291-93

Kernel Docker Containerd GPU Drivers
COS-6.1.123 v24.0.9 v1.7.24 See List

Update dev-go/net to v0.33.0. This fixed CVE-2023-45288.

Fixed CVE-2025-21763 in the Linux kernel.

Fixed CVE-2025-21762 in the Linux kernel.

Fixed CVE-2025-21764 in the Linux kernel.

Fixed CVE-2025-21760 in the Linux kernel.

Fixed CVE-2025-21726 in the Linux kernel.

Fixed KCTF-fcdd224 in the Linux kernel.

Fixed CVE-2024-57979 in the Linux kernel.

Fixed CVE-2025-21727 in the Linux kernel.

Fixed CVE-2025-21796 in the Linux kernel.

Fixed CVE-2025-21812 in the Linux kernel.

Fixed CVE-2024-56549 in the Linux kernel.

Fixed CVE-2023-52927 in the Linux kernel.

Fixed CVE-2024-57977 in the Linux kernel.

Fixed CVE-2024-57977 in the Linux kernel.

cos-beta-121-18867-0-75

Kernel Docker Containerd GPU Drivers
COS-6.6.74 v27.5.1 v2.0.2 See List

Updated dev-libs/expat to v2.7.0. This fixes CVE-2024-8176.

Fixed CVE-2024-57977 in the Linux kernel.

Fixed CVE-2024-57977 in the Linux kernel.

Runtime sysctl changes:

  • Changed: fs.file-max: 811789 -> 811827

cos-dev-125-18971-0-0

Kernel Docker Containerd GPU Drivers
COS-6.6.84 v27.5.1 v2.0.2 See List

Updated the Linux kernel to v6.6.84.

Runtime sysctl changes:

  • Changed: fs.file-max: 811727 -> 811816

Dataproc Dataproc Metastore

Dataproc Metastore federation now supports multi-regional Dataproc Metastore services.

Google Cloud Managed Service for Apache Kafka

Public preview: Google Cloud Managed Service for Apache Kafka now supports Kafka Connect. Kafka Connect provides a curated set of built-in connector plugins hosted in Connect clusters. Configure these connector plugins to create connectors that let you stream data at scale between Managed Service for Apache Kafka clusters and other systems, such as external Kafka deployments, BigQuery, Cloud Storage, or Pub/Sub. For more information, see Kafka Connect overview.

Looker Studio

Modern charts general availability

Modern charts offers new chart styling, new default theme colors, new chart configuration options, new axis customization options, and new chart settings that give report creators greater control over how data is curated and presented to users.

This feature is now generally available and is the default for all new Looker Studio reports. Existing reports must be upgraded to use modern charts. Classic report themes are still available in the Themes panel.

Learn more about modern charts.

Looker connector enhancements

The following enhancements to the Looker connector are now generally available:

Query results variables

Query result variables let you insert data directly into text elements.You can choose a cell from a table as a "query result" to insert into a text element, and Looker Studio will keep the result up to date.

YouTube Connector update

On March 31, 2025, YouTube changed the way views are calculated. Learn more about this change.

Manufacturing Data Engine

Release 1.5.0

This release is not a critical update, unless you are directly impacted by the bug fixes, you don't need to update, and you can wait for future releases before updating.

  • Metadata Versioning: To enhance the query readability of the metadata instances, MDE v1.5.0 introduced a new field called validFrom that designates the time when a particular metadata instance is effective. MDE uses this field to check which metadata instance picks based on the source message event time, not processing time, enabling accurate historical data representation. For more information, see Versioning metadata buckets.
  • Configuration Packages: Introduces a file-based configuration package system for atomic deployments and GitOps integration. For more information, see Upload configuration package and File content.
  • Development Mode: Adds a "Development Mode" to allow deletion of MDE entities and configuration packages, use with caution. For more information, see Development mode.
Pub/Sub

A weekly digest of client library updates from across the Cloud SDK.

Node.js

Changes for @google-cloud/pubsub

4.11.0 (2025-03-27)

Features
  • Add required messaging.operation span attrs for OTel sem convs 1.24 (#2019) (70ed2d7)
Bug Fixes
  • deps: Update dependency @opentelemetry/semantic-conventions to ~1.29.0 (#2012) (bfe8243)
  • deps: Update dependency @opentelemetry/semantic-conventions to ~1.30.0 (#2014) (7f8366a)
  • Type widening to match gapic, and two typing fixes (#2020) (9cd73b3)
Spanner

Spanner now supports the following GoogleSQL JSON mutator functions:

  • JSON_ARRAY_APPEND()
  • JSON_ARRAY_INSERT()
  • JSON_REMOVE()
  • JSON_SET()
  • JSON_STRIP_NULLS()

Spanner now supports the following PostgreSQL JSONB mutator functions:

  • jsonb_insert()
  • jsonb_set()
  • jsonb_set_lax()
  • jsonb_strip_nulls()

Spanner also supports the following PostgreSQL JSONB operators:

  • concat: jsonb || jsonb -> jsonb
  • delete: jsonb - text -> jsonb

For more information, see JSON functions in GoogleSQL and Supported PostgreSQL functions.

The GoogleSQL JSON_KEYS and PostgreSQL json_object_keys functions, which extract unique JSON keys from a JSON expression, are generally available.

JSON search indexes are generally available in Spanner. This extension of Spanner's full-text index capabilities accelerates many JSON document queries, even without prior knowledge of the documents' structure. You can create search indexes over any JSON document stored in a JSON column. The JSON_CONTAINS function in GoogleSQL and the @> and <@ operators in PostgreSQL can use search indexes to determine if one document structure is contained in another. Search indexing supports JSON types in GoogleSQL-dialect databases and JSONB in PostgreSQL-dialect databases. For more information, see JSON search indexes.

A monthly digest of client library updates from across the Cloud SDK.

Go

Changes for spanner/admin/database/apiv1

1.77.0 (2025-03-03)

Features
  • spanner: A new enum IsolationLevel is added (#11624) (2c4fb44)
  • spanner: A new field isolation_level is added to message .google.spanner.v1.TransactionOptions (2c4fb44)
  • spanner: Add a last field in the PartialResultSet (#11645) (794ecf7)
  • spanner: Add option for LastStatement in transaction (#11638) (d662a45)
Bug Fixes
  • spanner: Avoid desructive context augmentation that dropped all headers (#11659) (594732d)
Documentation
  • spanner: A comment for enum value OPTIMISTIC in enum ReadLockMode is changed (2c4fb44)
  • spanner: A comment for enum value PESSIMISTIC in enum ReadLockMode is changed (2c4fb44)
  • spanner: A comment for enum value READ_LOCK_MODE_UNSPECIFIED in enum ReadLockMode is changed (2c4fb44)
  • spanner: A comment for field chunked_value in message .google.spanner.v1.PartialResultSet is changed (794ecf7)
  • spanner: A comment for field precommit_token in message .google.spanner.v1.PartialResultSet is changed (794ecf7)
  • spanner: A comment for field precommit_token in message .google.spanner.v1.ResultSet is changed (794ecf7)
  • spanner: A comment for field query_plan in message .google.spanner.v1.ResultSetStats is changed (794ecf7)
  • spanner: A comment for field row_count_lower_bound in message .google.spanner.v1.ResultSetStats is changed (794ecf7)
  • spanner: A comment for field row_type in message .google.spanner.v1.ResultSetMetadata is changed (794ecf7)
  • spanner: A comment for field rows in message .google.spanner.v1.ResultSet is changed (794ecf7)
  • spanner: A comment for field stats in message .google.spanner.v1.PartialResultSet is changed (794ecf7)
  • spanner: A comment for field stats in message .google.spanner.v1.ResultSet is changed (794ecf7)
  • spanner: A comment for field values in message .google.spanner.v1.PartialResultSet is changed (794ecf7)
  • spanner: A comment for message ResultSetMetadata is changed (794ecf7)
  • spanner: A comment for message ResultSetStats is changed (794ecf7)

1.78.0 (2025-03-24)

Features
  • spanner/spansql: Add support for tokenlist and create search index (#11522) (cd894f8)
  • spanner: Support multiplexed sessions for ReadWriteStmtBasedTransaction (#11852) (528d9dd)
Bug Fixes
  • spanner/test/opentelemetry/test: Update golang.org/x/net to 0.37.0 (1144978)
  • spanner: Revert the ALTS bound token enablement (#11799) (68cfb38)
  • spanner: Update golang.org/x/net to 0.37.0 (1144978)

Java

Changes for google-cloud-spanner

6.88.0 (2025-02-27)

Features
  • Add a last field in the PartialResultSet (7c714be)
  • Automatically set default sequence kind in JDBC and PGAdapter (#3658) (e8abf33)
  • Default authentication support for external hosts (#3656) (ace11d5)
  • spanner: A new enum IsolationLevel is added (3fd33ba)
  • spanner: Add instance partitions field in backup proto (3fd33ba)
Bug Fixes
  • deps: Update the Java code generator (gapic-generator-java) to 2.54.0 (57497ad)
Dependencies
  • Update dependency com.google.cloud:sdk-platform-java-config to v3.44.0 (#3665) (3543548)

6.89.0 (2025-03-20)

Features
  • Enable ALTS hard bound token in DirectPath (#3645) (42cc961)
  • Next release from main branch is 6.89.0 (#3669) (7a8a29b)
  • Support isolation level REPEATABLE_READ for R/W transactions (#3670) (e62f5ab)
Bug Fixes
  • deps: Update the Java code generator (gapic-generator-java) to 2.55.1 (b959f4c)
  • Revert the ALTS bound token enablement (#3679) (183c1f0)
Performance Improvements
  • Get database dialect using multiplexed session (#3684) (f641a40)
  • Skip gRPC trailers for StreamingRead & ExecuteStreamingSql (#3661) (bd4b1f5)
Dependencies
  • Update dependency com.google.cloud:sdk-platform-java-config to v3.45.1 (#3689) (67188df)

Node.js

Changes for @google-cloud/spanner

7.19.0 (2025-02-26)

Features
  • Add AddSplitPoints API (e4d389a)
  • Paging changes for bigquery (e4d389a)
  • spanner: A new enum IsolationLevel is added (#2225) (e4d389a)
  • spanner: A new field isolation_level is added to message .google.spanner.v1.TransactionOptions (e4d389a)
  • spanner: Add instance partitions field in backup proto (e4d389a)
  • spanner: Add support for Multiplexed Session for Read Only Tran… (#2214) (3a7a51b)
  • x-goog-spanner-request-id: Add bases (#2211) (0008038)
Bug Fixes
  • Add x-goog-request params to headers for LRO-polling methods (e4d389a)
  • Error from fill method should not be emitted (#2233) (2cc44cf), closes #2103
  • Finalize fixing typings for headers in generator (e4d389a)
  • Fix typings for headers in generator (e4d389a)
  • Remove extra protos in ESM & capture ESM in headers (e4d389a)
  • Rollback with no id (#2231) (a6919b1), closes #2103

7.19.1 (2025-03-13)

Bug Fixes
  • CreateQueryPartition with query params (91f5afd)

Python

Changes for google-cloud-spanner

3.53.0 (2025-03-12)

Features
  • Add AddSplitPoints API (7a5afba)
  • Add Attempt, Operation and GFE Metrics (#1302) (fb21d9a)
  • Add REST Interceptors which support reading metadata (7a5afba)
  • Add support for opt-in debug logging (7a5afba)
  • Add support for reading selective GAPIC generation methods from service YAML (7a5afba)
  • Add the last statement option to ExecuteSqlRequest and ExecuteBatchDmlRequest (7a5afba)
  • Add UUID in Spanner TypeCode enum (7a5afba)
  • End to end tracing (#1315) (aa5d0e6)
  • Exposing FreeInstanceAvailability in InstanceConfig (7a5afba)
  • Exposing FreeInstanceMetadata in Instance configuration (to define the metadata related to FREE instance type) (7a5afba)
  • Exposing InstanceType in Instance configuration (to define PROVISIONED or FREE spanner instance) (7a5afba)
  • Exposing QuorumType in InstanceConfig (7a5afba)
  • Exposing storage_limit_per_processing_unit in InstanceConfig (7a5afba)
  • Snapshot isolation (#1318) (992fcae)
  • spanner: A new enum IsolationLevel is added (#1224) (7a5afba)
Bug Fixes
  • Allow Protobuf 6.x (#1320) (1faab91)
  • Cleanup after metric integration test (#1322) (d7cf8b9)
  • deps: Require grpc-google-iam-v1>=0.14.0 (7a5afba)
  • Fix typing issue with gRPC metadata when key ends in -bin (7a5afba)
Performance Improvements
Documentation
  • A comment for enum DefaultBackupScheduleType is changed (7a5afba)
  • A comment for enum value AUTOMATIC in enum DefaultBackupScheduleType is changed (7a5afba)
  • A comment for enum value GOOGLE_MANAGED in enum Type is changed (7a5afba)
  • A comment for enum value NONE in enum DefaultBackupScheduleType is changed (7a5afba)
  • A comment for enum value USER_MANAGED in enum Type is changed (7a5afba)
  • A comment for field base_config in message .google.spanner.admin.instance.v1.InstanceConfig is changed (7a5afba)
  • A comment for field default_backup_schedule_type in message .google.spanner.admin.instance.v1.Instance is changed (7a5afba)
  • A comment for field filter in message .google.spanner.admin.instance.v1.ListInstanceConfigOperationsRequest is changed (7a5afba)
  • A comment for field filter in message .google.spanner.admin.instance.v1.ListInstancePartitionOperationsRequest is changed (7a5afba)
  • A comment for field instance_config in message .google.spanner.admin.instance.v1.CreateInstanceConfigRequest is changed (7a5afba)
  • A comment for field instance_partition_deadline in message .google.spanner.admin.instance.v1.ListInstancePartitionOperationsRequest is changed (7a5afba)
  • A comment for field location in message .google.spanner.admin.instance.v1.ReplicaInfo is changed (7a5afba)
  • A comment for field node_count in message .google.spanner.admin.instance.v1.Instance is changed (7a5afba)
  • A comment for field node_count in message .google.spanner.admin.instance.v1.InstancePartition is changed (7a5afba)
  • A comment for field operations in message .google.spanner.admin.instance.v1.ListInstanceConfigOperationsResponse is changed (7a5afba)
  • A comment for field operations in message .google.spanner.admin.instance.v1.ListInstancePartitionOperationsResponse is changed (7a5afba)
  • A comment for field optional_replicas in message .google.spanner.admin.instance.v1.InstanceConfig is changed (7a5afba)
  • A comment for field parent in message .google.spanner.admin.instance.v1.ListInstancePartitionsRequest is changed (7a5afba)
  • A comment for field processing_units in message .google.spanner.admin.instance.v1.Instance is changed (7a5afba)
  • A comment for field processing_units in message .google.spanner.admin.instance.v1.InstancePartition is changed (7a5afba)
  • A comment for field referencing_backups in message .google.spanner.admin.instance.v1.InstancePartition is changed (7a5afba)
  • A comment for field replicas in message .google.spanner.admin.instance.v1.InstanceConfig is changed (7a5afba)
  • A comment for field storage_utilization_percent in message .google.spanner.admin.instance.v1.AutoscalingConfig is changed (7a5afba)
  • A comment for field unreachable in message .google.spanner.admin.instance.v1.ListInstancePartitionsResponse is changed (7a5afba)
  • A comment for message CreateInstanceConfigRequest is changed (7a5afba)
  • A comment for message DeleteInstanceConfigRequest is changed (7a5afba)
  • A comment for message UpdateInstanceConfigRequest is changed (7a5afba)
  • A comment for method CreateInstance in service InstanceAdmin is changed (7a5afba)
  • A comment for method CreateInstanceConfig in service InstanceAdmin is changed (7a5afba)
  • A comment for method CreateInstancePartition in service InstanceAdmin is changed (7a5afba)
  • A comment for method ListInstanceConfigOperations in service InstanceAdmin is changed (7a5afba)
  • A comment for method ListInstanceConfigs in service InstanceAdmin is changed (7a5afba)
  • A comment for method ListInstancePartitionOperations in service InstanceAdmin is changed (7a5afba)
  • A comment for method MoveInstance in service InstanceAdmin is changed (7a5afba)
  • A comment for method UpdateInstance in service InstanceAdmin is changed (7a5afba)
  • A comment for method UpdateInstanceConfig in service InstanceAdmin is changed (7a5afba)
  • A comment for method UpdateInstancePartition in service InstanceAdmin is changed (7a5afba)
  • Fix typo timzeone -> timezone (7a5afba)
Virtual Private Cloud

You can access global Google APIs by using Private Service Connect backends that are based on cross-region internal Application Load Balancers. This feature is available in General Availability. For more information, see Access global Google APIs through backends.

March 30, 2025

Google SecOps SOAR

Release 6.3.40 is now available for all regions.

March 29, 2025

Google SecOps SOAR

Release 6.3.41 is being rolled out to the first phase of regions as listed here.

Configure user preferences

The ability to manage platform time zones, date/time settings, and notifications have moved to the new User Preferences dialog, accessible from your avatar.

In addition, a new accessibility option in the User Preferences dialog lets you customize how long feedback messages remain on the screen.

For more information, see Configure user preferences.

March 28, 2025

Access Approval

Access Approval supports Org Lifecycle API in the GA stage.

Access Approval supports Integration Connectors in the GA stage.

Access Transparency

Access Transparency supports Integration Connectors in the GA stage.

Access Transparency supports Org Lifecycle API in the GA stage.

Cloud Run

The ability to disable the Invoker IAM check for Cloud Run services is now at general availability (GA).

Confidential Space

AWS token support for Confidential Space is now generally available.

You can now integrate Confidential Space with AWS resources. For more information, see Integrate AWS resources.

Dataproc

Dataproc Serverless for Spark: Hadoop Native libraries are installed by default in all runtimes.

Filestore

Instance replication is now generally available (GA).

Gemini Code Assist

Local codebase awareness is now available for IntelliJ Gemini Code Assist. You can now include files from your local IDE project in the prompt context by typing @ in the chat prompt box.

You can now see what files are used by IntelliJ Gemini Code Assist chat and can customize the context as needed.

Google Distributed Cloud (software only) for VMware

Google Distributed Cloud (software only) for VMware 1.29.1200-gke.99 is now available for download. To upgrade, see Upgrade a cluster or a node pool. Google Distributed Cloud 1.29.1200-gke.99 runs on Kubernetes v1.29.13-gke.500. This is the final patch for the 1.29 minor release.

If you are using a third-party storage vendor, check the GDC Ready storage partners document to make sure the storage vendor has already passed the qualification for this release.

After a release, it takes approximately 7 to 14 days for the version to become available for use with GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

The 1.29.1200-gke.99 release includes many vulnerability fixes. For a list of all vulnerabilities fixed in this release, see Vulnerability fixes.

Google Distributed Cloud (software only) for bare metal

Release 1.29.1200-gke.98

Google Distributed Cloud for bare metal 1.29.1200-gke.98 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.29.1200-gke.98 runs on Kubernetes v1.29.13-gke.500. This is the final patch for the 1.29 minor release.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

Updated the cluster upgrade operation to keep only the three latest kubeadm backups of etcd and configuration information for a node. Previously, kubeadm kept node backups for every attempted upgrade.

Fixed an issue that caused cluster creation to fail because kubelet restarted before required static pods are running.

The 1.29.1200-gke.98 release includes many vulnerability fixes. For a list of all vulnerabilities fixed in this release, see Vulnerability fixes.

For information about the latest known issues, see Google Distributed Cloud for bare metal known issues in the Troubleshooting section.

Google Kubernetes Engine

In version 1.32.1-gke.1729000 and later, you can customize specific kubelet and Linux kernel parameters like sysctls and huge pages by using the nodeSystemConfig field in your GKE compute classes. Additionally, you can now specify default values for fields that are omitted in individual rules in a compute class by using the priorityDefaults field. For details, see About custom compute classes.

Memorystore for Redis Cluster

Finding and setting maintenance windows are now Generally Available (GA) on Memorystore for Redis Cluster.

Memorystore for Valkey

You can now perform maintenance on a Memorystore for Valkey instance. This feature is Public Preview.

NetApp Volumes

The auto-tiering feature which is previously available to allow-listed users, is now generally available. For more information, see Auto-tiering.

You can now create and manage quota rules on a NetApp Volumes volume using the Google Cloud console. For more information, see Manage quota rules.

Added performance benchmark information for the electronic design automation workload.

Spanner

Spanner vector index and approximate nearest neighbor (ANN) distance functions in the GoogleSQL-dialect are Generally Available. If you have a table with a large amount of vector data, you can use a vector index to accelerate similarity searches and nearest neighbor queries. Spanner now also supports the following:

  • ALTER VECTOR INDEX DDL syntax
  • Import and export databases that use ANN
  • Use the STORING clause to store a copy of a column in the vector index to accelerate queries that filter by those columns
  • Use ANN in instances smaller than one node or 1000 processing units

For more information, see Find approximate nearest neighbors, create vector indexes, and query vector embeddings.

Spanner ANN indexes are now supported in Langchain. For more information, see LangChain Quickstart for Spanner.

VPC Service Controls

VPC Service Controls feature (Status: Preview): VPC Service Controls adds support for using IAM roles in ingress and egress rules to allow access to resources protected by service perimeters. This feature is available in Preview.

For more information, see Configure IAM roles in ingress and egress rules.

Workflows

Support for a Kubernetes API connector is generally available (GA). The connector allows you to interact with Kubernetes objects in a Google Kubernetes Engine cluster. For more information, see Access Kubernetes API objects using a connector.

March 27, 2025

Anthos Config Management

Addressed multiple Common Vulnerabilities and Exposures (CVEs) by updating dependencies.

Apigee X

On March 27, 2025, we released an updated version of Apigee.

Availability of client IP resolution functionality with Apigee hybrid.

Client IP resolution functonality is now available with Apigee hybrid versions 1.14.0 and later.

See Client IP resolution for information.

On March 26, 2025, we released an updated version of Apigee (1-14-0-apigee-5). This Apigee version applies only to organizations using the JavaCallout policy in production environments.

Bug ID Description
N/A Updates to security infrastructure and libraries.
Apigee hybrid

On March 27, 2025, we released an updated version of Apigee.

Availability of client IP resolution functionality with Apigee hybrid.

Client IP resolution functonality is now available with Apigee hybrid versions 1.14.0 and later.

See Client IP resolution for information.

BigQuery

You can now enable metadata caching for SQL translation, which can significantly reduce latency for subsequent translation requests. This feature is in preview.

Cloud Build

In the filtering toolbar of the Build history page, you can now filter builds by region. The region drop-down has been removed. For more information, see View build results.

Cloud Service Mesh

1.24.3-asm.6 is now available for in-cluster Cloud Service Mesh.

You can now download 1.24.3-asm.6 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.24.3 subject to the list of supported features. Cloud Service Mesh version 1.24.3-asm.6 uses envoy v1.32.4-dev.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh.

1.23.5-asm.3 is now available for in-cluster Cloud Service Mesh.

You can now download 1.23.5-asm.3 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.23.5 subject to the list of supported features. Cloud Service Mesh version 1.23.5-asm.3 uses envoy v1.31.6-dev.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh.

1.22.8-asm.5 is now available for in-cluster Cloud Service Mesh.

You can now download 1.22.8-asm.5 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.22.8 subject to the list of supported features. Cloud Service Mesh version 1.22.8-asm.5 uses envoy v1.30.10-dev.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh.

1.21.5-asm.34 is now available for in-cluster Cloud Service Mesh.

You can now download 1.21.5-asm.34 for in-cluster Cloud Service Mesh. It includes the features of Istio 1.21.5 subject to the list of supported features. Cloud Service Mesh version 1.21.5-asm.34 uses envoy v1.29.12-dev.

For details on upgrading Cloud Service Mesh, see Upgrade Cloud Service Mesh.

Cloud Workstations

Cloud Workstations is available in the me-central2 region (Dammam, Saudi Arabia, Middle East). For more information, see Locations.

Dialogflow

Dialogflow CX (Conversational Agents) data stores: Dialogflow now supports additional native and third-party data store sources as a private GA feature. For a list of data store sources, integration instructions, and the request form to be added to the allowlist, see the data stores documentation.

Dialogflow CX (Conversational Agents) data store handlers: The method of adding data store handlers to an agent has been streamlined. You are no longer required to create a Chat app on Agent Builder. For updated implementation instructions, see the data stores tools documentation.

Google SecOps

Google SecOps is renaming Applied Threat Intelligence (ATI) rules to improve clarity and better reflect the associated UDM fields with each rule detection.

Currently, multiple underlying ATI rules with the same name can appear in the Google SecOps console, even though the rules apply to different UDM fields.

This change modifies the rule_name field in the customer metadata to specify the relevant UDM field for each rule.

For example:

Old rule name: ATI Active Breach Rule Match for File IoCs (SHA256)

New rule name: ATI Active Breach Rule Match for File IoCs (about.file.sha256)

Google SecOps SIEM

Google SecOps is renaming Applied Threat Intelligence (ATI) rules to improve clarity and better reflect the associated UDM fields with each rule detection.

Currently, multiple underlying ATI rules with the same name can appear in the Google SecOps console, even though the rules apply to different UDM fields.

This change modifies the rule_name field in the customer metadata to specify the relevant UDM field for each rule.

For example:

Old rule name: ATI Active Breach Rule Match for File IoCs (SHA256)

New rule name: ATI Active Breach Rule Match for File IoCs (about.file.sha256)

Network Connectivity Center

Site-to-site data transfer locations in the following countries have been added to Network Connectivity Center:

  • Belgium
  • Canada
  • Chile
  • Finland
  • Israel
  • Mexico
  • Sweden
Secret Manager

Parameter Manager, an extension to the Secret Manager service, is now Generally available (GA). Parameter Manager lets you store, access, and manage the lifecycle of workload parameters. You can interact with Parameter Manager using the console, gcloud CLI, REST API, and client libraries.

For information, see the Parameter Manager documentation.

Spanner

You can save and manage your SQL scripts in Spanner Studio. This feature is in preview. For more information, see Saved queries overview.

Text-to-Speech

Chirp 3: HD voices in en-US now support experimental features for pace and pause controls.

VPC Service Controls

General availability support for the following integration:

March 26, 2025

API Gateway

On March 26, 2025, we released an updated version of API Gateway.

With this release, customer data in API Gateway is now CMEK-compliant at rest. No configuration is required.

For more information, see CMEK compliance in API Gateway.

To learn more about CMEK, see Customer-managed encryption keys (CMEK).

BigQuery

You can now set the column granularity when you create a search index, which stores additional column information in your search index to further optimize your search query performance. This feature is in preview.

Bigtable

The Monitoring page in the Google Cloud console for Bigtable has been renamed to System insights.

Cloud Composer

All Cloud Composer environment's GKE clusters are set up with maintenance exclusions from March 27, 2025 to April 04, 2025. For more information, see Maintenance exclusions.

Data lineage in Cloud Composer now uses OpenLineage.

Data lineage support for a specific Airflow operator is now provided by the provider package where the operator is located. See Supported classes in the apache-airflow-providers-openlineage documentation for a list of latest supported operators.

For more information about data lineage in Cloud Composer, see Data lineage with Dataplex.

This feature is gradually rolled out. It will be available in us-west1, us-south1, europe-north1, me-west1, asia-northeast2, asia-southeast2, and africa-south1 regions. We plan to provide this feature in other regions in future releases.

(Available without upgrading) Fixed an issue with updating maintenance windows when there is an upcoming Cloud Composer 3 infrastructure operation.

(Airflow 2.10.2 and 2.9.3) The apache-airflow-providers-google package was upgraded to version 14.0.0 in Cloud Composer 2 images and Cloud Composer 3 builds.

This package is a new major version where many previously deprecated Airflow operators are removed. It is not possible to use these operators in your DAGs.

Make sure that you update your DAGs to use up-to-date alternatives of the removed operators. For more information about removed and deprecated Airflow operators and their up-to-date alternatives, see Deprecated and removed Airflow operators.

For more information about changes, see the apache-airflow-providers-google changelog from version 10.26.0 to version 14.0.0.

(Airflow 2.10.2 and 2.9.3) The apache-airflow-providers-cncf-kubernetes package was upgraded to version 10.3.0 in Cloud Composer 2 images and Cloud Composer 3 builds. For more information about changes, see the apache-airflow-providers-cncf-kubernetes changelog from version 10.1.0 to version 10.3.0.

(Airflow 2.10.2 and 2.9.3) Changes in preinstalled packages:

  • apache-airflow-providers-postgres was upgraded to 6.1.0 from 5.14.0.
  • apache-airflow-providers-smtp was upgraded to 2.0.0 from 1.9.0.
  • types-requests was removed from preinstalled packages.

New Airflow builds are available in Cloud Composer 3:

  • composer-3-airflow-2.10.2-build.12 (default)
  • composer-3-airflow-2.9.3-build.19

New images are available in Cloud Composer 2:

  • composer-2.12.0-airflow-2.10.2 (default)
  • composer-2.12.0-airflow-2.9.3

Cloud Composer versions 2.6.4, 2.6.5, and 2.6.6 have reached their end of support period.

Cloud Deploy

Cloud Deploy is now available in the following regions:

  • northamerica-south1 (Mexico)
  • europe-north2 (Stockholm)
Cloud Run

Cloud Run services configured with Direct VPC egress now use only 2 times (2X) as many IP addresses as the number of instances for the duration of the instance plus up to 20 minutes, reduced from 4X as many IP addresses.

Compute Engine

Generally available: You can use instant snapshots to take in-place backups of the following types of disks:

  • Hyperdisk Balanced
  • Hyperdisk Balanced High Availability
  • Hyperdisk Extreme

Instant snapshots are ideal for rapid data restoration only within the same location as the source disk. You can use an instant snapshot to create a new disk in under a minute. For more information, see About instant snapshots.

Generally available: You can specify a custom ephemeral internal IPv6 address when creating an instance. For more information, see Create instances that use IPv6 addresses.

Generally available: Asynchronous Replication is now generally available for Hyperdisk Balanced, Hyperdisk Balanced High Availability, and Hyperdisk Extreme disks. Asynchronous Replication provides low-RPO and low-RTO block storage replication for cross-region disaster recovery. For more information, see About Asynchronous Replication.

Google Kubernetes Engine

(2025-R12) Version updates

GKE cluster versions have been updated.

New versions available for upgrades and new clusters.

The following Kubernetes versions are now available for new clusters and for opt-in control plane upgrades and node upgrades for existing clusters. For more information on versioning and upgrades, see GKE versioning and support and Upgrades.

Rapid channel

Regular channel

There are no new releases in the Regular channel.

Stable channel

Extended channel

No channel

(2025-R12) Version updates

(2025-R12) Version updates

There are no new releases in the Regular channel.

(2025-R12) Version updates

(2025-R12) Version updates

(2025-R12) Version updates

Google SecOps

The managed BigQuery resources and API keys associated with the chronicle-tla Google Cloud project will be fully deprecated by April 30, 2025. This applies to non-Enterprise+ customers only.

Google SecOps SIEM

The managed BigQuery resources and API keys associated with the chronicle-tla Google Cloud project will be fully deprecated by April 30, 2025. This applies to non-Enterprise+ customers only.

Resource Manager

Custom organization policies are now available in Preview for Cloud Resource Manager. For more information, see Manage resources with custom constraints.

Vertex AI

Generally available: You can consume reservations of VMs that have GPUs attached with your custom training jobs or prediction jobs. Reservations of Compute Engine zonal resources help you gain a high level of assurance that your jobs have the necessary resources to run. For more information, see the following:

Vertex AI Workbench

The ability to back up and restore data on a Vertex AI Workbench instance is now generally available. For more information, see Back up and restore data on an instance.

Virtual Private Cloud

Support for the following is available in General availability for dual-stack configurations:

  • IPv6 static routes with a next hop internal passthrough Network Load Balancer (next-hop-ilb)
  • IPv6 static routes with a next hop instance identified by address (next-hop-address)

For more information, see Next hops and features in the static routes overview.

March 25, 2025

API Gateway

On March 25, 2025, we released an updated version of API Gateway.

API Gateway now supports Workforce Identity Federation.

Workforce Identity Federation lets you use an external identity provider (IdP) to authenticate and authorize a workforce — a group of users, such as employees, partners, and contractors — using Identity and Access Management (IAM) to access API Gateway services.

See Identity federation: products and limitations for more information.

Apigee Advanced API Security

On March 25, 2025 we released an updated version of Advanced API Security.

Risk Assessment v2 is now the default Risk Assessment version

Starting with this release, Risk Assessment v2 is the default Risk Assessment version in the UI. You will see the see v2 functionality and interfaces unless you choose to switch back to v1 by clicking Switch to v1 in the upper right of the UI.

Note: Rollouts of this functionality to production instances will begin within two business days and may take four or more business days to complete across all Google Cloud zones. Your instances may not have the feature available until the rollout is complete.

New Advanced API Security support when using data residency (DRZ) with Apigee hybrid

Advanced API Security is now available for Apigee hybrid orgs using DRZ, for hybrid versions 1.14.0 and later. See Using data residency with Apigee hybrid.

See Introduction to data residency for information on DRZ and Advanced API Security support across organization types.

New features added to public preview of Risk Assessment v2

This release introduces new features to the Risk Assessment v2 preview:

  • Security monitoring conditions. Security monitoring conditions allow you to map resources (proxies or environments) to security profiles. Cloud Monitoring can then use this mapping to alert or create dedicated dashboards so that you can track security scores over time.
  • Alerts on security monitoring conditions. Once you've created a monitoring condition, you can set up alerts using Alerting in Cloud Monitoring so that you're notified when the security scores change.

For information on monitoring conditions features and usage see monitoring conditions and alerts. For usage information and a list of all features in Risk Assessment v2, see the Risk Assessment v2 customer documentation.

Note: Rollouts of this functionality to production instances will begin within two business days and may take four or more business days to complete across all Google Cloud zones. Your instances may not have the feature available until the rollout is complete.

Apigee hybrid

On March 25, 2025 we released an updated version of Advanced API Security.

New Advanced API Security support when using data residency (DRZ) with Apigee hybrid

Advanced API Security is now available for Apigee hybrid orgs using DRZ, for hybrid versions 1.14.0 and later. See Using data residency with Apigee hybrid.

See Introduction to data residency for information on DRZ and Advanced API Security support across organization types.

BigQuery

BigQuery ML now supports visualization of model monitoring metrics. This feature lets you use charts and graphs to analyze model monitoring function output. The following functions support metric visualization:

  • ML.VALIDATE_DATA_SKEW: compute the statistics for a set of serving data, and then compare them to the statistics for the data used to train a BigQuery ML model in order to identify anomalous differences between the two data sets.
  • ML.VALIDATE_DATA_DRIFT: compute and compare the statistics for two sets of serving data in order to identify anomalous differences between the two data sets.

This feature is in preview.

Cloud Run

New services using GPUs by default will have zonal redundancy turned on. However, you can now specify GPUs with zonal redundancy or without zonal redundancy, and request quota for either of these configurations. (In Preview)

Cloud SQL for MySQL

Cloud SQL read pools provide operational simplicity and scaling for your large read workloads.

Read pools provide a single endpoint in front of up to 20 read pool nodes and automatically load balance traffic.

You can scale your read pool in several ways:

  • Scale in or out: scale load balancing capacity horizontally by modifying the number of read pool nodes in the read pool. Each read pool supports up to 20 read pool nodes.
  • Scale up or down: scale load balancing capacity vertically by modifying the machine type associated with a read pool node. Once defined, configuration is uniformly applied across each read pool node in the read pool.

For more information, see About read pools.

Cloud SQL for PostgreSQL

Cloud SQL read pools provide operational simplicity and scaling for your large read workloads.

Read pools provide a single endpoint in front of up to 20 read pool nodes and automatically load balance traffic.

You can scale your read pool in several ways:

  • Scale in or out: scale load balancing capacity horizontally by modifying the number of read pool nodes in the read pool. Each read pool supports up to 20 read pool nodes.
  • Scale up or down: scale load balancing capacity vertically by modifying the machine type associated with a read pool node. Once defined, configuration is uniformly applied across each read pool node in the read pool.

For more information, see About read pools.

Cloud Trace

To send trace data to your Google Cloud project, we recommend that you use the new Telemetry API, which implements the OpenTelemetry OTLP API and provides compatibility and support for the open source ecosystem. The limits for the Telemetry API are often more generous than those for the proprietary Cloud Trace API, which you can continue to use. The Telemetry API supports VPC Service Controls. For more information about the Telemetry API, see the following documents:

Compute Engine

Resolved: Fixed the issue that caused Persistent Disks attached to VMs with n2d-standard-64 machine types to inconsistently reach the maximum performance limit of 100,000 IOPS.

For more information, see Known issues.

Confidential VM

On February 18, 2025, Google released a security fix for Confidential VM instances using AMD SEV-SNP on N2D machine types, which might result in performance degradation. The extent of the performance impact varies depending on the specific workload.

Generative AI on Vertex AI
Google Distributed Cloud (software only) for VMware

Since release 1.30.0-gke.1930, the featureGates.enableGMPForSystemMetrics field in the stackdriver custom resource is always on and can't be disabled. It has been enabled by default since 1.16. If you have manually turned this feature off, upgrading clusters to version 1.30 means a breaking change in the format of some system metrics. For information on this feature, see Using Managed Service for Prometheus.

Google Distributed Cloud (software only) for bare metal

Since release 1.30.0-gke.1930, the featureGates.enableGMPForSystemMetrics field in the stackdriver custom resource is always on and can't be disabled. It has been enabled by default since 1.16. If you've manually turned this feature off, upgrading clusters to version 1.30 means a breaking change in the format of some system metrics. For information on this feature, see Use Google Cloud Managed Service for Prometheus for selected system components.

NetApp Volumes

The backups feature for the Flex service level is now generally available. For more information, see About NetApp Volumes.

Google Cloud NetApp Volumes now supports cross-region backup vaults in Preview. For more information, see Backup vaults.

The Flex service level of Google Cloud NetApp Volumes now supports custom performance in Preview, enabling independent provisioning of capacity and performance with zonal pools in selected regions. For more information, see NetApp Volumes key features.

VPC Service Controls

Preview stage support for the following integration:

March 24, 2025

Apigee X

On March 24, 2025, we released an updated version of Apigee.

Apigee Spaces is now generally available (GA) for use in Apigee organizations.

Apigee Spaces enables identity-based isolation and grouping of API resources within an Apigee organization. With Apigee Spaces, you can have granular IAM control over access to your API proxies, shared flows, and API products.

Spaces also provide the option of resource isolation at a team level, providing a clear separation of resources associated with different teams operating within the same Apigee organization. IAM policies can be applied at the Space level, eliminating the need to manage permissions individually for every API proxy, shared flow, and API product.

Spaces are a brand new resource type with resource-level permissions. This means that Space permissions are not subject to the 64k limitation for project-level IAM conditions. Each space has its own 64k limit.

To learn more, see Apigee Spaces overview.

BigQuery

A weekly digest of client library updates from across the Cloud SDK.

Node.js

Changes for @google-cloud/bigquery

7.9.3 (2025-03-17)

Bug Fixes
  • Make sure to pass selectedFields to tabledata.list method (#1449) (206aff9)

Go

Changes for bigquery/storage/apiv1beta1

1.67.0 (2025-03-14)

Features
  • bigquery/reservation: Add a new field enable_gemini_in_bigquery to .google.cloud.bigquery.reservation.v1.Assignment that indicates if "Gemini in BigQuery" (601e742)
  • bigquery/reservation: Add a new field replication_status to .google.cloud.bigquery.reservation.v1.Reservation to provide visibility into errors that could arise during Disaster Recovery(DR) replication (#11666) (601e742)
  • bigquery/reservation: Add the CONTINUOUS Job type to .google.cloud.bigquery.reservation.v1.Assignment.JobType for continuous SQL jobs (601e742)
  • bigquery: Support MetadataCacheMode for ExternalDataConfig (#11803) (af5174d), refs #11802
Bug Fixes
  • bigquery: Increase timeout for storage api test and remove usage of deprecated pkg (#11810) (f47e038), refs #11801
  • bigquery: Update golang.org/x/net to 0.37.0 (1144978)
Documentation
  • bigquery/reservation: Remove the section about EDITION_UNSPECIFIED in the comment for slot_capacity in .google.cloud.bigquery.reservation.v1.Reservation to clarify that (601e742)
  • bigquery/reservation: Update the google.api.field_behavior for the .google.cloud.bigquery.reservation.v1.Reservation.primary_location and .google.cloud.bigquery.reservation.v1.Reservation.original_primary_location fields to clarify that they are OUTPUT_ONLY (601e742)

Java

Changes for google-cloud-bigquery

2.49.0 (2025-03-20)

Features
  • bigquery: Implement getArray in BigQueryResultImpl (#3693) (e2a3f2c)
  • Next release from main branch is 2.49.0 (#3706) (b46a6cc)
Bug Fixes
  • Retry ExceptionHandler not retrying on IOException (#3668) (83245b9)
Dependencies
  • Exclude io.netty:netty-common from org.apache.arrow:arrow-memor… (#3715) (11b5809)
  • Update actions/upload-artifact action to v4.6.2 (#3724) (426a59b)
  • Update actions/upload-artifact action to v4.6.2 (#3724) (483f930)
  • Update dependency com.google.api.grpc:proto-google-cloud-bigqueryconnection-v1 to v2.61.0 (#3703) (53b07b0)
  • Update dependency com.google.api.grpc:proto-google-cloud-bigqueryconnection-v1 to v2.62.0 (#3726) (38e004b)
  • Update dependency com.google.apis:google-api-services-bigquery to v2-rev20250302-2.0.0 (#3720) (c0b3902)
  • Update dependency com.google.apis:google-api-services-bigquery to v2-rev20250313-2.0.0 (#3723) (b8875a8)
  • Update dependency com.google.cloud:google-cloud-datacatalog-bom to v1.65.0 (#3704) (53b68b1)
  • Update dependency com.google.cloud:google-cloud-datacatalog-bom to v1.66.0 (#3727) (7339f94)
  • Update dependency com.google.cloud:sdk-platform-java-config to v3.45.1 (#3714) (e4512aa)
  • Update dependency com.google.oauth-client:google-oauth-client-java6 to v1.39.0 (#3710) (c0c6352)
  • Update dependency com.google.oauth-client:google-oauth-client-jetty to v1.39.0 (#3711) (43b86e9)
  • Update dependency node to v22 (#3713) (251def5)
  • Update netty.version to v4.1.119.final (#3717) (08a290a)
Documentation
  • Update error handling comment to be more precise in samples (#3712) (9eb555f)

You can now use KLL quantile functions to efficiently compute approximate quantiles. This feature is in preview.

You can now set labels on reservations. These labels can be used to organize your reservations and for billing analysis. This feature is in preview.

The BigQuery Data Transfer Service can now transfer reporting and configuration data from Google Analytics 4 into BigQuery. This feature is in preview.

We have redesigned the Add Data dialog to guide you through loading data into BigQuery with a source-first experience and enhanced search and filtering capabilities. This feature is generally available (GA).

Bigtable

A weekly digest of client library updates from across the Cloud SDK.

Java

Changes for google-cloud-bigtable

2.56.0 (2025-03-18)

Features
  • bigtable: Add support for Logical Views in Admin API (#2519) (6dac3fd)
  • bigtable: Add support for Materialized Views in Admin API (#2511) (55cd719)
Bug Fixes
  • deps: Update the Java code generator (gapic-generator-java) to 2.55.1 (7992af0)
Dependencies

Python

Changes for google-cloud-bigtable

2.30.0 (2025-03-18)

Features
Bug Fixes
Cloud Logging

A weekly digest of client library updates from across the Cloud SDK.

Java

Changes for google-cloud-logging

3.22.0 (2025-03-18)

Features
Bug Fixes
  • deps: Update the Java code generator (gapic-generator-java) to 2.55.1 (dd25992)
Dependencies
  • Update dependency com.google.cloud:sdk-platform-java-config to v3.45.1 (#1779) (a643ab0)
  • Update googleapis/sdk-platform-java action to v2.55.1 (#1780) (505557e)
Cloud SQL for MySQL

Cloud SQL now lets you retain existing backups after an instance is deleted. These consist of on-demand and automatic backups created when the instance was live. For more information, see Retained backups.

Cloud SQL for PostgreSQL

Cloud SQL now lets you retain existing backups after an instance is deleted. These consist of on-demand and automatic backups created when the instance was live. For more information, see Retained backups.

Cloud SQL for SQL Server

Cloud SQL now lets you retain existing backups after an instance is deleted. These consist of on-demand and automatic backups created when the instance was live. For more information, see Retained backups.

Compute Engine

Generally available: Multi-writer support for Hyperdisk Balanced High Availability disks. You can give up to 8 VMs, across two zones, simultaneous read-write access to the same disk. For more information, see Share disks between instances.

Container Optimized OS

cos-dev-125-18964-0-0

Kernel Docker Containerd GPU Drivers
COS-6.6.83 v27.5.1 v2.0.2 See List

Fixed an issue that resulted in missing grub boot measurements in some machine configurations.

Updated Python to v3.11.

Upgraded app-containers/docker to v27.5.1, Upgraded app-containers/docker-test to v27.5.1, Upgraded app-containers/docker-cli to v27.5.1.

Updated app-admin/google-guest-configs to v20250207.00.

Updated the default tag of the GPU driver supporting the NVIDIA H200 GPU device to 570.86.15.

Upgrade cloud-init from 23.4.3 to 24.4.1.

Added support for NVIDIA GB200 GPU with 570.124.06 GPU driver. This driver version has been assigned the latest, default, and R570 tags for this GPU type.

Added support for the Lustre 2.14.0 client drivers.

Added support for NVIDIA 570.124.06 GPU driver. Updated the LATEST GPU driver label to version 570.124.06 for all GPU devices. Updated the DEFAULT GPU driver label to version 570.124.06 for NVIDIA_B200 and NVIDIA_H200 GPU devices.

Add support for iRDMA devices.

Updated cos-gpu-installer to v2.4.8: Add the -skip-nvidia-smi flag to disable the execution of nvidia-smi verification during gpu driver installation.

Applied Intel patches to add iRDMA support in the Linux kernel.

Support for NVIDIA B200 GPU – Added support for the R570 driver series, including version 570.86.15. This version has been assigned the latest, default, and R570 tags.

Updated cos-gpu-installer to v2.4.7: 1.Added Support for NVIDIA B200 GPU. 2.Enabled --prepare-build-tools flag to preload GPU driver metadata for ARM64

Upgraded sys-auth/pambase to v20250228.

Upgraded app-admin/google-guest-agent to v20250304.03.

Upgraded app-containers/docker-credential-helpers to v0.9.2.

Disabled martian logging for ConnectX-7 network cards. These cards only communicate locally, but martian logging during communications with the host can lead to a race condition which causes GID table construction to sometimes fail.

Upgraded app-containers/runc to v1.2.5, Upgraded app-containers/runc-test to v1.2.5.

Upgraded app-admin/google-guest-configs to v20250221.00.

Upgraded app-admin/google-guest-agent to v20250225.00.

Upgraded app-admin/google-guest-agent to v20250204.02.

Upgraded app-admin/node-problem-detector to v0.8.20.

Upgraded app-admin/fluent-bit to v3.2.5.

Upgraded app-admin/google-guest-agent to v20250122.00.

Upgraded app-admin/google-guest-configs to v20250124.00.

Upgraded chromeos-base/chromeos-common-script to v0.0.1-r659.

Upgraded chromeos-base/session_manager-client to v0.0.1-r2821.

Upgraded chromeos-base/shill-client to v0.0.1-r4838.

Upgraded chromeos-base/session_manager-client to v0.0.1-r2820.

Upgraded chromeos-base/debugd-client to v0.0.1-r2728.

Upgraded chromeos-base/shill-client to v0.0.1-r4834.

Upgraded chromeos-base/update_engine-client to v0.0.1-r2474.

Upgraded chromeos-base/power_manager-client to v0.0.1-r2963.

Upgraded sys-apps/dbus to v1.14.10-r195.

Upgraded chromeos-base/minijail to v18-r163.

Upgraded chromeos-base/shill-client to v0.0.1-r4825.

Upgraded chromeos-base/minijail to v18-r160.

Upgraded chromeos-base/update_engine-client to v0.0.1-r2471.

Upgraded chromeos-base/session_manager-client to v0.0.1-r2818.

Upgraded chromeos-base/chromeos-common-script to v0.0.1-r658.

Upgraded sys-apps/dbus to v1.14.10-r194.

Upgraded chromeos-base/debugd-client to v0.0.1-r2727.

Upgraded chromeos-base/power_manager-client to v0.0.1-r2962.

Upgraded chromeos-base/power_manager-client to v0.0.1-r2961.

Upgraded chromeos-base/update_engine-client to v0.0.1-r2470.

Upgraded chromeos-base/shill-client to v0.0.1-r4818.

Upgraded chromeos-base/debugd-client to v0.0.1-r2726.

Upgraded chromeos-base/google-breakpad to v2024.02.16.014630-r227.

Upgraded chromeos-base/session_manager-client to v0.0.1-r2817.

Upgraded chromeos-base/chromeos-common-script to v0.0.1-r657.

Upgraded sys-libs/libseccomp to v2.6.0-r1.

Upgraded sys-apps/acl to v2.3.2-r2.

Upgraded sys-apps/pv to v1.9.31.

Upgraded dev-libs/nss to v3.109.

Updated app-admin/awscli to v1.38.4.

Updated dev-python/s3transfer to v0.11.4.

Updated dev-python/botocore to v1.37.9.

Updated dev-python/python-dateutil to v2.9.0.

Upgraded sys-apps/which to v2.23.

Upgraded dev-db/sqlite to v3.49.1.

Upgraded dev-libs/nss to v3.108.

Upgraded sys-apps/diffutils to v3.11-r1.

Upgraded dev-libs/double-conversion to v3.3.1.

Upgraded net-misc/socat to v1.8.0.3.

Upgraded sys-apps/diffutils to v3.11.

Upgraded sys-apps/pv to v1.9.27.

Upgraded sys-apps/hwdata to v0.391.

Upgraded dev-db/sqlite to v3.47.2-r1.

Upgraded sys-libs/libseccomp to v2.6.0.

Fixed a race condition that could cause a kernel panic.

Upgraded dev-go/crypto to v0.35.0. This fixes CVE-2025-22869.

Updated dev-go/oauth2 to v0.27.0. Fixes CVE-2025-22868.

Fixed CVE-2024-13176 in dev-libs/openssl.

Fixed CVE-2025-0395 in sys-libs/glibc.

Fixed CVE-2024-9287 in dev-lang/python.

Fixed CVE-2025-0840 in binutils.

Upgraded net-misc/openssh to version 9.9_p2. This fixed CVE-2025-26465 and CVE-2025-26466.

Upgrade sys-libs/binutils-libs to 2.44-r1. This fixes CVE-2024-53589.

Upgraded net-misc/wget to version 1.25.0. Fixes CVE-2024-10524.

Upgraded dev-libs/libxml2 to version 1.12.10. Fixes CVE-2025-27113.

Runtime sysctl changes:

  • Changed: fs.file-max: 811701 -> 811727

cos-beta-121-18867-0-73

Kernel Docker Containerd GPU Drivers
COS-6.6.74 v27.5.1 v2.0.2 See List

Fixed an issue that resulted in missing grub boot measurements in some machine configurations.

Updated Python to v3.11.

Added support for NVIDIA GB200 GPU with 570.124.06 GPU driver. This driver version has been assigned the latest, default, and R570 tags for this GPU type.

Added support for the Lustre 2.14.0 client drivers.

Added support for NVIDIA 570.124.06 GPU driver. Updated the LATEST GPU driver label to version 570.124.06 for all GPU devices. Updated the DEFAULT GPU driver label to version 570.124.06 for NVIDIA_B200 and NVIDIA_H200 GPU devices.

Upgraded app-admin/node-problem-detector to v0.8.20.

Updated app-admin/awscli to v1.38.4.

Updated dev-python/s3transfer to v0.11.4.

Updated dev-python/botocore to v1.37.9.

Updated dev-python/python-dateutil to v2.9.0.

Upgraded sys-apps/which to v2.23.

Upgraded sys-apps/pv to v1.9.31.

Fixed a race condition that could cause a kernel panic.

Fixed CVE-2024-58005 in the Linux kernel.

Fixed CVE-2024-57996 in the Linux kernel.

Fixed CVE-2024-57996 in the Linux kernel.

Fixed CVE-2024-57996 in the Linux kernel.

Fixed KCTF-647cef2 in the Linux kernel.

Fixed CVE-2025-21785 in the Linux kernel.

Fixed CVE-2025-21716 in the Linux kernel.

Fixed CVE-2025-21857 in the Linux kernel.

Fixed CVE-2024-58088 in the Linux kernel.

Fixed CVE-2025-21844 in the Linux kernel.

Fixed CVE-2025-21779 in the Linux kernel.

Fixed CVE-2025-21854 in the Linux kernel.

Fixed CVE-2025-21846 in the Linux kernel.

Fixed CVE-2025-21864 in the Linux kernel.

Fixed CVE-2025-21858 in the Linux kernel.

Fixed CVE-2025-21791 in the Linux kernel.

Fixed CVE-2025-21863 in the Linux kernel.

Runtime sysctl changes:

  • Changed: fs.file-max: 811701 -> 811789

cos-109-17800-436-79

Kernel Docker Containerd GPU Drivers
COS-6.1.124 v24.0.9 v1.7.24 See List

Added support for NVIDIA 570.124.06 GPU driver. Updated the R570, LATEST GPU driver label to version 570.124.06 for all GPU devices. Updated the DEFAULT GPU driver label to version 570.124.06 for NVIDIA_B200 and NVIDIA_H200 GPU devices.

Upgraded sys-apps/which to v2.23.

Fixed a race condition that could cause a kernel panic.

Fixed CVE-2023-45288 in app-containers/docker.

Fixed CVE-2024-53166 in the Linux kernel.

Fixed CVE-2024-53166 in the Linux kernel.

Fixed KCTF-647cef2 in the Linux kernel.

Fixed CVE-2025-21716 in the Linux kernel.

Fixed CVE-2025-21785 in the Linux kernel.

Fixed CVE-2025-21844 in the Linux kernel.

Fixed CVE-2025-21779 in the Linux kernel.

Fixed CVE-2025-21846 in the Linux kernel.

Fixed CVE-2025-21864 in the Linux kernel.

Fixed CVE-2025-21858 in the Linux kernel.

Fixed CVE-2025-21791 in the Linux kernel.

Fixed CVE-2024-26982 in the Linux kernel.

Fixed CVE-2024-57996 in the Linux kernel.

Fixed CVE-2024-57996 in the Linux kernel.

Fixed CVE-2024-57996 in the Linux kernel.

Runtime sysctl changes:

  • Changed: fs.file-max: 812258 -> 812224

cos-117-18613-164-93

Kernel Docker Containerd GPU Drivers
COS-6.6.72 v24.0.9 v1.7.24 See List

Fixed an issue that resulted in missing grub boot measurements in some machine configurations.

Added support for NVIDIA GB200 GPU with 570.124.06 GPU driver. This driver version has been assigned the latest, default, and R570 tags for this GPU type.

Added support for the Lustre 2.14.0 client drivers.

Upgraded dev-lang/go to v1.23.7.

Fixed a race condition that could cause a kernel panic.

Fixed CVE-2024-58005 in the Linux kernel.

Fixed KCTF-647cef2 in the Linux kernel.

Fixed CVE-2025-21785 in the Linux kernel.

Fixed CVE-2025-21716 in the Linux kernel.

Runtime sysctl changes:

  • Changed: fs.file-max: 811752 -> 811744

cos-113-18244-291-82

Kernel Docker Containerd GPU Drivers
COS-6.1.123 v24.0.9 v1.7.24 See List

Fixed an issue that resulted in missing grub boot measurements in some machine configurations.

Fixed a race condition that could cause a kernel panic.

Fixed CVE-2024-58005 in the Linux kernel.

Fixed CVE-2024-53166 in the Linux kernel.

Fixed CVE-2024-53166 in the Linux kernel.

Fixed KCTF-647cef2 in the Linux kernel.

Fixed CVE-2025-21716 in the Linux kernel.

Runtime sysctl changes:

  • Changed: fs.file-max: 812031 -> 812050

cos-105-17412-535-84

Kernel Docker Containerd GPU Drivers
COS-5.15.173 v23.0.3 v1.7.23 See List

Fixed CVE-2024-58017 in the Linux kernel.

Fixed CVE-2022-49728 in the Linux kernel.

Fixed CVE-2025-21785 in the Linux kernel.

Fixed KCTF-638ba50 in the Linux kernel.

Fixed KCTF-647cef2 in the Linux kernel.

Fixed CVE-2025-21858 in the Linux kernel.

Fixed CVE-2025-21791 in the Linux kernel.

Runtime sysctl changes:

  • Changed: fs.file-max: 812699 -> 812690

Document AI

As we launch Custom Extractor version pretrained-foundation-model-v1.4-2025-02-05 in GA with fine tuning (in Preview), these versions will no longer be accessible effective September 24, 2025:

  • pretrained-foundation-model-v1.2-2024-05-10
  • pretrained-foundation-model-v1.3-2024-08-31

To avoid service disruptions, migrate to a later version, such as pretrained-foundation-model-v1.4-2025-02-05. To learn more about the migration process, refer to our Manage processor versions documentation.

Customers and projects can access pretrained-foundation-model-v1.2-2024-05-10 and pretrained-foundation-model-v1.3-2024-08-31 until September 24, 2025. This includes the ability to create tuning jobs and access fine-tuned processor versions.

Starting March 24, 2025:

  • Newly created processor versions using pretrained-foundation-model-v1.2-2024-05-10 can only be used for batch processing.
  • Newly created processor versions using pretrained-foundation-model-v1.2-2024-05-10 and pretrained-foundation-model-v1.3-2024-08-31 will have a quota limit of 120 pages per minute.

This update requires planning, but if you have questions or need assistance, contact Google Cloud support.

Firestore

Cloud Firestore now supports multi-region nam7 United States (Central and East), which consists of regions us-central1 (Iowa) and us-east4 (Northern Virginia).

For a full list of supported locations, see Locations.

Firestore in Datastore mode

Firestore in Datastore mode now supports multi-region nam7 United States (Central and East), which consists of regions us-central1 (Iowa) and us-east4 (Northern Virginia).

For a full list of supported locations, see Locations.

A weekly digest of client library updates from across the Cloud SDK.

Java

Changes for google-cloud-datastore

2.27.1 (2025-03-18)

Bug Fixes
  • deps: Update the Java code generator (gapic-generator-java) to 2.55.1 (ba1ad98)
Dependencies
  • Update dependency com.google.cloud:sdk-platform-java-config to v3.45.1 (#1791) (ab5ac8e)
Google SecOps

Purging of expired raw logs and normalized events is now based on the Ingestion Timestamp instead of the Event Timestamp.

Google SecOps SIEM

Purging of expired raw logs and normalized events is now based on the Ingestion Timestamp instead of the Event Timestamp.

Looker

The following features have been added to Studio in Looker, which is available in preview:

Looker Studio

Looker connector enhancements

The following enhancements to the Looker connector are available in Preview:

Partner connection launch update

The following partner connectors have been added to the Looker Studio Connector Gallery:

Media CDN

Media CDN supports dynamic compression in General Availability.

Memorystore for Redis Cluster

After you create a Memorystore for Redis Cluster instance, you can now change the node type for the instance. For more information, see Scale an instance.

Memorystore for Valkey

After you create a Memorystore for Valkey instance, you can now change the node type for the instance. For more information, see Scale an instance.

Pub/Sub

A weekly digest of client library updates from across the Cloud SDK.

Python

Changes for google-cloud-pubsub

2.29.0 (2025-03-19)

Features
  • Add REST Interceptors which support reading metadata (4363179)
  • Add support for opt-in debug logging (4363179)
  • Deprecate enabled field for message transforms and add disabled field (4363179)
Bug Fixes
  • Allow logs to propagate upstream for caplog testing (#1374) (fa39b0e)
  • Allow Protobuf 6.x (#1369) (c95b7a5)
  • Fix typing issue with gRPC metadata when key ends in -bin (4363179)
Documentation
  • A comment for field code in message .google.pubsub.v1.JavaScriptUDF is changed (4363179)
  • Add samples and test for ingestion from Kafka sources (#1354) (820f986)
  • Deprecate enabled field for message transforms and add disabled field (4363179)
  • samples: Increase example max_bytes setting for cloud storage subscriptions to encourage more performant subscribe (#1324) (cb760a7)
VPC Service Controls

Preview stage support for the following integration:

March 23, 2025

Google SecOps SOAR

Release 6.3.40 is being rolled out to the first wave of regions as listed here.

Theme enhancement for SOAR platform

The header and left hand navigation menu now fully reflect the selected theme. If you select the light theme, both the header and side menu will also appear in light mode. This might impact customers who are using the rebranding feature.

March 22, 2025

Google SecOps SOAR

Release 6.3.39 is now available for all regions.

March 21, 2025

Access Context Manager

Access Context Manager now supports custom organization policies. This feature is generally available (GA). For more information, see Create custom constraints for Access Context Manager.

Cloud Build

In the filtering toolbar of the Triggers page, you can now filter by trigger repository and region. The region drop-down has been removed. For more information, see Create and manage build triggers.

You can now specify, in your build config file, a custom Pub/Sub topic for build notifications. For more information, see Pub/Sub topics for build notifications.

Cloud Deploy

Cloud Deploy now uses Skaffold 2.14 as the default Skaffold version, as of March 21, 2025, for all target types.

Cloud Monitoring

The Google-Built OpenTelemetry Collector is now available. This Collector is an open-source, production-ready build of the upstream OpenTelemetry Collector that is built with upstream OpenTelemetry Collector components. The Google-built Collector lets you send correlated OTLP traces, metrics, and logs to Cloud Observability and other backends from applications instrumented by using OpenTelemetry SDKs. The Collector also captures metadata for Google Cloud resources, so you can correlate application performance data with infrastructure telemetry data.

For information about using this Collector, see Overview of the Google-Built OpenTelemetry Collector.

Cloud Storage

Storage Intelligence for Cloud Storage is now generally available (GA). Storage Intelligence simplifies data management in Cloud Storage at scale by providing a unified platform for data exploration, cost optimization, security enforcement, and governance implementation. To learn more about Storage Intelligence, see Overview of Storage Intelligence.

Storage Insights datasets is now generally available (GA). Storage Insights datasets helps you get insights for your Cloud Storage resources and export the data to BigQuery. Storage Insights datasets is an exclusive feature only available through the Storage Intelligence subscription. To learn more about Storage Insights, see Overview of Storage Insights datasets.

Cross-bucket replication is now generally available (GA). You can use cross-bucket replication to copy new and updated objects asynchronously from a source bucket to a destination bucket.

Compute Engine

Generally available: Resource-based committed use discounts (CUDs) are available for licenses of RHEL operating system images. You can purchase commitments with a 1-year plan for these licenses and receive up to 20% discounts over on-demand prices.

To learn how to purchase these commitments, see Purchase commitments for licenses. For pricing information, reach out to your Technical account manager (TAM).

Dialogflow

The Conversational Agents console is now generally available (GA). This console combines the power of Generative AI playbooks and data stores with deterministic flows. Additional features:

  • The console is now hosted at https://conversational-agents.cloud.google.com/.
  • There is a new menu option for managing languages. Selecting Manage languages from the language drop-down menu at the top of the console now automatically redirects you to the Agent Settings language management section in the Deterministic Flows tab.
  • The simulator now has feature parity with the Dialogflow CX console.

Conversational Agents: Conversational Agents now supports multiple tool versions in addition to playbooks and flows. See the versions and environments documentation for details.

Conversational Agents: You can now toggle a Show latency option in the Conversational Agents Console simulator to view latency per conversation turn for simulator conversations. To view latency breakdown, click the total latency value for the conversation turn. Latency values are also shown in the original response, Cloud logging, and BigQuery export.

Be aware that latency values are not recorded directly in the logs, but are represented as startTime and completeTime values in the traceBlocks field.

Conversational Agents playbooks: New model gemini-2.0-flash (Preview) is now available. For more information and supported regions, see Model support.

Conversational Agents: New Chirp 3 HD Cloud Text-to-Speech voices are now available.

Conversational Agents playbooks: Playbooks now support 38 languages. Playbook language support is displayed on the language support page. Supported languages have been tested for quality with the gemini-2.0-flash-001 and gemini-1.5-flash-002 models.

Conversational Agents playbooks: You can now enable DTMF in playbook Settings and as a conditional actions as a Preview feature. See the playbook settings and DTMF for telephony integrations pages for more information.

Google Kubernetes Engine

In GKE version 1.32.2-gke.1652000 and later, new external LoadBalancer Services use zonal Network Endpoint Group (NEG) backends by default. This applies only to new backend service-based external LoadBalancer Services. Existing LoadBalancer Services are not affected. To learn more, see Create a backend service-based external load balancer.

All GKE clusters now export four new rollup metrics by default at no additional charge. These new metrics are for monitoring GKE TPU NodePools and JobSets:

  • kubernetes.io/node_pool/accelerator/times_to_recover: Distribution of recovery period durations. Each sample indicates a single recovery operation for the NodePool to recover from a downtime period. The data is sampled within 60s after the completion of NodePool recovery, and emitted within 24h. This metric does not include a sample for downtime period longer than 7 days. This metric is only applicable for GKE multi-host TPU node pools.

  • kubernetes.io/jobset/times_between_interruptions: Distribution of times between the end of last interruption and beginning of current interruption for a JobSet. Each sample indicates a single duration between last and current interruption. The data is sampled within 60s after the current interruption starts, and emitted within 24h. The metric does not include a sample for duration between interruptions longer than 7 days. This metric is only applicable for JobSets running on nodes with GPU/TPU and having a single replicated job.

  • kubernetes.io/jobset/times_to_recover: Distribution of recovery period durations. Each sample indicates a single recovery operation for the JobSet to recover from a downtime period. The data is sampled within 60s after the completion of JobSet recovery, and emitted within 24h. This metric does not include samples for downtime periods longer than 7 days. This metric is only applicable for JobSets running on nodes with GPU/TPU and having a single replicated job.

  • kubernetes.io/jobset/uptime: Total time the JobSet has been available. The data is sampled every 60s and emitted within 24h after sampling. This metric is only applicable for JobSets running on nodes with GPU/TPU and having a single replicated job.

Starting in GKE version 1.32.1-gke.1729000, Autopilot clusters will automatically use the new Performance HPA Profile. This new profile enables faster autoscaling on CPU and Memory metrics for up to 1,000 HorizontalPodAutoscaler objects by routing autoscaling metrics through the gke-metrics-agent Daemonset. If desired, users can revert to the old autoscaling profile by disabling the Peformance HPA Profile.

Kf

Upgraded server-side dependencies - Tekton Pipelines, Config Connector

Upgrade upload-pages-artifact dependency

Resource Manager

Custom organization policies are now generally available for Access Context Manager and VPC Service Controls. For more information, see Manage Access Context Manager resources with custom constraints and Create custom constraints for VPC Service Controls.

Security Command Center

Model Armor filter update

The prompt injection and jailbreak detection filter in Model Armor is upgraded with increased efficacy and higher model quality scores.

VPC Service Controls

VPC Service Controls now supports custom organization policies. This feature is generally available (GA). For more information, see Create custom constraints for VPC Service Controls.

March 20, 2025

BigQuery

BigQuery workflows have been renamed to BigQuery pipelines in the Google Cloud console. For more information, see Introduction to BigQuery pipelines.

You can now use repositories and workspaces in BigQuery to perform version control.

Repositories perform version control on files by using Git to record changes and manage file versions. You can use workspaces within repositories to edit the code stored in the repository.

You can have a repository use Git directly on BigQuery, or you can connect a repository to a third-party Git provider.

This feature is in preview.

You can now create remote models in BigQuery ML based on the Anthropic Claude model in Vertex AI.

Use the ML.GENERATE_TEXT function with these remote models to perform generative natural language tasks for text stored in BigQuery tables. Try this feature with the Generate text by using the ML.GENERATE_TEXT function tutorial.

You can also evaluate Claude models by using the ML.EVALUATE function.

This feature is generally available (GA).

Cloud Asset Inventory

The following resource types are now publicly available through the analyze policy APIs (AnalyzeIamPolicy and AnalyzeIamPolicyLongrunning).

  • Developer Connect
    • developerconnect.googleapis.com/Connection
    • developerconnect.googleapis.com/GitRepositoryLink
Cloud Service Mesh

You can now use custom constraints with Organization Policy to provide more granular control over specific fields for some networksecurity and networkservices resources.

Cloud Service Mesh now supports dual-stack, extending IPv6 capability to both proxy-based Envoy and proxyless gRPC. For more information, see Configure IPv6 dual-stack for Cloud Service Mesh.

If you use the managed Cloud Service Mesh with the ISTIOD control plane implementation, important changes have been made to how and when you'll receive notifications of upcoming modernization. For details, see Managed control plane modernization.

Datastream

You can now use Secret Manager to securely store authentication resources with Datastream. For more information, see Use Secret Manager to store sensitive data.

Generative AI on Vertex AI

Anthropic's Claude Sonnet 3.7 is GA on Vertex AI and supports Provision Throughput. To learn more, view the Claude Sonnet 3.7 model card in Model Garden.

Looker Studio

Quotas for scheduled emails

Looker Studio now limits the number of recipients to whom a user can send scheduled emails per day and per month. See the Quotas for scheduled email delivery section for more information. If you have Looker Studio Pro, no such quotas apply. However, any reports in the Owned by me folder are considered to be personal reports and will be subject to quotas. To resolve this, you can upgrade a report to Looker Studio Pro.

Scheduled email updates

The following features are now available only for Looker Studio Pro reports:

  • Send Now: The ability to immediately send a report with email using the "Send Now" option is available only for Pro reports.
  • Custom Subject and Messages: The option to customize the email subject and message is available only for Pro reports. Any custom messages in existing schedules will be preserved, but you will no longer be able to edit them.
  • Image in Preview: A preview of the report will be added to emails only for Pro reports.

These features are also unavailable for reports in the Owned by me folder, even if you have Looker Studio Pro. To resolve this, you can upgrade a report to Looker Studio Pro.

Preview your data

The data source editor displays a preview of the data in your fields. This feature is now generally available.

Partner connection launch update

The following partner connectors have been added to the Looker Studio Connector Gallery:

Oracle Database@Google Cloud Security Command Center

The Risk section of the SecOps console has been updated for Security Command Center Enterprise, introducing the following features in Preview:

  • Issues are the most important security risks Security Command Center Enterprise has found in your cloud environments. Sourced from Security Command Center's virtual red teaming and security graph, issues give you all the details you need to understand, triage, and remediate a risk. Explore attack path diagrams, attack exposure scores, exposed resources, related findings, and whether multiple issues exist on a primary resource, all from the one place.
  • Security graph is a graph database that has cloud resources like assets, identities, apps, and data assigned to its nodes, while the edges of the graph determine the risk relationship between those resources following detection rules. When a relationship risk is discovered, the security graph generates an issue.
  • Chokepoints are critical severity issues that focus on common resources or resource groups where multiple attack paths converge. Because of this focus on a common point, resolving a chokepoint can resolve other issues too, like toxic combinations.

The Risk Overview dashboard has also been updated, and a new Issues page added to the Risk section. You can navigate through different security domains in the Risk section using the tabs near the top of the page, such as All risk, Vulnerabilities, and Code.

Vertex AI Workbench

Encrypt your data-in-use by using Confidential Computing. This feature is now available in Preview. You can enable the Confidential VM service when you create a Vertex AI Workbench instance. To get started, see Create an instance with Confidential Computing.

March 19, 2025

Agent Assist

Build your own Gen AI Assist is available in preview. BYOA is available in all customer engagement suite regions and offers the following:

  • Foundation models
  • Gemini access
  • New trigger events based on agent and customer messages

Agent Assist offers Vertex extensions for Build your own assist (BYOA) in preview. Enable BYOA to access remote APIs with Vertex LLM extensions.

AlloyDB for PostgreSQL

Performing an in-place major version upgrade of your AlloyDB cluster is generally available (GA). You can upgrade your AlloyDB cluster to any higher supported PostgreSQL version. For information about supported PostgreSQL versions, see Database version policies.

Compute Engine

Preview: You can create regionally scoped snapshots. Setting a regional scope ensures that all snapshot data and the metadata necessary to use the snapshot are co-located within the scoped region. Regionally scoped snapshots also support additional location control by letting you restrict allowed snapshot creation and restore locations.

For more information, see Snapshot scopes.

Document AI

Custom Extractor model pretrained-foundation-model-v1.4-2025-02-05 is in General Availability (GA), and has fine-tuning available in Preview for the US and EU.

From version v1.4 and later, we will use a new quota for online processing called Number of online process document pages per minute per processor_type_and_model_version. This quota will be enforced at a per-page and per-foundation model level. There will be no change to the batch processing quota.

Google Kubernetes Engine

(2025-R11) Version updates

GKE cluster versions have been updated.

New versions available for upgrades and new clusters.

The following Kubernetes versions are now available for new clusters and for opt-in control plane upgrades and node upgrades for existing clusters. For more information on versioning and upgrades, see GKE versioning and support and Upgrades.

Rapid channel

  • Version 1.32.2-gke.1182001 is now the default version for cluster creation in the Rapid channel.
  • The following versions are now available in the Rapid channel:
  • The following versions are no longer available in the Rapid channel:
    • 1.32.2-gke.1182000
    • 1.32.2-gke.1400001
  • Auto-upgrade targets are now available for the following minor versions:
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.31 to version 1.32.2-gke.1182001 with this release.
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.32 to version 1.32.2-gke.1182001 with this release.

Regular channel

  • Version 1.32.2-gke.1182001 is now available in the Regular channel.
  • Version 1.32.2-gke.1182000 is no longer available in the Regular channel.

Stable channel

Extended channel

No channel

(2025-R11) Version updates

  • Version 1.32.2-gke.1182001 is now the default version for cluster creation in the Rapid channel.
  • The following versions are now available in the Rapid channel:
  • The following versions are no longer available in the Rapid channel:
    • 1.32.2-gke.1182000
    • 1.32.2-gke.1400001
  • Auto-upgrade targets are now available for the following minor versions:
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.31 to version 1.32.2-gke.1182001 with this release.
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.32 to version 1.32.2-gke.1182001 with this release.

(2025-R11) Version updates

  • Version 1.32.2-gke.1182001 is now available in the Regular channel.
  • Version 1.32.2-gke.1182000 is no longer available in the Regular channel.

(2025-R11) Version updates

(2025-R11) Version updates

(2025-R11) Version updates

Google SecOps

The following parser documentation is now available:

Collect AWS Config logs

Collect AWS Elastic Load Balancing logs

Collect AWS Route 53 logs

Collect AWS S3 server access logs

Collect AWS WAF logs

Collect Azure Application Gateway logs

Collect Carbon Black App Control logs

Collect Carbon Black EDR logs

Collect Delinea Secret Server logs

Collect Radware WAF logs

Collect AWS Aurora logs

Collect AWS CloudWatch logs

Collect AWS Control Tower logs

Collect AWS Elastic MapReduce logs

Collect AWS Key Management Service logs

Collect AWS Macie logs

Collect AWS Network Firewall logs

Collect AWS Security Hub logs

Collect AWS Session Manager logs

Collect Zscaler DLP logs

Collect Zscaler Tunnel logs

Collect Zscaler VPN logs

Collect Zscaler ZPA Audit logs

Collect Zscaler ZPA logs

Collect Zscaler CASB logs

Collect Azure AD Sign-In logs

Collect Azure API Management logs

Collect Azure APP Service logs

Collect Azure Firewall logs

Collect Azure VPN logs

Collect AWS VPN logs

Collect Azure Storage Audit logs

Collect Azure WAF logs

Collect Cloud IoT logs

Collect Cloud Run logs

Collect Cloud Compute logs

Collect CrowdStrike Falcon Stream logs

Collect SentinelOne Deep Visibility logs

Collect Cloud VPC Flow Logs

Collect Cloud Compute context logs

Collect Cloud Intrusion Detection System (Cloud IDS) logs

Collect Cloud Next Generation Firewall Enterprise logs

Collect Cloud Storage context logs

Collect Cloud Identity and Access Management (IAM) Analysis logs

Collect Cloud Identity Devices logs

Collect Cloud Identity Device Users logs

Collect Cloud Security Command Center Error logs

Collect Cloud Security Command Center Observation logs

Collect Cloud Security Command Center Posture Violation logs

Collect Cloud Security Command Center Toxic Combination logs

Collect Cloud Security Command Center Unspecified logs

Collect Cloud Secure Web Proxy logs

Migrate to Virtual Machines

Generally available: Migrate to Virtual Machines support for the Arm64 migration journey is now generally available. This feature lets you migrate Arm virtual machine (VM) instances from AWS and Azure cloud services to Arm VM instances on Compute Engine, and it is supported for the following operating systems:

  • Debian 11 and 12
  • RHEL 9
  • Rocky Linux 8 and 9
  • SLES 15 SP5
  • Ubuntu 20.04 and 22.04
Sensitive Data Protection

The CZECHIA_PASSPORT infoType detector is available in all regions. For more information about all built-in infoTypes, see InfoType detector reference.

Vertex AI Agent Builder

Vertex AI Search: Generate and return charts in answers and with follow-ups (Public preview)

The answer method can include a chart in an answer, as well as text. The chart is generated from the data in the data store. A chart is generated if there is sufficient data, and the query either asks for a chart or the answer is sufficiently complex that the method itself determines that a chart is helpful.

This feature is in public preview and is only available through the API. For more information, see Generate charts for answers.

Vertex AI Search: Return corpus images in answers and with follow-ups (Public preview)

The answer method can return images in answers, along with text.

If appropriate, one image from the data store can be returned with the answer. Citations can also include images from the data store.

This feature is restricted to queries made to unstructured data stores where the layout parser is in effect and is only available through the API. For more information, see Retrieve existing images from the data store.

March 18, 2025

AI Hypercomputer

Generally available: The A4 accelerator-optimized machine type is now generally available. A4 VMs are powered by NVIDIA B200 GPUs and provide up to 3x performance of previous GPU machine types for most GPU accelerated workloads. A4 is especially recommended for ML training workloads at large scales. A4 is available in the following region and zone:

  • Council Bluffs, Iowa: us-central1-b

When provisioning A4 machine types, you can use Hypercompute Cluster to request capacity and create VMs or clusters. To get started see Overview of creating VMs and clusters.

Software stack updates

The following new Docker images are also released to support workloads running on your A4 GKE clusters that are deployed using Hypercompute Cluster.

  • NeMo docker image: nemo25.02-gib1.0.5-A4
  • MaxText docker image: jax-maxtext-gpu:jax0.5.1-cuda_dl25.02-rev1-maxtext-20150317

For more information, see AI Hypercomputer images.

AlloyDB for PostgreSQL

You can use a query recall evaluator (Preview) to find the recall for a vector query for a given configuration, and to tune your parameters to achieve the desired vector query recall results. For more information, see Measure vector query recall.

App Engine flexible environment .NET

Container Registry is now shut down. We recommend that you use Artifact Registry for storing and managing container images. By default, new deployments created after March 5, 2025, use Artifact Registry instead of Container Registry for storing application build images. For more information, see Migrate App Engine container images to Artifact Registry.

App Engine flexible environment Go

Container Registry is now shut down. We recommend that you use Artifact Registry for storing and managing container images. By default, new deployments created after March 5, 2025, use Artifact Registry instead of Container Registry for storing application build images. For more information, see Migrate App Engine container images to Artifact Registry.

App Engine flexible environment Java

Container Registry is now shut down. We recommend that you use Artifact Registry for storing and managing container images. By default, new deployments created after March 5, 2025, use Artifact Registry instead of Container Registry for storing application build images. For more information, see Migrate App Engine container images to Artifact Registry.

App Engine flexible environment Node.js

Container Registry is now shut down. We recommend that you use Artifact Registry for storing and managing container images. By default, new deployments created after March 5, 2025, use Artifact Registry instead of Container Registry for storing application build images. For more information, see Migrate App Engine container images to Artifact Registry.

App Engine flexible environment PHP

Container Registry is now shut down. We recommend that you use Artifact Registry for storing and managing container images. By default, new deployments created after March 5, 2025, use Artifact Registry instead of Container Registry for storing application build images. For more information, see Migrate App Engine container images to Artifact Registry.

App Engine flexible environment Python

Container Registry is now shut down. We recommend that you use Artifact Registry for storing and managing container images. By default, new deployments created after March 5, 2025, use Artifact Registry instead of Container Registry for storing application build images. For more information, see Migrate App Engine container images to Artifact Registry.

App Engine flexible environment Ruby

Container Registry is now shut down. We recommend that you use Artifact Registry for storing and managing container images. By default, new deployments created after March 5, 2025, use Artifact Registry instead of Container Registry for storing application build images. For more information, see Migrate App Engine container images to Artifact Registry.

App Engine flexible environment custom runtimes

Container Registry is now shut down. We recommend that you use Artifact Registry for storing and managing container images. By default, new deployments created after March 5, 2025, use Artifact Registry instead of Container Registry for storing application build images. For more information, see Migrate App Engine container images to Artifact Registry.

App Engine standard environment Go

Container Registry is now shut down. We recommend that you use Artifact Registry for storing and managing container images. By default, new deployments created after March 5, 2025, use Artifact Registry instead of Container Registry for storing application build images. For more information, see Migrate App Engine container images to Artifact Registry.

App Engine standard environment Java

Container Registry is now shut down. We recommend that you use Artifact Registry for storing and managing container images. By default, new deployments created after March 5, 2025, use Artifact Registry instead of Container Registry for storing application build images. For more information, see Migrate App Engine container images to Artifact Registry.

App Engine standard environment Node.js

Container Registry is now shut down. We recommend that you use Artifact Registry for storing and managing container images. By default, new deployments created after March 5, 2025, use Artifact Registry instead of Container Registry for storing application build images. For more information, see Migrate App Engine container images to Artifact Registry.

App Engine standard environment PHP

Container Registry is now shut down. We recommend that you use Artifact Registry for storing and managing container images. By default, new deployments created after March 5, 2025, use Artifact Registry instead of Container Registry for storing application build images. For more information, see Migrate App Engine container images to Artifact Registry.

App Engine standard environment Python

Container Registry is now shut down. We recommend that you use Artifact Registry for storing and managing container images. By default, new deployments created after March 5, 2025, use Artifact Registry instead of Container Registry for storing application build images. For more information, see Migrate App Engine container images to Artifact Registry.

App Engine standard environment Ruby

Container Registry is now shut down. We recommend that you use Artifact Registry for storing and managing container images. By default, new deployments created after March 5, 2025, use Artifact Registry instead of Container Registry for storing application build images. For more information, see Migrate App Engine container images to Artifact Registry.

Cloud Composer

After April 15, 2025 the database retention policy feature will be enabled by default in newly created Cloud Composer 3 environments.

This feature helps to maintain the Airflow database size. You can enable or disable the database retention policy or adjust the retention period for new and existing environments.

The issue with Cloud Composer 2 upgrade operations is now resolved. The upgrade operations are unblocked in all regions.

Cloud SQL for MySQL Container Registry

Container Registry is shut down and writing images to Container Registry is unavailable. For more information about the Container Registry shut down and how to migrate to Artifact Registry, see Container Registry deprecation.

Gemini Code Assist

Streamed chat responses are now available in public preview for IntelliJ and VS Code Gemini Code Assist. You can disable this feature in settings.

You can now configure and use custom commands in the inline chat menu and lightbulb menu for VS Code Gemini Code Assist. To view custom commands settings, go to Settings > Gemini Code Assist > Custom Commands.

Fixed an issue with an infinite progress bar while trying to log in to IntelliJ Gemini Code Assist.

Google Cloud VMware Engine

VMware Engine is integrated with Google Cloud Essential Contacts for email notifications. Automatic emails are sent to the appropriate Essential Contacts notification categories for service-impacting events. For more information, see Overview of VMware Engine monitoring.

Google Distributed Cloud (software only) for VMware

Google Distributed Cloud (software only) for VMware 1.31.300-gke.81 is now available for download. To upgrade, see Upgrade a cluster or a node pool. Google Distributed Cloud 1.31.300-gke.81 runs on Kubernetes v1.30.9-gke.500.

If you are using a third-party storage vendor, check the GDC Ready storage partners document to make sure the storage vendor has already passed the qualification for this release.

After a release, it takes approximately 7 to 14 days for the version to become available for use with GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

The 1.31.300-gke.81 release includes many vulnerability fixes. For a list of all vulnerabilities fixed in this release, see Vulnerability fixes.

Google Distributed Cloud (software only) for bare metal

Release 1.31.300-gke.81

Google Distributed Cloud for bare metal 1.31.300-gke.81 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.31.300-gke.81 runs on Kubernetes v1.31.5-gke.700.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

The 1.31.300-gke.81 release includes many vulnerability fixes. For a list of all vulnerabilities fixed in this release, see Vulnerability fixes.

Google Kubernetes Engine

On GKE clusters running versions 1.32.2-gke.1182000 to 1.32.2-gke.1297000, Pods using Cloud Storage FUSE CSI driver volumes (persistent or CSI ephemeral) fail to schedule when both of the following are true:

The fix is available on GKE cluster version 1.32.2-gke.1297001 or later.

Google SecOps

Statistics and aggregations in UDM search using YARA-L 2.0

You can now run statistical queries on UDM events and group the results for analysis using YARA-L 2.0. You can use the statistical queries to track critical metrics, detect anomalous behavior, and analyze trends over time. For more information on how to run statistical queries on UDM events, see Statistics and aggregations in UDM search using YARA-L 2.0.

Google SecOps SIEM

Statistics and aggregations in UDM search using YARA-L 2.0

You can now run statistical queries on UDM events and group the results for analysis using YARA-L 2.0. You can use the statistical queries to track critical metrics, detect anomalous behavior, and analyze trends over time. For more information on how to run statistical queries on UDM events, see Statistics and aggregations in UDM search using YARA-L 2.0.

Resource Manager

Custom organization policies are now generally available for Cloud Service Mesh. For more information, see Set up custom constraints.

Security Command Center

Cloud Infrastructure Entitlement Management (CIEM) has launched support for the following:

  • Log ingestion from Amazon SQS queues.
  • An alternate CIEM only feed to reduce costs.

For more information, see Configure AWS log ingestion for CIEM.

This feature is available in General Availability to the Security Command Center Enterprise tier.

Spanner

The default time zone of your Spanner databases can now be set. For more information, see Set the default time zone of a database. This feature is generally available (GA).

March 17, 2025

AlloyDB for PostgreSQL

Outbound connectivity for Private Service Connect-enabled AlloyDB clusters is generally available (GA). Enabling outbound connectivity allows secure connection between your project and an AlloyDB instance during outbound operations such as migrations or foreign data wrappers (FDW).

Apigee X

On March 17, 2025, Apigee announced the GA support for DNS peering for Apigee organizations that have VPC peering disabled.

For Apigee organizations set up without VPC peering, you can now configure Apigee to resolve your private domains by peering your DNS zones with Apigee. See Connecting with private DNS peering zones.

BigQuery

You can now create an external dataset in BigQuery that links to an existing database in Spanner. This feature is generally available (GA).

You can now use the TYPEOF function to determine the data type of an expression. This feature is generally available (GA).

Bigtable

A weekly digest of client library updates from across the Cloud SDK.

Java

Changes for google-cloud-bigtable

2.55.0 (2025-03-11)

Features
  • Add MaterializedViewName to ReadRows and SampleRowKeys (1763c6e)
  • Add MaterializedViews and LogicalViews APIs (1763c6e)
  • Add MaterializedViews and LogicalViews APIs (7340527)
  • Add PrepareQuery api and update ExecuteQuery to support it (1763c6e)
  • bigtable: Add support for data APIs for materialized views (#2508) (6310a63)
  • large-row-skip: Added large-row-skip-callable with configurable rowadapter (#2509) (ba193ef)
  • Next release from main branch is 2.55.0 (#2506) (4e45837)
  • Publish row_key_schema fields in table proto and relevant admin APIs to setup a table with a row_key_schema (7340527)
Bug Fixes
  • deps: Update the Java code generator (gapic-generator-java) to 2.54.0 (91e4369)
Documentation
  • Fixed formatting of resource path strings (7340527)
Cloud Data Fusion

Cloud Data Fusion version 6.11.0 is available in Preview.

You can view instance metrics and pipeline metrics in Cloud Monitoring and in the dashboard provided by Cloud Data Fusion. For more information, see Metrics overview and Monitor Cloud Data Fusion system, instance, and pipeline health.

You can view instance logs and pipeline logs in Cloud Logging, and in the dashboard provided by Cloud Data Fusion. For more information, see View Cloud Data Fusion logs.

When a pipeline run fails, you can retrieve detailed error information on the pipeline details page of the Cloud Data Fusion web interface.

Cloud Data Fusion classifies pipeline errors by category, reason, and message. This classification speeds up resolution and reduces the need to examine complex logs. For more information, see Retrieve error information for a failed pipeline run.

Cloud Data Fusion 6.11.0 offers high availability with reduced upgrade downtime.

Changes in Cloud Data Fusion 6.11.0:

  • To create ephemeral clusters, Cloud Data Fusion uses the Dataproc 2.2 image by default. For more information about its limitations in Cloud Data Fusion, see Change the Dataproc image to version 2.1.

  • The maximum concurrent runs limit for triggers is displayed in the console (CDAP-21072).

  • Added support for destination table write preference in the BigQuery Execute plugin (PLUGIN-1438).

Fixed in Cloud Data Fusion 6.11.0:

  • Fixed a null pointer exception in the BigQuery multi-sink plugin when used without a reference name (PLUGIN-1843).

  • Fixed Joiner plugin failures observed on Dataproc 2.2-debian12 instances (CDAP-21075).

  • Fixed an issue that prevented pipelines from accepting empty input in Amazon S3 and Google Cloud Storage source plugins (PLUGIN-1742).

  • Fixed an issue in RBAC-enabled instances where the pipeline details page displayed an incorrect author name (CDAP-21069).

A soft limit of 2 MB for pipeline JSON size is introduced in 6.11.0. Pipelines exceeding this size might encounter deployment failures.

The following APIs for searching and querying metrics are deprecated in 6.11.0:

  • POST v3/metrics/query
  • POST v3/metrics/search

The following APIs for downloading system service and pipeline run logs are deprecated in 6.11.0:

  • GET /v3/namespaces/<NAMESPACE_ID>/apps/<APP_ID>/<PROGRAM_TYPE>/<PROGRAM_ID>/logs
  • GET /v3/system/services/<SERVICE_ID>/logs

The ability to retrieve all applications without pagination using the GET /v3/namespaces/<NAMESPACE_ID>/apps endpoint is deprecated in 6.11.0.

Cloud Load Balancing

Google Cloud periodically renews Google-managed certificates by requesting them from certificate authorities (CAs). Certificate authorities verify domain control by checking DNS settings of the domain and in case of load balancer authorization attempting to contact the server behind the domain's IP address. The CAs that Google Cloud works with have introduced a verification method called Multi-Perspective Issuance Corroboration, that is becoming mandatory for all public CAs and that consists in performing the verification from multiple locations in the world. As a result, if DNS settings do not correctly and consistently resolve from all locations, the validation fails and Google-managed certificates will fail to renew.

To learn more about preventing multi-perspective domain validation failures for misconfigured DNS records, see Multi-perspective domain validation.

Cloud Monitoring

You can now enable and disable uptime-checks by using the disabled field in the Cloud Monitoring API.

Cloud SQL for SQL Server

Cloud SQL for SQL Server supports transparent data encryption (TDE) to encrypt data stored in your Cloud SQL for SQL Server instances.

TDE automatically encrypts data before it is written to storage, and automatically decrypts data when the data is read from storage.

TDE provides another layer of encryption in addition to Google's default offering of encryption for data at rest and Google's optional offering of customer-managed encryption keys (CMEK). TDE helps you meet regulatory compliance requirements and supports import or export operations of TDE encrypted backups. For more information, see About transparent data encryption.

Cloud Storage

A weekly digest of client library updates from across the Cloud SDK.

Go

Changes for storage/internal/apiv2

1.51.0 (2025-03-12)

Features
  • storage/append: Support appends in w1r3. (#11483) (48bb391)
  • storage: Benchmark with experimental MRD. (#11501) (7b49152)
  • storage: Implement RetryChunkDeadline for grpc writes (#11476) (03575d7)
  • storage: Specify benchmark integrity check. (#11465) (da18845)
  • storage: Use ReadHandle for faster re-connect (#11510) (cac52f7)
  • storage: Wrap NotFound errors for buckets and objects (#11519) (0dd7d3d)
Bug Fixes
  • storage/append: Report progress for appends. (#11503) (96dbb6c)
  • storage: Add a safety check for readhandle (#11549) (c9edb37)
  • storage: Add universe domain to defaultSignBytesFunc (#11521) (511608b)
  • storage: Clone the defaultRetry to avoid modifying it directly (#11533) (7f8d69d)
  • storage: Fix adding multiple range on stream with same read id (#11584) (0bb3434)
  • storage: Modify the callback of mrd to return length of data read instead of limit. (#11687) (9e359f0)
  • storage: Propagate ctx from invoke to grpc upload reqs (#11475) (9ad9d76)
  • storage: Remove duplicate routing header (#11534) (8eeb59c)
  • storage: Return sentinel ErrObjectNotExist for copy and compose (#11369) (74d0c10), refs #10760
  • storage: Wait for XML read req to finish to avoid data races (#11527) (782e12a)

Java

Changes for google-cloud-storage

2.50.0 (2025-03-14)

Features
Bug Fixes
  • deps: Update the Java code generator (gapic-generator-java) to 2.54.0 (22e7e3d)
  • deps: Update the Java code generator (gapic-generator-java) to 2.55.1 (81c8c61)
  • Improve 503 handling for json resumable uploads (#2987) (9bc2b14)
  • Update usages of String.format to explicitly pass Locale.US (#2974) (8bcb2de), closes #2972
Dependencies
  • Update dependency com.google.apis:google-api-services-storage to v1-rev20250224-2.0.0 (#2969) (80a40c4)
  • Update googleapis/sdk-platform-java action to v2.55.1 (#2985) (e22a2de)
  • Update sdk-platform-java dependencies (#2983) (9eeb82a)
  • Update sdk-platform-java dependencies (#2986) (10b922a)

Cloud Storage now offers the DE configurable dual-region code, which can be used when creating a dual-region bucket in europe-west3 (Frankfurt) and europe-west10 (Berlin). To learn more about Cloud Storage configurable dual-regions, see Configurable dual-regions

Compute Engine

Generally available: The A4 accelerator-optimized machine type is now generally available. A4 instances are powered by NVIDIA B200 GPUs and provide up to 3x performance of previous GPU instance types for most GPU accelerated workloads. A4 is especially recommended for ML training workloads at large scales. A4 is available in the a4-highgpu-8g machine type in the us-central1-b zone.

To create A4 instances, you must either use AI Hypercomputer to request capacity and create VMs or clusters, or use Spot VMs. For detailed instructions, see Create an A3 Ultra or A4 VM.

Container Optimized OS

cos-dev-121-18867-0-53

Kernel Docker Containerd GPU Drivers
COS-6.6.74 v27.5.1 v2.0.2 See List

Upgraded app-containers/docker to v27.5.1, Upgraded app-containers/docker-test to v27.5.1, Upgraded app-containers/docker-cli to v27.5.1.

Added support for iRDMA devices.

Applied Intel patches to add iRDMA support in the Linux kernel.

Updated cos-gpu-installer to v2.4.8: Add the -skip-nvidia-smi flag to disable the execution of nvidia-smi verification during gpu driver installation.

Disabled martian logging for ConnectX-7 network cards. These cards only communicate locally, but martian logging during communications with the host can lead to a race condition which causes GID table construction to sometimes fail.

Upgraded net-misc/socat to v1.8.0.3.

Upgraded dev-go/crypto to v0.35.0. This fixes CVE-2025-22869.

Upgraded dev-go/oauth2 to v0.27.0. This fixes CVE-2025-22868.

Upgraded net-misc/openssh to version 9.9_p2. This fixed CVE-2025-26465 and CVE-2025-26466.

Upgrade sys-libs/binutils-libs to 2.44-r1. This fixes CVE-2024-53589.

Upgraded net-misc/wget to version 1.25.0. This fixes CVE-2024-10524.

Upgraded dev-libs/libxml2 to version 1.12.10. This fixes CVE-2025-27113.

Fixed CVE-2024-58017 in the Linux kernel.

Fixed CVE-2025-21745 in the Linux kernel.

Fixed CVE-2025-21814 in the Linux kernel.

Fixed CVE-2024-50017 in the Linux kernel.

Fixed CVE-2024-50146 in the Linux kernel.

Fixed CVE-2024-50304 in the Linux kernel.

Fixed KCTF-8802766 in the Linux kernel.

Fixed KCTF-fcdd224 in the Linux kernel.

Fixed CVE-2024-56549 in the Linux kernel.

Fixed KCTF-638ba50 in the Linux kernel.

Fixed CVE-2024-50014 in the Linux kernel.

Fixed CVE-2024-49994 in the Linux kernel.

Fixed CVE-2025-21690 in the Linux kernel.

Runtime sysctl changes:

  • Changed: fs.file-max: 811788 -> 811701
  • Deleted: net.bridge.bridge-nf-call-arptables: 1
  • Deleted: net.bridge.bridge-nf-call-ip6tables: 1
  • Deleted: net.bridge.bridge-nf-call-iptables: 1
  • Deleted: net.bridge.bridge-nf-filter-pppoe-tagged: 0
  • Deleted: net.bridge.bridge-nf-filter-vlan-tagged: 0
  • Deleted: net.bridge.bridge-nf-pass-vlan-input-dev: 0

cos-beta-121-18867-0-53

Kernel Docker Containerd GPU Drivers
COS-6.6.74 v27.5.1 v2.0.2 See List

Upgraded app-containers/docker to v27.5.1, Upgraded app-containers/docker-test to v27.5.1, Upgraded app-containers/docker-cli to v27.5.1.

Added support for iRDMA devices.

Applied Intel patches to add iRDMA support in the Linux kernel.

Updated cos-gpu-installer to v2.4.8: Add the -skip-nvidia-smi flag to disable the execution of nvidia-smi verification during gpu driver installation.

Disabled martian logging for ConnectX-7 network cards. These cards only communicate locally, but martian logging during communications with the host can lead to a race condition which causes GID table construction to sometimes fail.

Upgraded net-misc/socat to v1.8.0.3.

Upgraded dev-go/crypto to v0.35.0. This fixes CVE-2025-22869.

Upgraded dev-go/oauth2 to v0.27.0. This fixes CVE-2025-22868.

Upgraded net-misc/openssh to version 9.9_p2. This fixed CVE-2025-26465 and CVE-2025-26466.

Upgraded sys-libs/binutils-libs to 2.44-r1. This fixes CVE-2024-53589.

Upgraded net-misc/wget to version 1.25.0. This fixes CVE-2024-10524.

Upgraded dev-libs/libxml2 to version 1.12.10. This fixes CVE-2025-27113.

Fixed CVE-2024-58017 in the Linux kernel.

Fixed CVE-2025-21745 in the Linux kernel.

Fixed CVE-2025-21814 in the Linux kernel.

Fixed CVE-2024-50017 in the Linux kernel.

Fixed CVE-2024-50146 in the Linux kernel.

Fixed CVE-2024-50304 in the Linux kernel.

Fixed KCTF-8802766 in the Linux kernel.

Fixed KCTF-fcdd224 in the Linux kernel.

Fixed CVE-2024-56549 in the Linux kernel.

Fixed KCTF-638ba50 in the Linux kernel.

Fixed CVE-2024-50014 in the Linux kernel.

Fixed CVE-2024-49994 in the Linux kernel.

Fixed CVE-2025-21690 in the Linux kernel.

Runtime sysctl changes:

  • Changed: fs.file-max: 811788 -> 811701
  • Deleted: net.bridge.bridge-nf-call-arptables: 1
  • Deleted: net.bridge.bridge-nf-call-ip6tables: 1
  • Deleted: net.bridge.bridge-nf-call-iptables: 1
  • Deleted: net.bridge.bridge-nf-filter-pppoe-tagged: 0
  • Deleted: net.bridge.bridge-nf-filter-vlan-tagged: 0
  • Deleted: net.bridge.bridge-nf-pass-vlan-input-dev: 0

cos-117-18613-164-81

Kernel Docker Containerd GPU Drivers
COS-6.6.72 v24.0.9 v1.7.24 See List

Added support for NVIDIA 570.124.06 GPU driver. Updated the R570, LATEST GPU driver label to version 570.124.06 for all GPU devices. Updated the DEFAULT GPU driver label to version 570.124.06 for NVIDIA_B200 and NVIDIA_H200 GPU devices.

Added support for iRDMA devices.

Upgraded net-misc/socat to v1.8.0.3.

Fixed CVE-2023-45288 in app-containers/docker.

Fixed CVE-2025-21857 in the Linux kernel.

Fixed CVE-2024-58088 in the Linux kernel.

Fixed CVE-2025-21844 in the Linux kernel.

Fixed CVE-2025-21779 in the Linux kernel.

Fixed CVE-2025-21854 in the Linux kernel.

Fixed CVE-2025-21846 in the Linux kernel.

Fixed CVE-2025-21864 in the Linux kernel.

Fixed CVE-2025-21858 in the Linux kernel.

Fixed CVE-2025-21791 in the Linux kernel.

Fixed CVE-2025-21863 in the Linux kernel.

Fixed CVE-2024-57996 in the Linux kernel.

Fixed CVE-2024-57996 in the Linux kernel.

Fixed CVE-2024-57996 in the Linux kernel.

Fixed CVE-2025-21745 in the Linux kernel.

Fixed CVE-2024-58017 in the Linux kernel.

Fixed CVE-2025-21814 in the Linux kernel.

Runtime sysctl changes:

  • Changed: fs.file-max: 811757 -> 811752

cos-113-18244-291-73

Kernel Docker Containerd GPU Drivers
COS-6.1.123 v24.0.9 v1.7.24 See List

Added support for NVIDIA 570.124.06 GPU driver. Updated the R570, LATEST GPU driver label to version 570.124.06 for all GPU devices. Updated the DEFAULT GPU driver label to version 570.124.06 for NVIDIA_B200 and NVIDIA_H200 GPU devices.

Fixed CVE-2023-45288 in app-containers/docker.

Fixed CVE-2025-21785 in the Linux kernel.

Fixed CVE-2025-21844 in the Linux kernel.

Fixed CVE-2025-21779 in the Linux kernel.

Fixed CVE-2025-21846 in the Linux kernel.

Fixed CVE-2025-21864 in the Linux kernel.

Fixed CVE-2025-21858 in the Linux kernel.

Fixed CVE-2025-21791 in the Linux kernel.

Fixed CVE-2024-26982 in the Linux kernel.

Fixed CVE-2024-57996 in the Linux kernel.

Fixed CVE-2024-57996 in the Linux kernel.

Fixed CVE-2024-57996 in the Linux kernel.

Fixed CVE-2024-58017 in the Linux kernel.

Fixed CVE-2025-21745 in the Linux kernel.

Fixed CVE-2025-21814 in the Linux kernel.

Runtime sysctl changes:

  • Changed: fs.file-max: 812049 -> 812031

cos-105-17412-535-78

Kernel Docker Containerd GPU Drivers
COS-5.15.173 v23.0.3 v1.7.23 See List

Updated the default tag of the GPU driver supporting the NVIDIA H200 GPU device to 570.86.15.

Upgraded gzip to v1.13.

Added support for NVIDIA 570.124.06 GPU driver. Updated the R570, LATEST GPU driver label to version 570.124.06 for all GPU devices. Updated the DEFAULT GPU driver label to version 570.124.06 for NVIDIA_H200 GPU devices.

Updated cos-gpu-installer to v2.4.8: Add the -skip-nvidia-smi flag to disable the execution of nvidia-smi verification during gpu driver installation.

Fixed console TTY leak in runc shim in containerd.

Fixed CVE-2023-45288 in app-containers/docker.

Upgraded dev-go/crypto to v0.35.0. This fixes CVE-2025-22869.

Fixed CVE-2025-26465 and CVE-2025-26466 in net-misc/openssh.

Fixed CVE-2024-53589 in sys-libs/libutils-libs.

Upgraded net-misc/wget to version 1.25.0. This fixes CVE-2024-10524.

Upgraded dev-libs/libxml2 to version 1.12.10. This fixes CVE-2024-56171, CVE-2025-27113 and CVE-2025-24928.

Fixed CVE-2024-26982 in the Linux kernel.

Fixed CVE-2024-57946 in the Linux kernel.

Runtime sysctl changes:

  • Changed: fs.file-max: 812677 -> 812699

cos-109-17800-436-64

Kernel Docker Containerd GPU Drivers
COS-6.1.124 v24.0.9 v1.7.24 See List

Fixed CVE-2025-21814 in the Linux kernel.

Fixed CVE-2024-58017 in the Linux kernel.

Fixed CVE-2025-21745 in the Linux kernel.

Runtime sysctl changes:

  • Changed: fs.file-max: 812157 -> 812258

Data Catalog

Data Catalog is available in the europe-north2 (Stockholm) region.

Dataflow

A weekly digest of client library updates from across the Cloud SDK.

Go

Changes for dataflow/apiv1beta3

0.10.5 (2025-03-13)

Bug Fixes
  • dataflow: Update golang.org/x/net to 0.37.0 (1144978)
Dataplex

Dataplex and data lineage are available in the europe-north2 (Stockholm) region.

Dataproc

New Dataproc on Compute Engine subminor image versions:

  • 2.0.136-debian10, 2.0.136-rocky8, 2.0.136-ubuntu18
  • 2.1.84-debian11, 2.1.84-rocky8, 2.1.84-ubuntu20, 2.1.84-ubuntu20-arm
  • 2.2.50-debian12, 2.2.50-rocky9, 2.2.50-ubuntu22

Dataproc on Compute Engine: Spark upgraded to version 3.5.3 in the latest Dataproc image version 2.2.

Dataproc on Compute Engine: The latest Dataproc 2.2 image version now supports Spark data lineage.

Dataproc on Compute Engine: Added support for Enhanced Flexibility Mode (EFM) with primary worker shuffle mode on Spark for image version 2.2.50 and above.

Eventarc

Eventarc Standard is available in the europe-north2 (Stockholm, Sweden) region.

Generative AI on Vertex AI

Mistral Small 3.1 (25.03) feature multimodal capabilities and a context of up to 128,000 tokens. For more information, see the Mistral Small 3.1 (25.03) model card in Model Garden.

Looker

The following features have been added to Studio in Looker, which is available in preview:

  • If Studio in Looker is disabled and then re-enabled, reports that had been saved within the previous 30 days will still be available. Recovered reports may appear in the Recovered reports folder after an admin re-enables Studio in Looker.
  • The Looker Search function will include reports.
  • The Looker Trash folder will now contain deleted reports, and Looker admins can restore previously deleted reports.
  • The ability to set an instance or a group locale for Studio in Looker.
  • Looker admins can manage the data source connectors that are available in Studio in Looker.

Note: This item was updated on March 19, 2025.

Looker Studio

Looker connector enhancements

More Looker permissions have been propagated to Looker Studio and can now be granted to Looker Studio Pro users to perform the following the tasks on Looker Studio reports that are built with the Looker connector:

Scheduling report deliveries Create alerts Download and export chart and report data

Learn more about permissions to use the Looker connector.

Pub/Sub

A weekly digest of client library updates from across the Cloud SDK.

Go

Changes for pubsub/apiv1

1.48.0 (2025-03-12)

Features
  • pubsub/pstest: Support listening on custom address (#11606) (63865a2)
  • pubsub: Add support for message transforms to Topic and Subscription (59fe58a)
  • pubsub: Deprecate enabled field for message transforms and add disabled field (dd0d1d7)
Documentation
  • pubsub: A comment for field code in message .google.pubsub.v1.JavaScriptUDF is changed (#11553) (678944b)
  • pubsub: Deprecate enabled field for message transforms and add disabled field (dd0d1d7)
  • pubsub: Fix link for AnalyticsHubSubscriptionInfo (59fe58a)

Java

Changes for google-cloud-pubsub

1.138.0 (2025-03-14)

Features
  • Deprecate enabled field for message transforms and add disabled field (76b2a3d)
  • Next release from main branch is 1.138.0 (#2361) (b6ba56c)
Bug Fixes
  • deps: Update the Java code generator (gapic-generator-java) to 2.55.1 (76b2a3d)
  • Prevent excessive string parsing when publishing and receiving messages to improve performance (#2317) (07b1350)
Dependencies
  • Update dependency com.google.cloud:google-cloud-bigquery to v2.48.1 (#2356) (7d3d2e4)
  • Update dependency com.google.cloud:google-cloud-storage to v2.49.0 (#2358) (81d3435)
  • Update dependency com.google.cloud:sdk-platform-java-config to v3.45.1 (#2366) (15899d1)
  • Update googleapis/sdk-platform-java action to v2.55.1 (#2367) (de6f84a)
Resource Manager

You can enforce mandatory tags on resources using custom organization policies. When a user attempts to create a resource, the system checks for the presence of the mandatory tags. If any mandatory tag is missing or does not have a value, the resource creation is blocked. By defining mandatory tags within an organization policy, you can ensure that all newly created resources adhere to your organization's tagging standards. This feature is available in Preview.

For more information, see Enforcing mandatory tags on resources.

Secret Manager

A weekly digest of client library updates from across the Cloud SDK.

Go

Changes for secretmanager/apiv1

1.14.6 (2025-03-13)

Bug Fixes
  • secretmanager: Update golang.org/x/net to 0.37.0 (1144978)
Spanner

You can now create an external dataset in BigQuery that links to an existing database in Spanner. This feature is generally available (GA).

Text-to-Speech

Chirp 3: HD voices are only available in the global, us, eu, and asia-southeast1 regions. To use these voices, switch your endpoint to a supported region.

Workload Manager

Generally available: Workload Manager supports deploying Microsoft SQL Server workloads on Google Cloud. You can configure and deploy a SQL Server system using the Guided Deployment Automation tool in Workload Manager. For more information, see Overview of SQL Server deployment.

Workload Manager supports the following features when you deploy SAP S/4HANA workloads on Google Cloud:

  • Deploy SAP S/4HANA workloads on X4 instances.
  • Customize the names of application server VMs.
  • Specify network tags for the deployed instances.
  • Skip the creation of automatic firewall rules.
  • Skip the DNS configuration.
  • Choose an existing NFS shared storage.
  • Specify a service account to be attached to instances for each layer of the deployment.

For more information, see Deploy an SAP S/4HANA application

March 16, 2025

Google SecOps

Remote agent high availability

This feature is currently in preview.

Remote agents can now leverage high availability deployment, ensuring increased reliability for remote connectors, actions, and jobs.

This feature also introduces a new cloud-based remote connector scheduler for improved performance and scalability.

For more information, see Deploy high availability in remote agents.

Remote agent downtime notifications

Customers using remote agents can now opt in to receive in-app or email notifications when the agent is down.

Pause or resume Case SLA

Users can now pause and resume service level agreement (SLA) timers on cases.

For more information, see Pause and resume a case SLA.

Google SecOps SOAR

Release 6.3.38 is now in General Availability.

Theme enhancement for SOAR platform

The header and left hand navigation menu now fully reflect the selected theme. If you select the light theme, both the header and side menu will also appear in light mode. This might impact customers who are using the rebranding feature. We recommend taking a look at your logo in the light mode before we roll out and making any necessary changes.

This change will be rolled out to the first regional wave on March 23, 2025.

March 15, 2025

Cloud Composer

The Custom constraints with Organization Policy feature is now generally available (GA).

This feature provides more granular control over Cloud Composer environment configuration fields. You can use custom organization policies to allow or deny specific configuration values for Cloud Composer environments.

Google SecOps SOAR

Release 6.3.39 is being rolled out to the first wave of regions as listed here. This release includes the following features.

Remote agent high availability

This feature is currently in preview.

Remote agents can now leverage high availability deployment, ensuring increased reliability for remote connectors, actions, and jobs.

This feature also introduces a new cloud-based remote connector scheduler for improved performance and scalability.

For more information, see Deploy high availability in remote agents.

Remote agent downtime notifications

Customers using remote agents can now opt in to receive in-app or email notifications when the agent is down.

Pause or resume Case SLA

Users can now pause and resume service level agreement (SLA) timers on cases.

For more information, see Pause and resume a case SLA.

March 14, 2025

Access Approval

Access Approval supports Access Transparency in the GA stage.

Access Transparency

Access Transparency supports Access Transparency in the GA stage.

Agent Assist

Agent Assist offers a new version of summarization with custom sections in preview. Summarization with custom sections V4.0 uses gemini-2.0-flash and supports concise summary for situation and action.

Apigee UI

On March 14, 2025, we released an updated version of the Apigee UI.

Bug ID Description
401574741 Fixed issue with loading API resource and path configurations when opening the Product detail pages of legacy API products.

API resources and paths are now properly populated and applied when viewing the Product detail pages for legacy API products in the Apigee UI.

App Hub

App Hub supports resources from the following sources in Preview:

  • AlloyDB for PostgreSQL
  • Cloud Data Fusion
  • Cloud Deploy
  • Cloud Logging
  • Cloud Run jobs
  • Firestore
  • Google Kubernetes Engine (GKE) workloads
  • GKE single cluster Gateway
  • Managed Service for Microsoft Active Directory
  • Secret Manager
  • Vertex AI

Artifact Registry

Artifact Registry remote repositories and virtual repositories for Go are now Generally Available. To learn more about Go format repositories, read Work with Go modules.

Security Command Center ingests Artifact Analysis scanning findings from images scanned in Artifact Registry and deployed to supported runtimes.

In Security Command Center, you can view container image vulnerabilities within your running workloads across all projects alongside your other security risks in. You can also export these findings to BigQuery for in-depth analysis and long-term storage. This feature is in Preview. For more information, see vulnerability assessment.

Carbon Footprint

An issue resulting in unusually high emissions data for the service Identity Platform has been resolved. This affected some customers in their January 2025 data and was caused by an incorrect internal resource mapping for Identity Platform.

To correct your January emissions data, schedule a manual data backfill for the month. Note that there is a half-month lag of our data release. For example, to backfill January 2025 data, run the backfill for February 15, 2025, which will update the data for January 2025 in your BigQuery table.

Updated carbon model to version 13 to reflect the above-mentioned fixes.

Cloud Composer

March 18, 2025 update: The issue is resolved.

Some upgrade operations for Cloud Composer 2 might lead to unhealthy environments. That is why upgrades for Cloud Composer 2 versions will be blocked until the issue is fully resolved.

Cloud Database Migration Service

Database Migration Service now supports MySQL minor version 8.0.41 for homogeneous MySQL migrations. For more information, see Supported source and destination databases in Cloud SQL for MySQL migrations.

Cloud SQL for SQL Server Compute Engine

Generally available: The Create an instance page in the Google Cloud console has a Data protection pane where you can specify how to back up and replicate your data. For more information, see Configuration options during instance creation and Data protection options.

Generally available: Memory-optimized M4 VMs are now generally available. M4 3T VMs run on Intel's 5th generation Emerald Rapids CPU. They offer up to 224 vCPUs with up to 3 TB of memory.

M4 is available in five predefined machine types. The megamem VMs have a GB/vCPU ratio of 13.29:1 and the ultramem VMs have a GB/vCPU ratio of 25.57:1.

Dataproc Dialogflow

Dialogflow CX (Conversational Agents): Customer-managed encryption keys (CMEK) is now a GA feature.

Generative AI on Vertex AI Google Kubernetes Engine

JobSet metrics are automatically available on new GKE Standard and Autopilot clusters starting from version 1.32.1-gke.1357001 or later. For existing clusters, you can upgrade your clusters and manually enable the JobSet metrics package. For more details on the list of JobSet metrics, see JobSet metrics.

Resource Manager

Custom organization policies are now generally available for Cloud Composer. For more information, see Create custom organization policy constraints.

SAP on Google Cloud

New SAP certifications: M4 series of memory-optimized machine types

For use with SAP HANA scale-up (OLAP and OLTP) and SAP NetWeaver workloads, SAP has certified the Compute Engine memory-optimized M4 series machine types with the Intel Emerald Rapids CPU platform.

For more information, see:

Security Command Center

The Execution: Malicious Python Executed detector in Container Threat Detection released to General Availability.

The following Event Threat Detection rules for Google Kubernetes Engine have been released to General Availability:

  • GKE_NODEPORT_SERVICE_CREATED
  • GKE_SENSITIVE_NAMESPACE_WORKLOAD_TRIGGERED
  • GKE_STATIC_POD_CREATED
  • GKE_TOR_PROXY_IP_REQUEST
  • GKE_WEBHOOK_CONFIG_CREATED
  • YL2_GKE_ANONYMOUS_USERS_GRANTED_ACCESS
  • YL2_GKE_APPROVE_CSR_FORBIDDEN
  • YL2_GKE_CRB_CLUSTERROLE_AGGREGATION_CONTROLLER
  • YL2_GKE_MANUALLY_DELETED_CSR
  • YL2_GKE_POD_MASQUERADING
  • YL2_GKE_REVERSE_SHELL_POD
  • YL2_GKE_SERVICE_ACCOUNT_CREATION_SENSITIVE_NAMESPACE
  • YL2_GKE_SUSPICIOUS_CRYPTOMINING_POD

March 13, 2025

BigQuery

You can now use Gemini Cloud Assist chat to generate SQL queries and Python code. This feature is in preview.

Cloud Asset Inventory

The following resource types are now publicly available through the ExportAssets, ListAssets, BatchGetAssetsHistory, QueryAssets, Feed, and Search (SearchAllResources, SearchAllIamPolicies).

  • Storage Transfer Service
    • storagetransfer.googleapis.com/TransferJob
Cloud Billing

Improved consistency in resource-based committed use discount (CUD) string names across experiences.

We have improved consistency by standardizing CUD string names across the various experiences. This update helps provide a seamless experience in resource-based CUD purchase flows, recommendations, analysis, and the FinOps hub.

Cloud Logging

App Hub application labels are now attached to your log entries. The Log Fields pane of the Logs Explorer now includes facets for application, service, and workload labels. For more information, see Log Fields pane.

Cloud Monitoring

Documentation for Slack notification channels now supports Markdown. For more information, see Annotate notifications with user-defined documentation.

You can now see changes made to a dashboard by viewing the version history. For more information, see View dashboard version history.

Cloud Storage

Anywhere Cache for Cloud Storage is now generally available (GA). Anywhere Cache enables you to create SSD-backed caches in the same zones as your workloads, helping you get access to your data faster and avoid multi-region data transfer fees. To learn more about Anywhere Cache, see Overview of Anywhere Cache.

Dataflow

Dataflow now supports data lineage. Data lineage lets you track how data moves through your systems. This feature is generally available (GA). For more information, see Use data lineage in Dataflow.

Dataplex

Data lineage for Dataflow is generally available (GA). For more information, see Use data lineage in Dataflow.

Generative AI on Vertex AI

Context caching for Gemini on Vertex AI is generally available (GA).

Google Cloud Marketplace Partners

To improve data quality, we've updated the data source for the domain field in the detailed disbursement and insights reports.

Google Distributed Cloud (software only) for VMware

Google Distributed Cloud (software only) for VMware 1.30.700-gke.56 is now available for download. To upgrade, see Upgrade a cluster or a node pool. Google Distributed Cloud 1.30.700-gke.56 runs on Kubernetes v1.30.9-gke.500.

If you are using a third-party storage vendor, check the GDC Ready storage partners document to make sure the storage vendor has already passed the qualification for this release.

After a release, it takes approximately 7 to 14 days for the version to become available for use with GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

The 1.30.700-gke.56 release includes many vulnerability fixes. For a list of all vulnerabilities fixed in this release, see Vulnerability fixes.

Google Distributed Cloud (software only) for bare metal

Release 1.30.700-gke.56

Google Distributed Cloud for bare metal 1.30.700-gke.56 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.30.700-gke.56 runs on Kubernetes v1.30.9-gke.100.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

The following issue is fixed in 1.30.700-gke.56:

  • Fixed an issue where node upgrades failed due to missing super-admin.conf file.

The 1.30.700-gke.56 release includes many vulnerability fixes. For a list of all vulnerabilities fixed in this release, see Vulnerability fixes.

For information about the latest known issues, see Google Distributed Cloud for bare metal known issues in the Troubleshooting section.

Looker Studio

Looker Gemini permission now enforced

The gemini_in_looker Looker permission, available only in the Looker Gemini role, is now being enforced in Looker. This permission is required to use Conversational Analytics.

Learn more about Gemini in Looker.

Improved event logging for Looker-based reports

When data is downloaded or exported from a Looker Studio report that uses at least one Looker data source, the connector type for all charts in the report will be included in the Looker Studio audit log.

Learn more about Looker Studio log events (opens in the Google Workspace Help Center).

Security Command Center

Security Command Center has released the Artifact Registry vulnerability assessment detection service, which includes the CONTAINER_IMAGE_VULNERABILITY detector. This detector generates vulnerability findings for container images that are stored and scanned in Artifact Registry. The detector generates findings for vulnerable container images deployed to the following assets:

  • Google Kubernetes Engine cluster
  • Cloud Run revision
  • Cloud Run job
  • App Engine

This feature is available in Preview to all Security Command Center tiers.

March 12, 2025

AlloyDB for PostgreSQL

You can automatically create CMEKs using Cloud KMS Autokey to protect your AlloyDB resources. This feature is generally available (GA).

Apigee UI

On March 12, 2025, we released an updated version of the Apigee UI.

With this release, the Filter display name for the proxy field in the Custom reports page of the Apigee UI in Cloud console is changed to Proxy Endpoint.

This change should help users differentiate between Proxy and Proxy Endpoint values when configuring filters for custom reports using Apigee API Analytics.

For more information, see Creating and managing custom reports.

Apigee X

On March 12, 2025, we released an updated version of Apigee (1-15-0-apigee-1).

Bug ID Description
396944778 Security fix for Apigee infrastructure.
This addresses the following vulnerabilities:

The Nimbus JOSE + JWT library may cause a java.lang.ClassCircularityError when using a JavaCallout policy.

For more information, see Apigee known issues.

Bug ID Description
N/A Updates to security infrastructure and libraries.
Apigee hybrid

v1.13.3 , v1.14.1, v1.12.4

The Nimbus JOSE + JWT library may cause a java.lang.ClassCircularityError when using a JavaCallout policy.

For more information, see Apigee known issues.

BigQuery

You can configure reusable, default Cloud resource connections in a project. Default connections are available in Preview.

An updated version of ODBC driver for BigQuery is now available.

Cloud Asset Inventory

The following resource types are now publicly available through the ExportAssets, ListAssets, BatchGetAssetsHistory, QueryAssets, Feed, and Search (SearchAllResources, SearchAllIamPolicies).

  • GKE On-Prem API
    • gkeonprem.googleapis.com/BareMetalCluster
    • gkeonprem.googleapis.com/BareMetalNodePool
    • gkeonprem.googleapis.com/VmwareCluster
    • gkeonprem.googleapis.com/VmwareNodePool
Cloud Logging

You can now use the Observability API to set the default log scope. This feature is in Public Preview. For more information, see the following documents:

Cloud Service Mesh

The rollout of managed Cloud Service Mesh version 1.20 to the rapid channel has completed.

Container Optimized OS

cos-117-18613-164-68

Kernel Docker Containerd GPU Drivers
COS-6.6.72 v24.0.9 v1.7.24 See List

Applied Intel patches to add iRDMA support in the Linux kernel.

Updated cos-gpu-installer to v2.4.8: Add the -skip-nvidia-smi flag to disable the execution of nvidia-smi verification during gpu driver installation.

Disabled martian logging for ConnectX-7 network cards. These cards only communicate locally, but martian logging during communications with the host can lead to a race condition which causes GID table construction to sometimes fail.

Fixed console TTY leak in runc shim in containerd.

Upgraded sys-apps/which to v2.23.

Upgraded sys-apps/diffutils to v3.11-r1.

Upgraded dev-go/crypto to v0.35.0. This fixes CVE-2025-22869.

Updated dev-go/oauth2 to v0.27.0. This fixes CVE-2025-22868.

Fixed CVE-2025-26465 and CVE-2025-26466 in net-misc/openssh.

Fixed CVE-2024-53589 in sys-libs/libutils-libs.

Upgraded net-misc/wget to v1.25.0. This fixes CVE-2024-10524.

Upgraded dev-libs/libxml2 to v1.12.10. This fixes CVE-2025-27113.

Fixed KCTF-8802766 in the Linux kernel.

Fixed CVE-2024-50017 in the Linux kernel.

Fixed KCTF-fcdd224 in the Linux kernel.

Fixed CVE-2024-50146 in the Linux kernel.

Fixed KCTF-638ba50 in the Linux kernel.

Runtime sysctl changes:

  • Changed: fs.file-max: 811762 -> 811757

cos-109-17800-436-60

Kernel Docker Containerd GPU Drivers
COS-6.1.124 v24.0.9 v1.7.24 See List

Updated gzip to v1.13.

Updated google.golang.org/grpc to v1.56.3 and upgrade golang.org/x/net to v0.23.0 in docker and cri-tools. This fixes CVE-2023-44487 and CVE-2023-45288.

Fixed console TTY leak in runc shim in containerd.

Upgraded dev-go/crypto to v0.35.0. This fixes CVE-2025-22869.

Fixed CVE-2025-26465 and CVE-2025-26466 in net-misc/openssh.

Fixed CVE-2024-53589 in sys-libs/libutils-libs.

Upgraded net-misc/wget to v1.25.0. This fixes CVE-2024-10524.

Upgraded dev-libs/libxml2 to v1.12.10. This fixes CVE-2024-56171, CVE-2025-27113 and CVE-2025-24928.

Fixed KCTF-638ba50 in the Linux kernel.

Runtime sysctl changes:

  • Changed: fs.file-max: 812266 -> 812157

cos-113-18244-291-63

Kernel Docker Containerd GPU Drivers
COS-6.1.123 v24.0.9 v1.7.24 See List

Fixed console TTY leak in runc shim in containerd.

Upgraded dev-go/crypto to v0.35.0. This fixes CVE-2025-22869.

Fixed CVE-2025-26465 and CVE-2025-26466 in net-misc/openssh.

Fixed CVE-2024-53589 in sys-libs/libutils-libs.

Upgraded net-misc/wget to v1.25.0. This fixes CVE-2024-10524.

Upgraded dev-libs/libxml2 to v1.12.10. This fixes CVE-2025-27113.

Runtime sysctl changes:

  • Changed: fs.file-max: 812054 -> 812049

Deep Learning Containers

M128 release

  • Except for TensorFlow container images, new container images don't include conda. This change was made to improve size, performance, and vulnerability management. The existing container image names now point to container images that don't include conda (for example: gcr.io/deeplearning-platform-release/base-cpu.py310).
  • Container images that include conda will be available until at least September 30, 2025. These container images now have -conda appended to the name (for example: gcr.io/deeplearning-platform-release/base-cpu-conda.py310).
  • All TensorFlow container images still include conda, but M128 container image names have -conda appended. Specifying container images without -conda appended references older container images, which also include conda.
Deep Learning VM Images

M128 release

  • Except for TensorFlow images, new images don't include conda. This change was made to improve size, performance, and vulnerability management. The existing image names and image family names now point to images and image families that don't include conda (for example: the image name common-cpu-v20250310-debian-11-py310 and corresponding image family name common-cpu-debian-11-py310).
  • Images that include conda will be available until at least September 30, 2025. These images now have -conda appended to the name (for example: the image name common-cpu-v20250310-debian-11-py310-conda and corresponding image family name common-cpu-debian-11-py310-conda).
  • All TensorFlow images and image families still include conda, but M128 image names and image family names have -conda appended. Specifying images or image families without -conda appended references older images, which also include conda.
Gemini Code Assist

Gemini Code Assist now supports data residency at rest. Data residency meets compliance and regulatory requirements by allowing you to specify the geographic locations (regions) where Gemini Code Assist data is stored.

You can now use code customization for Gemini Code Assist Enterprise with VPC Service Controls. This allows secure access to on-premises source control systems. For more information, see Configure VPC Service Controls for Gemini.

Generative AI on Vertex AI

Model Garden fine tuning updates:

Google Kubernetes Engine

(2025-R10) Version updates

GKE cluster versions have been updated.

New versions available for upgrades and new clusters.

The following Kubernetes versions are now available for new clusters and for opt-in control plane upgrades and node upgrades for existing clusters. For more information on versioning and upgrades, see GKE versioning and support and Upgrades.

Rapid channel

  • Version 1.32.2-gke.1182000 is now the default version for cluster creation in the Rapid channel.
  • The following versions are now available in the Rapid channel:
  • The following versions are no longer available in the Rapid channel:
    • 1.29.14-gke.1018000
    • 1.30.10-gke.1022000
    • 1.31.6-gke.1020000
    • 1.32.1-gke.1357001
    • 1.32.1-gke.1729000
    • 1.32.2-gke.1297000
  • Auto-upgrade targets are now available for the following minor versions:
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.28 to version 1.29.14-gke.1067000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.29 to version 1.30.10-gke.1070000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.30 to version 1.31.6-gke.1064000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.31 to version 1.32.2-gke.1182000 with this release.
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.29 to version 1.29.14-gke.1067000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.30 to version 1.30.10-gke.1070000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.31 to version 1.31.6-gke.1064000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.32 to version 1.32.2-gke.1182000 with this release.

Regular channel

  • Version 1.31.6-gke.1020000 is now the default version for cluster creation in the Regular channel.
  • The following versions are now available in the Regular channel:
  • The following versions are no longer available in the Regular channel:
    • 1.29.13-gke.1169000
    • 1.30.9-gke.1201000
    • 1.31.5-gke.1233000
  • Auto-upgrade targets are now available for the following minor versions:
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.28 to version 1.29.14-gke.1018000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.29 to version 1.30.10-gke.1022000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.30 to version 1.31.6-gke.1020000 with this release.
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.29 to version 1.29.14-gke.1018000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.30 to version 1.30.10-gke.1022000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.31 to version 1.31.6-gke.1020000 with this release.

Stable channel

  • Version 1.30.9-gke.1127000 is now the default version for cluster creation in the Stable channel.
  • The following versions are now available in the Stable channel:
  • The following versions are no longer available in the Stable channel:
    • 1.30.9-gke.1046000
    • 1.31.5-gke.1068000
  • Auto-upgrade targets are now available for the following minor versions:
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.29 to version 1.30.9-gke.1127000 with this release.
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.30 to version 1.30.9-gke.1127000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.31 to version 1.31.5-gke.1169000 with this release.

Extended channel

  • Version 1.31.6-gke.1020000 is now the default version for cluster creation in the Extended channel.
  • The following versions are now available in the Extended channel:
  • The following versions are no longer available in the Extended channel:
    • 1.27.16-gke.2270000
    • 1.27.16-gke.2489000
    • 1.28.15-gke.1781000
    • 1.28.15-gke.1897000
    • 1.29.13-gke.1169000
    • 1.30.9-gke.1201000
    • 1.31.5-gke.1233000
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.27 to version 1.27.16-gke.2451000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.28 to version 1.28.15-gke.1844000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.29 to version 1.29.14-gke.1018000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.30 to version 1.30.10-gke.1022000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.31 to version 1.31.6-gke.1020000 with this release.

No channel

(2025-R10) Version updates

  • Version 1.32.2-gke.1182000 is now the default version for cluster creation in the Rapid channel.
  • The following versions are now available in the Rapid channel:
  • The following versions are no longer available in the Rapid channel:
    • 1.29.14-gke.1018000
    • 1.30.10-gke.1022000
    • 1.31.6-gke.1020000
    • 1.32.1-gke.1357001
    • 1.32.1-gke.1729000
    • 1.32.2-gke.1297000
  • Auto-upgrade targets are now available for the following minor versions:
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.28 to version 1.29.14-gke.1067000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.29 to version 1.30.10-gke.1070000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.30 to version 1.31.6-gke.1064000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.31 to version 1.32.2-gke.1182000 with this release.
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.29 to version 1.29.14-gke.1067000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.30 to version 1.30.10-gke.1070000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.31 to version 1.31.6-gke.1064000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.32 to version 1.32.2-gke.1182000 with this release.

(2025-R10) Version updates

  • Version 1.31.6-gke.1020000 is now the default version for cluster creation in the Regular channel.
  • The following versions are now available in the Regular channel:
  • The following versions are no longer available in the Regular channel:
    • 1.29.13-gke.1169000
    • 1.30.9-gke.1201000
    • 1.31.5-gke.1233000
  • Auto-upgrade targets are now available for the following minor versions:
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.28 to version 1.29.14-gke.1018000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.29 to version 1.30.10-gke.1022000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.30 to version 1.31.6-gke.1020000 with this release.
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.29 to version 1.29.14-gke.1018000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.30 to version 1.30.10-gke.1022000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.31 to version 1.31.6-gke.1020000 with this release.

(2025-R10) Version updates

  • Version 1.30.9-gke.1127000 is now the default version for cluster creation in the Stable channel.
  • The following versions are now available in the Stable channel:
  • The following versions are no longer available in the Stable channel:
    • 1.30.9-gke.1046000
    • 1.31.5-gke.1068000
  • Auto-upgrade targets are now available for the following minor versions:
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.29 to version 1.30.9-gke.1127000 with this release.
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.30 to version 1.30.9-gke.1127000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.31 to version 1.31.5-gke.1169000 with this release.

(2025-R10) Version updates

  • Version 1.31.6-gke.1020000 is now the default version for cluster creation in the Extended channel.
  • The following versions are now available in the Extended channel:
  • The following versions are no longer available in the Extended channel:
    • 1.27.16-gke.2270000
    • 1.27.16-gke.2489000
    • 1.28.15-gke.1781000
    • 1.28.15-gke.1897000
    • 1.29.13-gke.1169000
    • 1.30.9-gke.1201000
    • 1.31.5-gke.1233000
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.27 to version 1.27.16-gke.2451000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.28 to version 1.28.15-gke.1844000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.29 to version 1.29.14-gke.1018000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.30 to version 1.30.10-gke.1022000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.31 to version 1.31.6-gke.1020000 with this release.

(2025-R10) Version updates

Looker

Looker 25.4 is expected to include the following changes, features, and fixes:

  • Expected Looker (original) deployment start: Monday, March 17, 2025

  • Expected Looker (original) final deployment and download available: Thursday, March 27, 2025

  • Expected Looker (Google Cloud core) deployment start: Monday, March 17, 2025

  • Expected Looker (Google Cloud core) final deployment: Monday, March 31, 2025

The gemini_in_looker permission, available only in the Looker Gemini role, is now being enforced at the Looker instance level. This permission is required for any Looker user who will be using Gemini assistance to perform the following tasks:

Use of Conversational Analytics in Looker no longer requires Studio in Looker to be enabled for the Looker instance. Gemini in Looker enablement is still required. Admins must disable and then re-enable Gemini in Looker to access Conversational Analytics. Note: This release note was added on March 18, 2025.

By default, Looker connects to your database using the latest version of the JDBC driver for your database dialect. If your selected database dialect has more than one JDBC driver version that is supported by Looker, you can now select an earlier version of the JDBC driver for your dialect. See the Connecting Looker to your database documentation page for more information.

The Open SQL Interface feature now supports Explores that use the conditionally_filters parameter. Previously disabled Explores are now enabled.

The Chart Config Editor now supports dynamic annotations. Use the annotationsSource and annotationsTarget parameters to use data from a field as an annotation on a visualization.

Looker now supports key-pair authentication for Snowflake connections. Note: This feature is not currently available but will be available later in the release cycle (early April 2025).

An issue has been fixed where deployed LookML could still appear on the Uncommitted Changes pages. This feature now performs as expected.

An issue has been fixed where the PDT Activity Dashboard would only include one model that the PDT is included in. This feature now performs as expected.

An issue has been fixed where the text for the Query Tracker was misaligned in German. This feature now performs as expected.

An issue has been fixed where circular references in Liquid could cause the LookML validator to crash. This feature now performs as expected.

An issue has been fixed where an unspecified 'hidden' attribute could cause the LookML validator to crash if localization was enabled. This feature now performs as expected.

An issue has been fixed where some schedules did not appear in the User Schedules page. This feature now performs as expected.

An issue has been fixed where Liquid references to parameters required view scoping even if the parameter was defined in the same view file. This feature now performs as expected.

An issue has been fixed where downloading a dashboard with a radial chart with no data as a PDF in the French locale could cause a rendering failure. This feature now performs as expected.

An issue has been fixed where using the legacy dashboards-next URL path for an embedded dashboard could cause a blank screen. This feature now performs as expected.

An issue has been fixed where the Explore page could crash while using Google Chrome. This feature now performs as expected.

An issue has been fixed where dashboard filters could not be saved if two or more filters shared a name. This feature now performs as expected.

An issue has been fixed where Snowflake connection certificates in the .p12 file format were not accepted. This feature now performs as expected.

When you change the sorting type or direction for folder contents, Looker now brings you to the first page of results. This feature now performs as expected.

An issue has been fixed where selecting "Sort by Favorited Date" in a folder would sort incorrectly. This feature now performs as expected.

An issue has been fixed where users with different "bqserviceaccount" user attribute values could access the same cached results. This feature now performs as expected.

The Content Validator scoping feature is now out of Labs and generally available. This feature allows developers to scope the validation to specific LookML projects and a specific content folder (including its subfolders, if any). This can improve the performance of the Content Validator.

The New Database Connection Setup feature is now out of Labs and generally available. This feature updates the Add/Edit Connection page with a modernized UI, enhanced validation, connection testing capabilities, and a comprehensive configuration summary. If you want to revert to the legacy connections workflow, you can enable the Use Legacy Connections Page legacy toggle. Note: This item was updated on March 17, 2025.

A new Labs feature, Fast Dev Mode Transition, improves the performance of Development Mode on your instance by loading LookML projects in read-only mode until a developer clicks the Create Developer Copy button for the project.

Looker (Google Cloud core) instances now support the Admin via IAM Looker role. This role has full administrative privileges within a Looker (Google Cloud core) instance, but it's managed exclusively through Identity and Access Management (IAM), providing a direct sync between a principal's Looker Admin IAM role and admin privileges within the instance.

The Content Validator scoping feature is now generally available. This feature allows developers to scope the validation to specific LookML projects and a specific content folder (including its subfolders, if any). This can improve the performance of the Content Validator.

The Add/Edit Connection page is updated with a modernized UI, enhanced validation, connection testing capabilities, and a comprehensive configuration summary.

Migrate to Virtual Machines

Experimental: Migrate to Virtual Machines now supports the migration of VM instances running Amazon Linux 2 to Rocky Linux 8 as part of an open access experimental program. In order to migrate a VM running Amazon Linux 2, Migrate to Virtual Machines first converts Amazon Linux 2 to Rocky Linux 8, and then completes the migration.

Vertex AI Workbench

M128 release

The M128 release of Vertex AI Workbench user-managed notebooks includes the following:

  • Miscellaneous package updates.

The M128 release of Vertex AI Workbench managed notebooks includes the following:

  • Miscellaneous package updates.

M128 release

The M128 release of Vertex AI Workbench instances includes the following:

  • Miscellaneous package updates.

March 11, 2025

Apigee Integrated Portal

On March 11, 2025 we released a new version of the Apigee integrated portal.

Bug ID Description
380076166 For an app in a portal, the status for each key will now show approved, revoked, partially approved or inactive based on the approval status of all the API products on that key (or if the key has been revoked). Additionally, the status of an API Product for an app will show approved, partially approved, or pending approval based on the approval status for all keys associated to that API product. If a key is revoked, it will not effect the approval status of the API product.
Bigtable

You can use Cloud KMS Autokey to automate the creation and use of customer-managed encryption keys (CMEK) in Bigtable clusters. This feature is generally available (GA).

Data lineage for Dataflow jobs is generally available (GA) in the Bigtable Beam connector (BigtableIO) and the Bigtable HBase Beam connector (CloudBigtableIO). For more information, see Tracking lineage.

Cloud Composer

(Cloud Composer 3) Validation error messages now use the correct format for image versions.

New Airflow builds are available in Cloud Composer 3:

  • composer-3-airflow-2.10.2-build.11 (default)
  • composer-3-airflow-2.9.3-build.18

New images are available in Cloud Composer 2:

  • composer-2.11.5-airflow-2.10.2 (default)
  • composer-2.11.5-airflow-2.9.3
Cloud Logging

The API to create and manage Log Scopes is now Generally Available (GA). You can create and manage log scopes by using the Cloud Console, the Google Cloud CLI, and Terraform. For more information, see Create and manage log scopes.

Cloud Run

A new region is now available for Cloud Run GPUs: europe-west1.

Dialogflow

Dialogflow CX (Conversational Agents) generators: Model gemini-2.0-flash-001 is now a GA feature available in the following regions: global, us, us-central1, us-east1, us-west1, europe-west1, europe-west4.

Dialogflow CX (Conversational Agents) data store handlers: Model gemini-2.0-flash-lite-001 is now a Preview feature available in the following regions: global, us, us-central1, us-east1, us-west1, europe-west1, europe-west4.

Generative AI on Vertex AI

Gemini 2.0 Flash Tuning

Gemini 2.0 Flash fine-tuning is now generally available (GA).

Added support for tuning function calling.

Google SecOps

Within Curated Detections, the following rules have been added to the Cloud Hacktool rule pack for Google Cloud data in the "Broad" category. These rules are intended to detect the behavior of common open source hacktools.

  • Collection: Set GCP Cloud Storage Bucket to Public
  • Discovery: Cloud Run Enumeration
  • Discovery: CloudFunctions Enumeration of GCP Cloud Functions
  • Discovery: CloudKMS Enumeration of GCP Cloud KMS
  • Discovery: CloudResourceManager Resource Manager Enumeration
  • Discovery: Compute Enumeration
  • Discovery: GCP Cloud IAM Enumeration
  • Discovery: Secret Manager Cloud Secrets Enumeration
  • Discovery: Storage Cloud Storage Enumeration
  • Exfiltration: Download Cloud Function Code
  • Exfiltration: Export a Compute Image Instance
  • Persistence: Generate Signed URL for Modifying Cloud Function Code
  • Privilege Escalation: Compute Set Instance or Project Metadata to Enable OS Login

URL indicators are now available for matching as part of Applied Threat Intelligence. For more information about Applied Threat Intelligence, see Applied Threat Intelligence overview.

Google SecOps SIEM

Within Curated Detections, the following rules have been added to the Cloud Hacktool rule pack for Google Cloud data in the "Broad" category. These rules are intended to detect the behavior of common open source hacktools.

  • Collection: Set GCP Cloud Storage Bucket to Public
  • Discovery: Cloud Run Enumeration
  • Discovery: CloudFunctions Enumeration of GCP Cloud Functions
  • Discovery: CloudKMS Enumeration of GCP Cloud KMS
  • Discovery: CloudResourceManager Resource Manager Enumeration
  • Discovery: Compute Enumeration
  • Discovery: GCP Cloud IAM Enumeration
  • Discovery: Secret Manager Cloud Secrets Enumeration
  • Discovery: Storage Cloud Storage Enumeration
  • Exfiltration: Download Cloud Function Code
  • Exfiltration: Export a Compute Image Instance
  • Persistence: Generate Signed URL for Modifying Cloud Function Code
  • Privilege Escalation: Compute Set Instance or Project Metadata to Enable OS Login

URL indicators are now available for matching as part of Applied Threat Intelligence. For more information about Applied Threat Intelligence, see Applied Threat Intelligence overview.

Network Connectivity Center

VPC spoke updates for IPv6 subnet exchange is available in public preview.

You can update, or propose updates to, an existing VPC spoke to enable or disable the exchange of IPv6 subnet ranges. For information about updating spokes, see Update whether a VPC spoke exports IPv6 subnet ranges. For information about accepting proposed updates to spokes, see Review proposed spokes.

Network Security Integration

Network Security Integration, including the Out-of-band integration, is available in General Availability.

Use out-of-band integration service to analyze your workloads' network traffic at scale. For more information, see Out-of-band integration overview.

Retail API

Vertex AI Search for commerce: Conversational commerce

Conversational commerce uses LLM and conversational product filtering to provide users with a real-time, ongoing conversational experience. The conversational product filtering feature functions as part of the Guided Search package, helping narrow down search queries sooner by presenting users with either relevant products, follow-up questions, or both.

Conversational commerce is in private preview. For more information, see Conversational commerce and Conversational product filtering.

March 10, 2025

Batch

Cancelling jobs is generally available (GA).

BigQuery

Analytics Hub egress controls and data clean room subscriptions are now available in all BigQuery editions and on-demand pricing.

Bigtable

A weekly digest of client library updates from across the Cloud SDK.

Java

Changes for google-cloud-bigtable

2.54.0 (2025-02-28)

Features
  • The next release from the main branch is 2.54.0 (#2498) (f967ded)
Dependencies
Cloud SQL for MySQL

Cloud SQL for MySQL introduces a set of improvements that adjust MySQL configurations dynamically based on workload demands and underlying infrastructure to optimize write performance and reduce latency. By default these improvements are enabled for all new Cloud SQL Enterprise Plus edition instances that you create or that you upgrade to from Cloud SQL Enterprise edition. Existing Cloud SQL Enterprise Plus instances that are updated with maintenance version [MySQL_version].R20250304.00_01 will also enable these improvements automatically.

For more information about these improvements, see Configure database flags.

Compute Engine

Generally available: Compute flexible committed use discounts (CUDs) are available for Local SSD disks that you attach to instances of eligible machine types. Flexible CUDs add flexibility to your Compute Engine spending capabilities by eliminating the need to restrict your commitments to a single project, region, or machine series.

For more information, see Compute flexible CUDs.

Generally available: Configure the host error detection time, which is the the maximum amount of time Compute Engine waits to restart or terminate an instance after detecting that the instance is unresponsive. For more information, see Set VM host maintenance policy.

Dataflow

A weekly digest of client library updates from across the Cloud SDK.

Go

Changes for dataflow/apiv1beta3

0.10.4 (2025-03-06)

Bug Fixes
  • dataflow: Fix out-of-sync version.go (28f0030)
Dataproc

New Dataproc on Compute Engine subminor image versions:

  • 2.0.135-debian10, 2.0.135-rocky8, 2.0.135-ubuntu18
  • 2.1.83-debian11, 2.1.83-rocky8, 2.1.83-ubuntu20, 2.1.83-ubuntu20-arm
  • 2.2.49-debian12, 2.2.49-rocky9, 2.2.49-ubuntu22
Dialogflow

Dialogflow CX (Conversational Agents): The Conversational Agents console has moved to a new location.

Dialogflow CX (Conversational Agents): You can now use the console search feature to search for all resources, including playbooks, examples, and tools.

Dialogflow CX (Conversational Agents): Playbooks now support the following new features:

Dialogflow CX (Conversational Agents): You can now use the Conversational Agents console to manage languages.

Dialogflow CX (Conversational Agents) data store handlers: New model gemini-2.0-flash-001 is now available to data store handlers as a Preview feature. This launch is limited to the following regions: global, us, us-central1, us-east1, us-west1, europe-west1, europe-west4.

Dialogflow CX (Conversational Agents): Text-to-speech used by Dialogflow now supports new Chirp 3 HD voices.

Dialogflow CX (Conversational Agents): Git export/restore now supports additional Git providers and Google Secrets for token storage.

Google SecOps

The following rule has been removed from its associated rule pack in Curated Detections due to high alert volume across the Google SecOps customer base:

  • Serverless Threats
    • Potential Cryptomining Payload running in Cloud Run Service or Cloud Run Job
Google SecOps SIEM

The following rule has been removed from its associated rule pack in Curated Detections due to high alert volume across the Google SecOps customer base:

  • Serverless Threats
    • Potential Cryptomining Payload running in Cloud Run Service or Cloud Run Job
Security Command Center

The following detectors have been added to Container Threat Detection.

  • Execution: Program Run with Disallowed HTTP Proxy Env
  • Exfiltration: Launch Remote File Copy Tools in Container

For more information, see Container Threat Detection detectors.

Spanner

Tiered storage is Generally Available in Spanner. Tiered storage is a fully-managed feature that lets you store your data across solid-state drives (SSD) or hard disk drives (HDD). Using tiered storage lets you take advantage of both SSD storage, which supports the high performance of active data, and HDD storage, which supports infrequent data access at a lower cost. For more information, see Tiered storage.

March 09, 2025

Google SecOps

The session timeout duration is being extended from 3 hours to 8 hours. After 8 hours of activity, you are automatically logged out and required to sign in again. To prevent data loss, we recommend that you manually log out in advance if you anticipate being away from the platform for an extended period of time. This feature will be gradually rolled out starting March 17, 2025.

Google SecOps SIEM

The session timeout duration is being extended from 3 hours to 8 hours. After 8 hours of activity, you are automatically logged out and required to sign in again. To prevent data loss, we recommend that you manually log out in advance if you anticipate being away from the platform for an extended period of time. This feature will be gradually rolled out starting March 17, 2025.

Google SecOps SOAR

Release 6.3.37 is now in General Availability.

March 08, 2025

Google SecOps

Map users in the platform for Google Cloud Identity customers

Administrators can now provision and map new users into the platform by adding them to groups in bulk using their email addresses. This streamlines user management and access control for organizations using Google Cloud Identity.

For more information, see Map users with email groups to the platform.

Google SecOps SOAR

Release 6.3.38 is currently in Preview. This release contains internal and customer bug fixes.

March 07, 2025

Apigee Advanced API Security

On March 7, 2025 we released an updated version of Apigee Advanced API Security.

Availability of data obfuscation support with Advanced API Security

With this release, data obfuscation can be used with Advanced API Security.

For usage information, see Obfuscate user data for Apigee API Analytics and Data obfuscation with Advanced API Security.

Contact Center AI Insights

You can integrate Agent Assist summarization generators with Conversational Insights. Summarization uses existing LLM generators to automatically summarize conversations. You can then export those summaries along with your other Insights data.

Google Cloud Architecture Center

Infrastructure for a RAG-capable generative AI application using Vertex AI and Vector Search: Added information about the Terraform configuration sample to deploy the architecture.

Google Kubernetes Engine

GKE now allows you to enable logging of Horizontal Pod Autoscaler decisions starting from GKE version 1.31.5-gke.1090000 or later, or version 1.32.1-gke.1260000 or later. These logs include atomic recommendations (based on individual metrics) and final recommendations (consolidated HPA decisions). The logs are stored in Cloud Logging and offer insights into the decision-making process of the Horizontal Pod Autoscaler.

You can now monitor startup latency of Kubernetes workloads and nodes using the new Startup Latency dashboard available in the Observability tab on the Deployment details and Cluster details pages in the GKE Console. The dashboard is useful for tracking, troubleshooting and optimizing startup latency of your GKE workloads.

Virtual Private Cloud

The following features of internal ranges are available in Preview:

  • Reserving internal ranges with IPv6 addresses
  • Creating immutable internal ranges (ranges that can't be updated, except for the description)
  • Editable descriptions

For more information, see Internal ranges overview.

You can exclude IP address ranges from internal range automatic IP address allocation. This feature is available in Preview. For more information, see Reserve internal ranges.

You can create internal ranges that overlap with routes and subnets. This feature is available in General Availability. For more information, see Internal ranges overview.

March 06, 2025

Anthos Config Management

Fixed an issue where ConfigManagement uninstall could get stuck when Policy Controller was enabled via ConfigManagement. This was caused by Policy Controller finalizers not being properly removed during the uninstallation process.

BigQuery

BigQuery Data Transfer Service now supports custom reports for Google Ads. You can use Google Ads Query Language (GAQL) queries in your transfer configuration to ingest custom Google Ads reports and fields beyond those available in the standard reports and fields. This feature is now generally available (GA).

Cloud Router

Cloud Router support for BGP route policies is now generally available. For more information, see BGP route policies overview.

Cloud Run

The following new region is now available: europe-north2.

Contact Center AI Insights

Conversational Insights offers Rule-based analysis as a GA feature to customize your conversation analyses. Rule-based analysis provides the following customizations:

  • Filter conversations.
  • Select a percentage of your dataset.
  • Designate different types of analysis.
Container Registry

The schedule for the Container Registry shutdown has changed. After March 18, 2025, writing images to Container Registry is unavailable. After May 20, 2025, reading images from Container Registry is unavailable. For more information about the shutdown, see Container Registry deprecation.

Looker Studio

Partner connection launch update

The following partner connectors have been added to the Looker Studio Connector Gallery:

Security Command Center

The AWS connector has changed to enable additional use cases and requires the collection of AWS organization and organizational unit (OU) data. This change may require you to take additional action. For details about the change, see the AWS connector changelog.

Text-to-Speech

Chirp 3: HD voices now supports 8 new speakers in 31 new locales: ar-XA, bn-IN, cmn-CN, de-DE, en-AU, en-GB, en-IN, en-US, es-ES, es-US, fr-CA, fr-FR, gu-IN, hi-IN, id-ID, it-IT, ja-JP, kn-IN, ko-KR, ml-IN, mr-IN, nl-NL, pl-PL, pt-BR, ru-RU, sw-KE, ta-IN, te-IN, th-TH, tr-TR, and vi-VN.

March 05, 2025

Apigee UI

On March 5, 2025, we released an updated version of the Apigee UI.

Bug ID Description
368686537 Resolved issue causing delay when loading API product pages in the Apigee UI in Cloud console.

Members of Apigee organizations with large number of API proxies experienced long load times when accessing the API product create or API product edit pages in the Apigee UI in Cloud console.

Cloud Composer

You can now specify an order in which Airflow searches for secrets by overriding the [secrets]backends_order Airflow configuration option.

Fixed an issue in Cloud Composer REST API that allowed some environment.patch operations to succeed when multiple update masks that aren't related to each other were passed in a request. Now operations with such masks fail with an error.

New Airflow builds are available in Cloud Composer 3:

  • composer-3-airflow-2.10.2-build.10 (default)
  • composer-3-airflow-2.9.3-build.17

New images are available in Cloud Composer 2:

  • composer-2.11.4-airflow-2.10.2 (default)
  • composer-2.11.4-airflow-2.9.3

Cloud Composer versions 2.6.2 and 2.6.3 have reached their end of support period.

Cloud Storage

Configurable dual-regions now include the Turin, Italy (europe-west12) region. For more information, see Cloud Storage configurable dual-regions.

Container Optimized OS

cos-beta-121-18867-0-24

Kernel Docker Containerd GPU Drivers
COS-6.6.74 v25.0.7 v2.0.2 See List

Updates to Major Packages:

Upgraded app-admin/google-osconfig-agent to v20250121.00-r1.

Upgraded app-containers/cri-tools to v1.31.1-r1.

Upgraded app-containers/docker to v25.0.7.

Upgraded app-containers/runc to v1.2.4-r1.

Upgraded net-misc/openssh to v9.9_p1.

Upgraded app-admin/fluent-bit to v3.2.5-r1.

Upgraded app-containers/containerd to v2.0.2-r1.

Upgraded app-emulation/cloud-init to v24.4.1-r1.

Upgraded app-admin/google-guest-agent to v20250204.02-r1.

Upgraded app-admin/oslogin to 20241216.00-r1.

Upgraded app-containers/cni-plugins to v1.6.2-r1.

New Features and Changes in the Linux Kernel:

Removed the capability to change the kernel's preemption model on the kernel command line.

Added support for nftables flow offload and the flowtable infrastructure.

New Features and Changes in the Image:

Removed support for R550, R560, and R565 Nvidia drivers.

Updates to Minor Packages:

Removed dev-libs/confuse.

Removed sys-libs/libsepol.

Removed dev-go/protobuf.

Removed chromeos-base/chromeos-ec-headers.

Removed sys-libs/libselinux.

Removed dev-go/protobuf-legacy-api.

Removed sys-libs/gdbm.

Removed dev-go/appengine.

Removed dev-python/more-itertools.

Removed dev-python/typing-extensions.

Removed dev-python/webcolors.

Removed dev-python/ordered-set.

Removed dev-python/platformdirs.

Removed dev-python/trove-classifiers.

Removed dev-python/tomli.

Removed dev-python/jaraco-context.

Removed dev-python/autocommand.

Removed dev-python/zipp.

Removed dev-python/zope-interface.

Removed dev-python/wheel.

Removed dev-python/jaraco-functools.

Removed dev-python/importlib_resources.

Removed dev-python/pydantic.

Removed dev-python/inflect.

Removed dev-python/jaraco-text.

Removed dev-libs/libusb.

Removed virtual/libusb.

Removed dev-embedded/libftdi.

Removed chromeos-base/dlcservice-client.

Removed chromeos-base/libec.

Removed dev-python/setuptools.

Removed dev-python/setuptools_scm.

Updated dev-libs/expat to v2.6.4.

Updated net-libs/libtirpc to v1.3.6.

Updated sys-libs/libcap to v2.71.

Updated chromeos-base/power_manager-client to v0.0.1-r2960.

Updated chromeos-base/chromeos-common-script to v0.0.1-r656.

Updated chromeos-base/debugd-client to v0.0.1-r2725.

Updated chromeos-base/session_manager-client to v0.0.1-r2816.

Updated sys-apps/diffutils to v3.11.

Updated net-dns/c-ares to v1.34.4.

Updated app-admin/extensions-manager to v0.0.1-r58.

Updated sys-apps/gentoo-functions to v1.7.3.

Updated sys-libs/libseccomp to v2.5.5-r2.

Updated chromeos-base/minijail to v18-r158.

Updated net-libs/libnetfilter_conntrack to v1.1.0.

Updated sys-apps/pv to v1.9.27.

Updated net-firewall/iptables to v1.8.10-r3.

Updated dev-db/sqlite to v3.47.2.

Updated dev-libs/nss to v3.107.

Updated dev-go/oauth2 to v0.23.0-r1.

Updated sys-fs/xfsprogs to v6.9.0.

Updated dev-python/chardet to v3.0.4-r2.

Updated net-misc/curl to v8.11.1-r2.

Updated app-admin/sudo to v1.9.16_p2-r1.

Updated sys-apps/flashrom to v0.9.9-r1626.

Updated chromeos-base/shill-client to v0.0.1-r4812.

Updated chromeos-base/update_engine-client to v0.0.1-r2469.

Updated chromeos-base/update_engine to v0.0.3-r4806.

Updated chromeos-base/crash-reporter to v0.0.1-r4257.

Gemini Code Assist

Various bug fixes and minor product enhancements for IntelliJ Gemini Code Assist extension.

Google Cloud Architecture Center

Infrastructure for a RAG-capable generative AI application using Vertex AI and Vector Search: Updated the data processing component in the reference architecture to use a Cloud Run function in place of a Cloud Run job.

Google Distributed Cloud (software only) for VMware

The Envoy project recently announced several new security vulnerabilities (CVE-2024-53269, CVE-2024-53270, and CVE-2024-53271) that could allow an attacker to crash Envoy.

For more details, see the GCP-2025-009 security bulletin.

Google Distributed Cloud (software only) for bare metal

Security bulletin

The Envoy project recently announced several new security vulnerabilities (CVE-2024-53269, CVE-2024-53270, and CVE-2024-53271) that could allow an attacker to crash Envoy.

For more details, see the GCP-2025-009 security bulletin.

Google Kubernetes Engine

(2025-R09) Version updates

GKE cluster versions have been updated.

New versions available for upgrades and new clusters.

The following Kubernetes versions are now available for new clusters and for opt-in control plane upgrades and node upgrades for existing clusters. For more information on versioning and upgrades, see GKE versioning and support and Upgrades.

Rapid channel

Regular channel

  • Version 1.31.5-gke.1233000 is now the default version for cluster creation in the Regular channel.
  • The following versions are now available in the Regular channel:
  • The following versions are no longer available in the Regular channel:
    • 1.29.13-gke.1109000
    • 1.30.9-gke.1127000
    • 1.31.5-gke.1169000
  • Auto-upgrade targets are now available for the following minor versions:
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.28 to version 1.29.13-gke.1169000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.29 to version 1.30.9-gke.1201000 with this release.
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.29 to version 1.29.13-gke.1169000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.30 to version 1.30.9-gke.1201000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.31 to version 1.31.5-gke.1233000 with this release.

Stable channel

  • Version 1.30.9-gke.1046000 is now the default version for cluster creation in the Stable channel.
  • The following versions are now available in the Stable channel:
  • The following versions are no longer available in the Stable channel:
    • 1.29.13-gke.1006000
    • 1.30.9-gke.1009000
    • 1.31.5-gke.1023000
  • Auto-upgrade targets are now available for the following minor versions:
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.28 to version 1.29.13-gke.1038000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.29 to version 1.30.9-gke.1046000 with this release.
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.29 to version 1.29.13-gke.1038000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.30 to version 1.30.9-gke.1046000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.31 to version 1.31.5-gke.1068000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.32 to version 1.32.1-gke.1357001 with this release.

Extended channel

  • Version 1.31.5-gke.1233000 is now the default version for cluster creation in the Extended channel.
  • The following versions are now available in the Extended channel:
  • The following versions are no longer available in the Extended channel:
    • 1.27.16-gke.2477000
    • 1.28.15-gke.1641000
    • 1.28.15-gke.1881000
    • 1.29.13-gke.1109000
    • 1.30.9-gke.1127000
    • 1.31.5-gke.1169000
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.28 to version 1.28.15-gke.1781000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.29 to version 1.29.13-gke.1169000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.30 to version 1.30.9-gke.1201000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.31 to version 1.31.5-gke.1233000 with this release.

No channel

The Envoy project recently announced several new security vulnerabilities (CVE-2024-53269, CVE-2024-53270, and CVE-2024-53271) that could allow an attacker to crash Envoy.

For more details, see the GCP-2025-009 security bulletin.

(2025-R09) Version updates

(2025-R09) Version updates

  • Version 1.31.5-gke.1233000 is now the default version for cluster creation in the Regular channel.
  • The following versions are now available in the Regular channel:
  • The following versions are no longer available in the Regular channel:
    • 1.29.13-gke.1109000
    • 1.30.9-gke.1127000
    • 1.31.5-gke.1169000
  • Auto-upgrade targets are now available for the following minor versions:
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.28 to version 1.29.13-gke.1169000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.29 to version 1.30.9-gke.1201000 with this release.
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.29 to version 1.29.13-gke.1169000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.30 to version 1.30.9-gke.1201000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.31 to version 1.31.5-gke.1233000 with this release.

(2025-R09) Version updates

  • Version 1.30.9-gke.1046000 is now the default version for cluster creation in the Stable channel.
  • The following versions are now available in the Stable channel:
  • The following versions are no longer available in the Stable channel:
    • 1.29.13-gke.1006000
    • 1.30.9-gke.1009000
    • 1.31.5-gke.1023000
  • Auto-upgrade targets are now available for the following minor versions:
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.28 to version 1.29.13-gke.1038000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.29 to version 1.30.9-gke.1046000 with this release.
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.29 to version 1.29.13-gke.1038000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.30 to version 1.30.9-gke.1046000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.31 to version 1.31.5-gke.1068000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.32 to version 1.32.1-gke.1357001 with this release.

(2025-R09) Version updates

  • Version 1.31.5-gke.1233000 is now the default version for cluster creation in the Extended channel.
  • The following versions are now available in the Extended channel:
  • The following versions are no longer available in the Extended channel:
    • 1.27.16-gke.2477000
    • 1.28.15-gke.1641000
    • 1.28.15-gke.1881000
    • 1.29.13-gke.1109000
    • 1.30.9-gke.1127000
    • 1.31.5-gke.1169000
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.28 to version 1.28.15-gke.1781000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.29 to version 1.29.13-gke.1169000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.30 to version 1.30.9-gke.1201000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.31 to version 1.31.5-gke.1233000 with this release.

(2025-R09) Version updates

Google SecOps

Gemini documentation summaries

You can use Gemini to answer questions about Google SecOps based on the documentation. Enter a prompt in the Gemini pane to request information about any aspect of how to use Google SecOps. Gemini generates a summary based on relevant documentation. This feature is in public preview.

For more information, see Gemini documentation summaries.

Google SecOps SIEM

Gemini documentation summaries

You can use Gemini to answer questions about Google SecOps based on the documentation. Enter a prompt in the Gemini pane to request information about any aspect of how to use Google SecOps. Gemini generates a summary based on relevant documentation. This feature is in public preview.

For more information, see Gemini documentation summaries.

Google SecOps SOAR

The phased rollout to regions as described here is postponed to Sunday, March 16th, 2025.

Memorystore for Redis Cluster

Memorystore for Redis Cluster supports storing and querying vector data. This feature is now Generally Available (GA). For more information, see About Vector Search.

SAP on Google Cloud

Google Cloud's Agent for SAP version 3.7

Version 3.7 of Google Cloud's Agent for SAP is generally available (GA). This version introduces the following:

  • Support for the disk snapshot based backup and recovery of SAP HANA scale-out systems, except those with the host auto-failover solution.
  • Enhancements for Backint based backup and recovery of SAP HANA.
  • Enhancements for evaluating Pacemaker configurations by using Workload Manager.
  • Support for showing annotations for SAP events in Cloud Monitoring and predefined observability dashboards.
  • Support to validate the Google Cloud setup for using the agent features.
  • Automatic polling of agent configuration, negating the need to restart the agent after you change its configuration.

For more information, see What's new with Google Cloud's Agent for SAP.

March 04, 2025

AlloyDB for PostgreSQL

AlloyDB for PostgreSQL is available in the following region: europe-north2 (Stockholm). For more information, see AlloyDB Locations.

Artifact Registry

Artifact Registry is available in the europe-north2 region (Stockholm). For more information, see Global locations.

BigQuery

BigQuery is now available in the Stockholm (europe-north2) region.

Bigtable

Bigtable is available in the europe-north2 (Stockholm) region. For more information, see Bigtable locations.

Cloud Build

Cloud Build is now available in the northamerica-south1 region.

For more information, see Cloud Build locations.

Cloud Composer

Cloud Composer 3 supports Customer Managed Encryption Keys (CMEK).

Cloud Interconnect

Dedicated Cloud Interconnect support is available in the following colocation facilities:

  • Stockholm, Sweden

For more information, see the Locations table and Global Locations.

Cloud Key Management Service

Cloud KMS is available in the following region:

  • europe-north2

For more information, see Cloud KMS locations.

Cloud Load Balancing

Application Load Balancers now support the use of custom metrics that let you configure your load balancer's traffic distribution behavior to be based on metrics specific to your application or infrastructure requirements, rather than Google Cloud's standard utilization or rate-based metrics. Defining custom metrics for your load balancer gives you the flexibility to route application requests to the backend instances and endpoints that are most optimal for your workload.

For more information, see Custom metrics for Application Load Balancers.

This capability is in Preview.

Cloud Run

The following new region is now available: northamerica-south1.

Cloud SQL for MySQL

Cloud SQL Enterprise edition now supports the europe-north2 (Stockholm) region.

Cloud SQL for MySQL now supports minor version 8.0.41. To upgrade your existing instance to the new version, see Upgrade the database minor version.

Cloud SQL for PostgreSQL

Cloud SQL Enterprise edition now supports the europe-north2 (Stockholm) region.

Cloud SQL for SQL Server

Cloud SQL Enterprise edition now supports the europe-north2 (Stockholm) region.

Cloud Storage

Cloud Storage now offers support in the Stockholm, Sweden (europe-north2) region. To learn more about supported locations, see Cloud Storage bucket locations.

Cloud VPN

Cloud VPN is now available in region europe-north2 (Stockholm, Sweden). For more information, see Global locations.

Pricing is available on the Cloud VPN pricing page.

Compute Engine

Generally available: Stockholm, Sweden, Europe (europe-north2-a,b,c) has launched with N4, C3D highmem, C4 highmem, and E2 machine types available in all three zones. For more information, see Cloud locations and VM instance pricing.

Cortex Framework

Release 6.2

New Data Sources

  • Marketing: Cross Media & Product Connected Insights. Understand the effectiveness of marketing campaigns running across media platforms such as Google Ads, YouTube (with DV360), Meta, and TikTok for product and product category sales performance with the power of Gemini Flash 2.0. Access the Looker Block for Cross Media with sample dashboards for further analytics.
  • Cortex Common Dimensions: Newly added utility views and tables created within the Data Foundation to enable advanced use cases across different data sources, such as Cross Media & Product Connected Insights. Currently Country, Product Hierarchy and Currency Conversion are available.
  • Minor refactoring for Data Mesh configuration specs code, which are now moved to the /src/common/py_libs directory.
  • SAP CDC Deployer now provides detailed error messages on failure.
  • SAP Reporting - Fixing abundant join condition in PurchaseDocuments_Flow view.
  • For all DAGs, BigQuery execution now happens in the same location as the dataset.
  • 1-click deployer usability fixes for CM360 and SFMC bucket names.

The following standalone accelerators and samples are removed from Cortex Framework:

  • Demand Sensing
  • AppLayer
  • CATGAP
  • SAP ML Model samples
Dataflow

Dataflow is now available in Stockholm (europe-north2).

Dataproc

Dataproc is now available in the europe-north2 region (Stockholm, Sweden).

Firestore

Firestore now supports the europe-north2 Stockholm region.

For a full list of supported locations, see Locations.

Firestore in Datastore mode

Firestore in Datastore mode now supports the europe-north2 Stockholm region.

For a full list of supported locations, see Locations.

Generative AI on Vertex AI

Vertex AI Agent Engine

Vertex AI Agent Engine is now generally available (GA).

Billing for Vertex AI Agent Engine starts on March 4, 2025. We recommend that you delete unused resources to avoid incurring unwanted costs. For more information, see Pricing.

LangChain on Vertex AI has been renamed to Vertex AI Agent Engine.

Google Kubernetes Engine

The europe-north2 region in Stockholm, Sweden is now available. For more information, see the Global Locations.

The europe-north2 region in Stockholm, Sweden is now available. For more information, see the Global Locations.

Memorystore for Memcached

Memorystore is available in the europe-north2 (Stockholm) region. For more information, see Regions and zones.

Memorystore for Redis

Memorystore is available in the europe-north2 (Stockholm) region. For more information, see Regions and zones.

Memorystore for Redis Cluster

Memorystore is available in the europe-north2 (Stockholm) region. For more information, see Memorystore for Redis Cluster locations.

Oracle Database@Google Cloud

You can now start, stop, and restart your Autonomous Databases through the Google Cloud console. This feature is generally available (GA).

Pub/Sub

Pub/Sub is now available in the europe-north2 region (Stockholm, Sweden, Europe). For more information, see Cloud locations.

Sensitive Data Protection

Sensitive Data Protection is available in the europe-north2 region. For more information, see Sensitive Data Protection locations.

Spanner

You can create Spanner regional instance configurations in Stockholm, Sweden (europe-north2). For more information, see Google Cloud locations and Spanner pricing.

A new multi-region instance configuration is now available in Europe - eur7 (Milan/Frankfurt/Turin).

Virtual Private Cloud

For auto mode VPC networks, added a new subnet 10.226.0.0/20 for the Stockholm europe-north2 region. For more information, see Global Locations and Auto mode IP ranges.

March 03, 2025

App Engine flexible environment Go App Engine standard environment Go

App Engine now sets the automatic scaling maximum instances default for standard environment deployments to 20. This change doesn't impact existing apps. To override the default, specify a new max_instances value in your app.yaml file, and deploy a new version or redeploy over an existing version.

App Engine standard environment Java

App Engine now sets the automatic scaling maximum instances default for standard environment deployments to 20. This change doesn't impact existing apps. To override the default, specify a new max_instances value in your app.yaml file, and deploy a new version or redeploy over an existing version.

App Engine standard environment Node.js

App Engine now sets the automatic scaling maximum instances default for standard environment deployments to 20. This change doesn't impact existing apps. To override the default, specify a new max_instances value in your app.yaml file, and deploy a new version or redeploy over an existing version.

App Engine standard environment PHP

App Engine now sets the automatic scaling maximum instances default for standard environment deployments to 20. This change doesn't impact existing apps. To override the default, specify a new max_instances value in your app.yaml file, and deploy a new version or redeploy over an existing version.

App Engine standard environment Python

App Engine now sets the automatic scaling maximum instances default for standard environment deployments to 20. This change doesn't impact existing apps. To override the default, specify a new max_instances value in your app.yaml file, and deploy a new version or redeploy over an existing version.

App Engine standard environment Ruby

App Engine now sets the automatic scaling maximum instances default for standard environment deployments to 20. This change doesn't impact existing apps. To override the default, specify a new max_instances value in your app.yaml file, and deploy a new version or redeploy over an existing version.

BigQuery

A weekly digest of client library updates from across the Cloud SDK.

Java

Changes for google-cloud-bigquery

2.48.1 (2025-02-26)

Dependencies
  • Update actions/upload-artifact action to v4.6.1 (#3691) (9c0edea)
  • Update dependency com.google.api.grpc:proto-google-cloud-bigqueryconnection-v1 to v2.60.0 (#3680) (6d9a40d)
  • Update dependency com.google.apis:google-api-services-bigquery to v2-rev20250216-2.0.0 (#3688) (e3beb6f)
  • Update dependency com.google.cloud:google-cloud-datacatalog-bom to v1.64.0 (#3681) (9e4e261)
  • Update dependency com.google.cloud:sdk-platform-java-config to v3.44.0 (#3694) (f69fbd3)
  • Update dependency com.google.oauth-client:google-oauth-client-java6 to v1.38.0 (#3685) (53bd7af)
  • Update dependency com.google.oauth-client:google-oauth-client-jetty to v1.38.0 (#3686) (d71b2a3)
  • Update ossf/scorecard-action action to v2.4.1 (#3690) (cdb61fe)

Python

Changes for google-cloud-bigquery

3.30.0 (2025-02-26)

Features
  • Add roundingmode enum, wiring, and tests (#2121) (3a48948)
  • Adds foreign_type_info attribute to table class and adds unit tests. (#2126) (2c19681)
  • Support resource_tags for table (#2093) (d4070ca)
Bug Fixes
  • Avoid blocking in download thread when using BQ Storage API (#2034) (54c8d07)
  • Retry 404 errors in Client.query(...) (#2135) (c6d5f8a)
Dependencies
  • Updates required checks list in github (#2136) (fea49ff)
  • Use pandas-gbq to determine schema in load_table_from_dataframe (#2095) (7603bd7)
Documentation

Gemini in BigQuery can help you complete Python code with contextually appropriate recommendations that are based on content in the query editor. This feature is now generally available (GA).

Bigtable

A weekly digest of client library updates from across the Cloud SDK.

Java

Changes for google-cloud-bigtable

2.53.0 (2025-02-21)

Features

Python

Changes for google-cloud-bigtable

2.29.0 (2025-02-26)

Features
  • Add support for array and float32 SQL query params (#1078) (89b8da8)
Bug Fixes
Certificate Authority Service

Certificate Authority Service is now available in the following region:

  • europe-north2 (Stockholm)

For more information, see Certificate Authority Service locations.

Cloud Logging

A weekly digest of client library updates from across the Cloud SDK.

Java

Changes for google-cloud-logging

3.21.4 (2025-02-26)

Bug Fixes
  • deps: Update the Java code generator (gapic-generator-java) to 2.54.0 (67fa9fb)
Dependencies
  • Update dependency com.google.cloud:sdk-platform-java-config to v3.44.0 (#1768) (a69e699)
  • Update googleapis/sdk-platform-java action to v2.54.0 (#1762) (d50a8d2)
Cloud Run

Support for the Go 1.23 runtime is now in general availability (GA).

Cloud Run functions

Cloud Run functions now supports the Go 1.23 runtime at the General Availability release level.

Cloud SQL for PostgreSQL

The rollout of the following minor versions, extension versions, and plugin versions is complete:

Minor versions

  • 12.21 is upgraded to 12.22.
  • 13.18 is upgraded to 13.20.
  • 14.15 is upgraded to 14.17.
  • 15.10 is upgraded to 15.12
  • 16.6 is upgraded to 16.8.
  • 17.2 is upgraded to 17.4.

Extensions and plugins

  • PostGIS is upgraded from 3.4.3 to 3.4.4.

To use these versions of the extensions, update your instance to [PostgreSQL version].R20250112.01_14.

If you use a maintenance window, then the updates to the minor, extension, and plugin versions happen according to the timeframe that you set in the window. Otherwise, the updates occur within the next few weeks.

For more information on checking your maintenance version, see Self-service maintenance. To find your maintenance window or to manage maintenance updates, see Find and set maintenance windows.

Cloud Storage

A weekly digest of client library updates from across the Cloud SDK.

Java

Changes for google-cloud-storage

2.49.0 (2025-02-26)

Features
  • Add new Options to allow per method header values (#2941) (297802d)
  • transfer-manager: Add ParallelUploadConfig.Builder#setUploadBlobInfoFactory (#2936) (86e9ae8), closes #2638
Bug Fixes
  • Categorize a WatchdogTimeoutException as retriable for grpc ReadObject (#2954) (b53bd53)
  • deps: Update the Java code generator (gapic-generator-java) to 2.53.0 (9946d6b)
  • Update grpc based Storage to defer project id validation (#2930) (cc03784)
  • Update kms key handling when opening a resumable upload to clear the value in the json to be null rather than empty string (#2939) (43553de)
Dependencies
Documentation

Python

Changes for google-cloud-storage

3.1.0 (2025-02-27)

Features
  • Add api_key argument to Client constructor (#1441) (c869e15)
  • Add Bucket.move_blob() for HNS-enabled buckets (#1431) (24c000f)
Container Optimized OS

cos-113-18244-291-53

Kernel Docker Containerd GPU Drivers
COS-6.1.123 v24.0.9 v1.7.24 See List

Updated cos-gpu-installer to v2.4.8: Add the -skip-nvidia-smi flag to disable the execution of nvidia-smi verification during gpu driver installation.

Upgraded moby/buildkit to v0.12.5. This fixes CVE-2024-23653 in app-containers/docker v24.0.9.

Upgraded sys-apps/which to v2.23.

Upgraded sys-apps/diffutils to v3.11-r1.

Upgraded net-misc/socat to v1.8.0.3.

Fixed KCTF-638ba50 in the Linux kernel.

Fixed CVE-2025-21690 in the Linux kernel.

cos-109-17800-436-48

Kernel Docker Containerd GPU Drivers
COS-6.1.124 v24.0.9 v1.7.24 See List

Updated cos-gpu-installer to v2.4.8: Add the -skip-nvidia-smi flag to disable the execution of nvidia-smi verification during gpu driver installation.

Upgraded sys-apps/diffutils to v3.11-r1.

Upgraded moby/buildkit to v0.12.5. This fixes CVE-2024-23653 in app-containers/docker v24.0.9.

Fixed CVE-2025-21690 in the Linux kernel.

cos-105-17412-535-63

Kernel Docker Containerd GPU Drivers
COS-5.15.173 v23.0.3 v1.7.23 See List

Upgraded sys-apps/diffutils to v3.11-r1.

Upgraded sys-apps/which to v2.23.

Fixed CVE-2025-21690 in the Linux kernel.

cos-117-18613-164-49

Kernel Docker Containerd GPU Drivers
COS-6.6.72 v24.0.9 v1.7.24 See List

Upgraded moby/buildkit to v0.12.5. This fixes CVE-2024-23653 in app-containers/docker v24.0.9.

Fixed CVE-2025-21690 in the Linux kernel.

Dataproc Google SecOps

The Custom Fields feature is now in General Availability.

Google SecOps SOAR

Beginning on Sunday, March 9, 2025, we will initiate a phased rollout of releases.

The first stage will be rolled out in the following regions on Sunday, March 9, 2025:

  • Japan
  • India
  • Australia
  • Canada
  • Germany
  • Switzerland

The second stage will be rolled out in the remaining regions on Sunday, March 16, 2025:

  • Singapore
  • Qatar
  • Saudi Arabia
  • Israel
  • UK (London)
  • Italy
  • EU (multi-region)
  • US (multi-region)

If you're unsure of your assigned region, contact your Google SecOps representative.

Oracle Database@Google Cloud

You can now choose an Exadata Infrastructure instance from a project other than your default current project while creating a VM cluster. This feature is in Public Preview.

Policy Controller

Policy Controller version 1.20.1 is now available.

Pub/Sub

You can now ingest streaming data into Pub/Sub by using an import topic, from the following external sources:

A weekly digest of client library updates from across the Cloud SDK.

Java

Changes for google-cloud-pubsub

1.137.1 (2025-02-26)

Bug Fixes
  • deps: Update the Java code generator (gapic-generator-java) to 2.54.0 (ccf670f)
Dependencies
  • Update dependency com.google.cloud:google-cloud-bigquery to v2.48.0 (#2343) (3bbd7e1)
  • Update dependency com.google.cloud:google-cloud-core to v2.52.0 (#2348) (f0977b4)
  • Update dependency com.google.cloud:sdk-platform-java-config to v3.44.0 (#2349) (90ed10b)
  • Update googleapis/sdk-platform-java action to v2.54.0 (#2347) (ac8db2d)
Secret Manager

Secret Manager is now available in the following region:

  • europe-north2 (Stockholm)

For more information, see Secret Manager locations.

Security Command Center

You can use Virtual Machine Threat Detection to scan your Amazon Elastic Compute Cloud (EC2) VM disks for malware. To enable this feature, see Enable VM Threat Detection for AWS. This feature is in Preview.

Vertex AI Agent Builder

Vertex AI Search: Ranking visibility and custom ranking (Private preview)

You can access the signals that contribute to your ranking and then tune these signals to customize the ranking. To tune the ranking signals, you can modify predefined ranking expressions or specify custom ranking expressions.

Ranking visibility and custom ranking is a Private preview feature. For more information, see the rankingExpression field.

March 02, 2025

Google SecOps SOAR

Release 6.3.37 is currently in Preview. This release contains internal and customer bug fixes.

March 01, 2025

Apigee hybrid

hybrid v1.13.3

On March 1, 2025 we released an updated version of the Apigee hybrid software, 1.13.3.

This release enhances the security posture within the JavaCallout and PythonScript policies. This release does not include any new features or general bug fixes.

Bug ID Description
396886110 Fixed a bug where the HPA max replicas could be lower than min.
391861216 Restore for Google Cloud Platform and HYBRID Cloud Providers no longer affects system keyspaces. This fixes Known Issue 391861216.
390258745, 388608440 Any left over Cassandra snapshots are automatically removed. This fixes known issue 388608440.
390019667 Fixed bug where the daemonsets had an invalid pod disruption budget which prevented downscaling.
383441226 Added the following metrics configuration properties:

Manage process ID limits

The procedure to manage the process ID limits in your clusters has been added to the documentation.

A Process ID limit is a Kubernetes resource constraint on nodes and pods to prevent excessive process creation, which can impact node stability. Setting process ID limits in Kubernetes can improve system stability, security, and resource management. This is also consistent with Kubernetes best practices. Apigee Hybrid supports the Kubernetes feature to set process ID limits.

See: Manage process ID limits.

Stricter class instantiation checks included in this release.

JavaCallout policy now includes additional security during Java class instantiation. The enhanced security measure prevents the deployment of policies that directly or indirectly attempt actions that require permissions that are not allowed.

In most cases, existing policies will continue to function as expected without any issues. However, there is a possibility that policies relying on third-party libraries, or those with custom code that indirectly triggers operations requiring elevated permissions, could be affected.

To test your installation, follow the procedure in Validate policies after upgrade to 1.13.3 to validate policy behavior.

Bug ID Description
Bug ID Description
385394193, 383850393, 383778273 Security fixes for apigee-cassandra-backup-utility, apigee-cassandra-client, and apigee-hybrid-cassandra.
This addresses the following vulnerabilities:
382967738 Fixed a vulnerability in PythonScript policy.
N/A Security fixes for apigee-envoy.
This addresses the following vulnerability:
N/A Security fixes for apigee-fluent-bit.
This addresses the following vulnerability:
N/A Security fixes for apigee-mint-task-scheduler.
This addresses the following vulnerabilities:
N/A Security fixes for apigee-open-telemetry-collector.
This addresses the following vulnerability:
392174215 Security fixes for apigee-operator.
This addresses the following vulnerabilities:
N/A Security fixes for apigee-redis.
This addresses the following vulnerabilities:
391786033 Security fixes for apigee-watcher.
This addresses the following vulnerability:
N/A Security fixes for livenessprobe.
This addresses the following vulnerability:

hybrid v1.14.1

On March 1, 2025 we released an updated version of the Apigee hybrid software, 1.14.1.

This release enhances the security posture within the JavaCallout and PythonScript policies. This release does not include any new features or general bug fixes.

Bug ID Description
396886110 Fixed a bug where the HPA max replicas could be lower than min.
392547038 Add Helm chart template checks for non-existent environments and virtualhosts.
391861216 Restore for Google Cloud Platform and HYBRID Cloud Providers no longer affects system keyspaces. This fixes Known Issue 391861216.
390019667 Fixed bug where the daemonsets had an invalid pod disruption budget which prevented downscaling.
384937220 Fixed an issue where Helm release creation could fail when there are multiple virtual hosts.
383441226 Added the following metrics configuration properties:

Manage process ID limits

The procedure to manage the process ID limits in your clusters has been added to the documentation.

A Process ID limit is a Kubernetes resource constraint on nodes and pods to prevent excessive process creation, which can impact node stability. Setting process ID limits in Kubernetes can improve system stability, security, and resource management. This is also consistent with Kubernetes best practices. Apigee Hybrid supports the Kubernetes feature to set process ID limits.

See: Manage process ID limits.

Stricter class instantiation checks included in this release.

JavaCallout policy now includes additional security during Java class instantiation. The enhanced security measure prevents the deployment of policies that directly or indirectly attempt actions that require permissions that are not allowed.

In most cases, existing policies will continue to function as expected without any issues. However, there is a possibility that policies relying on third-party libraries, or those with custom code that indirectly triggers operations requiring elevated permissions, could be affected.

To test your installation, follow the procedure in Validate policies after upgrade to 1.14.1 to validate policy behavior.

Bug ID Description
385394193, 383850393, 383778273 Security fixes for apigee-cassandra-backup-utility, apigee-cassandra-client, and apigee-hybrid-cassandra.
This addresses the following vulnerabilities:
383113773, 382967738 Fixed a vulnerability in PythonScript policy.
365178914 Security fixes for apigee-cassandra-backup-utility and apigee-hybrid-cassandra.
This addresses the following vulnerability:
N/A Security fixes for apigee-asm-istiod.
This addresses the following vulnerability:
N/A Security fixes for apigee-hybrid-cassandra.
This addresses the following vulnerability:
N/A Security fixes for apigee-mint-task-scheduler.
This addresses the following vulnerabilities:
N/A Security fixes for apigee-open-telemetry-collector.
This addresses the following vulnerability:
392174215 Security fixes for apigee-operator.
This addresses the following vulnerabilities:
N/A Security fixes for apigee-prometheus-adapter.
This addresses the following vulnerabilities:
391786033 Security fixes for apigee-watcher.
This addresses the following vulnerability:

hybrid v1.12.4

On March 1, 2025 we released an updated version of the Apigee hybrid software, 1.12.4.

This release enhances the security posture within the JavaCallout and PythonScript policies. This release does not include any new features or general bug fixes.

Bug ID Description
390258745, 388608440 Any left over Cassandra snapshots are automatically removed. This fixes known issue 388608440.

Stricter class instantiation checks included in this release.

JavaCallout policy now includes additional security during Java class instantiation. The enhanced security measure prevents the deployment of policies that directly or indirectly attempt actions that require permissions that are not allowed.

In most cases, existing policies will continue to function as expected without any issues. However, there is a possibility that policies relying on third-party libraries, or those with custom code that indirectly triggers operations requiring elevated permissions, could be affected.

To test your installation, follow the procedure in Validate policies after upgrade to 1.12.4 to validate policy behavior.

Bug ID Description
391923260 Security fixes for apigee-watcher.
This addresses the following vulnerabilities:
385394193, 383850393, 383778273 Security fixes for apigee-cassandra-backup-utility, apigee-cassandra-client, and apigee-hybrid-cassandra.
This addresses the following vulnerabilities:
382967738 Fixed a vulnerability in PythonScript policy.
365178914 Security fixes for apigee-cassandra-backup-utility and apigee-hybrid-cassandra.
This addresses the following vulnerability:
N/A Security fixes for apigee-fluent-bit.
This addresses the following vulnerability:
N/A Security fixes for apigee-kube-rbac-proxy.
This addresses the following vulnerabilities:
N/A Security fixes for apigee-fluent-bit.
This addresses the following vulnerability:
N/A Security fixes for apigee-kube-rbac-proxy.
This addresses the following vulnerabilities:
N/A Security fixes for apigee-mint-task-scheduler.
This addresses the following vulnerability:
N/A Security fixes for apigee-open-telemetry-collector.
This addresses the following vulnerability:
N/A Security fixes for apigee-udca.
This addresses the following vulnerability:
Dataproc

New Dataproc on Compute Engine subminor image versions:

  • 2.0.134-debian10, 2.0.134-rocky8, 2.0.134-ubuntu18
  • 2.1.82-debian11, 2.1.82-rocky8, 2.1.82-ubuntu20, 2.1.82-ubuntu20-arm
  • 2.2.48-debian12, 2.2.48-rocky9, 2.2.48-ubuntu22

Dataproc on Compute Engine: Explicitly disabled sha1, md5 algorithms for use with kex and kex-gss sshd features.

Google SecOps SOAR

Release 6.3.36 is now in General Availability.

February 28, 2025

Apigee X

On February 28, 2025, we released an updated version of Apigee (1-14-0-apigee-8).

Bug ID Description
382883585 Fixed a vulnerability in the JavaCallout policy.
N/A Updates to security infrastructure and libraries.
Artifact Registry

Artifact Registry is now enabled for use with Cloud KMS Autokey.

Using keys generated by Autokey can help you consistently align with industry standards and recommended practices for data security, including the HSM protection level, separation of duties, key rotation, location, and key specificity. Keys requested using Autokey function identically to other Cloud HSM keys with the same settings.

For more information, see Enabling customer-managed encryption keys. To learn more about Cloud KMS Autokey, see Autokey overview.

Assured Workloads

The IL4 and IL5 control packages now supports the following products. See Supported products by control package for more information:

  • Artifact Registry
  • Cloud Composer
  • Cloud Run
  • Cloud Tasks
  • Spanner
Backup and DR

Security Command Center adds threat detection support for Backup Vault, Backup Plans, and vaulted backups.

Security Command Center released new rules for Google Cloud Backup and DR Service. Security Command Center can now do the following:

  • Detect Backup Vault deletions
  • Detect Backup Plan deletions
  • Detect deletion of backups stored in a Backup Vault

These detectors are available to all Security Command Center Premium and Enterprise customers. For more information, see Security Command Center for Backup and DR Service.

The Backup and DR service has added support for activating the management console and for storing backup vault data in the following regions: us-west3 (Salt Lake City), europe-west9 (Paris), me-west1 (Israel), europe-north1 (Finland), europe-west6 (Zürich), asia-northeast3 (Seoul), southamerica-west1 (Santiago).

Cloud Asset Inventory Config Connector

Config Connector version 1.129.2 is now available.

New Beta resources (direct reconciler)

Reconciliation Improvements

  • SQLInstance

    • All SQLInstance types are now reconciled using the new direct controller instead of the legacy Terraform-based controller. The previous "opt-in" annotation (document reference) no longer applies. Users no longer need to apply the "opt-in" annotation to SQLInstance resources to enable the direct controller. Regardless of the presence (or absence) of an opt-in annotation on SQLInstance resources, the direct reconciler will be used.
    • This change enables all SQLInstance resources to switch from edition ENTERPRISE to ENTERPRISE_PLUS and fixes the bug that prevented SQL Instance upgrade.

New Alpha resources (direct reconciler)

  • ManagedKafkaTopic
  • ApigeeInstanceAttachment
  • ApigeeEnvgroupAttachment
  • ApigeeEndpointAttachment
Google Kubernetes Engine

New recommendations of NODE_SA_MISSING_PERMISSIONS subtype are added to the portfolio of GKE Recommendations. Use the new recommendations to identify clusters with node service accounts missing IAM permissions that are critical for normal cluster operations.

If your organization has a policy to disable automatic role grants to default service accounts, the created default GKE node service account will not get the necessary permissions. Missing critical permissions can degrade your essential cluster operations, such as logging and monitoring.

Google SecOps

Google SecOps has updated the list of supported default parsers. Parsers are updated gradually, so it might take one to four days before you see the changes reflected in your region.

The following supported default parsers have changed. Each parser is listed by product name and log_type value, if applicable. This list now includes both released default parsers and pending parser updates.

  • 1Password Audit Events (ONEPASSWORD_AUDIT_EVENTS)
  • AIX system (AIX_SYSTEM)
  • Akamai DataStream 2 (AKAMAI_DATASTREAM_2)
  • Alveo Risk Data Management (ALVEO_RDM)
  • Amazon API Gateway (AWS_API_GATEWAY)
  • Apache Tomcat (TOMCAT)
  • Appian Cloud (APPIAN_CLOUD)
  • Arcsight CEF (ARCSIGHT_CEF)
  • Asset Panda (ASSET_PANDA)
  • Aware Audit (AWARE_AUDIT)
  • Aware Signals (AWARE_SIGNALS)
  • AWS Cloudtrail (AWS_CLOUDTRAIL)
  • AWS CloudWatch (AWS_CLOUDWATCH)
  • AWS ECS Metrics (AWS_ECS_METRICS)
  • AWS Elastic Load Balancer (AWS_ELB)
  • AWS GuardDuty (GUARDDUTY)
  • AWS Inspector (AWS_INSPECTOR)
  • AWS Lambda Function (AWS_LAMBDA_FUNCTION)
  • AWS RDS (AWS_RDS)
  • AWS Redshift (AWS_REDSHIFT)
  • AWS Route 53 DNS (AWS_ROUTE_53)
  • AWS Security Hub (AWS_SECURITY_HUB)
  • AWS VPC Flow (AWS_VPC_FLOW)
  • AWS WAF (AWS_WAF)
  • Azure AD Directory Audit (AZURE_AD_AUDIT)
  • Azure AD Organizational Context (AZURE_AD_CONTEXT)
  • Azure Application Gateway (AZURE_GATEWAY)
  • Azure Firewall (AZURE_FIREWALL)
  • Azure Key Vault logging (AZURE_KEYVAULT_AUDIT)
  • Barracuda CloudGen Firewall (BARRACUDA_CLOUDGEN_FIREWALL)
  • Barracuda WAF (BARRACUDA_WAF)
  • BeyondTrust BeyondInsight (BEYONDTRUST_BEYONDINSIGHT)
  • Blue Coat Proxy (BLUECOAT_WEBPROXY)
  • Broadcom Support Portal Audit Logs (BROADCOM_SUPPORT_PORTAL)
  • Cato Networks (CATO_NETWORKS)
  • Cequence Bot Defense (CEQUENCE_BOT_DEFENSE)
  • Check Point (CHECKPOINT_FIREWALL)
  • ChromeOS XDR (CHROMEOS_XDR)
  • Cisco Email Security (CISCO_EMAIL_SECURITY)
  • Cisco EStreamer (CISCO_ESTREAMER)
  • Cisco Firepower NGFW (CISCO_FIREPOWER_FIREWALL)
  • Cisco FireSIGHT Management Center (CISCO_FIRESIGHT)
  • Cisco Internetwork Operating System (CISCO_IOS)
  • Cisco IronPort (CISCO_IRONPORT)
  • Cisco ISE (CISCO_ISE)
  • Cisco NX-OS (CISCO_NX_OS)
  • Cisco Switch (CISCO_SWITCH)
  • Cisco Umbrella Cloud Firewall (UMBRELLA_FIREWALL)
  • Cisco vManage SD-WAN (CISCO_SDWAN)
  • Cisco VPN (CISCO_VPN)
  • Citrix Netscaler (CITRIX_NETSCALER)
  • Citrix Storefront (CITRIX_STOREFRONT)
  • Claroty Xdome (CLAROTY_XDOME)
  • Cloud Audit Logs (N/A)
  • Cloud Data Loss Prevention (N/A)
  • Cloudflare Network Analytics (CLOUDFLARE_NETWORK_ANALYTICS)
  • Cloudflare WAF (CLOUDFLARE_WAF)
  • Cloudflare Warp (CLOUDFLARE_WARP)
  • CommVault (COMMVAULT)
  • CrowdStrike Detection Monitoring (CS_DETECTS)
  • CrowdStrike Falcon (CS_EDR)
  • CrowdStrike Falcon Stream (CS_STREAM)
  • Crowdstrike Identity Protection Services (CS_IDP)
  • CrushFTP (CRUSHFTP)
  • Custom Application Access Logs (CUSTOM_APPLICATION_ACCESS)
  • CyberArk Privileged Access Manager (PAM) (CYBERARK_PAM)
  • Cybereason EDR (CYBEREASON_EDR)
  • Cyolo Secure Remote Access for OT (CYOLO_OT)
  • Datadog (DATADOG)
  • Delinea Secret Server (DELINEA_SECRET_SERVER)
  • Dell CyberSense (DELL_CYBERSENSE)
  • Digicert (DIGICERT)
  • Edgio WAF (EDGIO_WAF)
  • Elastic Packet Beats (ELASTIC_PACKETBEATS)
  • F5 ASM (F5_ASM)
  • F5 DNS (F5_DNS)
  • Forcepoint DLP (FORCEPOINT_DLP)
  • Forcepoint NGFW (FORCEPOINT_FIREWALL)
  • Forgerock OpenIdM (FORGEROCK_OPENIDM)
  • FortiGate (FORTINET_FIREWALL)
  • Fortinet FortiAnalyzer (FORTINET_FORTIANALYZER)
  • Fortinet Fortimanager (FORTINET_FORTIMANAGER)
  • Fortinet Web Application Firewall (FORTINET_FORTIWEB)
  • GitHub (GITHUB)
  • Gitlab (GITLAB)
  • Harness IO (HARNESS_IO)
  • Hashicorp Vault (HASHICORP)
  • Hillstone Firewall (HILLSTONE_NGFW)
  • Huawei Switches (HUAWEI_SWITCH)
  • IBM Guardium (GUARDIUM)
  • Imperva Database (IMPERVA_DB)
  • Intel Endpoint Management Assistant (INTEL_EMA)
  • JAMF Security Cloud (JAMF_SECURITY_CLOUD)
  • JFrog Artifactory (JFROG_ARTIFACTORY)
  • JumpCloud Directory Insights (JUMPCLOUD_DIRECTORY_INSIGHTS)
  • Juniper (JUNIPER_FIREWALL)
  • Kaspersky AV (KASPERSKY_AV)
  • Kaspersky Endpoint (KASPERSKY_ENDPOINT)
  • Kolide Endpoint Security (KOLIDE)
  • Kubernetes Audit (KUBERNETES_AUDIT)
  • Layer7 SiteMinder (SITEMINDER_SSO)
  • Linux Auditing System (AuditD) (AUDITD)
  • Looker Audit (LOOKER_AUDIT)
  • ManageEngine ADAudit Plus (ADAUDIT_PLUS)
  • ManageEngine ADManager Plus (ADMANAGER_PLUS)
  • McAfee Web Gateway (MCAFEE_WEBPROXY)
  • Metabase (METABASE)
  • Microsoft AD FS (ADFS)
  • Microsoft Azure Activity (AZURE_ACTIVITY)
  • Microsoft Azure NSG Flow (AZURE_NSG_FLOW)
  • Microsoft CyberX (CYBERX)
  • Microsoft Defender for Endpoint (MICROSOFT_DEFENDER_ENDPOINT)
  • Microsoft Defender for Identity (MICROSOFT_DEFENDER_IDENTITY)
  • Microsoft Defender for Office 365 (MICROSOFT_DEFENDER_MAIL)
  • Microsoft IIS (IIS)
  • Microsoft PowerShell (POWERSHELL)
  • Microsoft Sentinel (MICROSOFT_SENTINEL)
  • Microsoft System Center Endpoint Protection (MICROSOFT_SCEP)
  • Mikrotik Router (MIKROTIK_ROUTER)
  • Mimecast (MIMECAST_MAIL)
  • MISP Threat Intelligence (MISP_IOC)
  • NetIQ eDirectory (NETIQ_EDIRECTORY)
  • Netskope V2 (NETSKOPE_ALERT_V2)
  • Nozomi Networks Scada Guardian (NOZOMI_GUARDIAN)
  • Office 365 (OFFICE_365)
  • Okta (OKTA)
  • Okta User Context (OKTA_USER_CONTEXT)
  • One Identity Identity Manager (ONE_IDENTITY_IDENTITY_MANAGER)
  • Oort Security Tool (OORT)
  • Open Cybersecurity Schema Framework (OCSF) (OCSF)
  • Open LDAP (OPENLDAP)
  • Opnsense (OPNSENSE)
  • Ops Genie (OPS_GENIE)
  • Oracle (ORACLE_DB)
  • Oracle Cloud Guard (OCI_CLOUDGUARD)
  • Oracle Cloud Infrastructure Audit Logs (OCI_AUDIT)
  • Orca Cloud Security Platform (ORCA)
  • Palo Alto Cortex XDR Alerts (CORTEX_XDR)
  • Palo Alto Networks Firewall (PAN_FIREWALL)
  • Palo Alto Panorama (PAN_PANORAMA)
  • Palo Alto Prisma Access (PAN_CASB)
  • Palo Alto Prisma Cloud Alert payload (PAN_PRISMA_CA)
  • Pharos (PHAROS)
  • Privacy-I (PRIVACY_I)
  • Proofpoint On Demand (PROOFPOINT_ON_DEMAND)
  • Proofpoint Tap Alerts (PROOFPOINT_MAIL)
  • Proofpoint Threat Response (PROOFPOINT_TRAP)
  • Radware Web Application Firewall (RADWARE_FIREWALL)
  • ReviveSec (REVIVESEC)
  • Rubrik (RUBRIK)
  • Salesforce (SALESFORCE)
  • Sangfor Proxy (SANGFOR_PROXY)
  • Security Command Center Posture Violation (GCP_SECURITYCENTER_POSTURE_VIOLATION)
  • Security Command Center Threat (N/A)
  • Security Command Center Toxic Combination (GCP_SECURITYCENTER_TOXIC_COMBINATION)
  • ServiceNow CMDB (SERVICENOW_CMDB)
  • Snare System Diagnostic Logs (SNARE_SOLUTIONS)
  • Snipe-IT (SNIPE_IT)
  • Snyk Group level audit/issues logs (SNYK_ISSUES)
  • SonicWall (SONIC_FIREWALL)
  • Sophos Central (SOPHOS_CENTRAL)
  • Swimlane Platform (SWIMLANE)
  • Symantec DLP (SYMANTEC_DLP)
  • Symantec Event export (SYMANTEC_EVENT_EXPORT)
  • Symantec Web Security Service (SYMANTEC_WSS)
  • Tanium Question (TANIUM_QUESTION)
  • Tanium Threat Response (TANIUM_THREAT_RESPONSE)
  • Teleport Access Plane (TELEPORT_ACCESS_PLANE)
  • Tenable Active Directory Security (TENABLE_ADS)
  • Tenable CSPM (TENABLE_CSPM)
  • tenable.io (TENABLE_IO)
  • Terraform Enterprise Audit (TERRAFORM_ENTERPRISE)
  • Thinkst Canary (THINKST_CANARY)
  • ThreatX WAF (THREATX_WAF)
  • Trend Micro Email Security Advanced (TRENDMICRO_EMAIL_SECURITY)
  • Trend Micro Vision One (TRENDMICRO_VISION_ONE)
  • TrendMicro Apex Central (TRENDMICRO_APEX_CENTRAL)
  • TXOne Stellar (TRENDMICRO_STELLAR)
  • UKG (UKG)
  • Unix system (NIX_SYSTEM)
  • UPX AntiDDoS (UPX_ANTIDDOS)
  • VanDyke SFTP (VANDYKE_SFTP)
  • Varonis (VARONIS)
  • Vectra Alerts (VECTRA_ALERTS)
  • Vectra Stream (VECTRA_STREAM)
  • VMware AirWatch (AIRWATCH)
  • Vmware Avinetworks iWAF (VMWARE_AVINETWORKS_IWAF)
  • VMware ESXi (VMWARE_ESX)
  • VMware Horizon (VMWARE_HORIZON)
  • Watchguard EDR (WATCHGUARD_EDR)
  • Windows Defender AV (WINDOWS_DEFENDER_AV)
  • Windows DHCP (WINDOWS_DHCP)
  • Windows DNS (WINDOWS_DNS)
  • Windows Event (WINEVTLOG)
  • Windows Event (XML) (WINEVTLOG_XML)
  • Windows Sysmon (WINDOWS_SYSMON)
  • Workday Audit Logs (WORKDAY_AUDIT)
  • Workday User Activity (WORKDAY_USER_ACTIVITY)
  • WPEngine (WPENGINE)
  • Zimperium (ZIMPERIUM)
  • Zscaler (ZSCALER_WEBPROXY)
  • ZScaler DNS (ZSCALER_DNS)
  • Zscaler Internet Access Audit Logs (ZSCALER_INTERNET_ACCESS)
  • ZScaler NGFW (ZSCALER_FIREWALL)

The following log types were added without a default parser. Each parser is listed by product name and log_type value, if applicable.

  • Autodesk Cad Cam (AUTODESK_CAD_CAM)
  • Azure Risk Events (AZURE_RISK_EVENTS)
  • Azure Risky Users (AZURE_RISKY_USERS)
  • Azure Service Principal Logins (AZURE_SERVICE_PRINCIPAL_LOGINS)
  • Belden Switch (BELDEN_SWITCH)
  • Blue Voyant (BLUE_VOYANT)
  • Cisco NetFlow (CISCO_NETFLOW)
  • Citrix Receiver (CSG_CITRIX_RX)
  • Clavistier Firewall (CLAVISTER_FIREWALL)
  • ClickHouse (CLICKHOUSE)
  • Cloudflare Pageshield (CLOUDFLARE_PAGESHIELD)
  • CrowdStrike DLP (CROWDSTRIKE_DLP)
  • Crowdstrike Recon (TI) (CROWDSTRIKE_RECON)
  • Cynerio Healthcare NDR (CYNERIO_NDR_H)
  • Exterro FTK Central (EXTERRO_FTK_CENTRAL)
  • Fortra Vulnerability Management (FORTRA_VM)
  • GCP Cloud Asset Inventory (GCP_CLOUD_ASSET_INVENTORY)
  • Health ISAC (H_ISAC)
  • HP Router (HP_ROUTER)
  • Huawei Wireless (HUAWEI_WIRELESS)
  • IBM Sense (IBM_SENSE)
  • IIJ_LanScope (IIJ_LANSCOPE)
  • Joblogic (JOBLOGIC)
  • OneIdentity Safeguard (ONEIDENTITY_SAFEGUARD)
  • OpenText Cordy (OPENTEXT_CORDY)
  • Pave (PAVE)
  • Proofpoint Identity Threat Platform (PROOFPOINT_IDENTITY_THREAT_PLATFORM)
  • Rapid Identity (RAPID_IDENTITY)
  • Raven DB (RAVEN_DB)
  • SolidServer (SOLIDSERVER)
  • Spacelift (SPACELIFT)
  • Trend Micro Vision One Activity (TRENDMICRO_VISION_ONE_ACTIVITY)
  • Trend Micro Vision One Container Vulnerabilities (TRENDMICRO_VISION_ONE_CONTAINER_VULNERABILITIES)
  • Trend Micro Vision One Detections (TRENDMICRO_VISION_ONE_DETECTIONS)
  • Vectra XDR (VECTRA_XDR)
  • Vicarious VRX Events (VICARIUS_VRX_EVENTS)
  • WireGuard VPN Logs (WIREGUARD_VPN)
  • Zero Networks (ZERO_NETWORKS)
  • Zoho Assist (ZOHO_ASSIST)

For a list of supported log types and details about default parser changes, see Supported log types and default parsers.

Google SecOps SIEM

Google SecOps has updated the list of supported default parsers. Parsers are updated gradually, so it might take one to four days before you see the changes reflected in your region.

The following supported default parsers have changed. Each parser is listed by product name and log_type value, if applicable. This list now includes both released default parsers and pending parser updates.

  • 1Password Audit Events (ONEPASSWORD_AUDIT_EVENTS)
  • AIX system (AIX_SYSTEM)
  • Akamai DataStream 2 (AKAMAI_DATASTREAM_2)
  • Alveo Risk Data Management (ALVEO_RDM)
  • Amazon API Gateway (AWS_API_GATEWAY)
  • Apache Tomcat (TOMCAT)
  • Appian Cloud (APPIAN_CLOUD)
  • Arcsight CEF (ARCSIGHT_CEF)
  • Asset Panda (ASSET_PANDA)
  • Aware Audit (AWARE_AUDIT)
  • Aware Signals (AWARE_SIGNALS)
  • AWS Cloudtrail (AWS_CLOUDTRAIL)
  • AWS CloudWatch (AWS_CLOUDWATCH)
  • AWS ECS Metrics (AWS_ECS_METRICS)
  • AWS Elastic Load Balancer (AWS_ELB)
  • AWS GuardDuty (GUARDDUTY)
  • AWS Inspector (AWS_INSPECTOR)
  • AWS Lambda Function (AWS_LAMBDA_FUNCTION)
  • AWS RDS (AWS_RDS)
  • AWS Redshift (AWS_REDSHIFT)
  • AWS Route 53 DNS (AWS_ROUTE_53)
  • AWS Security Hub (AWS_SECURITY_HUB)
  • AWS VPC Flow (AWS_VPC_FLOW)
  • AWS WAF (AWS_WAF)
  • Azure AD Directory Audit (AZURE_AD_AUDIT)
  • Azure AD Organizational Context (AZURE_AD_CONTEXT)
  • Azure Application Gateway (AZURE_GATEWAY)
  • Azure Firewall (AZURE_FIREWALL)
  • Azure Key Vault logging (AZURE_KEYVAULT_AUDIT)
  • Barracuda CloudGen Firewall (BARRACUDA_CLOUDGEN_FIREWALL)
  • Barracuda WAF (BARRACUDA_WAF)
  • BeyondTrust BeyondInsight (BEYONDTRUST_BEYONDINSIGHT)
  • Blue Coat Proxy (BLUECOAT_WEBPROXY)
  • Broadcom Support Portal Audit Logs (BROADCOM_SUPPORT_PORTAL)
  • Cato Networks (CATO_NETWORKS)
  • Cequence Bot Defense (CEQUENCE_BOT_DEFENSE)
  • Check Point (CHECKPOINT_FIREWALL)
  • ChromeOS XDR (CHROMEOS_XDR)
  • Cisco Email Security (CISCO_EMAIL_SECURITY)
  • Cisco EStreamer (CISCO_ESTREAMER)
  • Cisco Firepower NGFW (CISCO_FIREPOWER_FIREWALL)
  • Cisco FireSIGHT Management Center (CISCO_FIRESIGHT)
  • Cisco Internetwork Operating System (CISCO_IOS)
  • Cisco IronPort (CISCO_IRONPORT)
  • Cisco ISE (CISCO_ISE)
  • Cisco NX-OS (CISCO_NX_OS)
  • Cisco Switch (CISCO_SWITCH)
  • Cisco Umbrella Cloud Firewall (UMBRELLA_FIREWALL)
  • Cisco vManage SD-WAN (CISCO_SDWAN)
  • Cisco VPN (CISCO_VPN)
  • Citrix Netscaler (CITRIX_NETSCALER)
  • Citrix Storefront (CITRIX_STOREFRONT)
  • Claroty Xdome (CLAROTY_XDOME)
  • Cloud Audit Logs (N/A)
  • Cloud Data Loss Prevention (N/A)
  • Cloudflare Network Analytics (CLOUDFLARE_NETWORK_ANALYTICS)
  • Cloudflare WAF (CLOUDFLARE_WAF)
  • Cloudflare Warp (CLOUDFLARE_WARP)
  • CommVault (COMMVAULT)
  • CrowdStrike Detection Monitoring (CS_DETECTS)
  • CrowdStrike Falcon (CS_EDR)
  • CrowdStrike Falcon Stream (CS_STREAM)
  • Crowdstrike Identity Protection Services (CS_IDP)
  • CrushFTP (CRUSHFTP)
  • Custom Application Access Logs (CUSTOM_APPLICATION_ACCESS)
  • CyberArk Privileged Access Manager (PAM) (CYBERARK_PAM)
  • Cybereason EDR (CYBEREASON_EDR)
  • Cyolo Secure Remote Access for OT (CYOLO_OT)
  • Datadog (DATADOG)
  • Delinea Secret Server (DELINEA_SECRET_SERVER)
  • Dell CyberSense (DELL_CYBERSENSE)
  • Digicert (DIGICERT)
  • Edgio WAF (EDGIO_WAF)
  • Elastic Packet Beats (ELASTIC_PACKETBEATS)
  • F5 ASM (F5_ASM)
  • F5 DNS (F5_DNS)
  • Forcepoint DLP (FORCEPOINT_DLP)
  • Forcepoint NGFW (FORCEPOINT_FIREWALL)
  • Forgerock OpenIdM (FORGEROCK_OPENIDM)
  • FortiGate (FORTINET_FIREWALL)
  • Fortinet FortiAnalyzer (FORTINET_FORTIANALYZER)
  • Fortinet Fortimanager (FORTINET_FORTIMANAGER)
  • Fortinet Web Application Firewall (FORTINET_FORTIWEB)
  • GitHub (GITHUB)
  • Gitlab (GITLAB)
  • Harness IO (HARNESS_IO)
  • Hashicorp Vault (HASHICORP)
  • Hillstone Firewall (HILLSTONE_NGFW)
  • Huawei Switches (HUAWEI_SWITCH)
  • IBM Guardium (GUARDIUM)
  • Imperva Database (IMPERVA_DB)
  • Intel Endpoint Management Assistant (INTEL_EMA)
  • JAMF Security Cloud (JAMF_SECURITY_CLOUD)
  • JFrog Artifactory (JFROG_ARTIFACTORY)
  • JumpCloud Directory Insights (JUMPCLOUD_DIRECTORY_INSIGHTS)
  • Juniper (JUNIPER_FIREWALL)
  • Kaspersky AV (KASPERSKY_AV)
  • Kaspersky Endpoint (KASPERSKY_ENDPOINT)
  • Kolide Endpoint Security (KOLIDE)
  • Kubernetes Audit (KUBERNETES_AUDIT)
  • Layer7 SiteMinder (SITEMINDER_SSO)
  • Linux Auditing System (AuditD) (AUDITD)
  • Looker Audit (LOOKER_AUDIT)
  • ManageEngine ADAudit Plus (ADAUDIT_PLUS)
  • ManageEngine ADManager Plus (ADMANAGER_PLUS)
  • McAfee Web Gateway (MCAFEE_WEBPROXY)
  • Metabase (METABASE)
  • Microsoft AD FS (ADFS)
  • Microsoft Azure Activity (AZURE_ACTIVITY)
  • Microsoft Azure NSG Flow (AZURE_NSG_FLOW)
  • Microsoft CyberX (CYBERX)
  • Microsoft Defender for Endpoint (MICROSOFT_DEFENDER_ENDPOINT)
  • Microsoft Defender for Identity (MICROSOFT_DEFENDER_IDENTITY)
  • Microsoft Defender for Office 365 (MICROSOFT_DEFENDER_MAIL)
  • Microsoft IIS (IIS)
  • Microsoft PowerShell (POWERSHELL)
  • Microsoft Sentinel (MICROSOFT_SENTINEL)
  • Microsoft System Center Endpoint Protection (MICROSOFT_SCEP)
  • Mikrotik Router (MIKROTIK_ROUTER)
  • Mimecast (MIMECAST_MAIL)
  • MISP Threat Intelligence (MISP_IOC)
  • NetIQ eDirectory (NETIQ_EDIRECTORY)
  • Netskope V2 (NETSKOPE_ALERT_V2)
  • Nozomi Networks Scada Guardian (NOZOMI_GUARDIAN)
  • Office 365 (OFFICE_365)
  • Okta (OKTA)
  • Okta User Context (OKTA_USER_CONTEXT)
  • One Identity Identity Manager (ONE_IDENTITY_IDENTITY_MANAGER)
  • Oort Security Tool (OORT)
  • Open Cybersecurity Schema Framework (OCSF) (OCSF)
  • Open LDAP (OPENLDAP)
  • Opnsense (OPNSENSE)
  • Ops Genie (OPS_GENIE)
  • Oracle (ORACLE_DB)
  • Oracle Cloud Guard (OCI_CLOUDGUARD)
  • Oracle Cloud Infrastructure Audit Logs (OCI_AUDIT)
  • Orca Cloud Security Platform (ORCA)
  • Palo Alto Cortex XDR Alerts (CORTEX_XDR)
  • Palo Alto Networks Firewall (PAN_FIREWALL)
  • Palo Alto Panorama (PAN_PANORAMA)
  • Palo Alto Prisma Access (PAN_CASB)
  • Palo Alto Prisma Cloud Alert payload (PAN_PRISMA_CA)
  • Pharos (PHAROS)
  • Privacy-I (PRIVACY_I)
  • Proofpoint On Demand (PROOFPOINT_ON_DEMAND)
  • Proofpoint Tap Alerts (PROOFPOINT_MAIL)
  • Proofpoint Threat Response (PROOFPOINT_TRAP)
  • Radware Web Application Firewall (RADWARE_FIREWALL)
  • ReviveSec (REVIVESEC)
  • Rubrik (RUBRIK)
  • Salesforce (SALESFORCE)
  • Sangfor Proxy (SANGFOR_PROXY)
  • Security Command Center Posture Violation (GCP_SECURITYCENTER_POSTURE_VIOLATION)
  • Security Command Center Threat (N/A)
  • Security Command Center Toxic Combination (GCP_SECURITYCENTER_TOXIC_COMBINATION)
  • ServiceNow CMDB (SERVICENOW_CMDB)
  • Snare System Diagnostic Logs (SNARE_SOLUTIONS)
  • Snipe-IT (SNIPE_IT)
  • Snyk Group level audit/issues logs (SNYK_ISSUES)
  • SonicWall (SONIC_FIREWALL)
  • Sophos Central (SOPHOS_CENTRAL)
  • Swimlane Platform (SWIMLANE)
  • Symantec DLP (SYMANTEC_DLP)
  • Symantec Event export (SYMANTEC_EVENT_EXPORT)
  • Symantec Web Security Service (SYMANTEC_WSS)
  • Tanium Question (TANIUM_QUESTION)
  • Tanium Threat Response (TANIUM_THREAT_RESPONSE)
  • Teleport Access Plane (TELEPORT_ACCESS_PLANE)
  • Tenable Active Directory Security (TENABLE_ADS)
  • Tenable CSPM (TENABLE_CSPM)
  • tenable.io (TENABLE_IO)
  • Terraform Enterprise Audit (TERRAFORM_ENTERPRISE)
  • Thinkst Canary (THINKST_CANARY)
  • ThreatX WAF (THREATX_WAF)
  • Trend Micro Email Security Advanced (TRENDMICRO_EMAIL_SECURITY)
  • Trend Micro Vision One (TRENDMICRO_VISION_ONE)
  • TrendMicro Apex Central (TRENDMICRO_APEX_CENTRAL)
  • TXOne Stellar (TRENDMICRO_STELLAR)
  • UKG (UKG)
  • Unix system (NIX_SYSTEM)
  • UPX AntiDDoS (UPX_ANTIDDOS)
  • VanDyke SFTP (VANDYKE_SFTP)
  • Varonis (VARONIS)
  • Vectra Alerts (VECTRA_ALERTS)
  • Vectra Stream (VECTRA_STREAM)
  • VMware AirWatch (AIRWATCH)
  • Vmware Avinetworks iWAF (VMWARE_AVINETWORKS_IWAF)
  • VMware ESXi (VMWARE_ESX)
  • VMware Horizon (VMWARE_HORIZON)
  • Watchguard EDR (WATCHGUARD_EDR)
  • Windows Defender AV (WINDOWS_DEFENDER_AV)
  • Windows DHCP (WINDOWS_DHCP)
  • Windows DNS (WINDOWS_DNS)
  • Windows Event (WINEVTLOG)
  • Windows Event (XML) (WINEVTLOG_XML)
  • Windows Sysmon (WINDOWS_SYSMON)
  • Workday Audit Logs (WORKDAY_AUDIT)
  • Workday User Activity (WORKDAY_USER_ACTIVITY)
  • WPEngine (WPENGINE)
  • Zimperium (ZIMPERIUM)
  • Zscaler (ZSCALER_WEBPROXY)
  • ZScaler DNS (ZSCALER_DNS)
  • Zscaler Internet Access Audit Logs (ZSCALER_INTERNET_ACCESS)
  • ZScaler NGFW (ZSCALER_FIREWALL)

The following log types were added without a default parser. Each parser is listed by product name and log_type value, if applicable.

  • Autodesk Cad Cam (AUTODESK_CAD_CAM)
  • Azure Risk Events (AZURE_RISK_EVENTS)
  • Azure Risky Users (AZURE_RISKY_USERS)
  • Azure Service Principal Logins (AZURE_SERVICE_PRINCIPAL_LOGINS)
  • Belden Switch (BELDEN_SWITCH)
  • Blue Voyant (BLUE_VOYANT)
  • Cisco NetFlow (CISCO_NETFLOW)
  • Citrix Receiver (CSG_CITRIX_RX)
  • Clavistier Firewall (CLAVISTER_FIREWALL)
  • ClickHouse (CLICKHOUSE)
  • Cloudflare Pageshield (CLOUDFLARE_PAGESHIELD)
  • CrowdStrike DLP (CROWDSTRIKE_DLP)
  • Crowdstrike Recon (TI) (CROWDSTRIKE_RECON)
  • Cynerio Healthcare NDR (CYNERIO_NDR_H)
  • Exterro FTK Central (EXTERRO_FTK_CENTRAL)
  • Fortra Vulnerability Management (FORTRA_VM)
  • GCP Cloud Asset Inventory (GCP_CLOUD_ASSET_INVENTORY)
  • Health ISAC (H_ISAC)
  • HP Router (HP_ROUTER)
  • Huawei Wireless (HUAWEI_WIRELESS)
  • IBM Sense (IBM_SENSE)
  • IIJ_LanScope (IIJ_LANSCOPE)
  • Joblogic (JOBLOGIC)
  • OneIdentity Safeguard (ONEIDENTITY_SAFEGUARD)
  • OpenText Cordy (OPENTEXT_CORDY)
  • Pave (PAVE)
  • Proofpoint Identity Threat Platform (PROOFPOINT_IDENTITY_THREAT_PLATFORM)
  • Rapid Identity (RAPID_IDENTITY)
  • Raven DB (RAVEN_DB)
  • SolidServer (SOLIDSERVER)
  • Spacelift (SPACELIFT)
  • Trend Micro Vision One Activity (TRENDMICRO_VISION_ONE_ACTIVITY)
  • Trend Micro Vision One Container Vulnerabilities (TRENDMICRO_VISION_ONE_CONTAINER_VULNERABILITIES)
  • Trend Micro Vision One Detections (TRENDMICRO_VISION_ONE_DETECTIONS)
  • Vectra XDR (VECTRA_XDR)
  • Vicarious VRX Events (VICARIUS_VRX_EVENTS)
  • WireGuard VPN Logs (WIREGUARD_VPN)
  • Zero Networks (ZERO_NETWORKS)
  • Zoho Assist (ZOHO_ASSIST)

For a list of supported log types and details about default parser changes, see Supported log types and default parsers.

Secret Manager

Parameter Manager, currently in Preview, now offers a console for storing, accessing, and managing the lifecycle of your workload parameters. For more information, see the Parameter Manager documentation.

Security Command Center

Event Threat Detection, a built-in service of Security Command Center, has released new detectors. The following detectors, which are available in Preview with the Enterprise and Premium tiers of Security Command Center, allow users to manage threats to their Google Cloud Backup and Disaster Recovery assets in Security Command Center:

  • BACKUP_DELETE_VAULT
  • BACKUP_DELETE_VAULT_BACKUP
  • BACKUP_DELETE_BACKUP_PLAN_ASSOCIATION

In addition, we updated the existing BACKUP_REMOVE_PLAN detector to support findings on Google Cloud Backup and Disaster Recovery assets that are managed in the Google Cloud console. This detector will dynamically generate finding descriptions based on the finding source.

Spanner

Full-text search is now generally available for PostgreSQL-dialect databases.

A monthly digest of client library updates from across the Cloud SDK.

Go

Changes for spanner/admin/database/apiv1

1.74.0 (2025-01-24)

Features
  • spanner/admin/instance: Exposing FreeInstanceAvailability in InstanceConfig (4254053)
  • spanner/admin/instance: Exposing FreeInstanceMetadata in Instance configuration (to define the metadata related to FREE instance type) (4254053)
  • spanner/admin/instance: Exposing InstanceType in Instance configuration (to define PROVISIONED or FREE spanner instance) (4254053)
  • spanner/admin/instance: Exposing QuorumType in InstanceConfig (4254053)
  • spanner/admin/instance: Exposing storage_limit_per_processing_unit in InstanceConfig (4254053)
  • spanner: Add the last statement option to ExecuteSqlRequest and ExecuteBatchDmlRequest (8dedb87)
  • spanner: Add UUID in Spanner TypeCode enum (46fc993)
  • spanner: Implement generation and propagation of "x-goog-spanner-request-id" Header (#11048) (10960c1)
Bug Fixes
  • spanner/spansql: PROTO BUNDLE and protobuf type parsing fixes (#11279) (b1ca714)
  • spanner/test/opentelemetry/test: Update golang.org/x/net to v0.33.0 (e9b0b69)
  • spanner: ReadWriteStmtBasedTransaction would not remember options for retries (#11443) (7d8f0c5)
  • spanner: Support setting monitoring host via env and override any endpoint override from spanner options with default one (#11141) (3d61545)
  • spanner: Update golang.org/x/net to v0.33.0 (e9b0b69)
Documentation
  • spanner/admin/database: Fix typo timzeone -> timezone (a694e11)
  • spanner/admin/instance: A comment for enum DefaultBackupScheduleType is changed (4254053)
  • spanner/admin/instance: A comment for enum value AUTOMATIC in enum DefaultBackupScheduleType is changed (4254053)
  • spanner/admin/instance: A comment for enum value GOOGLE_MANAGED in enum Type is changed (4254053)
  • spanner/admin/instance: A comment for enum value NONE in enum DefaultBackupScheduleType is changed (4254053)
  • spanner/admin/instance: A comment for enum value USER_MANAGED in enum Type is changed (4254053)
  • spanner/admin/instance: A comment for field base_config in message .google.spanner.admin.instance.v1.InstanceConfig is changed (4254053)
  • spanner/admin/instance: A comment for field default_backup_schedule_type in message .google.spanner.admin.instance.v1.Instance is changed (4254053)
  • spanner/admin/instance: A comment for field filter in message .google.spanner.admin.instance.v1.ListInstanceConfigOperationsRequest is changed (4254053)
  • spanner/admin/instance: A comment for field filter in message .google.spanner.admin.instance.v1.ListInstancePartitionOperationsRequest is changed (4254053)
  • spanner/admin/instance: A comment for field instance_config in message .google.spanner.admin.instance.v1.CreateInstanceConfigRequest is changed (4254053)
  • spanner/admin/instance: A comment for field instance_partition_deadline in message .google.spanner.admin.instance.v1.ListInstancePartitionOperationsRequest is changed (4254053)
  • spanner/admin/instance: A comment for field location in message .google.spanner.admin.instance.v1.ReplicaInfo is changed (4254053)
  • spanner/admin/instance: A comment for field node_count in message .google.spanner.admin.instance.v1.Instance is changed (4254053)
  • spanner/admin/instance: A comment for field node_count in message .google.spanner.admin.instance.v1.InstancePartition is changed (4254053)
  • spanner/admin/instance: A comment for field operations in message .google.spanner.admin.instance.v1.ListInstanceConfigOperationsResponse is changed (4254053)
  • spanner/admin/instance: A comment for field operations in message .google.spanner.admin.instance.v1.ListInstancePartitionOperationsResponse is changed (4254053)
  • spanner/admin/instance: A comment for field optional_replicas in message .google.spanner.admin.instance.v1.InstanceConfig is changed (4254053)
  • spanner/admin/instance: A comment for field parent in message .google.spanner.admin.instance.v1.ListInstancePartitionsRequest is changed (4254053)
  • spanner/admin/instance: A comment for field processing_units in message .google.spanner.admin.instance.v1.Instance is changed (4254053)
  • spanner/admin/instance: A comment for field processing_units in message .google.spanner.admin.instance.v1.InstancePartition is changed (4254053)
  • spanner/admin/instance: A comment for field referencing_backups in message .google.spanner.admin.instance.v1.InstancePartition is changed (4254053)
  • spanner/admin/instance: A comment for field replicas in message .google.spanner.admin.instance.v1.InstanceConfig is changed (4254053)
  • spanner/admin/instance: A comment for field storage_utilization_percent in message .google.spanner.admin.instance.v1.AutoscalingConfig is changed (4254053)
  • spanner/admin/instance: A comment for field unreachable in message .google.spanner.admin.instance.v1.ListInstancePartitionsResponse is changed (4254053)
  • spanner/admin/instance: A comment for message CreateInstanceConfigRequest is changed (4254053)
  • spanner/admin/instance: A comment for message DeleteInstanceConfigRequest is changed (4254053)
  • spanner/admin/instance: A comment for message UpdateInstanceConfigRequest is changed (4254053)
  • spanner/admin/instance: A comment for method CreateInstance in service InstanceAdmin is changed (4254053)
  • spanner/admin/instance: A comment for method CreateInstanceConfig in service InstanceAdmin is changed (4254053)
  • spanner/admin/instance: A comment for method CreateInstancePartition in service InstanceAdmin is changed (4254053)
  • spanner/admin/instance: A comment for method ListInstanceConfigOperations in service InstanceAdmin is changed (4254053)
  • spanner/admin/instance: A comment for method ListInstanceConfigs in service InstanceAdmin is changed (4254053)
  • spanner/admin/instance: A comment for method ListInstancePartitionOperations in service InstanceAdmin is changed (4254053)
  • spanner/admin/instance: A comment for method MoveInstance in service InstanceAdmin is changed (4254053)
  • spanner/admin/instance: A comment for method UpdateInstance in service InstanceAdmin is changed (4254053)
  • spanner/admin/instance: A comment for method UpdateInstanceConfig in service InstanceAdmin is changed (4254053)
  • spanner/admin/instance: A comment for method UpdateInstancePartition in service InstanceAdmin is changed (4254053)

1.75.0 (2025-02-02)

Features
  • spanner/admin/database: Add AddSplitPoints API (59fe58a)
Bug Fixes
  • spanner: Inject "x-goog-spanner-request-id" into outgoing client context (#11544) (a8f16ef), refs #11543

1.76.0 (2025-02-20)

DO NOT USE This version is retracted due to https://github.com/googleapis/google-cloud-go/issues/11630, use version >=v1.76.1

Features
  • spanner/admin/database: Add instance partitions field in backup proto (c6a6dc7)
  • spanner: Support multiplexed session for read-write transactions & partition ops (#11615) (4b40201)
Performance Improvements

1.76.1 (2025-02-21)

Bug Fixes
  • spanner: Multiplexed_session_previous_transaction_id is not supported in the request for a non multiplexed session (#11626) (a940bef)

Java

Changes for google-cloud-spanner

6.86.0 (2025-01-31)

Features
  • Add sample for asymmetric autoscaling instances (#3562) (3584b81)
  • Support graph and pipe queries in Connection API (#3586) (71c3063)
Bug Fixes
  • Always add instance-id for built-in metrics (#3612) (705b627)
  • deps: Update the Java code generator (gapic-generator-java) to 2.51.1 (3e27251)
  • deps: Update the Java code generator (gapic-generator-java) to 2.52.0 (bf69673)
  • spanner: Moved mTLSContext configurator from builder to construtor (#3605) (ac7c30b)
Dependencies
  • Update dependency com.google.cloud:sdk-platform-java-config to v3.42.0 (#3616) (2ea59f0)
  • Update dependency io.opentelemetry:opentelemetry-bom to v1.46.0 (#3530) (d505850)
Documentation
  • Clarify how async updates can overtake each other (#3581) (1be250f)
  • Fix typo timzeone -> timezone (bf69673)
  • Fixed parameter arguments for AbstractResultSet's Listener's on TransactionMetadata doc (#3602) (1f143a4)
  • samples: Add samples and tests for change streams transaction exclusion (#3098) (1f81600)

6.87.0 (2025-02-20)

Features
  • Add AddSplitPoints API (a5ebcd3)
  • Add option for multiplexed sessions with partitioned operations (#3635) (dc89b4d)
  • Add option to indicate that a statement is the last in a transaction (#3647) (b04ea80)
  • Adding gfe_latencies metric to built-in metrics (#3490) (314dadc)
  • spanner: Support multiplexed session for read-write transactions (#3608) (bda78ed)
Bug Fixes
  • deps: Update the Java code generator (gapic-generator-java) to 2.53.0 (20a3d0d)
  • spanner: End spans for read-write methods (#3629) (4a1f99c)
  • spanner: Release resources in TransactionManager (#3638) (e0a3e5b)
Dependencies
  • Update dependency com.google.cloud:sdk-platform-java-config to v3.43.0 (#3642) (c12968a)

Node.js

Changes for @google-cloud/spanner

7.18.0 (2025-01-29)

Features
  • Add gcp client attributes for Opentelemetry traces (#2215) (d2ff046)

7.18.1 (2025-02-05)

Bug Fixes

Python

Changes for google-cloud-spanner

3.52.0 (2025-02-19)

Features
  • Add additional opentelemetry span events for session pool (a6811af)
  • Add GCP standard otel attributes for python client (#1308) (0839f98)
  • Add updated span events + trace more methods (#1259) (ad69c48)
  • MetricsTracer implementation (#1291) (8fbde6b)
  • Support GRAPH and pipe syntax in dbapi (#1285) (959bb9c)
  • Support transaction and request tags in dbapi (#1262) (ee9662f)
  • x-goog-spanner-request-id: Introduce AtomicCounter (#1275) (f2483e1)
Bug Fixes
  • Retry UNAVAILABLE errors for streaming RPCs (#1278) (ab31078), closes #1150
  • tracing: Ensure nesting of Transaction.begin under commit + fix suggestions from feature review (#1287) (d9ee75a)
  • tracing: Only set span.status=OK if UNSET (#1248) (1d393fe), closes #1246
  • Update retry strategy for mutation calls to handle aborted transactions (#1279) (0887eb4)
Vertex AI Agent Builder

Vertex AI Search: Document-relevance scores for search results (GA)

You can ask to have a relevance score returned for each search result associated with a query. The returned score can be used to do post-search ranking or filtering of the results. This feature is available for search apps associated with structured and unstructured data stores.

This feature is Generally available (GA). For more information, see Get document-relevance score with search results.

Virtual Private Cloud

Accessing supported global Google APIs through Private Service Connect backends is available in General Availability.

Workflows

Support to create and manage tags is available. You can use tags to group workflows and other resources for reporting, auditing, and access control.

February 27, 2025

AlloyDB for PostgreSQL

AlloyDB's cross-region replication supports up to five secondary regions. You can use additional secondary regions to further harden disaster recovery response, or to serve geographically distributed workloads. For more information, see Cross-region replication overview and Work with cross-region replication.

Apigee UI

On February 27, 2025, we released an updated version of the Apigee Proxy Debug tool.

Overview

This release introduces a redesigned debugging experience for API proxies in the Apigee UI, which is available in Google Cloud console.

This new feature, Debug Sequence View (v2), addresses user feedback and aims to streamline the process of identifying and resolving issues in your API proxies.

We believe that Debug Sequence View will significantly improve the API proxy debugging experience. We encourage you to try it out and provide your valuable feedback as we continue to refine and enhance this feature!

Key highlights

  • Intuitive horizontal layout:
    The new Debug Sequence View (v2) features a horizontal sequence diagram, mirroring the familiar layout of the classic Apigee Console UI, making it easier to understand the flow of your API proxy transactions at a glance.
  • Enhanced clarity:
    The horizontal visualization, coupled with improved grouping of events, provides a clearer picture of policy execution, highlighting errors and their context within the transaction flow.
  • Streamlined workflow:
    Debug Sequence View (v2) is designed to reduce the need for disruptive pop-ups and sifting through events, offering a smoother and more focused debugging experience. Reimagined icons help quickly understand a transaction at a glance.
  • Feature parity:
    Debug Sequence View (v2) is designed for users already familiar with debugging in Apigee Classic UI to quickly be proficient.
  • Search:
    You can now search for a specific string in the sequence diagram and details pane.
  • Improved API status display:
    The API status display in the transaction list has been improved for increased readability.
  • Consolidated FlowInfo events:
    FlowInfo events are now grouped together in the sequence diagram.
  • Target URL displayed:
    Displayed target URL on "Request Sent" node when relevant
Backup and DR

Backup and DR now supports the latest RHEL and SLES OS and kernels in backup/recovery appliance 11.0.13 and later:

RHEL 8.8: 4.18.0-477.36.1, 4.18.0-477.43.1, 4.18.0-477.51.1, 4.18.0-477.55.1, 4.18.0-477.58.1, 4.18.0-477.64.1, 4.18.0-477.67.1, 4.18.0-477.70.1, 4.18.0-477.75.1, 4.18.0-477.81.1, 4.18.0-477.83.1

RHEL 8.10: 4.18.0-553.30.1, 4.18.0-553.32.1, 4.18.0-553.33.1

RHEL 9.3: 5.14.0-362.24.1

RHEL 9.4: 5.14.0-427.13.1, 5.14.0-427.16.1, 5.14.0-427.18.1, 5.14.0-427.20.1, 5.14.0-427.22.1, 5.14.0-427.24.1, 5.14.0-427.26.1, 5.14.0-427.28.1, 5.14.0-427.31.1, 5.14.0-427.33.1, 5.14.0-427.35.1, 5.14.0-427.37.1, 5.14.0-427.40.1, 5.14.0-427.42.1

RHEL 9.5: 5.14.0-503.11.1, 5.14.0-503.14.1, 5.14.0-503.15.1, 5.14.0-503.16.1, 5.14.0-503.19.1

SLES 15 SP6: All kernels

Cloud Composer

Database retention policy is available in Cloud Composer 3. You can use this feature to automatically delete older records from the Airflow database, which helps to maintain the Airflow database's size.

Cloud Load Balancing

In typical HTTPS communication, neither the load balancer nor the backend verify each other's identity, assuming that they are within a secure perimeter and can be trusted. However, when perimeter security needs reinforcement or communication extends beyond the perimeter, backend mTLS becomes essential. Backend mTLS ensures secure communication by requiring both the load balancer and the backend to mutually verify their identities.

With backend authenticated TLS, the load balancer verifies the backend server's certificate by checking its chain of trust, thereby confirming the backend's identity. Conversely, with backend mTLS, the backend server verifies the client certificate presented by the load balancer. Together, these mechanisms enable backend mTLS, ensuring that both parties validate each other's identity.

Backend mTLS complements frontend mTLS, which is already generally available (GA).

For details, see the following:

This capability is in Preview for global external Application Load Balancers.

Cloud Monitoring

On your custom dashboards, you can reduce the load time of the dashboard by using group widgets. The tab-group widget displays one member of a collection, and it provides tabs on the toolbar to let you select which member to display:

Colab Enterprise

You can use Terraform resources to schedule notebook runs, and to manage runtimes and runtime templates. To learn more, see the following:

Datastream

Datastream now supports Salesforce as a source. The feature is in Preview.

For more information, see the Datastream documentation.

Google Cloud Contact Center as a Service

Patch 3.31.36

This patch does the following:

  • Fixes an issue where the chat adapter was not appearing in the agent desktop when an incoming chat was received.
  • Fixes an issue where agents in Unavailable or Wrap up status were not receiving incoming contacts and were put into Unresponsive status.
  • Fixes a security vulnerability.
Google Distributed Cloud (software only) for VMware

Google Distributed Cloud (software only) for VMware 1.29.1100-gke.82 is now available for download. To upgrade, see Upgrade a cluster or a node pool. Google Distributed Cloud 1.29.1100-gke.82 runs on Kubernetes v1.29.13-gke.500.

If you are using a third-party storage vendor, check the GDC Ready storage partners document to make sure the storage vendor has already passed the qualification for this release.

After a release, it takes approximately 7 to 14 days for the version to become available for use with GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

The 1.29.1100-gke.82 release includes many vulnerability fixes. For a list of all vulnerabilities fixed in this release, see Vulnerability fixes.

Google Distributed Cloud (software only) for bare metal

Release 1.30.600-gke.69

Google Distributed Cloud for bare metal 1.30.600-gke.69 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.30.600-gke.69 runs on Kubernetes v1.30.9-gke.100.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

The following functional change was made in 1.30.600-gke.69:

  • Cluster deletion now deletes worker node pools prior to deleting any control plane node pools.

The following issues are fixed in 1.30.600-gke.69:

  • Fixed an issue where node upgrades failed due to missing super-admin.conf file.

  • Fixed an issue where bmctl update clustercommand fails for user clusters that were created with thecloudOperationsServiceAccountKeyPath setting in the header section of the cluster configuration file.

The 1.30.600-gke.69 release includes many vulnerability fixes. For a list of all vulnerabilities fixed in this release, see Vulnerability fixes.

For information about the latest known issues, see Google Distributed Cloud for bare metal known issues in the Troubleshooting section.

Release 1.30.500-gke.127

Google Distributed Cloud for bare metal 1.30.500-gke.127 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.30.500-gke.127 runs on Kubernetes 1.30.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

The following issues are fixed in 1.30.500-gke.127:

  • Fixed an issue where node upgrades failed due to missing super-admin.conf file.

  • Fixed an issue where prompting during bmctl update cluster prevented use of automation. You can now use the --quiet flag to skip prompting.

  • Fixed an issue where node machines didn't update when the registry mirror hosts field was updated.

The 1.30.500-gke.127 release includes many vulnerability fixes. For a list of all vulnerabilities fixed in this release, see Vulnerability fixes.

For information about the latest known issues, see Google Distributed Cloud for bare metal known issues in the Troubleshooting section.

Release 1.31.200-gke.59

Google Distributed Cloud for bare metal 1.31.200-gke.59 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.31.200-gke.59 runs on Kubernetes v1.31.5-gke.300.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

The following issue is fixed in 1.31.200-gke.69:

  • Fixed an issue where node upgrades failed due to missing super-admin.conf file.

The 1.31.200-gke.59 release includes many vulnerability fixes. For a list of all vulnerabilities fixed in this release, see Vulnerability fixes.

For information about the latest known issues, see Google Distributed Cloud for bare metal known issues in the Troubleshooting section.

Release 1.29.1100-gke.84

Google Distributed Cloud for bare metal 1.29.1100-gke.84 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.29.1100-gke.84 runs on Kubernetes v1.29.13-gke.500.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

The 1.29.1100-gke.84 release includes many vulnerability fixes. For a list of all vulnerabilities fixed in this release, see Vulnerability fixes.

The initial patch releases for 1.30.500, 1.30.600, and 1.31.200 contained a known issue that blocked cluster upgrades. This issue is fixed in the following updated patches:

  • 1.31.200-gke.59
  • 1.30.600-gke.69
  • 1.30.500-gke.127

The release notes and related documentation have been updated to reflect the updated patch version information.

Google Kubernetes Engine

The GKE Autopilot partner program now lets partners create and manage allowlists that correspond to specific partner workloads. In GKE version 1.32.1-gke.1729000 and later, you can explicitly install allowlists in your clusters to run only the partner solutions that you need.

To learn more, see Run privileged workloads from GKE Autopilot partners.

Network Connectivity Center

Producer VPC Spokes is generally available.

If you have a VPC network that consumes a service offered through private services access, you can use a Network Connectivity Center producer VPC spoke to make the service reachable by other spokes on a hub.

Network Intelligence Center

Flow Analyzer is available in General availability.

Organization Policy

Custom organization policies are now generally available for Service Management. For more information, see Manage Service Management resources with custom constraints.

Custom organization policies are now generally available for the Video Stitcher API. For more information, see Create custom constraints for the Video Stitcher API.

Resource Manager

Custom organization policies are now generally available for Service Management. For more information, see Manage Service Management resources with custom constraints.

Custom organization policies are now generally available for the Video Stitcher API. For more information, see Create custom constraints for the Video Stitcher API.

VPC Service Controls

Preview stage support for the following integration:

Virtual Private Cloud

The following Private Service Connect monitoring metrics are available for both producers and consumers in General Availability:

  • Closed connections count
  • Received packets dropped count
  • Sent packets dropped count
  • New connections count
  • Open connections
  • Received bytes count
  • Received packets count
  • Sent bytes count
  • Sent packets count

Additionally, the NAT IP address capacity metric is available for producers in General Availability.

You can use these metrics to help monitor and troubleshoot published services, endpoints that connect to published services, and backends that connect to published services. For more information, see Monitor Private Service Connect connections.

February 26, 2025

Backup and DR

Backup and DR Service 11.0.14.302 is now available to update your backup/recovery appliance. Refer to these instructions to update your appliance.

Backup and DR Service 11.0.14.302 includes the following fixes and improvements:

  • The following CVEs have been addressed in this hotfix: CVE-2024-42301, CVE-2024-42284, CVE-2024-41092
  • In some cases, a database that has data on multiple volumes can be mounted successfully, but a subsequent unmount operation fails. This has been fixed.
  • In rare cases, the management console could lose the connection to the backup appliance for up to an hour, after which it automatically recovered. During the disconnection, the scheduled backups continued to be taken but the jobs monitor could not show progress and new on-demand jobs could not be run. This has been fixed.
  • A Db2 log backup to a full disk failed without notification. With this hotfix, upon failure the disk is resized and the backup job is retried successfully.
  • A persistent disk backup job for an SAP HANA or an IBM Db2 database fails if the backup/recovery appliance includes another host with the same name in a different project. This has been fixed.
  • Imported persistent disk snapshots of SAP HANA and Db2 databases sometimes failed to mount or to restore if the database host had a custom (non-default) PD disk names. This fix ensures that these imported databases can be successfully mounted and restored.
  • For SAP IQ databases, the INC_BKP.1 file (a config file) is backed up. It can be a large file that consumes much storage, so starting with this hotfix the config file is compressed for backup.
  • Recovery of an IBM Db2 database from a standby image sometimes failed. This has been fixed.
  • Backup and DR now supports "Import without ownership" for SAP HANA and IBM Db2 databases and logs.
Cloud Database Migration Service

Database Migration Service for homogeneous Cloud SQL for PostgreSQL migrations now lets you migrate specific databases from your source instance. You can view metrics, statuses, and errors separately for each database.

For more information about migrating specific databases, see:

Cloud Monitoring

You can now enable and disable the logging of uptime-check failures by using the log_check_failures field in the Cloud Monitoring API.

Cloud SQL for MySQL

You can now include replicas when you perform an in-place major version upgrade using gcloud or the Cloud SQL Admin API. For more information, see Upgrade the database major version in-place.

Cloud SQL for PostgreSQL

You can now include replicas when you perform an in-place major version upgrade using gcloud or the Cloud SQL Admin API. For more information, see Upgrade the database major version in-place.

Cloud Storage

Bucket relocation for Cloud Storage is generally available (GA). You can use bucket relocation to relocate buckets between geographic locations.

Google Kubernetes Engine

(2025-R08) Version updates

GKE cluster versions have been updated.

New versions available for upgrades and new clusters.

The following Kubernetes versions are now available for new clusters and for opt-in control plane upgrades and node upgrades for existing clusters. For more information on versioning and upgrades, see GKE versioning and support and Upgrades.

Rapid channel

  • Version 1.32.1-gke.1729000 is now the default version for cluster creation in the Rapid channel.
  • The following versions are now available in the Rapid channel:
  • The following versions are no longer available in the Rapid channel:
    • 1.29.13-gke.1109000
    • 1.29.13-gke.1169000
    • 1.30.9-gke.1201000
    • 1.30.9-gke.1231000
    • 1.31.5-gke.1169000
    • 1.31.5-gke.1233000
    • 1.32.1-gke.1489001
  • Auto-upgrade targets are now available for the following minor versions:
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.28 to version 1.29.14-gke.1018000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.29 to version 1.30.10-gke.1022000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.30 to version 1.31.6-gke.1020000 with this release.
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.29 to version 1.29.14-gke.1018000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.30 to version 1.30.10-gke.1022000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.31 to version 1.31.6-gke.1020000 with this release.

Regular channel

  • Version 1.31.5-gke.1169000 is now the default version for cluster creation in the Regular channel.
  • The following versions are now available in the Regular channel:
  • The following versions are no longer available in the Regular channel:
    • 1.29.13-gke.1038000
    • 1.30.9-gke.1046000
    • 1.31.5-gke.1068000
    • 1.32.1-gke.1200003
  • Auto-upgrade targets are now available for the following minor versions:
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.28 to version 1.29.13-gke.1109000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.29 to version 1.30.9-gke.1127000 with this release.
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.29 to version 1.29.13-gke.1109000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.30 to version 1.30.9-gke.1127000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.31 to version 1.31.5-gke.1169000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.32 to version 1.32.1-gke.1357001 with this release.

Stable channel

  • Version 1.30.9-gke.1009000 is now the default version for cluster creation in the Stable channel.
  • The following versions are now available in the Stable channel:
  • The following versions are no longer available in the Stable channel:
    • 1.29.12-gke.1270000
    • 1.30.8-gke.1261000
    • 1.31.4-gke.1372000
  • Auto-upgrade targets are now available for the following minor versions:
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.28 to version 1.29.13-gke.1006000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.29 to version 1.30.9-gke.1009000 with this release.
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.29 to version 1.29.13-gke.1006000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.30 to version 1.30.9-gke.1009000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.31 to version 1.31.5-gke.1023000 with this release.

Extended channel

  • Version 1.31.5-gke.1169000 is now the default version for cluster creation in the Extended channel.
  • The following versions are now available in the Extended channel:
  • The following versions are no longer available in the Extended channel:
    • 1.27.16-gke.2440000
    • 1.28.15-gke.1612000
    • 1.28.15-gke.1844000
    • 1.29.13-gke.1038000
    • 1.30.9-gke.1046000
    • 1.31.5-gke.1068000
    • 1.32.1-gke.1200003
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.28 to version 1.28.15-gke.1641000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.29 to version 1.29.13-gke.1109000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.30 to version 1.30.9-gke.1127000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.31 to version 1.31.5-gke.1169000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.32 to version 1.32.1-gke.1357001 with this release.

No channel

(2025-R08) Version updates

  • Version 1.32.1-gke.1729000 is now the default version for cluster creation in the Rapid channel.
  • The following versions are now available in the Rapid channel:
  • The following versions are no longer available in the Rapid channel:
    • 1.29.13-gke.1109000
    • 1.29.13-gke.1169000
    • 1.30.9-gke.1201000
    • 1.30.9-gke.1231000
    • 1.31.5-gke.1169000
    • 1.31.5-gke.1233000
    • 1.32.1-gke.1489001
  • Auto-upgrade targets are now available for the following minor versions:
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.28 to version 1.29.14-gke.1018000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.29 to version 1.30.10-gke.1022000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.30 to version 1.31.6-gke.1020000 with this release.
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.29 to version 1.29.14-gke.1018000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.30 to version 1.30.10-gke.1022000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.31 to version 1.31.6-gke.1020000 with this release.

(2025-R08) Version updates

  • Version 1.31.5-gke.1169000 is now the default version for cluster creation in the Regular channel.
  • The following versions are now available in the Regular channel:
  • The following versions are no longer available in the Regular channel:
    • 1.29.13-gke.1038000
    • 1.30.9-gke.1046000
    • 1.31.5-gke.1068000
    • 1.32.1-gke.1200003
  • Auto-upgrade targets are now available for the following minor versions:
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.28 to version 1.29.13-gke.1109000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.29 to version 1.30.9-gke.1127000 with this release.
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.29 to version 1.29.13-gke.1109000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.30 to version 1.30.9-gke.1127000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.31 to version 1.31.5-gke.1169000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.32 to version 1.32.1-gke.1357001 with this release.

(2025-R08) Version updates

  • Version 1.30.9-gke.1009000 is now the default version for cluster creation in the Stable channel.
  • The following versions are now available in the Stable channel:
  • The following versions are no longer available in the Stable channel:
    • 1.29.12-gke.1270000
    • 1.30.8-gke.1261000
    • 1.31.4-gke.1372000
  • Auto-upgrade targets are now available for the following minor versions:
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.28 to version 1.29.13-gke.1006000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.29 to version 1.30.9-gke.1009000 with this release.
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.29 to version 1.29.13-gke.1006000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.30 to version 1.30.9-gke.1009000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.31 to version 1.31.5-gke.1023000 with this release.

(2025-R08) Version updates

  • Version 1.31.5-gke.1169000 is now the default version for cluster creation in the Extended channel.
  • The following versions are now available in the Extended channel:
  • The following versions are no longer available in the Extended channel:
    • 1.27.16-gke.2440000
    • 1.28.15-gke.1612000
    • 1.28.15-gke.1844000
    • 1.29.13-gke.1038000
    • 1.30.9-gke.1046000
    • 1.31.5-gke.1068000
    • 1.32.1-gke.1200003
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.28 to version 1.28.15-gke.1641000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.29 to version 1.29.13-gke.1109000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.30 to version 1.30.9-gke.1127000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.31 to version 1.31.5-gke.1169000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.32 to version 1.32.1-gke.1357001 with this release.

(2025-R08) Version updates

Network Connectivity Center

Private Service Connect connection propagation is asynchronous after spoke creation or deletion. When a VPC spoke is removed from a hub, it can take some time to update propagated Private Service Connect connections. While the Private Service Connect propagation connection update is in progress, traffic from the VM within the VPC network can flow to the backend, even after the VPC spoke is added to a new hub. To avoid this issue, we recommend that before adding the spoke to another hub, make sure that all of the propagation status entries for the VPC network in the previous hub, whether as a source spoke or a target spoke, are deleted.

Private Service Connect connection propagation is generally available.

Connection propagation through the Network Connectivity Center hub provides access to Private Service Connect endpoints from other VPC networks.

Vertex AI Agent Builder

Vertex AI Search: Personalize responses from the answer method (GA)

When making a query call to the answer method, you can provide information about the user to personalize the generated answer.

This feature is Generally available (GA). For more information, see Personalize answers.

Virtual Private Cloud

Private Service Connect propagated connections are available in General Availability. With propagated connections, services that are accessible in one consumer VPC spoke through Private Service Connect endpoints can be privately accessed by other consumer VPC spokes that are connected to the same Network Connectivity Center hub.

February 25, 2025

AlloyDB for PostgreSQL

The alloydb_scann extension is updated to include the following vector search improvements in Preview:

  • AlloyDB for PostgreSQL introduces inline filtering for vector search. With inline filtering, SQL filter evaluation is performed at the same time as vector search. This feature mitigates potential issues from existing pre and post-filter evaluation mechanisms. For more information about scann.enable_inline_filtering, see ScaNN index reference.
  • A distribution histogram is available in the pg_stat_ann_indexes view, which helps you understand the distribution of vectors between partitions and num_leaves of your ScaNN index. For more information, including recommendations about tuning the distributionpercentile metric, see Tuning metrics.
BigQuery

You can now see a list of BigQuery API and service dependencies. You can also review the effects of disabling an API or service.

You can use the best sellers and price competitiveness migration guides to transition to the newer version of the reports. This feature is in preview.

BigQuery resource utilization charts provide metrics views and more chart configuration options in Preview.

Cloud Composer

Cloud Composer 3 is now available in Stockholm (europe-north2). The change is gradually rolling out.

Cloud SQL for PostgreSQL

You can now export or import all user databases in an instance using a directory-formatted, parallel export or import operation.

Cloud Service Mesh

Managed Cloud Service Mesh with the Traffic Director control plane now supports configuring the network topology to use X-Forwarded-For and X-Forwarded-Client-Cert headers by MeshConfig or annotations of workloads.

Config Controller

Config Controller now uses the following versions of its included products:

Generative AI on Vertex AI

Gemini 2.0 Flash-Lite is now generally available

Gemini 2.0 Flash-Lite is now generally available. For more information, see Gemini 2.0.

Google Cloud VMware Engine

Generally available: VMware Engine Update center on the Google Cloud console is now generally available. Update center lets you view and manage updates to your private clouds, including specifying start dates and times for schedulable VMware version updates, and viewing the status of in-progress schedulable and non-schedulable updates, such as security patches. For more information, see Update a private cloud.

Google Kubernetes Engine

Three new metrics are added for checking node and node pool status:

  • kubernetes.io/node/status_condition: The condition of a node from the node status condition field. The Ready field has Unknown status if the node controller has not heard from the node in the last node-monitor-grace-period period. This metric is available for clusters with GKE version 1.32.1-gke.1260000 and later.

  • kubernetes.io/node_pool/multi_host/available: The multi-host NodePool availability. When all the nodes in the node pool are available, the value is True. If any of the nodes in the node pool are unavailable, the value is False. This metric is available for Multi-host TPU node pools only.

  • kubernetes.io/node_pool/status: The current status of the node pool from the NodePool instance. Status updates happen after GKE API operations complete. This metric is available for Multi-host TPU node pools only.

Google SecOps

The Custom Fields feature has been rolled back.

Security Command Center

You can now use Organization Policy Service custom constraints to provide more granular control over specific fields for some Security Command Center resources. For more information, see Configure custom organization policies. This feature is in General Availability.

February 24, 2025

App Hub

App Hub supports resources from the following sources in Preview:

  • Bigtable
  • Cloud SQL
  • Cloud Storage
  • Memorystore for Redis
  • Pub/Sub
  • Spanner

BigQuery

You can now use the @@location system variable to set the location in which to run a query. This feature is in preview.

Bigtable

Bigtable Data Boost, a serverless compute service designed for high-throughput read jobs and queries, is generally available (GA).

Automated backup for Bigtable is generally available (GA). For more information, see the Backups overview.

Cloud Service Mesh

If you're a user of managed Cloud Service Mesh with the ISTIOD control plane implementation, you can now fine-tune your control plane modernization. See the Managed control plane modernization page for details.

Cloud Storage

A weekly digest of client library updates from across the Cloud SDK.

Node.js

Changes for @google-cloud/storage

7.15.2 (2025-02-20)

Bug Fixes

You can move an object within a bucket with hierarchical namespace enabled using the Objects: move method.

Container Optimized OS

cos-dev-121-18867-0-24

Kernel Docker Containerd GPU Drivers
COS-6.6.74 v25.0.7 v2.0.2 See List

Updated app-admin/google-guest-configs to v20250207.00.

Upgraded app-admin/google-guest-agent to v20250204.02.

Updated the default tag of the GPU driver supporting the NVIDIA H200 GPU device to 570.86.15.

Upgraded cloud-init from 23.4.3 to 24.4.1.

Updated Konlet to v0.13.4.

Fixed CVE-2025-0840 in binutils.

Support for NVIDIA B200 GPU – Added support for the R570 driver series, including version 570.86.15. This version has been assigned the latest, default, and R570 tags.

Updated cos-gpu-installer to v2.4.7: 1.Added Support for NVIDIA B200 GPU. 2.Enabled --prepare-build-tools flag to preload GPU driver metadata for ARM64

Upgraded app-admin/fluent-bit to v3.2.5.

Upgraded sys-apps/hwdata to v0.391.

Upgraded sys-apps/diffutils to v3.11.

Upgraded sys-apps/pv to v1.9.27.

Fixed CVE-2024-13176 in dev-libs/openssl.

Fixed CVE-2025-0395 in sys-libs/glibc.

Fixed CVE-2024-9287 in dev-lang/python.

Runtime sysctl changes:

  • Changed: fs.file-max: 811771 -> 811788

cos-109-17800-436-42

Kernel Docker Containerd GPU Drivers
COS-6.1.124 v24.0.9 v1.7.24 See List

Updated app-admin/google-guest-configs to v20250207.00.

Fixed CVE-2024-13176 in dev-libs/openssl.

Fixed CVE-2025-0395 in sys-libs/glibc.

Fixed CVE-2024-9287 in dev-lang/python.

Fixed CVE-2024-56664 in the Linux kernel.

Fixed CVE-2024-57949 in the Linux kernel.

Fixed CVE-2024-57951 in the Linux kernel.

Runtime sysctl changes:

  • Changed: fs.file-max: 812276 -> 812258

cos-117-18613-164-47

Kernel Docker Containerd GPU Drivers
COS-6.6.72 v24.0.9 v1.7.24 See List

Fixed CVE-2025-0395 in sys-libs/glibc.

Fixed CVE-2024-9287 in dev-lang/python.

Updated app-admin/google-guest-configs to v20250207.00.

Fixed CVE-2024-13176 in dev-libs/openssl.

Fixed CVE-2024-57949 in the Linux kernel.

Fixed CVE-2024-57951 in the Linux kernel.

Runtime sysctl changes:

  • Changed: fs.file-max: 811817 -> 811792

cos-113-18244-291-46

Kernel Docker Containerd GPU Drivers
COS-6.1.123 v24.0.9 v1.7.24 See List

Updated app-admin/google-guest-configs to v20250207.00.

Fixed CVE-2024-13176 in dev-libs/openssl.

Fixed CVE-2025-0395 in sys-libs/glibc.

Fixed CVE-2024-9287 in dev-lang/python.

Fixed CVE-2024-57949 in the Linux kernel.

Fixed CVE-2024-57951 in the Linux kernel.

Runtime sysctl changes:

  • Changed: fs.file-max: 812031 -> 812058

cos-105-17412-535-61

Kernel Docker Containerd GPU Drivers
COS-5.15.173 v23.0.3 v1.7.23 See List

Fixed CVE-2025-0395 in sys-libs/glibc.

Fixed CVE-2024-9287 in dev-lang/python.

Fixed CVE-2023-27043 in dev-lang/python.

Fixed CVE-2024-57951 in the Linux kernel.

Fixed CVE-2024-53215 in the Linux kernel.

Fixed CVE-2024-56569 in the Linux kernel.

Dataproc

New Dataproc on Compute Engine subminor image versions:

  • 2.0.133-debian10, 2.0.133-rocky8, 2.0.133-ubuntu18
  • 2.1.81-debian11, 2.1.81-rocky8, 2.1.81-ubuntu20, 2.1.81-ubuntu20-arm
  • 2.2.47-debian12, 2.2.47-rocky9, 2.2.47-ubuntu22
Dialogflow

Dialogflow CX (Conversational Agents): Text-to-speech used by Dialogflow now supports new Chirp HD voices.

Dialogflow CX (Conversational Agents) & ES: Text-to-speech removed support for voices across European markets. Affected users were sent an email announcement.

Generative AI on Vertex AI

Anthropic's Claude Sonnet 3.7 is in Preview on Vertex AI. To learn more, view the Claude Sonnet 3.7 model card in Model Garden.

Identity and Access Management

Workforce Identity Federation can map up to 400 groups from Microsoft Entra ID. The feature is generally available. To learn more, see Configure Workforce Identity Federation with Microsoft Entra ID and a large number of groups.

Workforce Identity Federation supports an attribute mapping of up to 400 groups and a maximum size of 16 KB.

Looker

The following Gemini in Looker features are available in Preview for instances on Looker 25.2 and later:

To learn more about how to activate these features, see Admin settings – Gemini in Looker.

Conversational Analytics is now available in Preview for Looker (original) and Looker (Google Cloud core) instances on Looker 25.0 and later that have both Studio in Looker and Gemini in Looker enabled. You can use Conversational Analytics to query your Looker Explore data in natural language.

VPC Service Controls

VPC Service Controls feature (Status: Preview): The VPC Service Controls violation analyzer lets you diagnose access denial events for services in your perimeters using an encrypted troubleshooting token generated by VPC Service Controls. The violation analyzer also provides troubleshooting results that can help you understand and resolve the access denial events. This feature is available in Preview.

For more information, see Diagnose an access denial event using the VPC Service Controls violation analyzer.

February 22, 2025

Google SecOps

New Custom fields for case management

  • Added support for custom fields that analysts can fill out when working with cases or alerts, such as report time or false positives. These fields appear as a widget in the Case or Alert overview tab.
  • Custom fields can now be added to playbooks as actions or placeholders.
  • Requires downloading the latest Siemplify integration.

For more information about this new feature, see Create Custom Fields.

Google SecOps SOAR

Release 6.3.36 is currently in Preview. This release contains the following feature.

New Custom fields for case management

  • Added support for custom fields that analysts can fill out when working with cases or alerts, such as report time or false positives. These fields appear as a widget in the Case or Alert overview tab.
  • Custom fields can now be added to playbooks as actions or placeholders.
  • Requires downloading the latest Siemplify integration.

For more information about this new feature, see Create Custom Fields.

Release 6.3.35 is now in General Availability.

February 21, 2025

Access Approval

Access Approval supports Cloud Workstations in the GA stage.

Access Transparency

Access Transparency supports Cloud Workstations in the GA stage.

AlloyDB for PostgreSQL

You can use an API to import data to AlloyDB for PostgreSQL clusters. This feature is generally available (GA). You can also cancel the import of data and check the status of the import. For more information, see Import a CSV file and Import a SQL file.

You can perform an in-place major version upgrade of your AlloyDB cluster to PostgreSQL version 16 from PostgreSQL version 14 or 15. This feature is available in Preview.

Cloud Composer

Starting April 14, 2025, the Deployment Manager API won't be automatically enabled when you enable Cloud Composer API because this API isn't used by the Cloud Composer service.

Cloud DNS

Health checks for external endpoints in Cloud DNS routing policies are now available in GA.

Cloud Endpoints

Version 1.0.17 of the endpoints-management-java Java library is available.

This release contains no change in binaries.

Bug ID Description
387351751 Fixed Checkstyle violations in the ServiceConfigSupplierTest the of source code.
Cloud Key Management Service

Cloud KMS now supports the following post-quantum computing (PQC) algorithms for digital signatures in Public Preview:

  • PQ_SIGN_ML_DSA_65: Module-lattice-based digital signature algorithm
  • PQ_SIGN_SLH_DSA_SHA2_128S: Stateless hash-based digital signature algorithm

To Retrieve a public key for a PQC key, you must use the gcloud CLI or the Cloud KMS REST API.

  • For the gcloud CLI, use the --public-key-format nist-pqc flag.
  • For the REST API, use the public_key_format=NIST_PQC header parameter.

For more information about PQC algorithms, see PQC signing algorithms. For more information about PQC digital signatures, see Post-quantum cryptography (PQC) digital signature.

Gemini Code Assist

Gemini Code Assist now uses a code-optimized version of Gemini 2.0. This new model is used in the following experiences:

  • Chat
  • Code generation
  • Code transformation
Generative AI on Vertex AI
  • PEFT Docker updates
    • Added support for evaluation metrics like perplexity, bleu, google_bleu, rouge1, rouge2, rougeL, rougeLSum.
    • Uses the best checkpoint and loads the model based on the best eval metrics.
    • Run training and eval only for data which is less than or equal to the max_seq_length.
    • Use gcloud storage rsync instead of csfuse to save a checkpoint.
  • Fine tuning updates
  • Model updates
    • Updated the PaliGemma model card by supporting PaliGemma 2 mix models, and segmentation functionality to Paligemma 1 models.
    • Updated the LLaVa model card by supporting LLaVA Next models and adding vLLM to the notebook.
Google Distributed Cloud connected

This is a minor release of Google Distributed Cloud connected (version 1.8.0).

The following new functionality has been introduced in this release of Google Distributed Cloud connected:

  • Refreshed GDC connected rack hardware. New GDC connected rack hardware is now available for purchase as a preview-level offering. This new offering allows you to deploy GDC connected racks as combinations of base rack pairs and up to three expansion racks for each zone. Each rack is populated by up to four compute blocks of three machines each. For more information, see Google Distributed Cloud connected form factors.

  • GDC connected services platform. Google Distributed Cloud connected now ships with a platform supporting the deployment of select Google services. For more information, see Manage Google services.

  • GPU workloads on GDC connected servers. You can now deploy GPU-based workloads on Google Distributed Cloud connected servers. The machines now ship with optional NVIDIA L4 GPUs. For more information, see Manage GPU workloads. This is a limited-access feature; contact your Google field sales representative for details.

  • Configurable local storage schemas. You can now configure the local storage present on GDC connected deployments with custom schemas. For more information, see Configure local storage schemas.

  • Network connectivity verification tool. Google Distributed Cloud connected now offers a tool that allows you to verify that your local network meets the connectivity requirements for Google Distributed Cloud connected. For more information, see Validate your connectivity before ordering Distributed Cloud connected.

  • L2 load balancer virtual IP pool support. You can now specify IPv4 and IPv6 addresses, address ranges, or subnetworks for ingress traffic for services that run behind the GDC connected L2 load balancer when the cluster is running in survivability mode. For more information, see Layer 2 load balancing with MetalLB.

  • Terraform support for the Edge Container API. The Google Distributed Cloud Connected Edge Container API is now supported in Terraform. See the Terraform repository for details.

  • Symcloud Storage metrics. Certain metrics for Symcloud Storage are now available in Cloud Monitoring. For more information, see Google Distributed Cloud metrics.

The following changes to existing functionality have been introduced in this release of Google Distributed Cloud connected:

  • Kubernetes metadata API now required for cluster creation and upgrades. You must enable the kubernetesmetadata.googleapis.com API to create Google Distributed Cloud connected clusters. This API is also required for upgrading clusters to Google Distributed Cloud connected software version 1.8.0. For more information, see Create and manage clusters.

  • Configure CMEK on existing clusters and node pools. You can now enable and disable support for Customer-Managed Encryption Keys (CMEK) on existing Google Distributed Cloud connected clusters and node pools. For more information, see Local storage security.

  • Improved hardware ordering process. The ordering process for Google Distributed Cloud connected hardware has been improved. For more information, see Order hardware.

    • The order form for Google Distributed Cloud connected hardware in the Cloud console now has feature parity with the Google Distributed Cloud Hardware Management API.
    • The Google Distributed Cloud Hardware Management API has been improved with more robust functionality.
  • Overhauled pricing page. The pricing page for Google Distributed Cloud connected has been overhauled to include detailed pricing information for the supported form factors and their respective regions. For more information, see Pricing.

  • Hardware ordering documentation has been expanded. The "Order hardware" page has been expanded with additional information on prerequisites, enabling the Google Distributed Cloud Hardware Management API, and the actions that can be performed on an order. For more information, see Order hardware.

The following functionality has been deprecated in this release of Google Distributed Cloud connected:

  • Legacy GDC connected rack hardware. The legacy GDC connected rack hardware (also known as "Config 1" and "Config 2") has reached end-of-sale and can no longer be ordered. Google continues to support your existing legacy rack deployments until the end of your contract term. For more information, contact your Google field sales representative.

  • GPU workloads on refreshed GDC connected racks. The refreshed Google Distributed Cloud connected rack hardware does not support GPU workloads. GPU workloads are supported on Google Distributed Cloud connected legacy rack hardware and on Google Distributed Cloud connected servers as a limited-access feature.

  • Virtual machine workloads on refreshed GDC connected racks. The refreshed Google Distributed Cloud connected rack hardware does not support virtual machine workloads. Virtual machine workloads are supported on Google Distributed Cloud connected legacy rack hardware and on Google Distributed Cloud connected servers.

The following issues have been resolved in this release of Google Distributed Cloud connected:

  • Virtual machine management no longer fails after a node has been powered down for an extended time. If you power down your Google Distributed Cloud connected machines for an extended period of time, you can now reliably manage virtual machines scheduled on the corresponding nodes after you power the machines back up.

  • The Kubernetes API server no longer returns 404 errors when attempting to access virt-api endpoints.

  • Cluster deletion no longer fails due to stale Symcloud Storage data. You can now reliably delete a cluster during disaster recovery or cluster reset. Symcloud Storage now properly cleans up the corresponding Symcloud Storage volumes.

  • Containerized Data Importer (CDI) import performance has been improved. When creating a virtual machine that uses a block Symcloud Storage volume, the speed of importing machine images has been significantly improved.

This release of Google Distributed Cloud connected contains the following known issues:

  • Virtual machines using file-based Symcloud Storage volumes can experience a CDI import error. When creating a virtual machine that uses a file-based Symcloud Storage volume, you can experience a CDI import failure. To work around this issue, add the following annotation to the corresponding Symcloud storage class config:

    annotations:
            cdi.kubevirt.io/enable-qemu-target-zero-option: "false"
    
  • The Storage Infrastructure Cluster cannot be deleted. On refreshed rack hardware deployments, the first cluster in a Google Distributed Cloud connected zone, also known as the Storage Infrastructure Cluster (SIC) cannot be deleted. Doing so would render Google Distributed Cloud connected storage inoperable. This is intentional behavior. Legacy Google Distributed Cloud connected rack hardware deployments and Google Distributed Cloud connected server deployments are not affected by this issue.

  • You must manually copy storage secrets for corresponding buckets to the target clusters in a zone. For Google Distributed Cloud connected zones with more than one cluster deployed on refreshed rack hardware, management of storage buckets for all clusters must be done through the first cluster in the zone, also known as the Storage Infrastructure Cluster (SIC). This is because bucket access is granted through roles to users on the SIC. When access to a bucket is granted, a secret is generated on the SIC for the associated user, and Google Distributed Cloud connected does not synchronize storage secrets across clusters. To work around this issue, you must manually copy the respective storage secrets from the "storage infrastructure cluster" to the cluster on which the corresponding storage buckets are used. Legacy Google Distributed Cloud connected rack hardware deployments and Google Distributed Cloud connected server deployments do not use a SIC and are not affected by this issue.

  • Storage is not freed immediately upon cluster deletion. After deleting a cluster, the storage used by that cluster is not freed up immediately. This is because storage clean-up is part of a garbage collection task that runs infrequently. To work around this issue, manually delete all of a cluster's persistent volumes before deleting the cluster itself.

  • Machines can experience intermittent connectivity loss. Google Distributed Cloud connected machines can experience intermittent connectivity loss due to a rare condition that can occur with fleet credential management. To remedy this issue, contact Google Support.

  • After a network disruption, Symcloud Storage volumes can fail to mount or dismount. If a node that uses Symcloud Storage volumes experiences a network disconnection, the Symcloud Storage volumes can fail to mount or dismount after network connectivity is restored. This is caused by the iomgr service entering a degraded state. To work around this issue, delete the iomgr container on the affected node.

  • Reallocating a GPU resource from a VM to a container can cause an initialization error. When you reallocate a GPU from a virtual machine workload to a container workload, you might receive an NVML initialization error. To remedy this issue, contact Google Support.

  • The anthos-multinet container might take up to two hours to fully start. You might intermittently experience a slower than normal startup for the anthos-multinet container (up to two hours). To remedy this issue, contact Google Support.

The following Google Distributed Cloud connected components have been updated:

  • GKE on Bare Metal has been updated from version 1.28.700-gke.154 to version 1.29.800-gke.111. (This component was formerly known as Anthos Clusters on Bare Metal.)

  • Kubernetes has been updated from version 1.28.10 to version 1.29.

Security mitigations for the following vulnerabilities have been implemented in this release of Google Distributed Cloud connected:

  • OS layer security mitigations: CVE-2024-41087, CVE-2024-40961, CVE-2024-41000, CVE-2024-40995, CVE-2024-38588, CVE-2024-40905, CVE-2024-40959, CVE-2024-39487, CVE-2024-42131, CVE-2024-42145, CVE-2024-36901

  • GKE on Bare Metal security mitigations: CVE-2024-37371, CVE-2021-38297, CVE-2022-23806, CVE-2023-24538, CVE-2023-24540, CVE-2023-25775, CVE-2023-29402, CVE-2023-29404, CVE-2023-29405, CVE-2020-22218, CVE-2024-0553, CVE-2024-0567, CVE-2024-37370, GHSA-87m9-rv8p-rgmg, CVE-2024-39487, CVE-2024-41040, CVE-2024-41046, CVE-2024-41049, CVE-2024-41059, CVE-2024-41070, CVE-2024-42104, CVE-2024-42148, CVE-2023-49083, CVE-2024-0743, CVE-2024-6609, CVE-2024-46738, CVE-2024-46740, CVE-2024-46743, CVE-2024-46744, CVE-2024-46747, CVE-2024-46756, CVE-2024-46757, CVE-2024-46758, CVE-2024-46759, CVE-2024-46782, CVE-2024-46798, CVE-2024-46800, CVE-2024-46804, CVE-2024-46814, CVE-2024-46815, CVE-2024-46818, CVE-2024-46828, CVE-2024-46844, CVE-2020-29652, CVE-2021-29923, CVE-2021-33195, CVE-2021-33196, CVE-2021-33198, CVE-2021-39293, CVE-2021-41771, CVE-2021-41772, CVE-2021-44716, CVE-2022-2879, CVE-2022-2880, CVE-2022-21698, CVE-2022-23772, CVE-2022-23773, CVE-2022-24675, CVE-2022-24921, CVE-2022-28131, CVE-2022-28327, CVE-2022-28948, CVE-2022-30580, CVE-2022-30630, CVE-2022-30631, CVE-2022-30632, CVE-2022-30633, CVE-2022-30635, CVE-2022-32189, CVE-2022-41715, CVE-2022-41724, CVE-2022-41725, CVE-2023-5717, CVE-2023-6040, CVE-2023-6356, CVE-2023-6536, CVE-2023-6606, CVE-2023-6931, CVE-2023-6932, CVE-2023-24534, CVE-2023-24536, CVE-2023-24537, CVE-2023-24539, CVE-2023-29400, CVE-2023-29403, CVE-2023-29499, CVE-2023-35827, CVE-2023-46838, CVE-2023-51780, CVE-2023-51781, CVE-2023-51782, CVE-2023-52436, CVE-2023-52439, CVE-2023-52444, CVE-2023-52445, CVE-2023-52451, CVE-2023-52464, CVE-2023-52469, CVE-2024-1086, CVE-2024-26586, CVE-2024-26597, CVE-2024-26598, CVE-2023-6270, CVE-2023-39323, CVE-2023-45285, CVE-2023-45287, CVE-2023-52434, CVE-2024-0565, CVE-2024-0985, CVE-2024-26882, CVE-2024-26883, CVE-2024-26884, CVE-2024-26898, CVE-2024-26907, CVE-2024-26934, CVE-2024-27020, CVE-2022-48655, CVE-2019-16884, CVE-2021-30465, CVE-2021-33194, CVE-2021-38561, CVE-2021-43565, CVE-2021-43816, CVE-2022-23648, CVE-2022-27191, CVE-2022-27664, CVE-2022-32149, CVE-2022-41723, CVE-2022-43945, CVE-2024-36971, CVE-2024-38583, CVE-2024-39480, CVE-2024-39495, CVE-2024-40902, CVE-2024-7348, CVE-2023-47038, CVE-2024-42161, CVE-2024-42224, CVE-2024-6104, GHSA-mh55-gqvf-xfwm, CVE-2016-3709, CVE-2024-7264, CVE-2024-36901, CVE-2024-36938, CVE-2024-41009, CVE-2024-41012, CVE-2024-41055, CVE-2024-41063, CVE-2024-41064, CVE-2024-42101, CVE-2024-42102, CVE-2024-42131, CVE-2024-42137, CVE-2024-42152, CVE-2024-42153, CVE-2024-42154, CVE-2023-23931, CVE-2024-50096, CVE-2024-50099, CVE-2021-3669, CVE-2021-3733, CVE-2021-4189, CVE-2023-27043, CVE-2023-31083, CVE-2023-40217, CVE-2023-52889, CVE-2024-41098, CVE-2024-42114, CVE-2024-42246, CVE-2024-42259, CVE-2024-42272, CVE-2024-42283, CVE-2024-42286, CVE-2024-42287, CVE-2024-42288, CVE-2024-42289, CVE-2024-42297, CVE-2024-42309, CVE-2024-42310, CVE-2024-42311, CVE-2024-43828, CVE-2024-43829, CVE-2024-43834, CVE-2024-43835, CVE-2024-43846, CVE-2024-43849, CVE-2024-43853, CVE-2024-43854, CVE-2024-43856, CVE-2024-43860, CVE-2024-43861, CVE-2024-43871, CVE-2024-43884, CVE-2024-43889, CVE-2024-43890, CVE-2024-43892, CVE-2024-43893, CVE-2024-43894, CVE-2024-43905, CVE-2024-43907, CVE-2024-43908, CVE-2024-43914, CVE-2024-44935, CVE-2024-44944, CVE-2024-44946, CVE-2024-44947, CVE-2024-44954, CVE-2024-44960, CVE-2024-44965, CVE-2024-44968, CVE-2024-44971, CVE-2024-44988, CVE-2024-44989, CVE-2024-44990, CVE-2024-44995, CVE-2024-45003, CVE-2024-45006, CVE-2024-45016, CVE-2024-45018, CVE-2024-45021, CVE-2024-45025, CVE-2024-45028, CVE-2024-46675, CVE-2024-46676, CVE-2024-46677, CVE-2024-46679, CVE-2024-46685, CVE-2024-46689, CVE-2024-46702, CVE-2024-46707, CVE-2024-46714, CVE-2024-46719, CVE-2024-46721, CVE-2024-46737, CVE-2024-46739, CVE-2024-46750, CVE-2024-46755, CVE-2024-46763, CVE-2024-46771, CVE-2024-46777, CVE-2024-46780, CVE-2024-46781, CVE-2024-46783, CVE-2024-46791, CVE-2024-46817, CVE-2024-46819, CVE-2024-46822, CVE-2024-46829, CVE-2024-46840, CVE-2024-47663, CVE-2020-29509, CVE-2020-29511, CVE-2021-33197, CVE-2021-34558, CVE-2021-36221, CVE-2021-44879, CVE-2022-1705, CVE-2022-1962, CVE-2022-32148, CVE-2022-41717, CVE-2023-3446, CVE-2023-3817, CVE-2023-6004, CVE-2023-6121, CVE-2023-6915, CVE-2023-6918, CVE-2023-24532, CVE-2023-29406, CVE-2023-29409, CVE-2023-32611, CVE-2023-32665, CVE-2023-34324, CVE-2023-39198, CVE-2023-39804, CVE-2023-45863, CVE-2023-46218, CVE-2023-46343, CVE-2023-49290, CVE-2023-52443, CVE-2023-52449, CVE-2023-52470, CVE-2024-21664, CVE-2024-28085, GHSA-2c7c-3mj9-8fqh, CVE-2024-2961, CVE-2024-28182, CVE-2023-7042, CVE-2023-39318, CVE-2023-39319, CVE-2023-39326, CVE-2023-47233, CVE-2023-52429, CVE-2023-52435, CVE-2023-52458, CVE-2024-0340, CVE-2024-0607, CVE-2024-22099, CVE-2024-23849, CVE-2024-23851, CVE-2024-24857, CVE-2024-24858, CVE-2024-24861, CVE-2024-25739, CVE-2024-26600, CVE-2024-26602, CVE-2024-26606, CVE-2024-26901, CVE-2024-26903, CVE-2024-26910, CVE-2024-27013, CVE-2024-33599, CVE-2024-33600, CVE-2024-33601, CVE-2024-33602, CVE-2024-35978, CVE-2024-35982, CVE-2024-35984, CVE-2024-35997, GHSA-6xv5-86q9-7xr8, CVE-2024-26900, CVE-2024-28122, CVE-2024-35255, CVE-2024-36902, CVE-2019-19921, CVE-2021-31525, CVE-2021-32760, CVE-2021-41103, CVE-2021-43784, CVE-2022-23471, CVE-2022-29162, CVE-2022-29526, CVE-2022-31030, CVE-2022-40735, CVE-2022-41717, CVE-2023-25153, CVE-2023-25173, CVE-2023-28642, CVE-2023-48795, CVE-2024-27019, CVE-2024-36288, CVE-2024-38662, CVE-2024-38780, CVE-2024-39292, CVE-2024-39475, CVE-2024-39476, CVE-2024-39482, CVE-2024-39484, CVE-2024-39489, CVE-2024-39493, CVE-2024-42070, CVE-2024-42076, CVE-2024-42077, CVE-2024-42082, GHSA-7ww5-4wqc-m92c, CVE-2023-5981, CVE-2024-42157, CVE-2024-42223, CVE-2024-42229, CVE-2024-42232, CVE-2024-42236, CVE-2024-42244, CVE-2024-42247, CVE-2021-3426, CVE-2021-28861, CVE-2021-29921, CVE-2022-42919, CVE-2023-6597, CVE-2023-28450, CVE-2023-50387, CVE-2023-50868, CVE-2024-0397, CVE-2024-4032, CVE-2024-8088, CVE-2024-8508, CVE-2024-8775, CVE-2024-9287, CVE-2024-9902, CVE-2024-11168, CVE-2024-43841, CVE-2021-25743, CVE-2022-30629, CVE-2023-26604, CVE-2023-2975, CVE-2023-5178, CVE-2023-5197, CVE-2023-6531, CVE-2023-6817, CVE-2023-46813, CVE-2023-46862, CVE-2023-52438, CVE-2022-38096, CVE-2023-5363, CVE-2023-6246, CVE-2023-6779, CVE-2023-6780, CVE-2023-52447, CVE-2023-52489, CVE-2023-52492, CVE-2023-52493, CVE-2023-52497, CVE-2023-52616, CVE-2023-52627, CVE-2023-52637, CVE-2023-52672, CVE-2024-0841, CVE-2024-23850, CVE-2024-26581, CVE-2024-26593, CVE-2024-26601, CVE-2024-26610, CVE-2024-26627, CVE-2024-26643, CVE-2024-26665, CVE-2024-26673, CVE-2024-26684, CVE-2024-26688, CVE-2024-26695, CVE-2024-26698, CVE-2024-26702, CVE-2024-26707, CVE-2024-26712, CVE-2024-26727, CVE-2024-26748, CVE-2024-26749, CVE-2024-26753, CVE-2024-26781, CVE-2024-26782, CVE-2024-26787, CVE-2024-26788, CVE-2024-26790, CVE-2024-26795, CVE-2024-26808, CVE-2024-26809, CVE-2024-26814, CVE-2024-26833, CVE-2024-26835, CVE-2024-26848, CVE-2024-26855, CVE-2024-26861, CVE-2024-26862, CVE-2024-26870, CVE-2024-26877, CVE-2024-26885, CVE-2024-26891, CVE-2024-26895, CVE-2024-26897, CVE-2024-26924, CVE-2024-26925, CVE-2024-26926, CVE-2024-26935, CVE-2024-26937, CVE-2024-26950, CVE-2024-26951, CVE-2024-26970, CVE-2024-26978, CVE-2024-26988, CVE-2024-27030, CVE-2024-27038, CVE-2024-27044, CVE-2024-27045, CVE-2024-27047, CVE-2024-27052, CVE-2024-27053, CVE-2024-27065, CVE-2024-27076, CVE-2024-27414, CVE-2024-27417, CVE-2024-27431, CVE-2024-35785, CVE-2024-35796, CVE-2024-35813, CVE-2024-35829CVE-2023-25809, GHSA-5j5w-g665-5m35, GHSA-77vh-xpmg-72qh, GHSA-c9cp-9c75-9v8c, CVE-2022-48303, CVE-2022-2309, CVE-2024-41007, CVE-2024-43167, CVE-2024-43168, GHSA-xr7q-jx4m-x55m.

Google Kubernetes Engine

In GKE version 1.33 and later, if you omit the whenUnsatisfiable field in a new GKE compute class specification, the default value is DoNotScaleUp.

In GKE versions earlier than 1.33, the default value is ScaleUpAnyway. Ensure that your compute class specifications explicitly set a value in the whenUnsatisfiable field after you upgrade to version 1.33. This change only affects new ComputeClass objects that you create that omit the whenUnsatisfiable field. Any existing compute classes that omit the field continue to use ScaleUpAnyway as the default value even after you upgrade the cluster to version 1.33 or later.

To learn more about the whenUnsatisfiable field, see Define scaling behavior when no priority rules apply.

February 20, 2025

Backup and DR

Protection summary is now available for public preview. Protection summary provides a centralized, single-pane-of-glass view of your backup configurations for resources running within your Google Cloud project. Use protection summary to gain a holistic understanding of your backup state, identify gaps in coverage, and implement centralized backup management strategies. You can read about protection summary at Use protection summary.

Cloud Composer

(Cloud Composer 3) Fixed a problem with configuring access to SMTP servers that don't support user and password authentication. The [smtp]smtp_user and [smtp]smtp_password Airflow configuration options are no longer preconfigured with placeholder values.

Improved the forbidden APIs check. When a new environment is created, Cloud Composer now checks for forbidden APIs that are required by a specific major version of Cloud Composer.

(Airflow 2.10.2 and 2.9.3) Preinstalled packages were changed:

  • virtualenv was downgraded from 20.29.1 to 20.28.1

New Airflow builds are available in Cloud Composer 3:

  • composer-3-airflow-2.10.2-build.9 (default)
  • composer-3-airflow-2.9.3-build.16

New images are available in Cloud Composer 2:

  • composer-2.11.3-airflow-2.10.2 (default)
  • composer-2.11.3-airflow-2.9.3

Cloud Composer version 2.6.1 has reached its end of support period.

Cloud Healthcare API

A new release is available. This release may include some or all of the following: general performance improvements, bug fixes, and updates to the API reference documentation.

Cloud Load Balancing

Cleartext HTTP/2 over TCP, also known as H2C, lets you use HTTP/2 without TLS. H2C is supported by internal and external Application Load Balancers for both of the following connections:

  • Connections between clients and the load balancer. No special configuration is required. Support for this capability is in General Availability.

  • Connections between the load balancer and its backends. Support for this capability is in Preview.

    To configure H2C for connections between the load balancer and its backends, you set the backend service protocol to H2C.

Cloud Monitoring

When you add an Observability Analytics widget to a custom Cloud Monitoring dashboard, you can now select other log views and analytics views to query in the Views & Schema section. For more information, see Display charts generated from a Log Analytics query.

Cloud SQL for MySQL

You can now create a final backup of your data before you delete a Cloud SQL instance. You can use the final backup to restore your data to a new instance. This way, you can recover your data after you delete the instance. For more information, see About Cloud SQL backups.

Cloud SQL for PostgreSQL

You can now create a final backup of your data before you delete a Cloud SQL instance. You can use the final backup to restore your data to a new instance. This way, you can recover your data after you delete the instance. For more information, see About Cloud SQL backups.

Cloud SQL for SQL Server

You can now create a final backup of your data before you delete a Cloud SQL instance. You can use the final backup to restore your data to a new instance. This way, you can recover your data after you delete the instance. For more information, see About Cloud SQL backups.

Google Kubernetes Engine

GKE Managed NVIDIA Data Center GPU Manager (DCGM) Metrics Package is now generally available for both GKE Standard and Autopilot clusters running version 1.32.0-gke.1764000 and later. You can enable the feature via the Console, gcloud, or Terraform. Starting with cluster version 1.32.1-gke.1357000, GKE Managed NVIDIA DCGM will be default-on for new clusters.

GKE Managed DCGM provides a curated set of metrics for monitoring the utilization, performance, and health of NVIDIA GPUs. These metrics are collected by Google Cloud Managed Service for Prometheus and you can view the metric charts in the Observability Tab on the Kubernetes Clusters page or in Cloud Monitoring. For more information, see Collect and view DCGM metrics.

To learn more, see Collect and view DCGM metrics.

GKE automatically adds the following resource labels to node pools:

  • goog-gke-accelerator-type: The accelerator type used in the node pool.
  • goog-gke-tpu-node-pool-type: The TPU node pool type, which can be single-host or multi-host.
  • goog-gke-node-pool-provisioning-model: The provisioning model of the node pool. The nodes can be on demand, by reservation, or Spot VMs.

To learn more, see Automatically applied labels.

New GKE 1.27 patch versions starting with version 1.27.16-gke.2440000 are built with COS 109, because COS 105 is near the end of support. GKE makes new 1.27 patch versions available using COS 109. However, GKE won't auto-upgrade nodes across the COS milestone boundary, from a patch version using COS 105 to a patch version using COS 109.

If you manually upgrade your nodes to 1.27.16-gke.2440000 or later, GKE continues node auto-upgrades as normal. Control plane upgrades are unaffected, and cluster auto-upgrades to the next minor version towards the end of extended support proceed as normal.

To learn more, see Container-Optimized OS updates during the extended support period.

Google SecOps

Data tables

Data tables are multicolumn data constructs that let you input your own data into Google SecOps. They can act as lookup tables with defined columns and the data stored in rows. You can create or import a data table to your Google SecOps account using the Google SecOps UI, the data tables API, or by using a YARA-L query in rules. This feature is in public preview.

Enhanced Cloud Threat Detections by adding three new rules to the AWS - GuardDuty rule set.

Google SecOps SIEM

Data tables

Data tables are multicolumn data constructs that let you input your own data into Google SecOps. They can act as lookup tables with defined columns and the data stored in rows. You can create or import a data table to your Google SecOps account using the Google SecOps UI, the data tables API, or by using a YARA-L query in rules. This feature is in public preview.

Enhanced Cloud Threat Detections by adding three new rules to the AWS - GuardDuty rule set.

Organization Policy

Custom organization policies are now generally available for Cloud Healthcare API. For more information, see Use custom organization policies.

Resource Manager

Custom organization policies are now generally available for Cloud Healthcare API. For more information, see Use custom organization policies.

Spanner

The Java and Go clients for Spanner now implement multiplexed sessions. This allows all requests to be concurrently sent over a single session, thus eliminating the requirement that you define the minimum and maximum session count. Instead, you can use any number of requests to the configured gRPC channels. This approach eliminates the possibility of session leaks and reduces the occurrences of Transaction outcome unknown errors. You must set an environment variable in your client to opt in to this feature. For more information, see Multiplexed sessions.

Virtual Private Cloud

Private Service Connect service connectivity automation supports IPv6 connectivity to eligible managed services. This feature is available in General availability. For more information, see Endpoint IP versions.

reCAPTCHA

reCAPTCHA SMS defense (formerly SMS toll fraud protection) is now available in GA. For more information, see Detect and prevent SMS fraud.

February 19, 2025

Apigee X

On February 19, 2025, we released an updated version of Apigee (1-14-0-apigee-7).

Bug ID Description
391714121 Security fix for Apigee infrastructure.
This addresses the following vulnerability:
Bug ID Description
N/A Updates to security infrastructure and libraries.
App Hub Application Integration

Enhancements to Execution Logs

Application Integration Execution Logs now provides the following enhancements:

  • View detailed task execution information: The dedicated Task Execution pane displays comprehensive execution details, including start and end times, status, type, and variable payload information , enabling improved debugging.
  • Download execution logs in JSON format: You can now download integration execution logs as structured JSON files, facilitating easier log analysis.
  • View sub-integration execution logs: The Execution Logs page now displays all sub-integration execution logs within the same stack trace as the main integration, simplifying troubleshooting of complex integration flows.

For more information, see View execution logs.

Artifact Registry

Artifact Registry might give a 400 error on pushes or pulls for Workforce Identity Federation users. This issue is caused by Workforce Identity Federation attribute mappings in the Artifact Registry URL causing problems on the backend.

To mitigate this issue, you can push or pull from Artifact Registry without attribute mappings, or reduce the length of your attribute mappings.

Cloud Asset Inventory

The following resource types are now publicly available through the analyze policy APIs (AnalyzeIamPolicy and AnalyzeIamPolicyLongrunning).

  • Compute Engine
    • compute.googleapis.com/NetworkEdgeSecurityService
  • Gemini for Google Cloud
    • cloudaicompanion.googleapis.com/CodeRepositoryIndex
    • cloudaicompanion.googleapis.com/RepositoryGroup
  • Google Cloud NetApp Volumes
    • netapp.googleapis.com/Backup
    • netapp.googleapis.com/BackupPolicy
    • netapp.googleapis.com/BackupVault
  • Memorystore
    • redis.googleapis.com/Cluster
Cloud Load Balancing

Internal and external passthrough Network Load Balancers now support connection draining for UDP and other non-TCP protocol traffic. For details, see Enable connection draining.

This feature is now generally available (GA).

Cloud Run

Support for deploying functions in Cloud Run is now in general availability (GA). Note that you must use Google Cloud SDK 511.0.0 version or later if using the gcloud CLI. Review the use cases guide for deploying new functions.

Support for configuring automatic base image updates for Cloud Run source deployed services and functions is now in general availability (GA). Note that you must use Google Cloud SDK 511.0.0 version or later if using the gcloud CLI.

Cloud Run functions

Support for deploying v2 functions in Cloud Run is now in general availability (GA). This lets you customize your function as you would a Cloud Run service. This change removes support for creating, deploying, or updating v2 functions in the Google Cloud console. However, you can still manage functions created with the Cloud Functions v2 API using the Cloud Functions gcloud CLI, the Cloud Functions v2 API, or the Cloud Run Cloud Console. See Cloud Run functions comparison for more details.

Cloud Service Mesh

Managed Cloud Service Mesh 1.20 is rolling out to the rapid channel.

Developer Connect

Developer Connect now lets you connect to repositories on private networks.

To get started, see the guide for your source code management provider:

Once they're connected, you can use Gemini Code Assist code customization on source code repositories outside of Google Cloud.

You can now use Developer Connect to act as a proxy to run Git commands on source code management tools. You can toggle Enable git proxy on in the Google Cloud console, or pass the --git-proxy-config-enabled flag in glcoud. This feature is in Preview.

Dialogflow

Conversational Agents (CX), ES & Agent Assist: Starting February 24, 2025, a limit of 5 phone numbers per project will be enforced. This limit doesn't apply to the global region. For instructions on deleting unused phone numbers and resolving the limit issue, see the RESOURCE_EXHAUSTED troubleshooting section. If you have a business requirement to increase the limit, request to increase the Phone numbers quota specifying the region and providing detailed justification for your request.

Gemini Code Assist

IntelliJ Gemini Code Assist now shows disconnected network status in the Gemini status bar instead of an error.

Google Distributed Cloud (software only) for VMware

Google Distributed Cloud (software only) for VMware 1.30.600-gke.68 is now available for download. To upgrade, see Upgrade a cluster or a node pool. Google Distributed Cloud 1.30.600-gke.68 runs on Kubernetes v1.30.9-gke.100.

If you are using a third-party storage vendor, check the GDC Ready storage partners document to make sure the storage vendor has already passed the qualification for this release.

After a release, it takes approximately 7 to 14 days for the version to become available for use with GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

The following issues are fixed in 1.30.600-gke.68:

  • Fixed an issue that caused Runtime: out of memory errors after running gkeadm to create or upgrade clusters.

  • Fixed an issue to prevent checking for add-on node IP addresses for HA admin clusters with three control-plane nodes and no add-on nodes.

The 1.30.600-gke.68 release includes many vulnerability fixes. For a list of all vulnerabilities fixed in this release, see Vulnerability fixes.

Google Distributed Cloud (software only) for bare metal

Release 1.30.600-gke.68

Google Distributed Cloud for bare metal 1.30.600-gke.68 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.30.600-gke.68 runs on Kubernetes v1.30.9-gke.100.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

The following functional change was made in 1.30.600-gke.68:

  • Cluster deletion now deletes worker node pools prior to deleting any control plane node pools.

The following issue is fixed in 1.30.600-gke.68:

  • Fixed an issue where bmctl update clustercommand fails for user clusters that were created with thecloudOperationsServiceAccountKeyPath setting in the header section of the cluster configuration file.

The 1.30.600-gke.68 release includes many vulnerability fixes. For a list of all vulnerabilities fixed in this release, see Vulnerability fixes.

For information about the latest known issues, see Google Distributed Cloud for bare metal known issues in the Troubleshooting section.

Google Kubernetes Engine

Starting on July 1, 2025, new organizations will no longer be able to create GKE clusters with Identity Service for GKE. You can continue to use Identity Service for GKE in existing organizations, but we encourage you to migrate to Workforce Identity Federation.

Workforce Identity Federation is the recommended method for configuring access to your GKE clusters from external identity providers. Workforce Identity Federation provides a single hosted solution for managing external IdPs across Google Cloud products. Unlike Identity Service for GKE, Workforce Identity Federation doesn't install components in your cluster.

For details and migration instructions, see Use external identity providers to authenticate to GKE.

Organization Policy

Custom organization policies are now generally available for Essential Contacts. For more information, see Creating custom constraints for Essential Contacts.

Resource Manager

Custom organization policies are now generally available for Essential Contacts. For more information, see Creating custom constraints for Essential Contacts.

Workflows

Workflows is available in the following additional region: europe-north2 (Stockholm, Sweden).

February 18, 2025

Cloud CDN

External HTTP(S) Load Balancing and Cloud CDN support early data for TLS 1.3, also known as 0-RTT or zero round trip. Early data helps clients include HTTP request data with a TLS handshake, which can improve web performance for resumed connections.

Cloud Load Balancing

TLS 1.3 early data is now supported on the target HTTPS proxy of global external Application Load Balancers and classic Application Load Balancers.

TLS 1.3 early data, also known as zero-round-trip time (0-RTT) data, can improve application performance for resumed connections by 30 to 50%.

For details, see TLS 1.3 early data support.

This feature is available in General Availability.

Cloud Logging

You can now use custom constraints with Organization Policy to provide more granular control over your Cloud Logging resources. For more information, see Use custom organization policies.

Cloud Run Container Optimized OS

cos-105-17412-535-59

Kernel Docker Containerd GPU Drivers
COS-5.15.173 v23.0.3 v1.7.23 See List

Fixed CVE-2025-0395 in sys-libs/glibc.

Fixed CVE-2024-9287 in dev-lang/python.

Fixed CVE-2023-27043 in dev-lang/python.

Fixed CVE-2024-53215 in the Linux kernel.

Fixed CVE-2024-56569 in the Linux kernel.

Runtime sysctl changes:

  • Changed: fs.file-max: 812690 -> 812681

cos-117-18613-164-38

Kernel Docker Containerd GPU Drivers
COS-6.6.72 v24.0.9 v1.7.24 See List

Fixed CVE-2025-0395 in sys-libs/glibc.

Fixed CVE-2024-9287 in dev-lang/python.

Runtime sysctl changes:

  • Changed: fs.file-max: 811817 -> 811794

cos-109-17800-436-37

Kernel Docker Containerd GPU Drivers
COS-6.1.124 v24.0.9 v1.7.24 See List

Fixed CVE-2025-0395 in sys-libs/glibc.

Fixed CVE-2024-9287 in dev-lang/python.

Runtime sysctl changes:

  • Changed: fs.file-max: 812276 -> 812258

cos-113-18244-291-40

Kernel Docker Containerd GPU Drivers
COS-6.1.123 v24.0.9 v1.7.24 See List

Fixed CVE-2025-0395 in sys-libs/glibc.

Fixed CVE-2024-9287 in dev-lang/python.

Dataplex

Dataplex Attribute Store is deprecated and will be discontinued on February 18, 2026. For steps to transition to tags, policy tags, and IAM conditions, see Migrate from Attribute Store to tags and IAM conditions.

Gemini Code Assist

Code customization for Gemini Code Assist Enterprise now supports repositories hosted on the following:

Google Kubernetes Engine

(2025-R07) Version updates

GKE cluster versions have been updated.

New versions available for upgrades and new clusters.

The following Kubernetes versions are now available for new clusters and for opt-in control plane upgrades and node upgrades for existing clusters. For more information on versioning and upgrades, see GKE versioning and support and Upgrades.

Rapid channel

  • Version 1.32.1-gke.1489001 is now the default version for cluster creation in the Rapid channel.
  • The following versions are now available in the Rapid channel:
  • The following versions are no longer available in the Rapid channel:
    • 1.29.13-gke.1038000
    • 1.30.9-gke.1046000
    • 1.30.9-gke.1127000
    • 1.31.5-gke.1068000
    • 1.32.1-gke.1200003
  • Auto-upgrade targets are now available for the following minor versions:
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.28 to version 1.29.13-gke.1109000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.29 to version 1.30.9-gke.1201000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.30 to version 1.31.5-gke.1169000 with this release.
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.29 to version 1.29.13-gke.1109000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.30 to version 1.30.9-gke.1201000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.31 to version 1.31.5-gke.1169000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.32 to version 1.32.1-gke.1357001 with this release.

Regular channel

  • Version 1.31.5-gke.1068000 is now the default version for cluster creation in the Regular channel.
  • The following versions are now available in the Regular channel:
  • The following versions are no longer available in the Regular channel:
    • 1.29.13-gke.1006000
    • 1.30.9-gke.1009000
    • 1.31.5-gke.1023000
  • Auto-upgrade targets are now available for the following minor versions:
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.28 to version 1.29.13-gke.1038000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.29 to version 1.30.9-gke.1046000 with this release.
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.29 to version 1.29.13-gke.1038000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.30 to version 1.30.9-gke.1046000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.31 to version 1.31.5-gke.1068000 with this release.

Stable channel

  • Version 1.30.8-gke.1261000 is now the default version for cluster creation in the Stable channel.
  • The following versions are now available in the Stable channel:
  • The following versions are no longer available in the Stable channel:
    • 1.29.12-gke.1143001
    • 1.30.8-gke.1162001
    • 1.31.4-gke.1256000
  • Auto-upgrade targets are now available for the following minor versions:
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.28 to version 1.29.12-gke.1270000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.29 to version 1.30.8-gke.1261000 with this release.
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.29 to version 1.29.12-gke.1270000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.30 to version 1.30.8-gke.1261000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.31 to version 1.31.4-gke.1372000 with this release.

Extended channel

  • Version 1.31.5-gke.1068000 is now the default version for cluster creation in the Extended channel.
  • The following versions are now available in the Extended channel:
  • The following versions are no longer available in the Extended channel:
    • 1.27.16-gke.2296000
    • 1.27.16-gke.2387000
    • 1.28.15-gke.1781000
    • 1.29.13-gke.1006000
    • 1.30.9-gke.1009000
    • 1.31.5-gke.1023000
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.29 to version 1.29.13-gke.1038000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.30 to version 1.30.9-gke.1046000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.31 to version 1.31.5-gke.1068000 with this release.

No channel

(2025-R07) Version updates

  • Version 1.32.1-gke.1489001 is now the default version for cluster creation in the Rapid channel.
  • The following versions are now available in the Rapid channel:
  • The following versions are no longer available in the Rapid channel:
    • 1.29.13-gke.1038000
    • 1.30.9-gke.1046000
    • 1.30.9-gke.1127000
    • 1.31.5-gke.1068000
    • 1.32.1-gke.1200003
  • Auto-upgrade targets are now available for the following minor versions:
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.28 to version 1.29.13-gke.1109000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.29 to version 1.30.9-gke.1201000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.30 to version 1.31.5-gke.1169000 with this release.
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.29 to version 1.29.13-gke.1109000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.30 to version 1.30.9-gke.1201000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.31 to version 1.31.5-gke.1169000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.32 to version 1.32.1-gke.1357001 with this release.

(2025-R07) Version updates

  • Version 1.31.5-gke.1068000 is now the default version for cluster creation in the Regular channel.
  • The following versions are now available in the Regular channel:
  • The following versions are no longer available in the Regular channel:
    • 1.29.13-gke.1006000
    • 1.30.9-gke.1009000
    • 1.31.5-gke.1023000
  • Auto-upgrade targets are now available for the following minor versions:
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.28 to version 1.29.13-gke.1038000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.29 to version 1.30.9-gke.1046000 with this release.
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.29 to version 1.29.13-gke.1038000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.30 to version 1.30.9-gke.1046000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.31 to version 1.31.5-gke.1068000 with this release.

(2025-R07) Version updates

  • Version 1.30.8-gke.1261000 is now the default version for cluster creation in the Stable channel.
  • The following versions are now available in the Stable channel:
  • The following versions are no longer available in the Stable channel:
    • 1.29.12-gke.1143001
    • 1.30.8-gke.1162001
    • 1.31.4-gke.1256000
  • Auto-upgrade targets are now available for the following minor versions:
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.28 to version 1.29.12-gke.1270000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.29 to version 1.30.8-gke.1261000 with this release.
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.29 to version 1.29.12-gke.1270000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.30 to version 1.30.8-gke.1261000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.31 to version 1.31.4-gke.1372000 with this release.

(2025-R07) Version updates

  • Version 1.31.5-gke.1068000 is now the default version for cluster creation in the Extended channel.
  • The following versions are now available in the Extended channel:
  • The following versions are no longer available in the Extended channel:
    • 1.27.16-gke.2296000
    • 1.27.16-gke.2387000
    • 1.28.15-gke.1781000
    • 1.29.13-gke.1006000
    • 1.30.9-gke.1009000
    • 1.31.5-gke.1023000
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.29 to version 1.29.13-gke.1038000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.30 to version 1.30.9-gke.1046000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.31 to version 1.31.5-gke.1068000 with this release.

(2025-R07) Version updates

VPC Service Controls

Preview stage support for the following integration:

General availability support for the following integration:

February 17, 2025

BigQuery

A weekly digest of client library updates from across the Cloud SDK.

Node.js

Changes for @google-cloud/bigquery

7.9.2 (2025-02-12)

Bug Fixes
  • Avoid schema field mutation when passing selectedFields opt (#1437) (27044d5)

Java

Changes for google-cloud-bigquery

2.48.0 (2025-02-13)

Features
Dependencies
  • Update dependency com.google.api.grpc:proto-google-cloud-bigqueryconnection-v1 to v2.59.0 (#3660) (3a6228b)
  • Update dependency com.google.apis:google-api-services-bigquery to v2-rev20250128-2.0.0 (#3667) (0b92af6)
  • Update dependency com.google.cloud:google-cloud-datacatalog-bom to v1.63.0 (#3661) (9bc8c01)
  • Update dependency com.google.cloud:sdk-platform-java-config to v3.43.0 (#3669) (4d9e0ff)
Documentation
  • Update CONTRIBUTING.md for users without branch permissions (#3670) (009b9a2)

Subscriber email logging lets you log the principal identifiers of users who execute jobs and queries against linked datasets. You can enable logging at the listing level and the data exchange level (for all the listings in the data exchange). Once you enable and save subscriber email logging, this setting cannot be edited. This feature is in preview.

Bigtable

A weekly digest of client library updates from across the Cloud SDK.

Java

Changes for google-cloud-bigtable

2.52.0 (2025-02-14)

Features
  • Automated backups are supported in the admin client (#2472) (48633e6)
Bug Fixes
  • deps: Update the Java code generator (gapic-generator-java) to 2.53.0 (47ca299)
  • Extend timeouts for check consistency (47ca299)
Dependencies
  • Update dependency com.google.cloud:gapic-libraries-bom to v1.52.0 (#2490) (ca25d4e)
  • Update dependency com.google.cloud:sdk-platform-java-config to v3.43.0 (#2481) (deb1f79)
Cloud Logging

A weekly digest of client library updates from across the Cloud SDK.

Java

Changes for google-cloud-logging

3.21.3 (2025-02-12)

Bug Fixes
  • deps: Update the Java code generator (gapic-generator-java) to 2.52.0 (888a885)
Dependencies
  • Update dependency com.google.cloud:sdk-platform-java-config to v3.43.0 (#1763) (e0f9f27)
Cloud Storage

A weekly digest of client library updates from across the Cloud SDK.

Node.js

Changes for @google-cloud/storage

7.15.1 (2025-02-11)

Bug Fixes
  • getFiles: Add nextPageToken to fields for autoPaginate (#2570) (75c309c)

Java

Changes for google-cloud-storage

2.48.2 (2025-02-11)

Dependencies
Documentation
  • Update storage_copy_file to include MegabytesCopiedPerChunk (#2910) (971ca5d)
Dataproc

New Dataproc on Compute Engine subminor image versions:

  • 2.0.132-debian10, 2.0.132-rocky8, 2.0.132-ubuntu18
  • 2.1.80-debian11, 2.1.80-rocky8, 2.1.80-ubuntu20, 2.1.80-ubuntu20-arm
  • 2.2.46-debian12, 2.2.46-rocky9, 2.2.46-ubuntu22
Google Cloud Contact Center as a Service

Version 3.31 is released

All release notes published on this date are part of version 3.31.

The timing of the update to your instance depends on the deployment schedule that you have chosen. For more information, see Deployment schedules.

Transfer restrictions for teams

Transfer restrictions, which let you control the source and destination of transfers, is now available for teams. For more information, see Configure team transfer restrictions.

Additional options for maximum transfer limits for chats

You can now specify whether you want virtual agents, human agents, or both to be included in transfer counts. You can also specify whether you want the transfer count reset to zero when a chat is dismissed. For more information, see Configure transfer limits for chats.

Agents can configure spelling and grammar check in the chat adapter

You can let agents turn spelling and grammar check on and off in the chat adapter. You can also let agents select the language for spell and grammar check. For more information, see Turn on and configure Agent Assist for chat and Check spelling and grammar.

Get user configuration data using the Apps API

You can now use the Apps API to get user configuration data. For more information, see Get user configuration data.

Pass data parameters to a virtual agent mid-session

You can pass data parameters to a virtual agent while a session is in progress. For more information, see Pass data parameters to virtual agents mid-session.

Interaction history retrieval is extended to 90 days

There are two new settings for specifying how many days of interaction history to retrieve: 60 days and 90 days. For more information, see Set up interaction history.

Blended inbound and outbound calling

You can automatically transition agents between handling outbound campaign calls and inbound calls, based on call volumes and conditions that you configure. For more information, see Call blending.

Restrict outbound calling to emergency or special services

You can restrict outbound calling to emergency or special services by agent and location. The following configuration options are available:

  • Restrict specific agents from calling emergency or special service phone numbers.

  • Configure from which locations agents are permitted to call emergency or special service phone numbers.

For more information, see Restrict outbound calling for agents (new number).

Automatic redirect with percent allocation

You can configure automatic redirection so that specified percentages of sessions are redirected to the redirection groups that you specify. For more information, see Automatic redirection.

Custom agent status lists

You can create lists of custom statuses and assign them to queues or teams. This gives you control over the statuses that agents in queues and teams can use. For more information, see Agent status lists.

Availability preferences

You can create availability preferences filters and apply them to users and teams. This lets you filter incoming contacts so only the appropriate types of contacts enter their queues. You can also give agents the ability to create their own availability preference filters. Filtering criteria include channel, session direction, schedule, transfers, and more. For more information, see Availability preferences.

Fixed an issue where attempting to cancel a call transfer failed.

Fixed an issue where the SIP URI format was not accepted in the user interface.

Fixed an issue where chat shortcuts were not entered into message input fields when selected from the chat shortcut list.

Fixed an issue where character limits were causing errors when email templates were being created.

Fixed an issue where chats that were escalated from a virtual agent were assigned the wrong priority and never connected with an agent.

Fixed an issue where agents couldn't see waiting chat contacts when their statuses were set to Unavailable.

Fixed an issue where the Dismiss button in the agent adapter didn't meet accessibility requirements for contrast.

Fixed an issue with Co-browse taking too long to start.

Fixed an issue where the summary box in the chat adapter was not sized correctly when using a CRM.

Fixed an issue for custom CRM users where the CRM record was not appearing when a session started.

Fixed an issue where changing deflection settings for agent extensions in the call adapter failed.

Fixed an issue where agents could not set their statuses to Busy after calls.

For workforce management, fixed an issue where an error was returned when searching for an employee in the Assign Shift pane.

Pub/Sub

A weekly digest of client library updates from across the Cloud SDK.

Java

Changes for google-cloud-pubsub

1.137.0 (2025-02-12)

Features
  • Add support for message transforms to Topic and Subscription (3889a05)
Bug Fixes
  • deps: Update the Java code generator (gapic-generator-java) to 2.53.0 (b952e58)
Dependencies
  • Update dependency com.google.cloud:google-cloud-bigquery to v2.47.0 (#2331) (216feef)
  • Update dependency com.google.cloud:google-cloud-core to v2.51.0 (#2338) (ac2403e)
  • Update dependency com.google.cloud:google-cloud-storage to v2.48.1 (#2332) (23fd7a8)
  • Update dependency com.google.cloud:google-cloud-storage to v2.48.2 (#2341) (eeb99a9)
  • Update dependency com.google.cloud:sdk-platform-java-config to v3.43.0 (#2336) (996f4eb)
Documentation
  • A comment for field code in message .google.pubsub.v1.JavaScriptUDF is changed (3889a05)
Secret Manager

A weekly digest of client library updates from across the Cloud SDK.

Go

Changes for secretmanager/apiv1

1.14.5 (2025-02-12)

Bug Fixes
  • secretmanager: Upgrade Go gRPC Protobuf generation (90140b1)

February 16, 2025

Google SecOps SIEM

Manage user preferences

The ability to manage platform time zones has been relocated to the new User Preferences dialog, accessible from your avatar. In addition, a new accessibility option in the User Preferences dialog lets you define how long feedback messages remain on the screen.

For more information, refer to Configure user preferences (SIEM only).

February 15, 2025

Google SecOps

Manage user preferences

The ability to manage platform time zones, date/time settings, and notifications has been relocated to the new User Preferences dialog, accessible from your avatar.

In addition, a new accessibility option in the User Preferences dialog lets you define how long feedback messages remain on the screen.

For more information, refer to Configure user preferences.

This feature is available in Preview.

New options to close a case

New custom field options have been added to the SOAR Settings > Case Data > Close Case page. Once you define these fields, analysts must enter specific types of information when closing a case.

For more information, refer to Customize the Close Case dialog.

Google SecOps SOAR

Release 6.3.35 is currently in Preview. This release contains the following feature.

New options for closing a case

This feature is currently in Preview.

New custom field options have been added to the Settings > Case Data > Close Case page. Once you define these fields, analysts must enter specific types of information when closing a case.

For more information, refer to Customize the Close Case dialog.

Release 6.3.34 is now in General Availability.

February 14, 2025

AlloyDB for PostgreSQL

Support for advanced query insights, index advisor, and active queries is now generally available (GA) in AlloyDB for PostgreSQL.

You cannot enable advanced query insights on clusters with secondary instances. See Limitations for more information.

BigQuery Engine for Apache Flink

BigQuery Engine for Apache Flink Preview will be discontinued on February 28, 2025.

Cloud Database Migration Service

Database Migration Service for homogeneous AlloyDB for PostgreSQL migrations now lets you migrate specific databases from your source instance. You can view metrics, statuses, and errors separately for each database.

For more information about migrating specific databases, see: Create a migration job to a new destination instance and Create a migration job to an existing destination instance.

Database Migration Service for homogeneous Cloud SQL for SQL Server migrations now lets you promote, restart, or view additional metrics for each database individually.

For more information, see: Migration job metrics and Manage migration jobs.

Cloud Monitoring

The Dashboards page of the Cloud Console has been refreshed. For more information about dashboards, see the following documents:

Cloud SQL for SQL Server

Point in time recovery (PITR) is available by default for all Cloud SQL Enterprise Plus edition for SQL Server instances.

Compute Engine

Starting as soon as February 14, 2025, projects might start seeing a Data protection pane on the Create an instance page in the Google Cloud console. If you see the Data protection pane, it selects an option to automatically back up data by default, which is recommended to make sure you can recover your data if it's lost due to unforeseen events. The backup incurs additional costs according to either Backup and DR pricing or Compute Engine pricing for disk snapshots.

If desired, you can select a different backup option (or disable backups) before you finish creating an instance. You can also change which backup option your project selects by default. For more information, see Configure the default backup setting for the console.

You can apply a Backup and DR Service backup plan during instance creation. Use backup plans to centralize backup management of instances across projects and improve cyber resilience through immutable and indelible backups to backup vaults.

Document AI

Custom extractor model pretrained-foundation-model-v1.4-2025-02-05 powered by Gemini 2.0 Flash LLM is available as Public Preview in US and EU regions with improved accuracy. The Custom Extractor Model supports a quota of up to 120 pages per minute for online process requests.

For more information about available models, see Custom extractor model versions.

Organization Policy

Custom organization policies are now generally available for Cloud Logging. For more information, see Use custom organization policies.

Resource Manager

Custom organization policies are now generally available for Cloud Logging. For more information, see Use custom organization policies.

Security Command Center

The attack path simulations feature can now automatically set the resource value of a Vertex AI dataset based on the sensitivity of the data that the dataset contains. For information about how to enable the automatic assignment of resource values based on data sensitivity, see Create a resource value configuration.

Sensitive Data Protection

Sensitive data discovery for Vertex AI is in General Availability. You can run discovery at the organization, folder, or project level to generate profiles of your Vertex AI training data. Data profiles provide metrics and insights about the sensitivity and risk levels of your data to help you plan your data governance workflows.

VPC Service Controls

VPC Service Controls feature (Status: Preview): The VPC Service Controls violation dashboard provides an aggregated view of all access denials by service perimeters in your organization. This feature is available in Preview.

For more information, see Set up and view the violation dashboard.

February 13, 2025

AlloyDB for PostgreSQL

The extension vector, which includes pgvector functions and operators, is updated to version 0.8.0.

Carbon Footprint

For the January 2025 semi-annual methodology refresh (released in mid-February 2025), we implemented the following improvements and updated the carbon model to version 12:

Improved internal cost accounting for Vertex AI and Notebooks services. This resulted in an improved allocation of energy consumption and emissions to these services. For more information on how we use internal cost to reallocate shared infrastructure, see Energy use and allocation to internal services.

Certificate Authority Service

Custom Authority Information Access (AIA) and CRL Distribution Point (CDP) extensions for certificate authorities (CAs) is now generally available (GA). You can create CAs with custom AIA and CDP certificate extensions. These custom URLs are embedded directly into certificates issued by your CA, providing precise control over certificate validation paths. If custom AIA and CDP extensions are not specified, the system continues to use the default Google Cloud Storage (GCS) publishing locations for AIA and CDP information in issued certificates. The AIA extension enables clients to locate the issuer's certificate, while the CDP extension provides access to the Certificate Revocation List (CRL).

Cloud CDN

Cloud CDN supports invalidation by using cache tags with faster performance and higher rate limits in Preview. By grouping objects together using cache tags, you can remove and refresh content at scale.

Cloud Composer

(Cloud Composer 3) The GOOGLE_CLOUD_PROJECT environment variable is changed to reserved for Cloud Composer 3. This fixes an issue where creating an environment with this variable failed with a non-specific error.

(Cloud Composer 2) The dependency_permissions_check_count metric now correctly reports the number of missing permissions.

(Cloud Composer 2) The list of permissions reported by dependency_permissions_check_count metric was updated. Now the metric reports more permissions that are required for a functioning environment. Permissions that weren't necessary were replaced or removed.

(New Cloud Composer environments only) Cloud Composer now enforces SSL connections to Cloud SQL instances.

This change implements a security compliance standard in Cloud Composer and enforces SSL usage. You can adopt other security standards by following recommendations listed in Vulnerability findings. Previously, it was possible to create a non-SSL connection to the Airflow database. After the change, the connection will be refused.

(Available without upgrading) Fixed a problem that caused Terraform to unnecessarily force the replacement of cloud_composer_network_ipv4_cidr_block, web_server_ipv4_cidr_block, and cloud_sql_ipv4_cidr_block fields in some configurations of Cloud Composer 2 and Cloud Composer 1 environments.

(Airflow 2.10.2 and 2.9.3) Preinstalled packages were changed:

  • logbook was removed from preinstalled packages
  • minimal-snowplow-tracker was removed from preinstalled packages
  • mashumaro was downgraded from 3.15 to 3.14

New Airflow builds are available in Cloud Composer 3:

  • composer-3-airflow-2.10.2-build.8 (default)
  • composer-3-airflow-2.9.3-build.15

New images are available in Cloud Composer 2:

  • composer-2.11.2-airflow-2.10.2 (default)
  • composer-2.11.2-airflow-2.9.3

Cloud Composer versions 2.6.0 and 2.6.1 have reached their end of support period.

Cloud SQL for MySQL

Cloud SQL for MySQL lets you recreate a lagging replica when replication falls behind a predefined length of time. For more information, see Recreate lagging replica. This feature is in Preview.

Google Cloud VMware Engine

Google Cloud VMware Engine now supports soft deletion for private clouds. This feature provides seven days of post delete data protection. See Delete a private cloud for more information.

Google Distributed Cloud (software only) for VMware

Google Distributed Cloud (software only) for VMware 1.31.200-gke.58 is now available for download. To upgrade, see Upgrade a cluster or a node pool. Google Distributed Cloud 1.31.200-gke.58 runs on Kubernetes v1.31.5-gke.300.

If you are using a third-party storage vendor, check the GDC Ready storage partners document to make sure the storage vendor has already passed the qualification for this release.

After a release, it takes approximately 7 to 14 days for the version to become available for use with GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

The following issue is fixed in 1.31.200-gke.58:

  • Fixed an issue that caused Runtime: out of memory errors after running gkeadm to create or upgrade clusters.

The 1.31.200-gke.58 release includes many vulnerability fixes. For a list of all vulnerabilities fixed in this release, see Vulnerability fixes.

Google Distributed Cloud (software only) for bare metal

Release 1.31.200-gke.58

Google Distributed Cloud for bare metal 1.31.200-gke.58 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.31.200-gke.58 runs on Kubernetes v1.31.5-gke.300.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

The 1.31.200-gke.58 release includes many vulnerability fixes. For a list of all vulnerabilities fixed in this release, see Vulnerability fixes.

For information about the latest known issues, see Google Distributed Cloud for bare metal known issues in the Troubleshooting section.

Looker Studio

Sort by multiple columns

Viewers can now sort table charts by multiple columns by clicking multiple column headers while holding the Shift key.

Learn more about table charts.

Organization Policy

Custom organization policies are now generally available for security posture resources. For more information, see Add a custom organization policy.

Resource Manager

Custom organization policies are now generally available for security posture resources. For more information, see Add a custom organization policy.

Security Command Center

Security Command Center now supports integration with Snyk. This feature is in Preview.

Vertex AI Agent Builder

Vertex AI Search: Stream answers (GA)

Vertex AI Search now supports answer streaming. This feature returns generated answers in sequential parts, reducing the perception of latency. As the end users read the first part of the answer, the subsequent parts of the answer are being generated.

This feature also includes many of the features of the original answer method.

This feature is Generally available to all customers. For more information, see Stream answers.

February 12, 2025

Anthos Attached Clusters

You can now launch clusters with the following Kubernetes versions. Click on the following links to see the release notes associated with these patches:

Anthos clusters on AWS

You can now launch clusters with the following Kubernetes versions. Click on the following links to see the release notes associated with these patches:

Anthos clusters on Azure

You can now launch clusters with the following Kubernetes versions. Click on the following links to see the release notes associated with these patches:

Cloud NAT

Cloud NAT gateways for Public NAT support IPv6 to IPv4 network address translation in Preview. For more information, see NAT64 in Public NAT.

Cloud SQL for PostgreSQL

Cloud SQL for PostgreSQL now supports the tds_fdw extension. This extension provides a foreign data wrapper (fdw) for accessing databases that use the Tabular Data Stream (TDS) protocol, such as Microsoft SQL Server or Sybase. Cloud SQL for PostgreSQL supports tds_fdw version 2.0.4. For more information about using this extension, see Configure PostgreSQL extensions.

You can now perform pg_replication_origin_* functions as a database user with the cloudsqlsuperuser role. For more information about cloudsqlsuperuser, see About PostgreSQL users and roles.

The rollout of the following extension version is underway:

  • rdkit is upgraded from 4.3.0 to 4.6.1

If you use a maintenance window, then the updates to the extension version happen according to the timeframe that you set in the window. Otherwise, the updates occur within the next few weeks.

The new maintenance version is [PostgreSQL version].R20250112.01_03. To learn how to check your maintenance version, see Self-service maintenance. To find your maintenance window or to manage maintenance updates, see Find and set maintenance windows.

Container Optimized OS

cos-113-18244-291-36

Kernel Docker Containerd GPU Drivers
COS-6.1.123 v24.0.9 v1.7.24 See List

Updated the default tag of the GPU driver supporting the NVIDIA H200 GPU device to 570.86.15.

Updated Konlet to v.0.13.4.

Support for NVIDIA B200 GPU – Added support for the R570 driver series, including version 570.86.15. This version has been assigned the latest, default, and R570 tags.

Updated cos-gpu-installer to v2.4.7:

1.Added Support for NVIDIA B200 GPU.

2.Enabled --prepare-build-tools flag to preload GPU driver metadata for ARM64.

Upgraded sys-apps/diffutils to v3.11.

Upgraded sys-apps/hwdata to v0.391.

Fixed CVE-2025-0840 in binutils.

Fixed CVE-2024-56664 in the Linux kernel.

Fixed CVE-2024-50304 in the Linux kernel.

Fixed CVE-2024-50047 in the Linux kernel.

Fixed CVE-2025-21669 in the Linux kernel.

Fixed CVE-2025-21683 in the Linux kernel.

Fixed CVE-2024-40945 in the Linux kernel.

Fixed CVE-2025-21666 in the Linux kernel.

Fixed CVE-2025-21631 in the Linux kernel.

Fixed CVE-2025-21671 in the Linux kernel.

Fixed CVE-2024-50014 in the Linux kernel.

Fixed CVE-2024-49994 in the Linux kernel.

Fixed CVE-2025-21665 in the Linux kernel.

Fixed CVE-2025-21667 in the Linux kernel.

Runtime sysctl changes:

  • Changed: fs.file-max: 812027 -> 812031

cos-109-17800-436-33

Kernel Docker Containerd GPU Drivers
COS-6.1.124 v24.0.9 v1.7.24 See List

Added support for TPU v6 devices.

Runtime sysctl changes:

  • Changed: fs.file-max: 812272 -> 812276

Generative AI on Vertex AI

Deepseek-V3 and Deepseek-R1 have been added to Model Garden in Preview:

  • DeepSeek-V3 (671B) is a powerful Mixture-of-Experts (MoE) language model with 671B total parameters with 37B activated for each token.
  • DeepSeek-R1 (671B) is one of the first-generation reasoning models introduced by DeepSeek and offers performance comparable to OpenAI-o1 across math, code, and reasoning tasks.

You can use a notebook to deploy these models.

Google SecOps Google SecOps SIEM Looker

Looker 25.2 is expected to include the following changes, features, and fixes:

  • Expected Looker (original) deployment start: Tuesday, February 18, 2025

  • Expected Looker (original) final deployment and download available: Thursday, February 27, 2025

  • Expected Looker (Google Cloud core) deployment start: Tuesday, February 18, 2025

  • Expected Looker (Google Cloud core) final deployment: Tuesday, March 4, 2025

The Search Content Summaries API endpoint now returns more secure results when a closed system is enabled for an instance. The target_user_id value must be a user who is visible to the user who is calling the endpoint, and the target_group_id value must be a group that the user is a part of.

Looker now prevents developers from creating new models named system__activity.

The Chart Config Editor now supports the median function in the formatters.select parameter.

The manage_modelsets_restricted permission is now generally available. This permission lets users add or remove models from specified model sets.

The manage_schedules permission is now generally available. This permission lets users reassign and delete schedules on the Schedules page for the models that they have access to.

Aggregate tables now support the publish_as_db_view parameter for database dialects that support PDT stable database views. When an aggregate table is configured with publish_as_db_view: yes, Looker creates a stable database view on your database for the aggregate table to enable querying the table outside of Looker. NOTE: This item was added on March 4, 2025.

An issue has been fixed where downloading a dashboard as a PDF with multiple pages could cause some content to be cut off. This feature now performs as expected.

An issue has been fixed where using a Snowflake or Postgres connection could trigger the following error message: Driver cannot be initialized: can't modify frozen String. This feature now performs as expected.

An issue has been fixed where creating a visualization with no unpivoted dimensions could cause Looker to display a vague error message for some chart types. Looker now informs the user that at least one unpivoted dimension is required for the visualization, and this feature now performs as expected.

An issue has been fixed where encoded embed domains could not be used with the Embed SDK. Looker can now decode URLs in the embed_domain parameter, and this feature now performs as expected.

An issue has been fixed where the Marketplace auto-update and auto-install processes could cause other parts of Looker to take longer to respond. This feature now performs as expected.

An issue has been fixed where searching terms with multiple words in the field picker would match each word separately. The search now correctly matches multi-word phrases, and this feature now performs as expected.

An issue has been fixed where an invalid conditional formatting string could cause the Explore page to crash. This feature now performs as expected.

An issue has been fixed where actions whose connection tests failed would continue to run excessive tests in the background. This feature now performs as expected.

An issue has been fixed where Looker did not correctly apply theme text colors to axis labels on timeline visualizations. This feature now performs as expected.

An issue has been fixed where setting a long external_group_id when creating an embed user caused Looker to display a vague error. The recommended external_group_id length is now documented as 81 characters, and this feature now performs as expected.

An issue has been fixed where navigating to a Look from another Look could cause incorrect System Activity records. This feature now performs as expected.

An issue has been fixed where reordering columns in an Explore could cause hidden table calculations to be removed from the table. This feature now performs as expected.

An issue has been fixed where adding multiple dashboard filters to the same date field could cause Looker to remove filters from the dashboard. This feature now performs as expected.

An issue has been fixed where tables could be cut off on dashboard PDFs that included multiple pages. This feature now performs as expected.

An issue has been fixed where dashboard filters could prevent users from using commas to add multiple filter conditions. This feature now performs as expected.

An issue has been fixed where certain custom visualization configurations could cause rendered PDF downloads to be blank. This feature now performs as expected.

An issue has been fixed where the LookML Validator could surface outdated LookML errors that were related to extensions. This feature now performs as expected.

An issue has been fixed where exploring from a merge query on an embedded dashboard could lead to a blank page. This feature now performs as expected.

An issue has been fixed where embed users were unable to see certain shared folders. This feature now performs as expected.

Security Command Center

Cloud Infrastructure Entitlement Management (CIEM) has launched support for the following:

  • AWS Managed Microsoft AD and on-premises Active Directory identities. This feature alerts you to potential misconfigurations in your on-premises Active Directory or AWS-managed Active Directory identities.
  • Account-level findings in AWS. This lets you set up AWS audit logs for individual AWS accounts—instead of mandating logs across the entire AWS organization—and helps reduce your total cost of operations for CIEM in Security Command Center Enterprise.
Service Extensions

Service Extensions plugins support Go-compiled Wasm, in addition to Rust and C++. For more information, see Prepare the plugin code.

February 11, 2025

Apigee API hub

IAM conditions for fine-grained access

API hub now integrates with IAM Conditions, enabling you to define and enforce granular, conditional attribute-based access control for your API hub resources. For more information, see Add IAM conditions.

Enhanced onboarding experience

After provisioning your API hub instance in your Google Cloud project, you'll now see an updated Overview page. You can also automatically attach your Apigee runtime projects right from this page. For more information, see Provision API hub in the Cloud console.

Auth support for Vertex AI extensions

API hub now supports the following authentication configurations for creating Vertex AI extensions:

  • API Key: Authenticate using API keys stored in Secret Manager.
  • HTTP Basic: Authenticate using credentials stored in Secret Manager.

For more information, see Create a Vertex AI extension.

Resource ID length limits increased

The maximum allowed length for API hub resource IDs has been increased. The new limits are as follows:

  • APIs: API unique IDs can now be up to 500 characters long.
  • Versions: Version unique IDs can now be up to 700 characters long.
  • Specs: Specification unique IDs can now be up to 1000 characters long.
Apigee UI

On February 11, 2025, we released an updated version of the Apigee UI.

Bug ID Description
356780408 Fixed issue preventing users from saving a proxy revision

Resolved issue in the proxy editor where navigating away from a proxy file containing an error would not properly clear the error state, requiring users to reload the page to save the edited proxy.

Cloud Healthcare API

A new release is available. This release may include some or all of the following: general performance improvements, bug fixes, and updates to the API reference documentation.

Cloud Run functions

Cloud Run functions created with the Cloud Functions (v2) API (cloudfunctions.googleapis.com) can now be detached so that they can only be managed through the Cloud Run Admin API (run.googleapis.com). When the detach operation completes, your function will retain its cloudfunctions.net URLs and triggers, and can only be managed using the Cloud Run Admin API. Note that the detach operation is irreversible. For more information see Manage functions.

Cloud SQL for MySQL

Cloud SQL for MySQL vector search is now generally available. After you store vector embeddings in a table, you can perform K-nearest neighbor (KNN) searches against your vector dataset. You can also add a vector search index to perform approximate nearest neighbor (ANN) searches.

For more information, see Vector search.

You can now use a custom DNS name to connect to your Cloud SQL instances by adding a custom subject alternative name (SAN) to your Cloud SQL instances. This feature is available for instances that are configured with Customer Managed CAS CA.. For more information, see Create instances.

You can also add, modify, and remove a custom SAN for existing Cloud SQL instances. For more information, see Edit instances.

This feature is available in Preview.

Cloud SQL for PostgreSQL

You can now use a custom DNS name to connect to your Cloud SQL instances by adding a custom subject alternative name (SAN) to your Cloud SQL instances. This feature is available for instances that are configured with Customer Managed CAS CA.. For more information, see Create instances.

You can also add, modify, and remove a custom SAN for existing Cloud SQL instances. For more information, see Edit instances.

This feature is available in Preview.

Cloud SQL for SQL Server

You can now use a custom DNS name to connect to your Cloud SQL instances by adding a custom subject alternative name (SAN) to your Cloud SQL instances. This feature is available for instances that are configured with Customer Managed CAS CA.. For more information, see Create instances.

You can also add, modify, and remove a custom SAN for existing Cloud SQL instances. For more information, see Edit instances.

This feature is available in Preview.

Dataplex

Data lineage for Dataproc Hive jobs is available in preview. For more information, see Enable Hive data lineage in Dataproc.

Dataproc

Data Lineage for Dataproc Hive is now in Public Preview, which can be enabled using the Hive Lineage initialization action.

Developer Connect

Developer Connect gcloud commands are now Generally Available (GA).

Developer Connect now supports connectivity with Bitbucket Cloud and Bitbucket Data Center. These features are Generally Available (GA). Learn how to get started at Connect to Bitbucket Cloud and Connect to Bitbucket Data Center.

Generative AI on Vertex AI

The Llama 3.3 70B model that is managed on Vertex AI is now in Preview.

Google Kubernetes Engine

(2025-R06) Version updates

GKE cluster versions have been updated.

New versions available for upgrades and new clusters.

The following Kubernetes versions are now available for new clusters and for opt-in control plane upgrades and node upgrades for existing clusters. For more information on versioning and upgrades, see GKE versioning and support and Upgrades.

Rapid channel

  • Version 1.32.1-gke.1200003 is now the default version for cluster creation in the Rapid channel.
  • The following versions are now available in the Rapid channel:
  • The following versions are no longer available in the Rapid channel:
    • 1.28.15-gke.1641000
    • 1.28.15-gke.1673000
    • 1.28.15-gke.1720000
    • 1.29.13-gke.1006000
    • 1.30.9-gke.1009000
    • 1.31.5-gke.1023000
    • 1.32.0-gke.1448000
  • Auto-upgrade targets are now available for the following minor versions:
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.28 to version 1.29.13-gke.1038000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.29 to version 1.30.9-gke.1046000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.30 to version 1.31.5-gke.1068000 with this release.
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.29 to version 1.29.13-gke.1038000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.30 to version 1.30.9-gke.1046000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.31 to version 1.31.5-gke.1068000 with this release.

Regular channel

  • Version 1.31.5-gke.1023000 is now the default version for cluster creation in the Regular channel.
  • The following versions are now available in the Regular channel:
  • The following versions are no longer available in the Regular channel:
    • 1.28.15-gke.1612000
    • 1.28.15-gke.1641000
    • 1.29.12-gke.1270000
    • 1.30.8-gke.1261000
    • 1.31.4-gke.1372000
  • Auto-upgrade targets are now available for the following minor versions:
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.28 to version 1.29.13-gke.1006000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.29 to version 1.30.9-gke.1009000 with this release.
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.29 to version 1.29.13-gke.1006000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.30 to version 1.30.9-gke.1009000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.31 to version 1.31.5-gke.1023000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.32 to version 1.32.1-gke.1200003 with this release.

Stable channel

  • Version 1.30.8-gke.1162001 is now the default version for cluster creation in the Stable channel.
  • The following versions are now available in the Stable channel:
  • The following versions are no longer available in the Stable channel:
    • 1.28.15-gke.1480000
    • 1.28.15-gke.1503000
    • 1.29.12-gke.1120001
    • 1.30.8-gke.1128001
    • 1.30.8-gke.1162000
    • 1.31.4-gke.1183000
  • Auto-upgrade targets are now available for the following minor versions:
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.28 to version 1.29.12-gke.1143001 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.29 to version 1.30.8-gke.1162001 with this release.
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.29 to version 1.29.12-gke.1143001 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.30 to version 1.30.8-gke.1162001 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.31 to version 1.31.4-gke.1256000 with this release.

Extended channel

  • Version 1.31.5-gke.1023000 is now the default version for cluster creation in the Extended channel.
  • The following versions are now available in the Extended channel:
  • The following versions are no longer available in the Extended channel:
    • 1.27.16-gke.2246000
    • 1.27.16-gke.2342000
    • 1.29.12-gke.1270000
    • 1.30.8-gke.1261000
    • 1.31.4-gke.1372000
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.27 to version 1.27.16-gke.2270000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.29 to version 1.29.13-gke.1006000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.30 to version 1.30.9-gke.1009000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.31 to version 1.31.5-gke.1023000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.32 to version 1.32.1-gke.1200003 with this release.

No channel

(2025-R06) Version updates

  • Version 1.32.1-gke.1200003 is now the default version for cluster creation in the Rapid channel.
  • The following versions are now available in the Rapid channel:
  • The following versions are no longer available in the Rapid channel:
    • 1.28.15-gke.1641000
    • 1.28.15-gke.1673000
    • 1.28.15-gke.1720000
    • 1.29.13-gke.1006000
    • 1.30.9-gke.1009000
    • 1.31.5-gke.1023000
    • 1.32.0-gke.1448000
  • Auto-upgrade targets are now available for the following minor versions:
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.28 to version 1.29.13-gke.1038000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.29 to version 1.30.9-gke.1046000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.30 to version 1.31.5-gke.1068000 with this release.
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.29 to version 1.29.13-gke.1038000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.30 to version 1.30.9-gke.1046000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.31 to version 1.31.5-gke.1068000 with this release.

(2025-R06) Version updates

  • Version 1.31.5-gke.1023000 is now the default version for cluster creation in the Regular channel.
  • The following versions are now available in the Regular channel:
  • The following versions are no longer available in the Regular channel:
    • 1.28.15-gke.1612000
    • 1.28.15-gke.1641000
    • 1.29.12-gke.1270000
    • 1.30.8-gke.1261000
    • 1.31.4-gke.1372000
  • Auto-upgrade targets are now available for the following minor versions:
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.28 to version 1.29.13-gke.1006000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.29 to version 1.30.9-gke.1009000 with this release.
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.29 to version 1.29.13-gke.1006000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.30 to version 1.30.9-gke.1009000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.31 to version 1.31.5-gke.1023000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.32 to version 1.32.1-gke.1200003 with this release.

(2025-R06) Version updates

  • Version 1.30.8-gke.1162001 is now the default version for cluster creation in the Stable channel.
  • The following versions are now available in the Stable channel:
  • The following versions are no longer available in the Stable channel:
    • 1.28.15-gke.1480000
    • 1.28.15-gke.1503000
    • 1.29.12-gke.1120001
    • 1.30.8-gke.1128001
    • 1.30.8-gke.1162000
    • 1.31.4-gke.1183000
  • Auto-upgrade targets are now available for the following minor versions:
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.28 to version 1.29.12-gke.1143001 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.29 to version 1.30.8-gke.1162001 with this release.
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.29 to version 1.29.12-gke.1143001 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.30 to version 1.30.8-gke.1162001 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.31 to version 1.31.4-gke.1256000 with this release.

(2025-R06) Version updates

  • Version 1.31.5-gke.1023000 is now the default version for cluster creation in the Extended channel.
  • The following versions are now available in the Extended channel:
  • The following versions are no longer available in the Extended channel:
    • 1.27.16-gke.2246000
    • 1.27.16-gke.2342000
    • 1.29.12-gke.1270000
    • 1.30.8-gke.1261000
    • 1.31.4-gke.1372000
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.27 to version 1.27.16-gke.2270000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.29 to version 1.29.13-gke.1006000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.30 to version 1.30.9-gke.1009000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.31 to version 1.31.5-gke.1023000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.32 to version 1.32.1-gke.1200003 with this release.

(2025-R06) Version updates

Google SecOps

The following is a correction to the release note published on December 22, 2024.

Google SecOps has updated the list of supported default parsers. Parsers are updated gradually, so it might take one to four days before you see the changes reflected in your region.

The following supported default parsers have changed. Each parser is listed by product name and log_type value, if applicable. This list now includes both released default parsers and pending parser updates.

  • Absolute Mobile Device Management (ABSOLUTE)
  • Atlassian Cloud Admin Audit (ATLASSIAN_AUDIT)
  • AWS VPC Flow (AWS_VPC_FLOW)
  • Azure AD (AZURE_AD)
  • Azure Application Gateway (AZURE_GATEWAY)
  • Azure SQL (AZURE_SQL)
  • Azure Storage Audit (AZURE_STORAGE_AUDIT)
  • Blue Coat Proxy (BLUECOAT_WEBPROXY)
  • Check Point Harmony (CHECKPOINT_HARMONY)
  • Cisco ASA (CISCO_ASA_FIREWALL)
  • Cisco Firepower NGFW (CISCO_FIREPOWER_FIREWALL)
  • Cisco Meraki (CISCO_MERAKI)
  • Cisco Router (CISCO_ROUTER)
  • Cisco Umbrella SWG DLP (CISCO_UMBRELLA_SWG_DLP)
  • Cisco VPN (CISCO_VPN)
  • Citrix Netscaler (CITRIX_NETSCALER)
  • Claroty Continuous Threat Detection (CLAROTY_CTD)
  • Cloud Audit Logs (N/A)
  • Cloud DNS (N/A)
  • Code42 Incydr (CODE42_INCYDR)
  • Colinet Trotta GAUS SEGUROS (CT_GAUS_SEGUROS)
  • CrowdStrike Falcon (CS_EDR)
  • Delinea Distributed Engine (DELINEA_DISTRIBUTED_ENGINE)
  • Druva Backup (DRUVA_BACKUP)
  • Duo Administrator Logs (DUO_ADMIN)
  • Elastic Audit Beats (ELASTIC_AUDITBEAT)
  • F5 BIGIP LTM (F5_BIGIP_LTM)
  • Forcepoint NGFW (FORCEPOINT_FIREWALL)
  • FortiGate (FORTINET_FIREWALL)
  • GitHub (GITHUB)
  • Google Cloud Identity Context (CLOUD_IDENTITY_CONTEXT)
  • Guardicore Centra (GUARDICORE_CENTRA)
  • HPE Aruba Networking Central (ARUBA_CENTRAL)
  • Imperva Advanced Bot Protection (IMPERVA_ABP)
  • Kubernetes Audit Azure (KUBERNETES_AUDIT_AZURE)
  • Linux Auditing System (AuditD) (AUDITD)
  • Maria Database (MARIA_DB)
  • Microsoft Defender for Endpoint (MICROSOFT_DEFENDER_ENDPOINT)
  • Opnsense (OPNSENSE)
  • Oracle NetSuite (ORACLE_NETSUITE)
  • Palo Alto Panorama (PAN_PANORAMA)
  • Palo Alto Prisma Cloud Alert payload (PAN_PRISMA_CA)
  • Ping One (PING_ONE)
  • Proofpoint Observeit (OBSERVEIT)
  • Proofpoint Threat Response (PROOFPOINT_TRAP)
  • QNAP Systems NAS (QNAP_NAS)
  • Reserved LogType2 (RESERVED_LOG_TYPE_2)
  • Salesforce (SALESFORCE)
  • SAP Sybase Adaptive Server Enterprise Database (SAP_ASE)
  • Sentinelone Alerts (SENTINELONE_ALERT)
  • Snort (SNORT_IDS)
  • Solaris system (SOLARIS_SYSTEM)
  • Sourcefire (SOURCEFIRE_IDS)
  • Suricata IDS (SURICATA_IDS)
  • Symantec DLP (SYMANTEC_DLP)
  • Symantec Event export (SYMANTEC_EVENT_EXPORT)
  • Trend Micro Vision One (TRENDMICRO_VISION_ONE)
  • TrendMicro Apex Central (TRENDMICRO_APEX_CENTRAL)
  • Twingate (TWINGATE)
  • Wazuh (WAZUH)
  • Windows DHCP (WINDOWS_DHCP)
  • Windows Event (WINEVTLOG)
  • Windows Network Policy Server (WINDOWS_NET_POLICY_SERVER)
  • Windows Sysmon (WINDOWS_SYSMON)

The following log types were added without a default parser. Each parser is listed by product name and log_type value, if applicable.

  • Addigy MDM (ADDIGY_MDM)
  • Akamai DataStream 2 (AKAMAI_DATASTREAM_2)
  • Anzenna (ANZENNA)
  • AWS ECS Metrics (AWS_ECS_METRICS)
  • Azure Log Analytics Workspace (AZURE_LOG_ANALYTICS_WORKSPACE)
  • Blockdaemon API (BLOCKDAEMON_API)
  • Chronicle Feed (CHRONICLE_FEED)
  • Claroty xDome Secure Access (CLAROTY_XDOME_SECURE_ACCESS)
  • Cloudflare Spectrum (CLOUDFLARE_SPECTRUM)
  • Cloudsek Alerts (CLOUDSEK_ALERTS)
  • CloudWaves Sensato Nightingale Honeypot (SENSATO_HONEYPOT)
  • Docker Hub Activity (DOCKER_HUB_ACTIVITY)
  • Fortinet FortiDDoS (FORTINET_FORTIDDOS)
  • Honeywell Cyber Insights (HONEYWELL_CYBERINSIGHTS)
  • IPFire (IPFIRE)
  • Jamf Connect (JAMF_CONNECT)
  • KnowBe4 Audit Log (KNOWBE4)
  • LogicGate (LOGICGATE)
  • ManageEngine NCM (MANAGEENGINE_NCM)
  • Microsoft Dotnet Log Files (MICROSOFT_DOTNET)
  • Nessus Network Monitor (NESSUS_NETWORK_MONITOR)
  • Netography Fusion (NETOGRAPHY_FUSION)
  • Netwrix StealthAudit (NETWRIX_STEALTHAUDIT)
  • Oomnitza (OOMNITZA)
  • Open CTI Platform (OPENCTI)
  • Oracle EBS (ORACLE_EBS)
  • Oracle Zero Data Loss Recovery Appliance (ORACLE_ZDLRA)
  • PhishAlarm (PHISHALARM)
  • Savvy Security (SAVVY_SECURITY)
  • Symantec Security Analytics (SYMANTEC_SA)
  • Venafi ZTPKI (VENAFI_ZTPKI)

For a list of supported log types and details about default parser changes, see Supported log types and default parsers.

Google SecOps SIEM

The following is a correction to the release note published on December 22, 2024.

Google SecOps has updated the list of supported default parsers. Parsers are updated gradually, so it might take one to four days before you see the changes reflected in your region.

The following supported default parsers have changed. Each parser is listed by product name and log_type value, if applicable. This list now includes both released default parsers and pending parser updates.

  • Absolute Mobile Device Management (ABSOLUTE)
  • Atlassian Cloud Admin Audit (ATLASSIAN_AUDIT)
  • AWS VPC Flow (AWS_VPC_FLOW)
  • Azure AD (AZURE_AD)
  • Azure Application Gateway (AZURE_GATEWAY)
  • Azure SQL (AZURE_SQL)
  • Azure Storage Audit (AZURE_STORAGE_AUDIT)
  • Blue Coat Proxy (BLUECOAT_WEBPROXY)
  • Check Point Harmony (CHECKPOINT_HARMONY)
  • Cisco ASA (CISCO_ASA_FIREWALL)
  • Cisco Firepower NGFW (CISCO_FIREPOWER_FIREWALL)
  • Cisco Meraki (CISCO_MERAKI)
  • Cisco Router (CISCO_ROUTER)
  • Cisco Umbrella SWG DLP (CISCO_UMBRELLA_SWG_DLP)
  • Cisco VPN (CISCO_VPN)
  • Citrix Netscaler (CITRIX_NETSCALER)
  • Claroty Continuous Threat Detection (CLAROTY_CTD)
  • Cloud Audit Logs (N/A)
  • Cloud DNS (N/A)
  • Code42 Incydr (CODE42_INCYDR)
  • Colinet Trotta GAUS SEGUROS (CT_GAUS_SEGUROS)
  • CrowdStrike Falcon (CS_EDR)
  • Delinea Distributed Engine (DELINEA_DISTRIBUTED_ENGINE)
  • Druva Backup (DRUVA_BACKUP)
  • Duo Administrator Logs (DUO_ADMIN)
  • Elastic Audit Beats (ELASTIC_AUDITBEAT)
  • F5 BIGIP LTM (F5_BIGIP_LTM)
  • Forcepoint NGFW (FORCEPOINT_FIREWALL)
  • FortiGate (FORTINET_FIREWALL)
  • GitHub (GITHUB)
  • Google Cloud Identity Context (CLOUD_IDENTITY_CONTEXT)
  • Guardicore Centra (GUARDICORE_CENTRA)
  • HPE Aruba Networking Central (ARUBA_CENTRAL)
  • Imperva Advanced Bot Protection (IMPERVA_ABP)
  • Kubernetes Audit Azure (KUBERNETES_AUDIT_AZURE)
  • Linux Auditing System (AuditD) (AUDITD)
  • Maria Database (MARIA_DB)
  • Microsoft Defender for Endpoint (MICROSOFT_DEFENDER_ENDPOINT)
  • Opnsense (OPNSENSE)
  • Oracle NetSuite (ORACLE_NETSUITE)
  • Palo Alto Panorama (PAN_PANORAMA)
  • Palo Alto Prisma Cloud Alert payload (PAN_PRISMA_CA)
  • Ping One (PING_ONE)
  • Proofpoint Observeit (OBSERVEIT)
  • Proofpoint Threat Response (PROOFPOINT_TRAP)
  • QNAP Systems NAS (QNAP_NAS)
  • Reserved LogType2 (RESERVED_LOG_TYPE_2)
  • Salesforce (SALESFORCE)
  • SAP Sybase Adaptive Server Enterprise Database (SAP_ASE)
  • Sentinelone Alerts (SENTINELONE_ALERT)
  • Snort (SNORT_IDS)
  • Solaris system (SOLARIS_SYSTEM)
  • Sourcefire (SOURCEFIRE_IDS)
  • Suricata IDS (SURICATA_IDS)
  • Symantec DLP (SYMANTEC_DLP)
  • Symantec Event export (SYMANTEC_EVENT_EXPORT)
  • Trend Micro Vision One (TRENDMICRO_VISION_ONE)
  • TrendMicro Apex Central (TRENDMICRO_APEX_CENTRAL)
  • Twingate (TWINGATE)
  • Wazuh (WAZUH)
  • Windows DHCP (WINDOWS_DHCP)
  • Windows Event (WINEVTLOG)
  • Windows Network Policy Server (WINDOWS_NET_POLICY_SERVER)
  • Windows Sysmon (WINDOWS_SYSMON)

The following log types were added without a default parser. Each parser is listed by product name and log_type value, if applicable.

  • Addigy MDM (ADDIGY_MDM)
  • Akamai DataStream 2 (AKAMAI_DATASTREAM_2)
  • Anzenna (ANZENNA)
  • AWS ECS Metrics (AWS_ECS_METRICS)
  • Azure Log Analytics Workspace (AZURE_LOG_ANALYTICS_WORKSPACE)
  • Blockdaemon API (BLOCKDAEMON_API)
  • Chronicle Feed (CHRONICLE_FEED)
  • Claroty xDome Secure Access (CLAROTY_XDOME_SECURE_ACCESS)
  • Cloudflare Spectrum (CLOUDFLARE_SPECTRUM)
  • Cloudsek Alerts (CLOUDSEK_ALERTS)
  • CloudWaves Sensato Nightingale Honeypot (SENSATO_HONEYPOT)
  • Docker Hub Activity (DOCKER_HUB_ACTIVITY)
  • Fortinet FortiDDoS (FORTINET_FORTIDDOS)
  • Honeywell Cyber Insights (HONEYWELL_CYBERINSIGHTS)
  • IPFire (IPFIRE)
  • Jamf Connect (JAMF_CONNECT)
  • KnowBe4 Audit Log (KNOWBE4)
  • LogicGate (LOGICGATE)
  • ManageEngine NCM (MANAGEENGINE_NCM)
  • Microsoft Dotnet Log Files (MICROSOFT_DOTNET)
  • Nessus Network Monitor (NESSUS_NETWORK_MONITOR)
  • Netography Fusion (NETOGRAPHY_FUSION)
  • Netwrix StealthAudit (NETWRIX_STEALTHAUDIT)
  • Oomnitza (OOMNITZA)
  • Open CTI Platform (OPENCTI)
  • Oracle EBS (ORACLE_EBS)
  • Oracle Zero Data Loss Recovery Appliance (ORACLE_ZDLRA)
  • PhishAlarm (PHISHALARM)
  • Savvy Security (SAVVY_SECURITY)
  • Symantec Security Analytics (SYMANTEC_SA)
  • Venafi ZTPKI (VENAFI_ZTPKI)

For a list of supported log types and details about default parser changes, see Supported log types and default parsers.

Organization Policy

Custom organization policies are now generally available for Spanner. For more information, see Add a custom organization policy.

Custom organization policies are now generally available for Identity-Aware Proxy. For more information, see Use custom organization policies.

Custom organization policies are now generally available for Developer Connect. For more information, see Create custom organization policies.

Custom organization policies are now generally available for Dataproc Serverless. For more information, see Use custom constraints.

Custom organization policies are now generally available for Cloud DNS. For more information, see Create custom organization policy constraints.

Resource Manager

Custom organization policies are now generally available for Spanner. For more information, see Add a custom organization policy.

Custom organization policies are now generally available for Identity-Aware Proxy. For more information, see Use custom organization policies.

Custom organization policies are now generally available for Developer Connect. For more information, see Create custom organization policies.

Custom organization policies are now generally available for Dataproc Serverless. For more information, see Use custom constraints.

Custom organization policies are now generally available for Cloud DNS. For more information, see Create custom organization policy constraints.

Sensitive Data Protection

The JAPAN_CORPORATE_NUMBER infoType detector is available in all regions. For more information about all built-in infoTypes, see InfoType detector reference.

Spanner

Managed autoscaler is Generally Available.

Managed autoscaler now also supports the ability to scale read-only replicas independently from read-write replicas. By setting the compute capacity limits and CPU utilization targets, you can configure the managed autoscaler for all replicas of an instance or independently scale read-only replicas. For more information, see Asymmetric read-only autoscaling.

February 10, 2025

BigQuery

A weekly digest of client library updates from across the Cloud SDK.

Go

Changes for bigquery/storage/apiv1beta1

1.66.2 (2025-02-04)

Bug Fixes
  • bigquery: Broken github.com/envoyproxy/go-control-plane/envoy dep (#11556) (e70d63b), refs #11542

1.66.1 (2025-02-03)

Bug Fixes
  • bigquery: Move MaxStaleness field to table level (#10066) (164492d)

BigQuery data preparation provides context-aware join operation recommendations from Gemini. Data preparation is available in Preview.

Bigtable

A weekly digest of client library updates from across the Cloud SDK.

Java

Changes for google-cloud-bigtable

2.51.2 (2025-02-03)

Bug Fixes
Dependencies
Cloud Asset Inventory

The following resource types are now publicly available through the ExportAssets, ListAssets, BatchGetAssetsHistory, QueryAssets, Feed, and Search (SearchAllResources, SearchAllIamPolicies).

  • Essential Contacts API
    • essentialcontacts.googleapis.com/Contact
Cloud Monitoring

You can now use a variable to control the visibility of a dashboard widget. For more information, see the following documents:

Cloud Storage

A weekly digest of client library updates from across the Cloud SDK.

Java

Changes for google-cloud-storage

2.48.1 (2025-02-03)

Bug Fixes
  • deps: Update the Java code generator (gapic-generator-java) to 2.52.0 (00754bc)
  • Update batch handling to ensure each operation has its own unique idempotency-token (#2905) (8d79b8d)
Dependencies
  • Update dependency com.google.cloud:sdk-platform-java-config to v3.42.0 (#2895) (145afb0)
  • Update dependency com.google.cloud.opentelemetry:exporter-trace to v0.33.0 (#2904) (2a5242e)
Documentation
Cloud Translation

Translation LLM now supports translation between any of the supported source/target languages without English having to be either source or target.

Container Optimized OS

cos-117-18613-164-28

Kernel Docker Containerd GPU Drivers
COS-6.6.72 v24.0.9 v1.7.24 See List

Updated the default tag of the GPU driver supporting the NVIDIA H200 GPU device to 570.86.15.

Updated Konlet to v0.13.4.

Support for NVIDIA B200 GPU – Added support for the R570 driver series, including version 570.86.15. This version has been assigned the latest, default, and R570 tags.

Updated cos-gpu-installer to v2.4.7: 1.Added Support for NVIDIA B200 GPU. 2.Enabled --prepare-build-tools flag to preload GPU driver metadata for ARM64

Upgraded app-admin/fluent-bit to v3.1.10.

Upgraded sys-apps/hwdata to v0.391.

Fixed CVE-2025-0840 in binutils.

Fixed CVE-2025-21673 in the Linux kernel.

Fixed CVE-2025-21669 in the Linux kernel.

Fixed CVE-2025-21683 in the Linux kernel.

Fixed CVE-2024-50304 in the Linux kernel.

Fixed CVE-2025-21671 in the Linux kernel.

Fixed CVE-2025-21670 in the Linux kernel.

Fixed CVE-2024-50014 in the Linux kernel.

Fixed CVE-2024-49994 in the Linux kernel.

Fixed CVE-2025-21666 in the Linux kernel.

Fixed CVE-2025-21665 in the Linux kernel.

Fixed CVE-2025-21667 in the Linux kernel.

cos-109-17800-436-32

Kernel Docker Containerd GPU Drivers
COS-6.1.124 v24.0.9 v1.7.24 See List

Updated the default tag of the GPU driver supporting the NVIDIA H200 GPU device to 570.86.15.

Updated Konlet to v0.13.4.

Support for NVIDIA B200 GPU – Added support for the R570 driver series, including version 570.86.15. This version has been assigned the latest, default, and R570 tags.

Updated cos-gpu-installer to v2.4.7: Added Support for NVIDIA B200 GPU.

Upgraded sys-apps/diffutils to v3.11.

Fixed CVE-2025-0840 in binutils.

Fixed CVE-2024-50304 in the Linux kernel.

Fixed CVE-2024-50047 in the Linux kernel.

Fixed CVE-2025-21669 in the Linux kernel.

Fixed CVE-2025-21683 in the Linux kernel.

Fixed CVE-2024-40945 in the Linux kernel.

Fixed CVE-2025-21671 in the Linux kernel.

Fixed CVE-2024-50014 in the Linux kernel.

Fixed CVE-2024-49994 in the Linux kernel.

Fixed CVE-2025-21666 in the Linux kernel.

Fixed CVE-2025-21631 in the Linux kernel.

Fixed CVE-2025-21665 in the Linux kernel.

Fixed CVE-2025-21667 in the Linux kernel.

cos-105-17412-535-55

Kernel Docker Containerd GPU Drivers
COS-5.15.173 v23.0.3 v1.7.23 See List

Updated Konlet to v0.13.4.

Upgraded sys-apps/diffutils to v3.11.

Fixed CVE-2025-0840 in binutils.

Fixed CVE-2024-56672 in the Linux kernel.

Fixed CVE-2024-50304 in the Linux kernel.

Fixed CVE-2025-21669 in the Linux kernel.

Fixed CVE-2025-21683 in the Linux kernel.

Fixed CVE-2024-53217 in the Linux kernel.

Fixed CVE-2024-48881 in the Linux kernel.

Fixed CVE-2025-21666 in the Linux kernel.

Fixed CVE-2025-21631 in the Linux kernel.

Fixed CVE-2024-57874 in the Linux kernel.

Fixed CVE-2025-21665 in the Linux kernel.

Dataproc

Dataproc on Compute Engine: To help diagnose Dataproc clusters, you can set the following cluster properties to true when you create a cluster:

Note: starting May 10, 2025, these properties will be set to true by default.

Sensitive Data Protection

The RELIGIOUS_TERM infoType detector is now generally available in all regions. For more information about all built-in infoTypes, see InfoType detector reference.

Spanner

Custom organization policies are now generally available for Spanner. For more information, see Add a custom organization policy.

Text-to-Speech

Journey voices have been rebranded as Chirp HD voices.

VPC Service Controls

VPC Service Controls feature: Support for using third-party identities (both single identities and groups) in the ingress and egress rules to allow access to resources protected by a service perimeter is generally available.

For more information, see Configure identity groups and third-party identities in ingress and egress rules.

Vertex AI Agent Builder

Vertex AI Search: gemini-2.0-flash-001 model for the answer method

The Gemini 2.0 Flash (gemini-2.0-flash-001) model is available for answer generation in Vertex AI Search. This model is tuned to address context-based question and answering tasks.

For more information, see Answer generation model versions and lifecycle.

February 09, 2025

Dataproc Google SecOps SOAR

Release 6.3.33 is now in General Availability.

February 08, 2025

Google SecOps SOAR

Release 6.3.34 is currently in Preview.

February 07, 2025

Cloud Composer

Starting March 2025, the default version for new Cloud Composer environments changes from Cloud Composer 2 to Cloud Composer 3.

New environments that are created without a specified version will use the default Airflow build of Cloud Composer 3, composer-3-airflow-2. Currently, the default version is composer-2-airflow-2.

Cloud Run

Cloud Run integrations are discontinued from the Google Cloud console and Google Cloud CLI. No action is required; your deployed services that use these integrations will continue to work. We recommend transitioning to use the individual product experiences for each integration you have deployed. For more information about configuring resources for your services to connect to other Google Cloud products, see Connect to Google Cloud services.

Dataproc

New Dataproc on Compute Engine subminor image versions:

  • 2.0.131-debian10, 2.0.131-rocky8, 2.0.131-ubuntu18
  • 2.1.79-debian11, 2.1.79-rocky8, 2.1.79-ubuntu20, 2.1.79-ubuntu20-arm
  • 2.2.45-debian12, 2.2.45-rocky9, 2.2.45-ubuntu22

Spark UI for Dataproc Serverless Batches and Interactive sessions, which lets you to monitor and debug your serverless Spark workloads, is now available for CMEK (Customer-Managed Encryption Keys) and Assured Workloads. The Spark UI is available by default and free of cost.

Gemini Code Assist

Various bug fixes and minor product enhancements for VSCode Gemini Code Assist extension.

Generative AI on Vertex AI

The following advanced LLM inference optimization techniques are available in Model Garden in Preview:

  • Prefix caching reuses computations from previously generated text, eliminating redundant processing. It reduces time-to-first-token for requests with common prompt prefixes. Prefix caching is available for the following models:

    • vLLM: Llama 3.1 (8b, 70b), Llama 3.3 (70b)
    • Hex-LLM: Llama 2 (7b, 13b), Llama 3 (8b), Llama 3.1 (8b, 70b), Llama 3.2 (1b, 3b), Llama Guard (1b, 8b), CodeLlama (7b, 13b), Gemma (2b, 7b), CodeGemma (2b, 7b), Mistral-7B (v0.2, v0.3), Mixtral-8x7B (v0.1)
  • Speculative decoding is an effective optimization technique to reduce generation time-per-output-token latency. For more information, see the Model Garden advanced features notebook.

Google Cloud Architecture Center

Google Cloud Architecture Framework: Security, privacy, and compliance: Major update to align the recommendations with core principles of security.

Identity-Aware Proxy

Generally available: You can configure Workforce Identity Federation with IAP, and use an external identity provider (IdP) to authenticate and authorize a workforce—a group of users, such as employees, partners, and contractors—using Identity and Access Management (IAM), so that the users can securely access services deployed on Google Cloud or on-premises.

For more information, see Configure IAP with Workforce Identity Federation.

Generally available: Support for service account JWT authentication for Identity Platform and Workforce Identity Federation configured applications. For more information, see Authenticating with a service account JWT.

Memorystore for Redis Cluster

Multi-VPC support for Memorystore for Redis Cluster is now Generally Available (GA). This functionality enables you to create Private Service Connect endpoints in multiple VPCs to connect to the same Memorystore for Redis Cluster instance. This provides you with enhanced flexibility and resilience for your network architecture. For more information, see About multiple VPC networking.

VPC Service Controls

VPC Service Controls feature: Support for adding projects as a source in the egress rules of a service perimeter is generally available.

For more information, see Ingress and egress rules.

VPC Service Controls feature: Support for adding titles in the ingress and egress rules of a service perimeter is generally available.

For more information, see Ingress and egress rules.

Workflows

February 06, 2025

Apigee X

On February 6, 2025, we released an updated version of Apigee (1-14-0-apigee-6).

Bug ID Description
381553288 Fixed class initialization issue in JavaCallout policy.
390559772 Fixed issue with ResponseCache policy not appearing in debug sessions when added using Apigee APIM Operator for Kubernetes.
N/A Updates to security infrastructure and libraries.
BigQuery Cloud Composer

Cloud Composer 2 is no longer available in Mexico (northamerica-south1). It is not possible to select this region when creating a new Cloud Composer 2 environment. Existing Cloud Composer 2 environments and both new and existing Cloud Composer 3 environments are not affected by this change.

Cloud Logging

You can now create and manage your log views by using the Google Cloud console. For more information, see Configure log views on a log bucket.

Gemini Code Assist

IntelliJ Gemini Code Assist now has a setting to block suggestions that contain citations.

Fixed issues with Google Cloud project settings for VS Code Gemini Code Assist.

Google Kubernetes Engine

(2025-R05) Version updates

GKE cluster versions have been updated.

New versions available for upgrades and new clusters.

The following Kubernetes versions are now available for new clusters and for opt-in control plane upgrades and node upgrades for existing clusters. For more information on versioning and upgrades, see GKE versioning and support and Upgrades.

Rapid channel

  • Version 1.31.5-gke.1068000 is now the default version for cluster creation in the Rapid channel.
  • The following versions are now available in the Rapid channel:
  • The following versions are no longer available in the Rapid channel:
    • 1.28.15-gke.1612000
    • 1.29.12-gke.1270000
    • 1.30.9-gke.1027000
    • 1.31.4-gke.1372000
    • 1.32.0-gke.1538000
    • 1.32.1-gke.1200000
  • Auto-upgrade targets are now available for the following minor versions:
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.27 to version 1.28.15-gke.1641000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.28 to version 1.29.13-gke.1006000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.30 to version 1.31.5-gke.1023000 with this release.
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.28 to version 1.28.15-gke.1641000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.29 to version 1.29.13-gke.1006000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.31 to version 1.31.5-gke.1023000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.32 to version 1.32.1-gke.1200003 with this release.

Regular channel

  • Version 1.31.4-gke.1372000 is now the default version for cluster creation in the Regular channel.
  • The following versions are now available in the Regular channel:
  • The following versions are no longer available in the Regular channel:
    • 1.28.15-gke.1503000
    • 1.29.12-gke.1143000
    • 1.29.12-gke.1143001
    • 1.30.8-gke.1162000
    • 1.30.8-gke.1162001
    • 1.31.4-gke.1256000
  • Auto-upgrade targets are now available for the following minor versions:
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.27 to version 1.28.15-gke.1612000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.28 to version 1.29.12-gke.1270000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.29 to version 1.30.8-gke.1261000 with this release.
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.28 to version 1.28.15-gke.1612000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.29 to version 1.29.12-gke.1270000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.30 to version 1.30.8-gke.1261000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.31 to version 1.31.4-gke.1372000 with this release.

Stable channel

  • Version 1.30.8-gke.1128001 is now the default version for cluster creation in the Stable channel.
  • The following versions are now available in the Stable channel:
  • The following versions are no longer available in the Stable channel:
    • 1.28.15-gke.1435000
    • 1.29.12-gke.1055000
    • 1.29.12-gke.1055001
    • 1.30.8-gke.1051000
    • 1.30.8-gke.1051001
  • Auto-upgrade targets are now available for the following minor versions:
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.27 to version 1.28.15-gke.1480000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.28 to version 1.29.12-gke.1120001 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.29 to version 1.30.8-gke.1128001 with this release.
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.28 to version 1.28.15-gke.1480000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.29 to version 1.29.12-gke.1120001 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.30 to version 1.30.8-gke.1128001 with this release.

Extended channel

  • Version 1.31.4-gke.1372000 is now the default version for cluster creation in the Extended channel.
  • The following versions are now available in the Extended channel:
  • The following versions are no longer available in the Extended channel:
    • 1.27.16-gke.2142000
    • 1.27.16-gke.2296000
    • 1.28.15-gke.1503000
    • 1.29.12-gke.1143000
    • 1.29.12-gke.1143001
    • 1.30.8-gke.1162000
    • 1.30.8-gke.1162001
    • 1.31.4-gke.1256000
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.27 to version 1.27.16-gke.2246000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.28 to version 1.28.15-gke.1612000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.29 to version 1.29.12-gke.1270000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.30 to version 1.30.8-gke.1261000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.31 to version 1.31.4-gke.1372000 with this release.

No channel

  • Version 1.31.4-gke.1372000 is now the default version for cluster creation.
  • The following versions are now available:
  • The following node versions are now available:
  • The following versions are no longer available:
    • 1.28.15-gke.1435000
    • 1.29.12-gke.1055000
    • 1.29.12-gke.1055001
    • 1.29.12-gke.1143000
    • 1.30.5-gke.1713000
    • 1.30.8-gke.1051001
    • 1.30.9-gke.1027000
  • Auto-upgrade targets are now available for the following minor versions:
    • Control planes and nodes with auto-upgrade enabled will be upgraded from version 1.27 to version 1.28.15-gke.1612000 with this release.
    • Control planes and nodes with auto-upgrade enabled will be upgraded from version 1.28 to version 1.29.12-gke.1270000 with this release.
    • Control planes and nodes with auto-upgrade enabled will be upgraded from version 1.29 to version 1.30.8-gke.1128001 with this release.
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled will be upgraded from version 1.28 to version 1.28.15-gke.1612000 with this release.
    • Control planes and nodes with auto-upgrade enabled will be upgraded from version 1.29 to version 1.29.12-gke.1270000 with this release.
    • Control planes and nodes with auto-upgrade enabled will be upgraded from version 1.30 to version 1.30.8-gke.1128001 with this release.
    • Control planes and nodes with auto-upgrade enabled will be upgraded from version 1.31 to version 1.31.4-gke.1372000 with this release.

(2025-R05) Version updates

  • Version 1.31.5-gke.1068000 is now the default version for cluster creation in the Rapid channel.
  • The following versions are now available in the Rapid channel:
  • The following versions are no longer available in the Rapid channel:
    • 1.28.15-gke.1612000
    • 1.29.12-gke.1270000
    • 1.30.9-gke.1027000
    • 1.31.4-gke.1372000
    • 1.32.0-gke.1538000
    • 1.32.1-gke.1200000
  • Auto-upgrade targets are now available for the following minor versions:
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.27 to version 1.28.15-gke.1641000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.28 to version 1.29.13-gke.1006000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.30 to version 1.31.5-gke.1023000 with this release.
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.28 to version 1.28.15-gke.1641000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.29 to version 1.29.13-gke.1006000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.31 to version 1.31.5-gke.1023000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Rapid channel will be upgraded from version 1.32 to version 1.32.1-gke.1200003 with this release.

(2025-R05) Version updates

  • Version 1.31.4-gke.1372000 is now the default version for cluster creation in the Regular channel.
  • The following versions are now available in the Regular channel:
  • The following versions are no longer available in the Regular channel:
    • 1.28.15-gke.1503000
    • 1.29.12-gke.1143000
    • 1.29.12-gke.1143001
    • 1.30.8-gke.1162000
    • 1.30.8-gke.1162001
    • 1.31.4-gke.1256000
  • Auto-upgrade targets are now available for the following minor versions:
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.27 to version 1.28.15-gke.1612000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.28 to version 1.29.12-gke.1270000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.29 to version 1.30.8-gke.1261000 with this release.
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.28 to version 1.28.15-gke.1612000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.29 to version 1.29.12-gke.1270000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.30 to version 1.30.8-gke.1261000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Regular channel will be upgraded from version 1.31 to version 1.31.4-gke.1372000 with this release.

(2025-R05) Version updates

  • Version 1.30.8-gke.1128001 is now the default version for cluster creation in the Stable channel.
  • The following versions are now available in the Stable channel:
  • The following versions are no longer available in the Stable channel:
    • 1.28.15-gke.1435000
    • 1.29.12-gke.1055000
    • 1.29.12-gke.1055001
    • 1.30.8-gke.1051000
    • 1.30.8-gke.1051001
  • Auto-upgrade targets are now available for the following minor versions:
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.27 to version 1.28.15-gke.1480000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.28 to version 1.29.12-gke.1120001 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.29 to version 1.30.8-gke.1128001 with this release.
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.28 to version 1.28.15-gke.1480000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.29 to version 1.29.12-gke.1120001 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Stable channel will be upgraded from version 1.30 to version 1.30.8-gke.1128001 with this release.

(2025-R05) Version updates

  • Version 1.31.4-gke.1372000 is now the default version for cluster creation in the Extended channel.
  • The following versions are now available in the Extended channel:
  • The following versions are no longer available in the Extended channel:
    • 1.27.16-gke.2142000
    • 1.27.16-gke.2296000
    • 1.28.15-gke.1503000
    • 1.29.12-gke.1143000
    • 1.29.12-gke.1143001
    • 1.30.8-gke.1162000
    • 1.30.8-gke.1162001
    • 1.31.4-gke.1256000
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.27 to version 1.27.16-gke.2246000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.28 to version 1.28.15-gke.1612000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.29 to version 1.29.12-gke.1270000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.30 to version 1.30.8-gke.1261000 with this release.
    • Control planes and nodes with auto-upgrade enabled in the Extended channel will be upgraded from version 1.31 to version 1.31.4-gke.1372000 with this release.

(2025-R05) Version updates

  • Version 1.31.4-gke.1372000 is now the default version for cluster creation.
  • The following versions are now available:
  • The following node versions are now available:
  • The following versions are no longer available:
    • 1.28.15-gke.1435000
    • 1.29.12-gke.1055000
    • 1.29.12-gke.1055001
    • 1.29.12-gke.1143000
    • 1.30.5-gke.1713000
    • 1.30.8-gke.1051001
    • 1.30.9-gke.1027000
  • Auto-upgrade targets are now available for the following minor versions:
    • Control planes and nodes with auto-upgrade enabled will be upgraded from version 1.27 to version 1.28.15-gke.1612000 with this release.
    • Control planes and nodes with auto-upgrade enabled will be upgraded from version 1.28 to version 1.29.12-gke.1270000 with this release.
    • Control planes and nodes with auto-upgrade enabled will be upgraded from version 1.29 to version 1.30.8-gke.1128001 with this release.
  • The following patch-only version auto-upgrade targets are now available for clusters with maintenance exclusions or other factors preventing minor version upgrades:
    • Control planes and nodes with auto-upgrade enabled will be upgraded from version 1.28 to version 1.28.15-gke.1612000 with this release.
    • Control planes and nodes with auto-upgrade enabled will be upgraded from version 1.29 to version 1.29.12-gke.1270000 with this release.
    • Control planes and nodes with auto-upgrade enabled will be upgraded from version 1.30 to version 1.30.8-gke.1128001 with this release.
    • Control planes and nodes with auto-upgrade enabled will be upgraded from version 1.31 to version 1.31.4-gke.1372000 with this release.

Weighted load balancing for GKE External LoadBalancer Services is now generally available on GKE clusters running version 1.31.0-gke.1506000 or later. Weighted load balancing is a more efficient way to distribute traffic to nodes based on the number of serving Pods they have backing the Service.

To learn more, see Weighted load balancing.

Google SecOps

The collector ID representing Google Cloud direct ingestion in the Cloud Monitoring metrics and BigQuery has changed from dddddddd-dddd-dddd-dddd-dddddddddddd to aaaa3333-aaaa-3333-aaaa-3333aaaa3333.

For a complete list of updated collector IDs used for ingestion metrics, see Use Cloud Monitoring for ingestion notifications.

Google SecOps SIEM

The collector ID representing Google Cloud direct ingestion in the Cloud Monitoring metrics and BigQuery has changed from dddddddd-dddd-dddd-dddd-dddddddddddd to aaaa3333-aaaa-3333-aaaa-3333aaaa3333.

For a complete list of updated collector IDs used for ingestion metrics, see Use Cloud Monitoring for ingestion notifications.

Looker Studio

Looker Studio documentation has a new home

Looker Studio documentation has moved from Help Center to Google Cloud. Visit the new documentation site to learn more about the move.

Modern charts in public preview

The new Modern charts public preview offers new chart styling, new default chart configuration options, and new chart settings that give report creators greater control over how data is curated and presented to users.

Learn more about Modern charts.

Partner connection launch update

The following partner connectors have been added to the Looker Studio Connector Gallery:

Organization Policy

You can now create custom organization policies for Workflows. For more information, see Create custom organization policy constraints for Workflows.

Resource Manager

You can now create custom organization policies for Workflows. For more information, see Create custom organization policy constraints for Workflows.

Workflows

February 05, 2025

Cloud Asset Inventory

The following resource types are now publicly available through the ExportAssets, ListAssets, BatchGetAssetsHistory, QueryAssets, Feed, and Search (SearchAllResources, SearchAllIamPolicies).

  • Backup and Disaster Recovery
    • backupdr.googleapis.com/BackupPlan
    • backupdr.googleapis.com/BackupPlanAssociation
Cloud SQL for MySQL

You can now configure customer-managed CA (CUSTOMER_MANAGED_CAS_CA) as the server certificate authority (CA) mode when you create a Cloud SQL instance. With customer-managed CA mode, you set up your own CA pool and CA in Certificate Authority Service. This option lets you establish your own CA hierarchy and manage the rotation of CA certificates for your Cloud SQL instances to help you meet your regulatory compliance needs.

To use the customer-managed CA option in Cloud SQL, see Use a customer-managed certificate authority (CA). For more information about server CA mode options, see Certificate authority (CA) hierarchies. The customer-managed CA feature is in Preview.

Cloud SQL for PostgreSQL

You can now migrate a subset of databases from an external server to a destination Cloud SQL instance. For more information, see Configure Cloud SQL and the external server for replication.

You can now configure customer-managed CA (CUSTOMER_MANAGED_CAS_CA) as the server certificate authority (CA) mode when you create a Cloud SQL instance. With customer-managed CA mode, you set up your own CA pool and CA in Certificate Authority Service. This option lets you establish your own CA hierarchy and manage the rotation of CA certificates for your Cloud SQL instances to help you meet your regulatory compliance needs.

To use the customer-managed CA option in Cloud SQL, see Use a customer-managed certificate authority (CA). For more information about server CA mode options, see Certificate authority (CA) hierarchies. The customer-managed CA feature is in Preview.

Cloud SQL for SQL Server

You can now configure customer-managed CA (CUSTOMER_MANAGED_CAS_CA) as the server certificate authority (CA) mode when you create a Cloud SQL instance. With customer-managed CA mode, you set up your own CA pool and CA in Certificate Authority Service. This option lets you establish your own CA hierarchy and manage the rotation of CA certificates for your Cloud SQL instances to help you meet your regulatory compliance needs.

To use the customer-managed CA option in Cloud SQL, see Use a customer-managed certificate authority (CA). For more information about server CA mode options, see Certificate authority (CA) hierarchies. The customer-managed CA feature is in Preview.

Cloud Storage

Announced billing changes for accessing Cloud Storage through BigQuery take effect Feb 21, 2025. These changes were originally set to take effect on February 01, 2025.

Confidential Space

A new Confidential Space image (250101) is now available.

Update go-sev-guest to v.0.12.1.

Update the verifier API version to include a new principal tag token type.

Generative AI on Vertex AI

Gemini 2.0 Flash general availability for text-only output

Gemini 2.0 Flash is now generally available for text-only outputs. Multimodal outputs are still available only as a private preview. For more information, see Gemini 2.0.

New Gemini 2.0 Pro and Gemini 2.0 Flash-Lite models available to users

Two new models in the Gemini 2.0 family are now available to users:

  • Gemini 2.0 Pro: Our strongest model for coding and world knowledge, featuring a 2M long context window. Gemini 2.0 Pro is available as an experimental model in Vertex AI.
  • Gemini 2.0 Flash-Lite: Our fastest and most cost efficient Flash model. Gemini 2.0 Flash-Lite is available as a Preview model in Vertex AI.

For more information, see Gemini 2.0

Google Distributed Cloud (software only) for VMware

Google Distributed Cloud (software only) for VMware 1.31.100-gke.136 is now available for download. To upgrade, see Upgrade a cluster or a node pool. Google Distributed Cloud 1.31.100-gke.136 runs on Kubernetes v1.31.4-gke.900.

If you are using a third-party storage vendor, check the GDC Ready storage partners document to make sure the storage vendor has already passed the qualification for this release.

After a release, it takes approximately 7 to 14 days for the version to become available for use with GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

The following functional change was made in 1.31.100-gke.136:

  • Removed support in the Konnectivity server (konnectivity-server) for the following weak cryptographic cipher suites: TLS_RSA_WITH_AES_256_GCM_SHA384 and TLS_RSA_WITH_AES_128_GCM_SHA256

The following issues are fixed in 1.31.100-gke.136:

  • Fixed an issue to prevent checking for add-on node IP addresses for HA admin clusters with three control-plane nodes and no add-on nodes.

  • Fixed an issue where DNS and NTP servers weren't checked for HA admin clusters or for user clusters configured for Controlplane V2.

  • Fixed an issue where the VM template used for the HA admin control plane node repair isn't refreshed in vCenter after an upgrade.

  • Fixed an issue where a race condition during migration caused admin add-on nodes to get stuck at a NotReady status.

The 1.31.100-gke.136 release includes many vulnerability fixes. For a list of all vulnerabilities fixed in this release, see Vulnerability fixes.

Google Distributed Cloud (software only) for VMware 1.30.500-gke.126 is now available for download. To upgrade, see Upgrade a cluster or a node pool. Google Distributed Cloud 1.30.500-gke.126 runs on Kubernetes v1.30.8-gke.200.

If you are using a third-party storage vendor, check the GDC Ready storage partners document to make sure the storage vendor has already passed the qualification for this release.

After a release, it takes approximately 7 to 14 days for the version to become available for use with GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

The following issues are fixed in 1.30.500-gke.126:

  • Fixed an issue that caused non-HA cluster upgrades to get stuck creating or updating cluster control plane workloads.

  • Fixed an issue where DNS and NTP servers weren't checked for HA admin clusters or for user clusters configured for Controlplane V2.

  • Fixed an issue where a race condition during migration caused admin add-on nodes to get stuck at a NotReady status.

  • Fixed an issue where customer workloads with high resource requests triggered irrelevant resource validation warnings.

  • Fixed an issue where the VM template used for the HA admin control plane node repair isn't refreshed in vCenter after an upgrade.

The 1.30.500-gke.126 release includes many vulnerability fixes. For a list of all vulnerabilities fixed in this release, see Vulnerability fixes.

Google Distributed Cloud (software only) for bare metal

Release 1.31.100-gke.136

Google Distributed Cloud for bare metal 1.31.100-gke.136 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.31.100-gke.136 runs on Kubernetes 1.31.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

The following feature is available in 1.31.100-gke.136:

The following functional change was made in 1.31.100-gke.136:

  • Cluster deletion now deletes worker node pools prior to deleting any control plane node pools.

The following issues are fixed in 1.31.100-gke.136:

  • Fixed an issue where bmctl update clustercommand fails for user clusters that were created with thecloudOperationsServiceAccountKeyPath setting in the header section of the cluster configuration file.

  • Fixed an issue where prompting during bmctl update cluster prevented use of automation. You can now use the --quiet flag to skip prompting.

  • Fixed an issue where node machines didn't update when the registry mirror hosts field was updated.

The 1.31.100-gke.136 release includes many vulnerability fixes. For a list of all vulnerabilities fixed in this release, see Vulnerability fixes.

For information about the latest known issues, see Google Distributed Cloud for bare metal known issues in the Troubleshooting section.

Release 1.29.1000-gke.93

Google Distributed Cloud for bare metal 1.29.1000-gke.93 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.29.1000-gke.93 runs on Kubernetes 1.29.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

The following functional change was made in 1.29.1000-gke.93:

  • Cluster deletion now deletes worker node pools prior to deleting any control plane node pools.

The 1.29.1000-gke.93 release includes many vulnerability fixes. For a list of all vulnerabilities fixed in this release, see Vulnerability fixes.

For information about the latest known issues, see Google Distributed Cloud for bare metal known issues in the Troubleshooting section.

Release 1.30.500-gke.126

Google Distributed Cloud for bare metal 1.30.500-gke.126 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.30.500-gke.126 runs on Kubernetes 1.30.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the Ready storage partners document to make sure the storage vendor has already passed the qualification for this release of Google Distributed Cloud for bare metal.

The following issues are fixed in 1.30.500-gke.126:

  • Fixed an issue where prompting during bmctl update cluster prevented use of automation. You can now use the --quiet flag to skip prompting.

  • Fixed an issue where node machines didn't update when the registry mirror hosts field was updated.

The 1.30.500-gke.126 release includes many vulnerability fixes. For a list of all vulnerabilities fixed in this release, see Vulnerability fixes.

For information about the latest known issues, see Google Distributed Cloud for bare metal known issues in the Troubleshooting section.

Google SecOps

Google SecOps has updated the list of supported default parsers. Parsers are updated gradually, so it might take one to four days before you see the changes reflected in your region.

The following supported default parsers have changed. Each parser is listed by product name and log_type value, if applicable. This list now includes both released default parsers and pending parser updates.

  • A10 Load Balancer (A10_LOAD_BALANCER)
  • Akamai Enterprise Application Access (AKAMAI_EAA)
  • Akamai WAF (AKAMAI_WAF)
  • Apache (APACHE)
  • Apache Tomcat (TOMCAT)
  • AppOmni (APPOMNI)
  • Arcsight CEF (ARCSIGHT_CEF)
  • Aruba (ARUBA_WIRELESS)
  • Aruba Airwave (ARUBA_AIRWAVE)
  • Atlassian Cloud Admin Audit (ATLASSIAN_AUDIT)
  • Attivo Networks (ATTIVO)
  • Auth0 (AUTH_ZERO)
  • Avigilon Access Logs (AVIGILON_ACCESS_LOGS)
  • AWS Cloudtrail (AWS_CLOUDTRAIL)
  • AWS GuardDuty (GUARDDUTY)
  • AWS RDS (AWS_RDS)
  • AWS Security Hub (AWS_SECURITY_HUB)
  • AWS VPC Flow (AWS_VPC_FLOW)
  • Azure AD (AZURE_AD)
  • Azure Application Gateway (AZURE_GATEWAY)
  • Azure Cosmos DB (AZURE_COSMOS_DB)
  • Azure Firewall (AZURE_FIREWALL)
  • Azure Front Door (AZURE_FRONT_DOOR)
  • Bindplane Agent (BINDPLANE_AGENT)
  • BloxOne Threat Defense (BLOXONE)
  • Blue Coat Proxy (BLUECOAT_WEBPROXY)
  • Cato Networks (CATO_NETWORKS)
  • Check Point (CHECKPOINT_FIREWALL)
  • Check Point Harmony (CHECKPOINT_HARMONY)
  • CircleCI (CIRCLECI)
  • Cisco AMP (CISCO_AMP)
  • Cisco Application Centric Infrastructure (CISCO_ACI)
  • Cisco ASA (CISCO_ASA_FIREWALL)
  • Cisco Email Security (CISCO_EMAIL_SECURITY)
  • Cisco Firepower NGFW (CISCO_FIREPOWER_FIREWALL)
  • Cisco Internetwork Operating System (CISCO_IOS)
  • Cisco ISE (CISCO_ISE)
  • Cisco NX-OS (CISCO_NX_OS)
  • Cisco Umbrella DNS (UMBRELLA_DNS)
  • Cisco Umbrella Web Proxy (UMBRELLA_WEBPROXY)
  • Cisco vManage SD-WAN (CISCO_SDWAN)
  • Cisco VPN (CISCO_VPN)
  • Citrix Netscaler (CITRIX_NETSCALER)
  • Cloudflare (CLOUDFLARE)
  • Cloudflare Warp (CLOUDFLARE_WARP)
  • CrowdStrike Detection Monitoring (CS_DETECTS)
  • CrowdStrike Falcon (CS_EDR)
  • CrowdStrike Falcon Stream (CS_STREAM)
  • Crowdstrike Identity Protection Services (CS_IDP)
  • Dell CyberSense (DELL_CYBERSENSE)
  • Duo Administrator Logs (DUO_ADMIN)
  • Elastic Packet Beats (ELASTIC_PACKETBEATS)
  • Elastic Windows Event Log Beats (ELASTIC_WINLOGBEAT)
  • ExtraHop RevealX (EXTRAHOP)
  • F5 ASM (F5_ASM)
  • F5 BIGIP LTM (F5_BIGIP_LTM)
  • F5 Distributed Cloud Services (F5_DCS)
  • Fastly CDN (FASTLY_CDN)
  • Forcepoint DLP (FORCEPOINT_DLP)
  • Forcepoint Proxy (FORCEPOINT_WEBPROXY)
  • FortiGate (FORTINET_FIREWALL)
  • Fortinet FortiAnalyzer (FORTINET_FORTIANALYZER)
  • Fortinet FortiClient (FORTINET_FORTICLIENT)
  • Fortinet FortiDDoS (FORTINET_FORTIDDOS)
  • Fortinet FortiEDR (FORTINET_FORTIEDR)
  • Fortinet Proxy (FORTINET_WEBPROXY)
  • GitHub (GITHUB)
  • Gitlab (GITLAB)
  • HP Linux (HP_LINUX)
  • IBM Guardium (GUARDIUM)
  • Imperva (IMPERVA_WAF)
  • Juniper MX Router (JUNIPER_MX)
  • Kemp Load Balancer (KEMP_LOADBALANCER)
  • Linkshadow NDR (LINKSHADOW_NDR)
  • Linux Auditing System (AuditD) (AUDITD)
  • McAfee Web Gateway (MCAFEE_WEBPROXY)
  • McAfee Web Protection (MCAFEE_WEB_PROTECTION)
  • Micro Focus iManager (MICROFOCUS_IMANAGER)
  • Microsoft Azure NSG Flow (AZURE_NSG_FLOW)
  • Microsoft Azure Resource (AZURE_RESOURCE_LOGS)
  • Microsoft CyberX (CYBERX)
  • Microsoft Defender for Endpoint (MICROSOFT_DEFENDER_ENDPOINT)
  • Microsoft Dynamics 365 User Activity (MICROSOFT_DYNAMICS_365)
  • Microsoft Graph API Alerts (MICROSOFT_GRAPH_ALERT)
  • Microsoft Netlogon (MICROSOFT_NETLOGON)
  • Microsoft PowerShell (POWERSHELL)
  • Microsoft System Center Endpoint Protection (MICROSOFT_SCEP)
  • Mikrotik Router (MIKROTIK_ROUTER)
  • Mimecast URL Logs (MIMECAST_URL_LOGS)
  • Office 365 (OFFICE_365)
  • Okta (OKTA)
  • Okta User Context (OKTA_USER_CONTEXT)
  • Open LDAP (OPENLDAP)
  • Open Policy Agent (OPA)
  • Oracle (ORACLE_DB)
  • Oracle Cloud Guard (OCI_CLOUDGUARD)
  • Orca Cloud Security Platform (ORCA)
  • Palo Alto Cortex XDR Alerts (CORTEX_XDR)
  • Palo Alto Networks Firewall (PAN_FIREWALL)
  • Palo Alto Networks IoT Security (PAN_IOT)
  • Palo Alto Prisma Cloud Alert payload (PAN_PRISMA_CA)
  • ProFTPD (PROFTPD)
  • Proofpoint Observeit (OBSERVEIT)
  • Proofpoint On Demand (PROOFPOINT_ON_DEMAND)
  • ProofPoint Secure Email Relay (PROOFPOINT_SER)
  • Proofpoint Tap Alerts (PROOFPOINT_MAIL)
  • Proofpoint Threat Response (PROOFPOINT_TRAP)
  • RSA SecurID Access Identity Router (RSA_SECURID)
  • Rubrik (RUBRIK)
  • Salesforce (SALESFORCE)
  • Security Command Center Threat (N/A)
  • Sentry (SENTRY)
  • ServiceNow Audit (SERVICENOW_AUDIT)
  • ServiceNow CMDB (SERVICENOW_CMDB)
  • Smartsheet (SMARTSHEET)
  • Snare System Diagnostic Logs (SNARE_SOLUTIONS)
  • Snowflake (SNOWFLAKE)
  • Solaris system (SOLARIS_SYSTEM)
  • SonicWall (SONIC_FIREWALL)
  • Sophos Central (SOPHOS_CENTRAL)
  • Sophos UTM (SOPHOS_UTM)
  • Sourcefire (SOURCEFIRE_IDS)
  • Suricata EVE (SURICATA_EVE)
  • Symantec DLP (SYMANTEC_DLP)
  • Symantec Endpoint Protection (SEP)
  • Symantec Event export (SYMANTEC_EVENT_EXPORT)
  • Symantec Web Security Service (SYMANTEC_WSS)
  • Sysdig (SYSDIG)
  • Tableau (TABLEAU)
  • Tanium Asset (TANIUM_ASSET)
  • Tanium Threat Response (TANIUM_THREAT_RESPONSE)
  • tenable.io (TENABLE_IO)
  • Trend Micro (TIPPING_POINT)
  • Trend Micro Deep Security (TRENDMICRO_DEEP_SECURITY)
  • Trend Micro Vision One (TRENDMICRO_VISION_ONE)
  • TrendMicro Deep Discovery Inspector (TRENDMICRO_DDI)
  • UberAgent (UBERAGENT)
  • Unix system (NIX_SYSTEM)
  • Vectra Detect (VECTRA_DETECT)
  • Vectra Stream (VECTRA_STREAM)
  • Venafi ZTPKI (VENAFI_ZTPKI)
  • Vercel WAF (VERCEL_WAF)
  • Virtru Email Encryption (VIRTRU_EMAIL_ENCRYPTION)
  • WatchGuard (WATCHGUARD)
  • Wazuh (WAZUH)
  • Windows DNS (WINDOWS_DNS)
  • Windows Event (WINEVTLOG)
  • Windows Event (XML) (WINEVTLOG_XML)
  • Windows Network Policy Server (WINDOWS_NET_POLICY_SERVER)
  • Zendesk CRM (ZENDESK_CRM)
  • ZeroFox Platform (ZEROFOX_PLATFORM)
  • Zimperium (ZIMPERIUM)
  • Zoom Operation Logs (ZOOM_OPERATION_LOGS)
  • Zscaler (ZSCALER_WEBPROXY)
  • Zscaler Internet Access Audit Logs (ZSCALER_INTERNET_ACCESS)
  • Zscaler Secure Private Access Audit Logs (ZSCALER_ZPA_AUDIT)

The following log types were added without a default parser. Each parser is listed by product name and log_type value, if applicable.

  • Arcon PAM (ARCON_PAM)
  • Azure VNET Flow (AZURE_VNET_FLOW)
  • Cameyo Activity Logs (CAMEYO_ACTIVITY_LOGS)
  • ChromeOS XDR (CHROMEOS_XDR)
  • Cisco Vulnerability Management (CISCO_VULNERABILITY_MANAGEMENT)
  • Cloudflare Network Analytics (CLOUDFLARE_NETWORK_ANALYTICS)
  • Draytek Router (DRAYTEK_ROUTER)
  • FA Solutions (FA_SOLUTIONS)
  • Files dot com (FILES_DOT_COM)
  • Fortinet ADC (FORTINET_ADC)
  • FoxPass Audit Logs (FOXPASS_AUDIT_LOGS)
  • Front (FRONT)
  • Ghangor DLP (GHANGOR_DLP)
  • Hillstone Firewall (HILLSTONE_NGFW)
  • Hoxhunt (HOXHUNT)
  • Huawei NextGen Firewall (HUAWEI_FIREWALL)
  • Huawei Fusion Sphere Hypervisor (HUAWEI_FUSIONSPHERE)
  • IBM Security Verify Access (IBM_SVA)
  • Indusface WAF (INDUSFACE_WAF)
  • Informatica (INFORMATICA)
  • Informatica Powercenter (INFORMATICA_POWERCENTER)
  • Intel Endpoint Management Assistant (INTEL_EMA)
  • Jamf Protect Telemetry V2 (JAMF_TELEMETRY_V2)
  • JiranSecurity MailScreen (JIRANSECURITY_MAILSCREEN)
  • Juniper SSR Conductor (JUNIPER_SSR_CONDUCTOR)
  • Metabase (METABASE)
  • Netlify Log Drains (NETLIFY_LOGDRAINS)
  • Pingcap TIDB (PINGCAP_TIDB)
  • PingOne Advanced Identity Cloud (PINGONE_AIC)
  • PingOne Protect (PINGONE_PROTECT)
  • Privacy-I (PRIVACY_I)
  • ReviveSec (REVIVESEC)
  • Sangfor Proxy (SANGFOR_PROXY)
  • SoftEther VPN (SOFTETHER_VPN)
  • Tehtris EDR (TEHTRIS_EDR)
  • TrendMicro Cloud Email Gateway Protection (TRENDMICRO_CLOUD_EMAIL_GATEWAY_PROTECTION)
  • VMware VeloCloud SD-WAN (VELOCLOUD_SDWAN)
  • Wing Security (WING_SECURITY)

For a list of supported log types and details about default parser changes, see Supported log types and default parsers.

Google SecOps SIEM

Google SecOps has updated the list of supported default parsers. Parsers are updated gradually, so it might take one to four days before you see the changes reflected in your region.

The following supported default parsers have changed. Each parser is listed by product name and log_type value, if applicable. This list now includes both released default parsers and pending parser updates.

  • A10 Load Balancer (A10_LOAD_BALANCER)
  • Akamai Enterprise Application Access (AKAMAI_EAA)
  • Akamai WAF (AKAMAI_WAF)
  • Apache (APACHE)
  • Apache Tomcat (TOMCAT)
  • AppOmni (APPOMNI)
  • Arcsight CEF (ARCSIGHT_CEF)
  • Aruba (ARUBA_WIRELESS)
  • Aruba Airwave (ARUBA_AIRWAVE)
  • Atlassian Cloud Admin Audit (ATLASSIAN_AUDIT)
  • Attivo Networks (ATTIVO)
  • Auth0 (AUTH_ZERO)
  • Avigilon Access Logs (AVIGILON_ACCESS_LOGS)
  • AWS Cloudtrail (AWS_CLOUDTRAIL)
  • AWS GuardDuty (GUARDDUTY)
  • AWS RDS (AWS_RDS)
  • AWS Security Hub (AWS_SECURITY_HUB)
  • AWS VPC Flow (AWS_VPC_FLOW)
  • Azure AD (AZURE_AD)
  • Azure Application Gateway (AZURE_GATEWAY)
  • Azure Cosmos DB (AZURE_COSMOS_DB)
  • Azure Firewall (AZURE_FIREWALL)
  • Azure Front Door (AZURE_FRONT_DOOR)
  • Bindplane Agent (BINDPLANE_AGENT)
  • BloxOne Threat Defense (BLOXONE)
  • Blue Coat Proxy (BLUECOAT_WEBPROXY)
  • Cato Networks (CATO_NETWORKS)
  • Check Point (CHECKPOINT_FIREWALL)
  • Check Point Harmony (CHECKPOINT_HARMONY)
  • CircleCI (CIRCLECI)
  • Cisco AMP (CISCO_AMP)
  • Cisco Application Centric Infrastructure (CISCO_ACI)
  • Cisco ASA (CISCO_ASA_FIREWALL)
  • Cisco Email Security (CISCO_EMAIL_SECURITY)
  • Cisco Firepower NGFW (CISCO_FIREPOWER_FIREWALL)
  • Cisco Internetwork Operating System (CISCO_IOS)
  • Cisco ISE (CISCO_ISE)
  • Cisco NX-OS (CISCO_NX_OS)
  • Cisco Umbrella DNS (UMBRELLA_DNS)
  • Cisco Umbrella Web Proxy (UMBRELLA_WEBPROXY)
  • Cisco vManage SD-WAN (CISCO_SDWAN)
  • Cisco VPN (CISCO_VPN)
  • Citrix Netscaler (CITRIX_NETSCALER)
  • Cloudflare (CLOUDFLARE)
  • Cloudflare Warp (CLOUDFLARE_WARP)
  • CrowdStrike Detection Monitoring (CS_DETECTS)
  • CrowdStrike Falcon (CS_EDR)
  • CrowdStrike Falcon Stream (CS_STREAM)
  • Crowdstrike Identity Protection Services (CS_IDP)
  • Dell CyberSense (DELL_CYBERSENSE)
  • Duo Administrator Logs (DUO_ADMIN)
  • Elastic Packet Beats (ELASTIC_PACKETBEATS)
  • Elastic Windows Event Log Beats (ELASTIC_WINLOGBEAT)
  • ExtraHop RevealX (EXTRAHOP)
  • F5 ASM (F5_ASM)
  • F5 BIGIP LTM (F5_BIGIP_LTM)
  • F5 Distributed Cloud Services (F5_DCS)
  • Fastly CDN (FASTLY_CDN)
  • Forcepoint DLP (FORCEPOINT_DLP)
  • Forcepoint Proxy (FORCEPOINT_WEBPROXY)
  • FortiGate (FORTINET_FIREWALL)
  • Fortinet FortiAnalyzer (FORTINET_FORTIANALYZER)
  • Fortinet FortiClient (FORTINET_FORTICLIENT)
  • Fortinet FortiDDoS (FORTINET_FORTIDDOS)
  • Fortinet FortiEDR (FORTINET_FORTIEDR)
  • Fortinet Proxy (FORTINET_WEBPROXY)
  • GitHub (GITHUB)
  • Gitlab (GITLAB)
  • HP Linux (HP_LINUX)
  • IBM Guardium (GUARDIUM)
  • Imperva (IMPERVA_WAF)
  • Juniper MX Router (JUNIPER_MX)
  • Kemp Load Balancer (KEMP_LOADBALANCER)
  • Linkshadow NDR (LINKSHADOW_NDR)
  • Linux Auditing System (AuditD) (AUDITD)
  • McAfee Web Gateway (MCAFEE_WEBPROXY)
  • McAfee Web Protection (MCAFEE_WEB_PROTECTION)
  • Micro Focus iManager (MICROFOCUS_IMANAGER)
  • Microsoft Azure NSG Flow (AZURE_NSG_FLOW)
  • Microsoft Azure Resource (AZURE_RESOURCE_LOGS)
  • Microsoft CyberX (CYBERX)
  • Microsoft Defender for Endpoint (MICROSOFT_DEFENDER_ENDPOINT)
  • Microsoft Dynamics 365 User Activity (MICROSOFT_DYNAMICS_365)
  • Microsoft Graph API Alerts (MICROSOFT_GRAPH_ALERT)
  • Microsoft Netlogon (MICROSOFT_NETLOGON)
  • Microsoft PowerShell (POWERSHELL)
  • Microsoft System Center Endpoint Protection (MICROSOFT_SCEP)
  • Mikrotik Router (MIKROTIK_ROUTER)
  • Mimecast URL Logs (MIMECAST_URL_LOGS)
  • Office 365 (OFFICE_365)
  • Okta (OKTA)
  • Okta User Context (OKTA_USER_CONTEXT)
  • Open LDAP (OPENLDAP)
  • Open Policy Agent (OPA)
  • Oracle (ORACLE_DB)
  • Oracle Cloud Guard (OCI_CLOUDGUARD)
  • Orca Cloud Security Platform (ORCA)
  • Palo Alto Cortex XDR Alerts (CORTEX_XDR)
  • Palo Alto Networks Firewall (PAN_FIREWALL)
  • Palo Alto Networks IoT Security (PAN_IOT)
  • Palo Alto Prisma Cloud Alert payload (PAN_PRISMA_CA)
  • ProFTPD (PROFTPD)
  • Proofpoint Observeit (OBSERVEIT)
  • Proofpoint On Demand (PROOFPOINT_ON_DEMAND)
  • ProofPoint Secure Email Relay (PROOFPOINT_SER)
  • Proofpoint Tap Alerts (PROOFPOINT_MAIL)
  • Proofpoint Threat Response (PROOFPOINT_TRAP)
  • RSA SecurID Access Identity Router (RSA_SECURID)
  • Rubrik (RUBRIK)
  • Salesforce (SALESFORCE)
  • Security Command Center Threat (N/A)
  • Sentry (SENTRY)
  • ServiceNow Audit (SERVICENOW_AUDIT)
  • ServiceNow CMDB (SERVICENOW_CMDB)
  • Smartsheet (SMARTSHEET)
  • Snare System Diagnostic Logs (SNARE_SOLUTIONS)
  • Snowflake (SNOWFLAKE)
  • Solaris system (SOLARIS_SYSTEM)
  • SonicWall (SONIC_FIREWALL)
  • Sophos Central (SOPHOS_CENTRAL)
  • Sophos UTM (SOPHOS_UTM)
  • Sourcefire (SOURCEFIRE_IDS)
  • Suricata EVE (SURICATA_EVE)
  • Symantec DLP (SYMANTEC_DLP)
  • Symantec Endpoint Protection (SEP)
  • Symantec Event export (SYMANTEC_EVENT_EXPORT)
  • Symantec Web Security Service (SYMANTEC_WSS)
  • Sysdig (SYSDIG)
  • Tableau (TABLEAU)
  • Tanium Asset (TANIUM_ASSET)
  • Tanium Threat Response (TANIUM_THREAT_RESPONSE)
  • tenable.io (TENABLE_IO)
  • Trend Micro (TIPPING_POINT)
  • Trend Micro Deep Security (TRENDMICRO_DEEP_SECURITY)
  • Trend Micro Vision One (TRENDMICRO_VISION_ONE)
  • TrendMicro Deep Discovery Inspector (TRENDMICRO_DDI)
  • UberAgent (UBERAGENT)
  • Unix system (NIX_SYSTEM)
  • Vectra Detect (VECTRA_DETECT)
  • Vectra Stream (VECTRA_STREAM)
  • Venafi ZTPKI (VENAFI_ZTPKI)
  • Vercel WAF (VERCEL_WAF)
  • Virtru Email Encryption (VIRTRU_EMAIL_ENCRYPTION)
  • WatchGuard (WATCHGUARD)
  • Wazuh (WAZUH)
  • Windows DNS (WINDOWS_DNS)
  • Windows Event (WINEVTLOG)
  • Windows Event (XML) (WINEVTLOG_XML)
  • Windows Network Policy Server (WINDOWS_NET_POLICY_SERVER)
  • Zendesk CRM (ZENDESK_CRM)
  • ZeroFox Platform (ZEROFOX_PLATFORM)
  • Zimperium (ZIMPERIUM)
  • Zoom Operation Logs (ZOOM_OPERATION_LOGS)
  • Zscaler (ZSCALER_WEBPROXY)
  • Zscaler Internet Access Audit Logs (ZSCALER_INTERNET_ACCESS)
  • Zscaler Secure Private Access Audit Logs (ZSCALER_ZPA_AUDIT)

The following log types were added without a default parser. Each parser is listed by product name and log_type value, if applicable.

  • Arcon PAM (ARCON_PAM)
  • Azure VNET Flow (AZURE_VNET_FLOW)
  • Cameyo Activity Logs (CAMEYO_ACTIVITY_LOGS)
  • ChromeOS XDR (CHROMEOS_XDR)
  • Cisco Vulnerability Management (CISCO_VULNERABILITY_MANAGEMENT)
  • Cloudflare Network Analytics (CLOUDFLARE_NETWORK_ANALYTICS)
  • Draytek Router (DRAYTEK_ROUTER)
  • FA Solutions (FA_SOLUTIONS)
  • Files dot com (FILES_DOT_COM)
  • Fortinet ADC (FORTINET_ADC)
  • FoxPass Audit Logs (FOXPASS_AUDIT_LOGS)
  • Front (FRONT)
  • Ghangor DLP (GHANGOR_DLP)
  • Hillstone Firewall (HILLSTONE_NGFW)
  • Hoxhunt (HOXHUNT)
  • Huawei NextGen Firewall (HUAWEI_FIREWALL)
  • Huawei Fusion Sphere Hypervisor (HUAWEI_FUSIONSPHERE)
  • IBM Security Verify Access (IBM_SVA)
  • Indusface WAF (INDUSFACE_WAF)
  • Informatica (INFORMATICA)
  • Informatica Powercenter (INFORMATICA_POWERCENTER)
  • Intel Endpoint Management Assistant (INTEL_EMA)
  • Jamf Protect Telemetry V2 (JAMF_TELEMETRY_V2)
  • JiranSecurity MailScreen (JIRANSECURITY_MAILSCREEN)
  • Juniper SSR Conductor (JUNIPER_SSR_CONDUCTOR)
  • Metabase (METABASE)
  • Netlify Log Drains (NETLIFY_LOGDRAINS)
  • Pingcap TIDB (PINGCAP_TIDB)
  • PingOne Advanced Identity Cloud (PINGONE_AIC)
  • PingOne Protect (PINGONE_PROTECT)
  • Privacy-I (PRIVACY_I)
  • ReviveSec (REVIVESEC)
  • Sangfor Proxy (SANGFOR_PROXY)
  • SoftEther VPN (SOFTETHER_VPN)
  • Tehtris EDR (TEHTRIS_EDR)
  • TrendMicro Cloud Email Gateway Protection (TRENDMICRO_CLOUD_EMAIL_GATEWAY_PROTECTION)
  • VMware VeloCloud SD-WAN (VELOCLOUD_SDWAN)
  • Wing Security (WING_SECURITY)

For a list of supported log types and details about default parser changes, see Supported log types and default parsers.

Organization Policy

You can now create custom organization policies for Cloud Monitoring alerting policies, notification channels, and snoozes. For more information, see Use custom organization policies.

Resource Manager

You can now create custom organization policies for Cloud Monitoring alerting policies, notification channels, and snoozes. For more information, see Use custom organization policies.

Sensitive Data Protection

The CREDIT_CARD_EXPIRATION_DATE infoType detector is available in all regions. For more information about all built-in infoTypes, see InfoType detector reference.

Spanner

Informational foreign keys are available in Spanner. Informational foreign keys don't enforce referential integrity and are used to declare the intended logical data model for query optimization. Enforced foreign keys, which enforce referential integrity, are also available.

Informational foreign keys are supported by GoogleSQL only. Enforced foreign keys are supported by GoogleSQL and PostgreSQL.

For more information, see the following:

February 04, 2025

Apigee Integrated Portal

On February 4, 2025 we released a new version of the Apigee integrated portal.

This release includes general improvements to performance and availability.

Backup and DR

The Backup and DR service has added support for activating the management console and for storing backup vault data in the following regions: us-east5, asia-northeast1, and asia-southeast2.

Cloud Asset Inventory

The following resource types are now publicly available through the analyze policy APIs (AnalyzeIamPolicy and AnalyzeIamPolicyLongrunning).

  • Google Kubernetes Engine
    • admissionregistration.k8s.io/ValidatingWebhookConfiguration
  • BigQuery Data Transfer API
    • bigquerydatatransfer.googleapis.com/TransferConfig
Cloud Composer

All Cloud Composer environment's GKE clusters are set up with maintenance exclusions from January 21, 2025 to February 10, 2025. For more information, see Maintenance exclusions.

Cloud Monitoring

When you create a snooze from the Incident details page, you can now apply the snooze to other incidents that have one or more of the same resource labels. For more information, see Create a snooze.

Cloud Run

When deploying a function in Cloud Run, you can now specify an Artifact Registry image repository to store the container (Preview).

Config Connector

Config Connector version 1.128.0 is now available.

New Beta resources (direct reconciler)

New Fields

  • SpannerInstance

    • You need to use the alpha.cnrm.cloud.google.com/reconciler: direct annotation on SpannerInstance resource to opt-in these features.

      • spec.autoscalingConfig
      • spec.edition

Reconciliation Improvements

  • We have added support for direct reconciliation to more resources, with opt-in behaviour. The API is unchanged. To use the direct reconciler, add the alpha.cnrm.cloud.google.com/reconciler: direct annotation to the corresponding Config Connector object. The following resources now have direct reconciliation support:

    • AlloyDBInstance
    • SpannerInstance

New Alpha resources (direct reconciler)

  • IAPSettings

  • SecureSourceManangerInstance

  • SecureSourceManangerRepository

DataformRepository fields validation error.

  • Fixed the incorrect format validation for the following fields:

    • spec.gitRemoteSettings.authenticationTokenSecretVersionRef
    • spec.gitRemoteSettings.sshAuthenticationConfig.userPrivateKeySecretVersionRef
    • spec.npmrcEnvironmentVariablesSecretVersionRef
Google Distributed Cloud (software only) for VMware

Google Distributed Cloud (software only) for VMware 1.29.1000-gke.94 is now available for download. To upgrade, see Upgrade a cluster or a node pool. Google Distributed Cloud 1.29.1000-gke.94 runs on Kubernetes v1.29.12-gke.800.

If you are using a third-party storage vendor, check the GDC Ready storage partners document to make sure the storage vendor has already passed the qualification for this release.

After a release, it takes approximately 7 to 14 days for the version to become available for use with GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

The following issues are fixed in 1.29.1000-gke.94:

  • Fixed an issue to prevent checking for add-on node IP addresses for HA admin clusters with three control-plane nodes and no add-on nodes.

  • Fixed an issue where DNS and NTP servers weren't checked for HA admin clusters or for user clusters configured for Controlplane V2.

The 1.29.1000-gke.94 release includes many vulnerability fixes. For a list of all vulnerabilities fixed in this release, see Vulnerability fixes.

Google Kubernetes Engine

A bug in the image streaming feature caused authentication-related failures in specific scenarios when the workload tried to access container image data. This bug has been fixed in the following GKE versions:

  • 1.32.0-gke.1448000 and above.
  • 1.31.4-gke.1183000 and above.
  • 1.30.8-gke.1261000 and above.

A security vulnerability was discovered in the Google Secret Manager Provider for Secret Store CSI Driver. This vulnerability could allow an attacker to gain access to the Kubernetes service account token of the CSI driver.

For more details, see GCP-2025-006 security bulletin.

GKE cluster notifications have the following new capabilities:

For more details about the different types of cluster notifications GKE sends and how you can receive them, see Cluster notifications.

Sensitive Data Protection

Regional endpoints for Sensitive Data Protection are available in the eu and us multi-regions. For more information, see Global and regional endpoints for Sensitive Data Protection.

Transcoder API

Standalone MP3 audio-only outputs are now supported.