status: Active · 233 items
- Platform/SRE — Plan: If you run Amazon MSK, this GA feature lets managed Prometheus collectors scrape consumer-group lag metrics without self-operated agents; evaluate adopting it this quarter to replace any self-managed Kafka exporters in your observability pipeline.
- CI/CD — Skip
- Leader — Skip
- Signals: GA announcement
- Platform/SRE — Plan: New GA capability worth evaluating this quarter: enabling automatic SDK integration on existing CloudFront web ACLs that use Bot Control (targeted), ATP, or ACFP rule groups eliminates per-application script-tag maintenance and reduces misconfiguration risk. Review your WAF web ACLs and enable the setting via Console, CLI, CDK, or CloudFormation.
- CI/CD — Skip
- Leader — Learn: This reduces recurring per-application engineering overhead for teams protecting many CloudFront-fronted properties with advanced WAF rule groups — useful context when assessing operational cost of the WAF managed-rule investment, but no strategic decision is required.
- Platform/SRE — Plan: MSK Provisioned clusters now support TLS 1.3 as a GA opt-in via named security policies — evaluate applying a TLS 1.3-capable policy this quarter, particularly if your org has compliance frameworks requiring TLS 1.3 or if post-quantum readiness is on the roadmap.
- CI/CD — Skip
- Leader — Learn: MSK’s new TLS 1.3 support is a step toward post-quantum cryptography readiness and aligns with tightening compliance standards; no strategic or licensing decision is forced, but worth knowing if your security policy roadmap includes post-quantum preparedness.
- Platform/SRE — Learn: New GA capability in GovCloud: Cross-Region Inference auto-routes requests across both GovCloud regions for throughput and redundancy, with native Bedrock observability (CloudWatch, S3 logging, Cost Explorer). Worth noting for platform teams operating AI workloads under US data-sovereignty constraints, but no operational change required today.
- CI/CD — Skip
- Leader — Learn: For leaders in regulated/government environments, this signals that OpenAI model APIs are now accessible on AWS-controlled infrastructure with native account governance, cost attribution, and data sovereignty — a potentially relevant option when evaluating AI tooling strategy in GovCloud-mandated contexts.
- Platform/SRE — Plan: If your org maintains a firewall or security-group allowlist for incoming GitHub webhook traffic, update it to include the new IP ranges from the Meta API hooks field before deployments that rely on webhooks start failing.
- CI/CD — Plan: Pipelines that trigger via GitHub webhooks and sit behind a strict inbound allowlist may silently drop deliveries; pull the updated ranges from the Meta API and refresh your allowlist rules.
- Leader — Skip
- Platform/SRE — Learn: GovCloud parity for ElastiCache Serverless public endpoints means IAM-authenticated Valkey caches can now be reached outside a VPC in GovCloud without a bastion or VPN. Worth noting for any GovCloud workloads that need serverless caching with simplified network topology.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Frames agentic AI risk as a platform design question — what tools and permissions are exposed to agents defines the blast radius. Worth reading as platform teams start exposing internal APIs to AI agents.
- CI/CD — Skip
- Leader — Learn: CNCF perspective on why AI agent safety is a platform governance problem, not just an ML one — useful context for leaders setting AI adoption policy or evaluating internal developer platform expansion to agentic tooling.
- Platform/SRE — Plan: Azure MCP Server 3.0 is now GA with expanded Terraform/IaC integration, making AI-agent-driven Azure resource management more viable; evaluate whether it fits your infrastructure automation workflow this quarter — no forced migration or deadline involved.
- CI/CD — Skip
- Leader — Learn: Azure MCP Server 3.0 GA signals growing maturity of AI-agent-to-cloud-API tooling; worth tracking as context for AI-assisted platform engineering strategy, but no immediate toolchain or cost decision is triggered.
- Signals: GA announcement · major release (3.0)
- Platform/SRE — Plan: If you’re running DataSync tasks against FSx for Windows File Server or NetApp ONTAP, Enhanced mode is now fully compatible and offers parallel processing plus no file-count limits over Basic mode — worth scheduling an evaluation and migrating existing tasks this quarter.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: SOCI lazy-loading cuts GPU idle time during image pulls by up to 90% on SageMaker training jobs — worth evaluating for teams running large deep learning containers, but no deadline or breaking change makes this a now-or-later optimization.
- CI/CD — Skip
- Leader — Learn: For organizations with significant SageMaker GPU spend, this GA feature reduces billable idle time during container pulls; useful context for FinOps reviews of ML training costs but requires no strategic decision now.
- Platform/SRE — Plan: Teams running MSK Connect can now update connector plugins and worker configurations without deleting and recreating connectors, preserving committed offsets; evaluate adopting this for your next connector upgrade cycle to reduce disruption risk.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: Managed Grafana 13.2 is now GA with Git Sync for dashboard-as-code, dynamic dashboards, and PromQL in the CloudWatch data source — worth scheduling an upgrade this quarter; no forced-upgrade deadline exists for version 12.4, so no clock is running.
- CI/CD — Skip
- Leader — Skip
- Signals: Grafana 13.2 EOL 2027-05-18 · GA announcement
- Platform/SRE — Learn: Volcano v1.16 introduces namespace-scoped hierarchical queues and fairshare scheduling, worth evaluating if you run batch or ML workloads on Kubernetes; no EOL pressure or breaking changes signaled.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: A small early-stage project (72 stars, no enrichment signals) for aggregating noisy service metrics into explainable health signals — worth a bookmark for SREs designing health-score systems, but nothing to adopt today.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Kubernetes is formalizing AI workload conformance standards under SIG Architecture, which shapes how AI inference and training workloads will be certified to run on Kubernetes; no operational change needed today, but worth tracking as conformance requirements may influence cluster configuration choices for AI workloads.
- CI/CD — Skip
- Leader — Learn: Kubernetes’s elevation of AI Conformance to a formal SIG subproject signals the ecosystem is converging on standards for AI workloads, useful context when evaluating long-term platform strategy for AI infrastructure.
- Platform/SRE — Plan: Grafana 13.3 is a new GA minor for a core observability stack tool; schedule an upgrade this quarter to gain Notebooks and the UI refresh — cross-dashboard variables are still public preview, so hold off on that feature specifically until GA.
- CI/CD — Skip
- Leader — Skip
- Signals: Grafana 13.3 EOL 2027-07-20
- Platform/SRE — Learn: Orbit’s graph linking code, pipelines, container images, and ownership could streamline how platform teams locate vulnerable infrastructure components during a CVE response, but it requires no change to running systems and is GitLab-specific.
- CI/CD — Skip
- Leader — Learn: If the org is on GitLab, Orbit GA is worth noting as a DevSecOps capability that reduces manual triage overhead for security investigations — no strategic decision is forced, but it’s relevant when evaluating GitLab’s security toolchain breadth.
- Signals: GA announcement
- Platform/SRE — Skip
- CI/CD — Plan: GitLab Orbit is now GA and directly improves AI agent efficiency in CI/CD workflows — pipeline context, vulnerability data, and ownership are queryable in one graph. Teams using AI-assisted GitLab pipelines should evaluate adopting Orbit MCP integration to reduce agent retry churn and token spend.
- Leader — Learn: The 4.5x token reduction claim is a concrete data point for anyone budgeting AI agent usage on GitLab; worth tracking as a cost-optimization lever when planning AI toolchain investments, but no decision is required now.
- Signals: GA announcement
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Learn: Aggregate Copilot capability expansion (model choice, agent flexibility) is worth tracking for AI-assisted development strategy and tooling decisions.
- Platform/SRE — Plan: If you run Azure Container Apps with Log Analytics as the logging destination, Microsoft has marked it legacy and recommends migrating to Azure Monitor; no forced removal date is given, but schedule the migration before it becomes a breaking change.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: New GA observability plugin for Lambda durable functions exports execution history to 13 destinations including CloudWatch, S3, and OpenSearch; worth noting when designing telemetry for serverless workflows, but installed at the function-code level so no platform infrastructure change required.
- CI/CD — Skip
- Leader — Learn: New no-cost AWS capability for observability into long-running Lambda workflows; relevant context for teams standardizing on serverless architectures, but no licensing, cost, or vendor-risk decision is triggered.
- Platform/SRE — Plan: GA capability that can cut cold-start latency up to 70% for large Lambda container workloads; evaluate adding SOCI index creation to ECR push workflows for any function images over a few hundred MB this quarter.
- CI/CD — Learn: Adopting SOCI requires a new pipeline step (generate SOCI index, push a second tagged manifest to ECR), but it is fully opt-in with no deadline — worth noting as a future build-pipeline enhancement if cold starts are a pain point.
- Leader — Skip
- Platform/SRE — Plan: New GA capability lets platform teams build automated identity lifecycle workflows — audit Lambda functions, SIEM alerts, or downstream access revocation triggered by group/user changes. Worth incorporating into identity management automation this quarter if IAM Identity Center is the identity source.
- CI/CD — Skip
- Leader — Learn: EventBridge-driven identity change events can strengthen automated compliance and audit posture for organizations managing large workforces in AWS; no strategic vendor or cost decision required, but informs thinking on identity automation capabilities.
- Platform/SRE — Plan: Enable EKS Dashboard trusted access via AWS Organizations to get consolidated CA rotation status across all clusters and regions — clusters created since 2018 carry 10-year CAs that are now entering the window where rotation planning should begin. No hard expiration deadline is cited, but this is a free GA capability worth enabling this quarter to surface clusters approaching rotation.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: EKS Auto Mode now natively manages Gateway API resources (Gateway, HTTPRoute) including weighted routing, header-based routing, and ACM TLS — eliminating the need for a separate ingress controller. Evaluate adopting Gateway/HTTPRoute as the standard traffic-management pattern for EKS Auto Mode clusters this quarter.
- CI/CD — Skip
- Leader — Learn: EKS Auto Mode’s native Gateway API support signals Kubernetes standardizing on a single next-gen ingress model; worth tracking as a data point when reviewing golden-path networking standards for EKS-based platforms.
- Platform/SRE — Plan: New GA ECS capability that packs tasks across multiple underutilized instances and consolidates Spot capacity — worth evaluating this quarter if you operate ECS Managed Instances with narrow instance-type capacity providers to improve utilization and reduce EC2 spend.
- CI/CD — Skip
- Leader — Learn: Cross-instance and Spot consolidation in ECS Managed Instances is a FinOps-relevant feature for ECS-heavy orgs, but it’s a new GA optimization capability rather than a pricing or vendor-risk event — no strategic decision required now.
- Platform/SRE — Skip
- CI/CD — Learn: AI-assisted code review in pipelines can produce hallucinated vulnerabilities and harmful remediation steps; worth understanding the containment and verification patterns before integrating coding agents into release workflows.
- Leader — Learn: Illustrates the risk profile of deploying coding agents without human verification gates — useful context when setting standards or policy around AI-assisted development tooling adoption.
- Platform/SRE — Learn: An early-stage self-hosted PaaS layer on top of Kubernetes worth watching as an IDP building block, but with only 115 stars and no enrichment signals it’s too immature to evaluate for production adoption today.
- CI/CD — Skip
- Leader — Learn: An emerging open-source self-hosted PaaS option relevant to internal developer platform strategy; no concrete adoption decision warranted yet given its early community size.
- Platform/SRE — Learn: o11y-bench provides a structured way to evaluate AI models on real SRE workflows—metric queries, incident investigation, dashboard management—which may inform future AI tooling decisions for the observability stack, but nothing in production needs to change today.
- CI/CD — Skip
- Leader — Learn: This benchmark shapes thinking about how to objectively compare AI models for observability use cases before committing to a vendor or internal tooling investment, but no strategic decision is forced by this release.
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Plan: If your org pays for GitHub Enterprise and Copilot separately, this bundling change is worth reviewing with your account team to consolidate licensing and potentially reduce complexity or cost. No deadline, but address it in the next contract or planning cycle.
- Platform/SRE — Skip
- CI/CD — Plan: Evaluate enabling Dependabot reachability analysis to triage which vulnerable dependencies are actually callable from your code, reducing alert noise and helping the team focus remediation effort on real exposure.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Learn: This public preview extension lets engineers triage code scanning alerts inside the Copilot app; worth evaluating as a developer experience improvement, but it’s pre-GA so no pipeline action needed yet.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Learn: Copilot Fusion is now GA and automatically routes tasks to the most appropriate model — worth tracking as it may affect Copilot seat value and how the org evaluates AI coding assistant ROI in future contract cycles.
- Signals: GA announcement
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Learn: Experimental preview of intelligent local-vs-cloud model routing in Copilot Fusion; worth monitoring as a signal of where AI coding tooling is heading, but pre-GA status means no adoption decision yet.
- Platform/SRE — Skip
- CI/CD — Learn: Shared Copilot Automations let teams compose AI-driven workflows with prompts, triggers, and tools — worth evaluating if your org uses GitHub Copilot heavily, but no pipeline migration or deadline to act on yet.
- Leader — Learn: Collaborative AI workflow tooling within GitHub Copilot could influence developer-productivity strategy; track adoption maturity before standardizing.
- Platform/SRE — Learn: GA automation for issue triage and CI failure analysis could reduce toil on shared infra, but there’s no operational urgency or infrastructure surface change — worth watching as the tooling matures.
- CI/CD — Plan: Now GA, GitHub Agentic Workflows can automate CI failure analysis and triage directly in the pipeline; evaluate adopting it this quarter to reduce manual investigation overhead across teams.
- Leader — Learn: A new GA open-source automation layer from GitHub Next that could eventually inform the org’s golden path for AI-assisted DevOps, but no licensing, cost, or strategic decision is required yet.
- Signals: GA announcement
- Platform/SRE — Learn: AlloyDB AI query functions (ai.extract, ai.classify) are Preview-only, capping relevance at Learn. The Apigee API Health dashboard reaching GA in Cloud Monitoring is worth noting for teams running Apigee proxies, but it adds a monitoring view, not a required migration or operational change.
- CI/CD — Skip
- Leader — Skip
- Signals: GA announcement
- Platform/SRE — Learn: A novel architecture using Cloudflare Workers, Durable Objects, and R2 to host git and CI primitives; too early-stage (62 stars) to evaluate for production platform use, but worth tracking as a pattern.
- CI/CD — Learn: Drop-in GitHub Actions YAML compatibility on Cloudflare edge infrastructure is an interesting alternative pipeline substrate, but adoption is premature at this maturity level.
- Leader — Learn: Early signal of an OSS self-hosted GitHub alternative that could inform thinking about GitHub vendor dependency; no strategic decision warranted at 62 stars.
- Platform/SRE — Plan: GA feature that meaningfully changes GPU capacity planning on ECS — teams running small-model inference or multi-model serving should evaluate adopting MPS sharing to improve GPU utilization and reduce per-workload instance costs this quarter.
- CI/CD — Skip
- Leader — Learn: GPU workload cost density improvement is worth noting for teams with ML inference spend on ECS, but adoption is optional and operational — no strategic vendor, licensing, or pricing-model decision required.
- Platform/SRE — Skip
- CI/CD — Learn: Pillow 13.0.0 fixes a CVSS 9.2 argument injection; if Python build or app container images carry Pillow transitively, it is worth auditing, but EPSS 0.01 and no KEV listing mean there is no hard clock requiring pipeline changes now.
- Leader — Skip
- Signals: CVE-2026-112900 — CISA KEV: not listed, EPSS 0.01
- Platform/SRE — Learn: The WG targets exactly the repeated per-cluster workload assessments operators do today — node-drain tolerance, removed-API dependencies, over-privileged containers. Worth tracking as the spec develops, but the deliverable doesn’t exist yet so there’s nothing to act on.
- CI/CD — Skip
- Leader — Learn: A Kubernetes-blessed workload conformance standard could eventually reduce per-environment onboarding overhead and inform the org’s golden-path requirements, but the working group is newly chartered with no published spec yet — no planning decision warranted now.
- Platform/SRE — Learn: New GA capability in Grafana Cloud adds LLM-specific observability (latency, token costs, PII detection) on top of the existing stack; worth evaluating if the team manages AI workloads, but no deadline or forced migration.
- CI/CD — Learn: The deployment-gate angle (using agent quality experiments as CI gates) is genuinely novel, but requires Grafana Cloud adoption and AI agent deployments before it becomes actionable — nothing to change in pipelines today.
- Leader — Learn: Relevant for leaders investing in AI agent rollouts; frames the emerging observability-for-agents space but introduces no vendor-risk, licensing, or cost change requiring a decision now.
- Signals: GA announcement
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Learn: A new lower-cost model option in GitHub Copilot may be worth noting when reviewing Copilot licensing costs or evaluating AI coding tool ROI, but no contract or pricing change is forced.
- Signals: GA announcement
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Learn: Copilot’s new permission-gating model for CLI and IDE commands is now GA — worth noting as it affects AI-assisted development guardrails, though no toolchain decision is required today.
- Signals: GA announcement
- Platform/SRE — Plan: AWS KMS now GA with all three ML-KEM key specs, backed by FIPS 140-3 HSMs — evaluate adopting ML-KEM for workloads handling long-lived sensitive data as part of a PQC migration plan this quarter; no forced deadline, but the NIST IR 8547 roadmap signals classical key-exchange schemes will be phased out.
- CI/CD — Skip
- Leader — Learn: AWS KMS adding ML-KEM signals cloud providers are operationalizing NIST’s PQC standards; useful context for shaping a post-quantum cryptography roadmap, but no licensing change, cost impact, or deadline requires a decision now.
- Platform/SRE — Plan: This GA capability removes the need for overly broad IAM roles in multi-Region architectures, enabling per-user fine-grained access control and audit trails across Regions. Teams running distributed or disaster-recovery workloads on AWS should evaluate updating their IAM Identity Center configuration and multi-Region access patterns this quarter.
- CI/CD — Skip
- Leader — Learn: Cross-Region identity propagation tightens the audit and access-control story for multi-Region AWS deployments without additional cost, which may eventually inform golden-path standards for identity architecture, but no strategic decision is required now.
- Platform/SRE — Plan: New GA capability that changes how external query engines and partners authenticate to Glue-hosted Iceberg tables — teams running Iceberg on Glue should evaluate replacing SigV4 paths with OAuth token exchange to eliminate credential distribution to third-party analytics platforms.
- CI/CD — Skip
- Leader — Learn: OAuth-based federated access to Iceberg tables without distributing AWS credentials is a meaningful shift in data-partnership architecture, relevant for orgs negotiating third-party analytics integrations, but no immediate strategic decision is triggered.
- Platform/SRE — Plan: New GA capability lets you enable Launch Before Terminate once at the account level via PutAccountSetting, ensuring full capacity is maintained during instance refreshes, rebalancing, and health-check replacements across all ASGs. Worth scheduling a review and enabling this quarter to reduce availability risk during replacement events.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: If your org runs WorkSpaces Core Managed Instances, this GA capability removes the previous requirement to rebuild instances for storage changes — useful to know for future capacity planning, but no action needed today.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: New GA ECR capability eliminates the manual retag workaround for backfilling existing images to replication destinations — worth scheduling adoption for teams expanding to new regions or validating DR readiness. No deadline, but evaluate this quarter if multi-region image parity is a compliance or DR requirement.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: etcd backs every Kubernetes control plane, and a breaking change in a patch release demands a CHANGELOG review before upgrading; review the upgrade guide and validate cluster behavior in staging before rolling this out to production — no forced deadline yet.
- CI/CD — Skip
- Leader — Skip
- Signals: breaking-change flagged
- Platform/SRE — Plan: etcd v3.6.16 carries a flagged breaking change in a patch release, which is atypical — review the changelog and upgrade guide before applying, since etcd is the Kubernetes control-plane backing store and an unexpected breakage can bring down cluster state. No hard deadline, but treat this as a deliberate upgrade rather than a routine patch rollout.
- CI/CD — Skip
- Leader — Skip
- Signals: breaking-change flagged
- Platform/SRE — Plan: Unusual for a patch release, v3.5.35 carries a breaking-change flag; review the etcd CHANGELOG and upgrade guide before applying this to any cluster running etcd 3.5.x to avoid unexpected behavior in the control-plane data store.
- CI/CD — Skip
- Leader — Skip
- Signals: breaking-change flagged
- Platform/SRE — Act: The eMudhra intermediate CA private keys are confirmed compromised, enabling potential MITM against any service trusting those CAs; upgrade Envoy to v1.40.1 now to remove trust in those CAs from the proxy trust store. If running Istio, also review the peer metadata label-fallback behavior change, which affects source_app/destination_app attribution in telemetry.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.40 EOL 2027-10-13
- Platform/SRE — Act: The eMudhra intermediate CA private keys are confirmed compromised, meaning any Envoy instance still trusting those CAs is exposed to forged-certificate MITM attacks; upgrade Envoy to v1.39.5 now to remove trust of the affected roots from docker images and the Hickory DNS-over-TLS/HTTPS resolver.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.39 EOL 2027-07-14
- Platform/SRE — Act: The eMudhra intermediate CA private keys are confirmed compromised — Envoy instances running older versions still trust those CAs, leaving upstream TLS connections exposed to potential MITM via fraudulent certificates. Upgrade Envoy to v1.38.8 to remove trust in the compromised CAs; Envoy 1.38 is supported until 2027-04-23 so the upgrade path is available now.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.38 EOL 2027-04-23
- Platform/SRE — Plan: Removes trust for compromised eMudhra CA private keys from Envoy’s trust store; any 1.37.x deployment trusting those CAs is exposed to fraudulent cert acceptance. No KEV listing or confirmed active exploitation, so cap is Plan — schedule patching to 1.37.10 this sprint; 1.37 itself EOLs 2027-01-13.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.37 reaches EOL in 79d (2027-01-13)
- Platform/SRE — Plan: Two breaking changes affect teams running Backstage: the catalog backend now rejects primitive-root filter predicates (any custom catalog queries or plugins using that pattern must be updated), and the Atlassian usernameMatchingUserEntityName resolver is removed (migrate to emailMatchingUserEntityProfileEmail). No forced deadline, but plan the upgrade and audit affected code before rolling this version out.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Learn: High-engagement essay drawing a parallel between Kubernetes adoption and the current open-weight AI inflection point — relevant background for leaders evaluating build-vs-buy decisions around AI infrastructure and whether to standardize on hosted vs self-hosted model serving.
- Platform/SRE — Skip
- CI/CD — Plan: New GA capabilities in GitHub secret scanning—validity checks, dismissals, API, and webhooks—are worth integrating this quarter to automate triage and response when pipeline credentials or tokens are exposed in public repos.
- Leader — Learn: GitHub’s expanded secret-monitoring surface (validity checks, webhooks, API) shapes how orgs can build automated security workflows around leaked credentials, but no licensing, pricing, or vendor-risk decision is triggered.
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Learn: If your org uses GitHub Enterprise Managed Users, review whether any accounts were incorrectly deleted (rather than suspended) during June 1–13, 2026 via SCIM deprovisioning — particularly any service or bot accounts your teams rely on.
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Learn: Expanded coverage in the Copilot usage metrics API gives leaders more complete visibility into how developers are actually consuming Copilot licenses across third-party tools; no decision required, but worth noting if you’re tracking Copilot ROI or license utilization.
- Platform/SRE — Skip
- CI/CD — Plan: GitHub Apps can now replace classic PATs for enterprise-wide automation; schedule an audit of existing PAT-based pipeline credentials and migrate to GitHub App installations for tighter scope and auditability — no forced deadline, but a clear security improvement to queue this quarter.
- Leader — Learn: This GA capability enables org-wide policy to standardize on GitHub Apps over classic PATs for automation, which strengthens credential hygiene and reduces blast radius of leaked tokens; worth factoring into enterprise GitHub governance standards but no immediate decision required.
- Signals: GA announcement
- Platform/SRE — Plan: Teams using Cloud SQL Auth Proxy must upgrade to 2.26.3+, Cloud SQL Proxy Operator to 1.8.4+, and Ops Agent to 2.73.0 to address this Go root-certificate vulnerability (GCP-2026-071); managed Cloud SQL instances are auto-patched during scheduled maintenance. CVE is not KEV-listed and EPSS is 0.00, so no active exploitation warrants immediate emergency action, but proxy upgrades are concrete tasks to schedule this sprint.
- CI/CD — Skip
- Leader — Skip
- Signals: CVE-2026-111943 — CISA KEV: not listed, EPSS 0.00
- Platform/SRE — Plan: If you run Azure VMs on Premium SSDv2 or Ultra disks, this GA feature enables granular file/folder recovery rather than full-disk restores — worth adopting this quarter if ILR was previously a gap in your backup strategy.
- CI/CD — Skip
- Leader — Skip
- Signals: GA announcement
- Platform/SRE — Plan: This GA capability eliminates the need for a NAT appliance or IP renumbering when connecting networks with overlapping CIDRs — directly relevant if the org has pending M&A integration, partner VPN, or multicloud connectivity work blocked by address conflicts. Evaluate adding to the network-connectivity pattern for such scenarios this quarter.
- CI/CD — Skip
- Leader — Learn: Managed 1:1 NAT on Transit Gateway removes the appliance cost and renumbering complexity historically incurred during M&A network integration; worth noting as an option when assessing future acquisition or partner-connectivity scope.
- Platform/SRE — Plan: If you run MSK Connect, update your maintenance runbooks to use pause/resume instead of delete/recreate — this preserves offsets and config, reducing risk during source/sink maintenance windows. No deadline; schedule adoption this quarter.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Plan: A 30% reduction in EMR on EKS per-vCPU and per-GB charges applies automatically with no action required — validate the cost impact in your next FinOps review and update budget forecasts for Spark workloads on EKS accordingly.
- Platform/SRE — Learn: A community toolkit covering VMware-to-K8s migration, Compose translation, and Alibaba Cloud HA setups — worth bookmarking for teams planning a VMware exit, but it carries no deadline, no enrichment signals, and only 52 stars, so there’s nothing to act on today.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: Platform teams pulling providers and modules from the public Terraform Registry are subject to the revised ToS; review the updated terms and evaluate whether to implement a provider network mirror or private registry to ensure automated and commercial usage remains compliant.
- CI/CD — Plan: CI pipelines that run
terraform initagainst the public registry are exposed to ToS restrictions on automated usage; audit pipeline patterns and consider mirroring providers or switching to the OpenTofu registry to keep builds compliant. - Leader — Plan: This ToS change compounds the earlier BSL relicensing as a vendor-risk signal for orgs standardized on Terraform; use this moment to formally evaluate OpenTofu as the org’s IaC standard and assess whether current Registry usage complies with the new terms before the next planning cycle.
- Platform/SRE — Skip
- CI/CD — Learn: Companion code exploring automated pipeline self-remediation patterns; useful reference for CI/CD engineers thinking about failure-recovery design, but no concrete migration or deadline.
- Leader — Skip
- Platform/SRE — Act: CVSS 9.2 pre-auth RCE in the PHP engine itself with a vendor-confirmed attack path on Apache/mod_php and no application-level workaround; upgrade every web-serving host or container to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 now (patch released 2026-10-21).
- CI/CD — Skip
- Leader — Skip
- Signals: CVE-2026-109618 — CISA KEV: not listed, EPSS 0.12, reported by 2 collected sources · CVE-2026-109619 — CISA KEV: not listed, EPSS 0.06, reported by 2 collected sources
- Platform/SRE — Skip
- CI/CD — Plan: Two critical PHP CVEs affect Docker images built on PHP; audit pipelines for PHP-based container images and update base images to patched PHP versions. Neither CVE is KEV-listed and EPSS scores are low (0.12/0.06), so no emergency, but schedule the base-image refresh this sprint.
- Leader — Skip
- Signals: CVE-2026-109618 — CISA KEV: not listed, EPSS 0.12, reported by 2 collected sources · CVE-2026-109619 — CISA KEV: not listed, EPSS 0.06, reported by 2 collected sources
- Platform/SRE — Learn: Describes an architecture pattern for GPU multi-tenancy using Kamaji (hosted control planes) and HAMi, worth evaluating if your org runs shared GPU clusters — no GA migration pressure, but a useful design reference.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Adds cultural context to the ongoing HashiCorp–community tension following the BSL relicensing; no new concrete deadline or action, but relevant background for teams weighing Terraform vs. OpenTofu.
- CI/CD — Skip
- Leader — Learn: Shapes thinking on long-term HashiCorp vendor risk—the CEO’s framing of community engagement informs the strategic conversation around staying on HashiCorp Terraform versus migrating to OpenTofu, but no new contract or licensing fact is introduced here.
- Platform/SRE — Skip
- CI/CD — Learn: Public preview feature extending secret scanning to public repos for GHEC DR customers; worth monitoring for GA, but no pipeline action needed today.
- Leader — Learn: If your org uses GHEC with data residency, this expands secret scanning coverage to public repositories; track for GA adoption as a security policy enhancement.
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Learn: If your org has invested in custom Copilot agents or MCP servers, the usage metrics API now breaks out per-extension adoption data rather than lumping it under a generic category — useful for tracking ROI on those AI tooling investments, but no action is required.
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Learn: The new industry comparison section lets leaders benchmark their org’s Copilot adoption against aggregated peers, useful context for AI tooling strategy discussions with leadership.
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Learn: Organizations on Copilot Business or Enterprise should understand that the new global default policy means newly GA Copilot features will roll out automatically; review whether your org’s governance posture requires opting out of any features by default.
- Signals: GA announcement
- Platform/SRE — Skip
- CI/CD — Plan: If your runners operate behind strict outbound firewall or IP allowlist rules, review and update allowlists to include the new GitHub Actions blob storage endpoints surfaced in the meta API — no deadline given, but unpatched allowlists could silently break artifact uploads or caching.
- Leader — Skip
- Platform/SRE — Learn: New GA machine-readable IAM service reference (global condition keys, service name mappings, IsDataPlane flag) is a useful building block for automating policy guardrails, but requires no immediate change to existing infrastructure.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Lambda MicroVMs (GA, VM-level isolation with state preservation) is now available in Hong Kong, Malaysia, Thailand, and Spain — relevant if you’re architecting isolated code-execution environments for users in those regions, but no action required unless you have a workload targeting those geos.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Useful quality-of-life improvement for teams managing CloudFormation stacks — force rollback collapses what was a multi-step manual recovery into a single operation. No migration or deadline; worth knowing for the next stuck rollback.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: If you operate in GovCloud, EU Sovereign, or China regions and want unified S3 access log analysis alongside other CloudWatch metrics, this integration is now available — no deadline, but worth evaluating for your observability pipeline.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: The GA Grafana Marketplace introduces paid, partner-backed plugins for data sources and observability use cases — worth knowing when evaluating Grafana extensions, but no operational change required today.
- CI/CD — Skip
- Leader — Learn: Grafana’s move to a commercial plugin marketplace signals a shift in its ecosystem model; worth monitoring for budget implications if teams adopt paid plugins, but no forced decision or cost change yet.
- Signals: GA announcement
- Platform/SRE — Plan: If you self-host GitLab, schedule an upgrade to the relevant patched branch (19.5.1, 19.4.3, 19.3.6, etc.) this sprint; GitLab’s ‘Critical’ designation signals high-severity CVEs, but no KEV listing or active exploitation is confirmed in the signals, so this is urgent planned work rather than a drop-everything hotfix.
- CI/CD — Plan: Teams running self-hosted GitLab CI should upgrade to the appropriate patched version for their minor branch; a critical security fix in the CI/CD platform itself is a supply-chain risk that warrants scheduling an upgrade this sprint, even without confirmed exploitation.
- Leader — Skip
- Signals: major release (19.0)
- Platform/SRE — Learn: Pre-GA preview of short-lived, auto-refreshing OAuth tokens in gh CLI; worth tracking if your teams use GitHub CLI for scripted infra workflows, but no action warranted until GA.
- CI/CD — Learn: Expiring tokens would improve credential hygiene for pipelines that invoke gh CLI, but this is public preview — evaluate once it reaches GA before updating pipeline auth patterns.
- Leader — Skip
- Platform/SRE — Learn: New console visibility into MIG instance distribution across zones and machine types — useful context for capacity planning and troubleshooting, but no operational change required.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Useful pattern for taming high-volume AI agent telemetry using OTel Collector’s filter/transform processors — worth evaluating if the org is running AI agents that emit excessive telemetry into the observability pipeline.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Useful reference if planning an AWS network migration: Transform can now generate a net-new VPC layout or convert on-prem access rules into optimized security groups (with stale-rule detection). Nothing to change in existing production infrastructure today.
- CI/CD — Skip
- Leader — Learn: Worth noting if the org has AWS network migrations on the roadmap — this managed tool reduces manual rework when converting on-prem security rules. No cost, licensing, or strategic toolchain decision triggered by this GA announcement.
- Platform/SRE — Learn: TorchNeuron and Neuron Observer are both public beta, so no production action is warranted yet; worth tracking for teams running Trainium workloads on Trn2/Trn3 instances.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: This GA capability closes a real security gap by validating destination IPs against Route 53-resolved addresses, extending domain-based filtering to SFTP, SSH, and other protocols beyond HTTP/HTTPS. Evaluate adding Route 53 Resolved IP Validation to existing Network Firewall policies to harden egress controls and prevent SNI spoofing.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Offers perspective on Docker’s product evolution and ecosystem fragmentation — useful context when evaluating container toolchain choices, but no operational change required.
- CI/CD — Skip
- Leader — Learn: Community retrospective on Docker’s strategic direction and vendor positioning; worth reading when assessing long-term container toolchain vendor risk or build-vs-buy decisions.
- Platform/SRE — Skip
- CI/CD — Learn: A provider-agnostic pipeline tool using Terraform-style HCL and modules worth evaluating for teams wanting portability across CI systems; no GA maturity signals or adoption data to act on yet.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Learn: A concept piece arguing for a paradigm shift in how DevOps tooling should work; worth reading for strategic thinking about the next evolution of platform engineering, but no decision or action required.
- Platform/SRE — Learn: A newly open-sourced collaborative IaC/DevOps tool worth evaluating as an alternative to existing platforms, but no GA maturity signal or migration deadline to act on yet.
- CI/CD — Skip
- Leader — Learn: Open-sourcing lowers vendor-risk barriers for evaluation; worth tracking as a potential addition to the golden-path toolkit, but no procurement or licensing decision is forced now.
- Platform/SRE — Learn: Public-preview feature in Grafana Cloud that can automate incident coordination steps (channel creation, paging, AI briefings); worth evaluating if your team runs Grafana Cloud, but not actionable until GA.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: Several new GA Grafana Cloud capabilities — including always-on Assistant Watchers that detect anomalies outside predefined alert rules — are worth evaluating for teams running Grafana Cloud as their observability platform. No hard deadline, but the features are GA and relevant to how observability stacks are architected this quarter.
- CI/CD — Skip
- Leader — Learn: Grafana Labs is positioning Grafana Cloud toward AI-assisted autonomous operations; understanding this capability direction is useful context for observability platform strategy and build-vs-buy decisions, but no pricing change or vendor risk event requires a decision now.
- Signals: GA announcement
- Platform/SRE — Plan: If your org runs Grafana Cloud, the Knowledge Graph’s GA expansion — connecting service catalog, on-call ownership, and past-incident context into a unified runtime view — is worth evaluating this quarter to improve investigation workflows and reduce MTTR.
- CI/CD — Skip
- Leader — Learn: The direction of shared observability context for both humans and AI agents (via open standards) shapes thinking about platform-wide incident tooling strategy, though no vendor or toolchain decision is forced by this announcement.
- Platform/SRE — Plan: Assistant Watchers and Investigations are now GA in Grafana Cloud, adding AI-driven monitoring and automated evidence gathering to the observability workflow — evaluate adopting these for on-call runbooks this quarter; Managed Sandboxes remain public preview so hold off on that piece.
- CI/CD — Skip
- Leader — Learn: Grafana’s GA AI incident-response features signal a maturing market for AI-augmented observability — useful context for evaluating where AI tooling fits in the platform strategy, but no immediate decision required.
- Signals: GA announcement
- Platform/SRE — Learn: Adaptive Telemetry offers a strategy for decoupling observability costs from data volume — worth evaluating if Grafana Cloud is in your stack, but no deadline or breaking change makes this actionable now.
- CI/CD — Skip
- Leader — Learn: The value-based pricing framing and Rapid7 case study are useful context for FinOps conversations around observability spend, but there is no contract or pricing change forcing a decision.
- Platform/SRE — Plan: New GA managed service for Terraform execution on GCP could replace self-managed Terraform runners for platform teams standardized on GCP; evaluate whether to adopt Infrastructure Manager as the org’s Terraform execution layer this quarter.
- CI/CD — Skip
- Leader — Learn: Shifts the build-vs-buy calculation for GCP Terraform execution toward a managed option, but no licensing, cost, or vendor-risk forcing function exists yet.
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Learn: The framing that AI-assisted development is accelerating codebase growth while also lowering the cost to exploit business logic flaws is a useful input for prioritizing AppSec investment; the feature itself is pre-GA early access and not yet actionable.
- Platform/SRE — Learn: Beta dashboard surfaces which AI agents (internal and external like Claude Code/Cursor) touched which projects; worth evaluating once GA to understand AI-agent exposure on platform codebases.
- CI/CD — Learn: Beta feature that could clarify which AI agents are interacting with pipeline code and who authorized them; monitor for GA before incorporating into supply-chain governance practices.
- Leader — Learn: Pre-GA, but the direction is directly relevant to AI accountability and auditor readiness — track for adoption as a governance policy tool when it reaches GA.
- Platform/SRE — Skip
- CI/CD — Plan: If your repos still use legacy branch protection rules, schedule a migration to rulesets using this new bulk-convert action — rulesets offer better inheritance and auditability across org-wide pipelines.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Act: The
businessfield insecret_scanning_alert.*andsecret_scanning_push_protection.bypassaudit log events changes on November 12, 2026; audit any automation, SIEM integrations, or compliance scripts that parse these events and update field references before that date. - Leader — Skip
- Platform/SRE — Skip
- CI/CD — Learn: A pre-GA feature that intercepts malicious packages at install time on CI runners — worth monitoring for GA so you can evaluate it as a supply-chain hardening layer in your pipelines.
- Leader — Learn: Signals maturing vendor-side tooling for supply-chain defense at the package layer; worth tracking as it approaches GA to assess whether it fits your org’s hardening roadmap.
- Signals: pre-GA (alpha/beta/RC/preview)
- Platform/SRE — Plan: Apigee X instances below 1-18-0-apigee-6 will be automatically updated within 7–21 days (by ~Nov 10). Verify your instances are not excluded due to the DNS misconfiguration in Known Issue 445936920 or use of the deprecated Apigee Java Library (removed Oct 16, 2025); excluded instances will be left on older versions.
- CI/CD — Plan: Cloud SDK 590.0.0 (released Oct 20) removes cloud-build-local and the app-engine-grpc component as breaking changes. Audit pipelines for any use of cloud-build-local for local Cloud Build testing and plan migration to alternatives before auto-upgrading the Cloud SDK to this version.
- Leader — Skip
- Signals: breaking-change flagged
- Platform/SRE — Plan: This new GA capability lets platform teams detach a DynamoDB replica into a standalone single-region table without recreating it — useful for regional isolation, offboarding a region, or audit scenarios. Worth evaluating if your platform runs global tables and needs cleaner multi-region lifecycle management.
- CI/CD — Skip
- Leader — Learn: Adds flexibility to multi-region DynamoDB architectures (including multi-account global tables), which may inform future data residency or regional isolation decisions, but no strategic action is required now.
- Platform/SRE — Skip
- CI/CD — Learn: The new
version_requirementfield in Dependabot alert API responses enables richer automated triage — useful when designing pipeline workflows that parse alerts for version-specific remediation logic, but nothing to change today. - Leader — Skip
- Platform/SRE — Learn: A thoughtful architectural critique of stateless Terraform patterns that could inform how platform teams design state management — no action required, but worth reading before committing to a stateless approach.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: Finer-grained Azure Monitor signals can improve incident detection and trend analysis for Azure-based platforms; evaluate enabling advanced metrics across key resources this quarter.
- CI/CD — Skip
- Leader — Learn: Improved Azure Monitor granularity is a capability to be aware of for observability strategy, but no licensing, cost, or vendor-risk change is involved — no decision required now.
- Signals: GA announcement
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Learn: Public beta of a native PyTorch backend for AWS Trainium chips; worth monitoring as a potential cost-efficiency alternative to GPU-based training if the org has AI/ML workloads, but no adoption decision warranted at beta stage.
- Signals: pre-GA (alpha/beta/RC/preview)
- Platform/SRE — Plan: New GA capability removes a major operational barrier: migrating IAM Identity Center from Active Directory to an external IdP (Okta, Entra ID) no longer requires recreating users, groups, and permission assignments. If an AD-to-IdP identity migration is on the roadmap, schedule an evaluation of this simplified path.
- CI/CD — Skip
- Leader — Learn: This lowers the migration cost for orgs considering a shift from on-prem AD to a cloud IdP as their AWS identity source — a previously high-friction strategic move is now substantially simpler, which may shift the build-vs-buy calculus for identity infrastructure.
- Platform/SRE — Plan: New GA managed-service capability that changes how ECS ingress is architected — centralized ALB lifecycle management and ALB sharing across up to 25 services could simplify governance and reduce load balancer sprawl. Evaluate ECS Gateway as an alternative to custom ALB provisioning patterns in ECS environments this quarter.
- CI/CD — Skip
- Leader — Learn: ECS Gateway introduces a platform-team-governs, app-team-inherits model for ingress networking, and ALB sharing (up to 25 services) offers a cost optimization angle worth noting for FinOps reviews — but it forces no strategic decision today.
- Platform/SRE — Learn: Offers a reframing worth absorbing before committing budget to a dedicated AI SRE product: existing coding agents may cover meaningful incident-investigation use cases with added context, no action required today.
- CI/CD — Skip
- Leader — Learn: Relevant to build-vs-buy decisions around AI SRE tooling; suggests evaluating what existing coding-agent licenses already cover before signing a dedicated AI SRE contract.
- Platform/SRE — Learn: Platform engineers who run Grafana as part of their observability stack can absorb these Assistant improvements (faster dashboarding, better error recovery, evidence-backed alert investigation) to adjust how they use the tool, but no operational change or deadline is required.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Plan: Orgs standardized on GitHub Copilot Enterprise can now automate model policy governance via GET/PATCH REST endpoints; evaluate integrating this into policy-as-code workflows or org-wide AI model standards this planning cycle.
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Plan: If teams have hardcoded specific deprecated Copilot model identifiers in their IDE configs or API integrations, those workflows may already be broken as of today; audit Copilot model configurations org-wide and update any pinned references to supported models.
- Signals: deprecation/EOL deadline mentioned: October 19, 2026
- Platform/SRE — Plan: If your team uses EC2 Image Builder to bake AMIs or container base images, this GA opt-in feature eliminates per-build instance launch overhead by reusing warm ASG instances — worth evaluating this quarter for any image pipeline with meaningful build latency.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Plan: If your pipelines use npm 12, pnpm 11/12, or Bun 1.4, you can now upgrade those package managers without losing Dependabot coverage — schedule the version bumps in your lockfiles and CI configs this quarter.
- Leader — Skip
- Platform/SRE — Plan: This GA feature lets you audit Azure Monitor workspace consumption — identify unused metrics and right-size ingestion this quarter; no forced deadline but directly actionable for cost and hygiene.
- CI/CD — Skip
- Leader — Learn: Adds visibility into Azure Monitor spend patterns, useful context for FinOps reviews, but no strategic decision is forced by this release.
- Signals: GA announcement
- Platform/SRE — Plan: If you have automation or multiple admins modifying IAM Identity Center users/groups (via SCIM, AD sync, or API), adopt the new Revision parameter on update/delete calls to prevent silent overwrites; no deadline, but worth scheduling for any identity-management automation this quarter.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: CloudWatch Omni is now GA in more regions including major global hubs; platform teams running multi-region or multi-cloud observability stacks should evaluate adopting it as a replacement or complement to their existing Prometheus/Grafana/OpenTelemetry pipeline this quarter.
- CI/CD — Skip
- Leader — Learn: CloudWatch Omni’s AI-powered, multi-cloud observability experience with SSO and agent observability support is worth tracking as it matures — no immediate strategic decision required, but relevant context for future build-vs-buy reviews of the observability stack.
- Platform/SRE — Plan: CVE-2026-78669 affects Terraform’s HTTP/2 stack but is not KEV-listed (EPSS 0.01) and requires a compromised provider/module registry to exploit; schedule an upgrade to 1.16.6 in the next routine Terraform maintenance window.
- CI/CD — Skip
- Leader — Skip
- Signals: deprecation mentioned (no explicit date found) · CVE-2026-78669 — CISA KEV: not listed, EPSS 0.01
- Platform/SRE — Plan: Two correctness fixes worth scheduling: the env edit/set/rm overwriting bug could silently discard environment changes in Pulumi-managed stacks, and the drift status fix improves reliability reporting accuracy. No deadline, but upgrade when next maintaining the Pulumi toolchain.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: Upgrade OpenTofu to v1.12.8 to address a CPU exhaustion vulnerability reachable via attacker-controlled HTTP/2 servers during
tofu init; no KEV listing or active exploitation reported, so no hard deadline, but schedule patching this sprint. - CI/CD — Plan: If pipelines run
tofu initagainst untrusted or external registries, upgrade to v1.12.8 to close the HTTP/2 CPU exhaustion vector; no confirmed exploitation or pipeline-breaking deadline, so plan within current cycle. - Leader — Skip
- Platform/SRE — Plan: Three containerd security fixes ship in this patch: two crash-on-pull vectors and a disk-exhaustion flaw (GHSA-hc94-p972-ch66) that could drain host storage on malicious image pulls. None are KEV-listed or actively exploited, but any team running Docker Engine or raw containerd in production should schedule an upgrade to 29.9.1 this sprint.
- CI/CD — Skip
- Leader — Skip
- Signals: CVE-2026-95839 — CISA KEV: not listed, EPSS n/a, reported by 2 collected sources
- Platform/SRE — Plan: Four CVEs patched (including IAM/SCIM and OAuth2 fixes), none KEV-listed and EPSS scores are effectively zero — no active exploitation, but Grafana is standard in the observability stack; schedule an upgrade to 13.2.4 this quarter.
- CI/CD — Skip
- Leader — Skip
- Signals: CVE-2026-15577 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-33374 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-92539 — CISA KEV: not listed, EPSS n/a
- Platform/SRE — Plan: Grafana sits in most Platform teams’ observability stack; this patch fixes four CVEs (including an IAM/SCIM Enterprise fix), but none are KEV-listed and EPSS scores are near zero — no active exploitation confirmed. Schedule an upgrade to 13.1.8 this sprint rather than treating it as an emergency.
- CI/CD — Skip
- Leader — Skip
- Signals: CVE-2026-15577 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-33374 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-92539 — CISA KEV: not listed, EPSS n/a
- Platform/SRE — Plan: Four CVEs fixed including OAuth2 header leakage and an IAM/SCIM endpoint flaw; none are KEV-listed and EPSS scores are near zero, so no active exploitation anchor, but teams running Grafana 13.x in production should schedule an upgrade to 13.0.11 this sprint.
- CI/CD — Skip
- Leader — Skip
- Signals: major release (13.0) · CVE-2026-15577 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-33374 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-92539 — CISA KEV: not listed, EPSS n/a
- Platform/SRE — Plan: v1.40.0 changes mcp_router to stop forwarding downstream headers (including
authorization) to backends by default — a silent auth-breakage risk on upgrade. Audit MCP router configs and validate header_forwarding settings before rolling this out to any cluster. - CI/CD — Skip
- Leader — Skip
- Signals: breaking-change flagged
- Platform/SRE — Plan: CVE-2026-95839 is a security fix in the container runtime underlying every Kubernetes node, but it is not KEV-listed and carries no public exploitation signal, so this does not meet the Act bar. Plan to upgrade containerd to 2.4.2 across node pools this quarter.
- CI/CD — Skip
- Leader — Skip
- Signals: containerd 2.4 EOL 2027-05-16 · CVE-2026-95839 — CISA KEV: not listed, EPSS n/a, reported by 2 collected sources
- Platform/SRE — Plan: CVE-2026-95839 is not KEV-listed and no active exploitation is reported, but this patch hardens symlink handling, seccomp socket allowlisting, and image reference validation in the container runtime — all within the production-critical containerd path. Schedule an upgrade to 2.3.7 across node pools within your next maintenance window; containerd 2.3 EOL is 2028-04-30, so no forced-upgrade urgency.
- CI/CD — Skip
- Leader — Skip
- Signals: containerd 2.3 EOL 2028-04-30 · CVE-2026-95839 — CISA KEV: not listed, EPSS n/a, reported by 2 collected sources
- Platform/SRE — Learn: Pre-release (next.3 RC) of Backstage; worth tracking if you run an internal developer portal, but no action until GA.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: RC1 for Ansible Core 2.22.0 is available for evaluation; pre-GA status caps this at Learn — wait for stable release before planning adoption.
- CI/CD — Learn: Pre-GA release candidate; worth testing against pipelines that use ansible-core, but no action warranted until GA.
- Leader — Skip
- Platform/SRE — Plan: This open-source module automates ephemeral, auto-scaling GitHub Actions runner fleets on AWS via Terraform — worth evaluating if the org self-hosts runners on EKS or EC2 and wants to reduce idle capacity costs.
- CI/CD — Plan: Teams running self-hosted GitHub Actions runners on AWS should evaluate this module to gain on-demand ephemeral runners and eliminate persistent runner maintenance overhead; no deadline, but a useful near-term adoption candidate.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Learn: Red Hat’s entry into the enterprise developer desktop market creates a credible alternative to Docker Desktop’s per-seat licensing; worth tracking as a potential cost-optimization or vendor-risk lever in the toolchain strategy.
- Platform/SRE — Learn: Oracle’s adoption of OpenTofu adds credibility to the fork as a production-grade Terraform alternative, reinforcing the case for teams still evaluating their IaC path after HashiCorp’s BSL relicensing — but no deadline or forced action exists here.
- CI/CD — Skip
- Leader — Plan: A major cloud vendor publicly standardizing on OpenTofu is a meaningful market signal; if your org hasn’t yet resolved its Terraform-vs-OpenTofu strategy following the 2023 BSL license change, schedule that evaluation this quarter before toolchain drift makes migration harder.
- Platform/SRE — Learn: The Knight Capital incident is a foundational reliability case study illustrating how a deployment error can cause catastrophic, irreversible production failures — useful for grounding runbook and rollback design.
- CI/CD — Learn: The incident’s root cause was a flawed deployment process with no automated rollback, making it a canonical reference for why pipeline safeguards, feature flag hygiene, and staged rollouts matter.
- Leader — Learn: A classic cautionary tale about organizational deployment risk at scale — useful context for briefing leadership on why investing in release engineering controls and incident response is non-negotiable.
- Platform/SRE — Plan: Infrastructure automation (Terraform module fetches, Helm chart pulls, init containers) that clones public GitHub repos over unauthenticated HTTPS could intermittently fail; audit and add GitHub credentials to affected workflows.
- CI/CD — Plan: Pipelines cloning public GitHub repos over unauthenticated HTTPS risk intermittent checkout failures; audit all pipeline steps using unauthenticated HTTPS and switch to authenticated HTTPS (GITHUB_TOKEN) or SSH to ensure reliability.
- Leader — Skip
- Platform/SRE — Plan: Two items worth acting on this quarter: enable graceful shutdown on production Compute Engine instances where long-running tasks risk data loss on stop/delete, and review the Cloud Armor WAF v33-stable and v3.0-stable ruleset changes to assess whether updated detection rules alter behavior for existing tuned deployments.
- CI/CD — Skip
- Leader — Skip
- Signals: deprecation/EOL deadline mentioned: October 19, 2026 · GA announcement
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Learn: Opinion piece examining the current state of DevOps as a discipline — useful background for strategy and org-design thinking, though no concrete decision follows from it.
- Platform/SRE — Skip
- CI/CD — Plan: Teams running CodeQL on Swift projects will need to update their scanning configuration when adopting macOS 27 or Xcode 27 runners, as Apple has removed Intel x86_64 code from system binaries CodeQL depends on for build tracing. No forced deadline, but plan this alongside any macOS 27 runner migration.
- Leader — Skip
- Platform/SRE — Learn: A technical overview of BuildKit’s capabilities; useful context for evaluating build infrastructure but no operational change required.
- CI/CD — Learn: Highlights BuildKit features (caching, multi-platform, secrets mounts) that could inform pipeline optimization, but no concrete action or deadline is present.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Learn: Azure DevOps suffered a global outage affecting pipelines; no remediation action required post-recovery, but worth noting as a reliability data point when evaluating CI/CD platform dependencies.
- Leader — Learn: A global Azure DevOps outage is a vendor reliability signal worth noting when reviewing single-vendor CI/CD risk and continuity planning.
- Platform/SRE — Plan: GuardDuty Runtime Monitoring now supports 50+ tunable detection rules for EC2, EKS, and ECS workloads, covering MITRE ATT&CK tactics like persistence and privilege escalation. Evaluate and enable relevant rules this quarter, using dry-run mode first to reduce false positives before going live.
- CI/CD — Skip
- Leader — Learn: AWS expanding GuardDuty’s runtime threat detection with granular, MITRE-mapped rules signals a maturing managed-security posture for AWS-native environments; useful context when assessing build-vs-buy decisions around runtime security tooling.
- Platform/SRE — Learn: Useful framing on how GPU-bound and bursty AI workloads strain the classic HPA/VPA/cluster-autoscaler division; no version change or deadline, but informs how you’d architect autoscaling for AI teams onboarding to the cluster.
- CI/CD — Skip
- Leader — Learn: Useful context for platform strategy as teams push AI/ML workloads onto shared Kubernetes; no near-term decision or cost/vendor change implied, but shapes how you’d evaluate autoscaling capabilities when reviewing cluster investments.
Learn
A Eulogy for DevOps
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Learn: A widely-read retrospective on the DevOps movement’s trajectory — useful context for framing platform strategy and org design conversations with leadership.
- Platform/SRE — Learn: A decade-long retrospective on Docker’s evolution offers useful context for understanding how container infrastructure and operational patterns have matured, but requires no operational change.
- CI/CD — Skip
- Leader — Learn: A peer-reviewed longitudinal study of container adoption trends can inform strategic thinking about platform direction and where containerization is heading next.
- Platform/SRE — Skip
- CI/CD — Plan: The Xcode 27 hosted runner is now GA on GitHub Actions after public preview; if your team builds or tests Apple platform apps, schedule adoption to stay on current toolchain and avoid future runner deprecations.
- Leader — Skip
- Signals: GA announcement
- Platform/SRE — Plan: If your org operates in GovCloud or any of the newly supported commercial regions, this GA feature lets you centralize logs across accounts via AWS Organizations without custom pipelines — worth adding to your observability architecture this quarter.
- CI/CD — Skip
- Leader — Learn: Cross-account log centralization is now available in GovCloud, which matters for regulated-industry customers; free for one copy, $0.05/GB beyond that — useful context for FinOps and compliance conversations but no immediate decision required.
- Platform/SRE — Plan: If you run Oracle Database@AWS, this new GA capability lets you advertise a single aggregate CIDR or default route (0.0.0.0/0) over ODB peering instead of managing per-network entries — worth updating your ODB network peering config during your next network ops review cycle.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: GitLab Secrets Manager is now GA in 19.5 Premium/Ultimate, built on OpenBao — evaluate whether it can replace a standalone Vault deployment for GitLab-centric orgs, since it reuses the existing GitLab permission model and eliminates the sync-drift problem between vault access and project membership.
- CI/CD — Plan: Now GA in GitLab 19.5 — schedule evaluation of Secrets Manager as a replacement for unscoped CI/CD variables; it scopes credentials to individual jobs and attaches pipeline and job IDs to every credential read, making this a concrete supply-chain hardening step for GitLab-hosted pipelines.
- Leader — Learn: For orgs standardized on GitLab, this GA release shifts the build-vs-buy calculus on maintaining a separate secrets vault; no urgent vendor or licensing decision, but worth tracking as a potential toolchain consolidation as the feature matures on Dedicated.
- Signals: GitLab 19.5 EOL 2027-01-21 · GA announcement
- Platform/SRE — Skip
- CI/CD — Plan: The GitLab MCP server is now GA with 19.5, letting MCP-compatible agents drive merge requests, pipelines, and work items under existing GitLab permissions. Evaluate integrating it into agentic pipeline automation workflows this quarter.
- Leader — Learn: GA availability of GitLab’s MCP server signals maturing AI-agent integration across the software development lifecycle; useful input when assessing whether to deepen or broaden AI tooling investment in the platform strategy.
- Signals: GitLab 19.5 EOL 2027-01-21 · GA announcement
- Platform/SRE — Skip
- CI/CD — Plan: Code Review Flow is now GA on GitLab Duo Agent Platform, adding policy-enforced AI review as a merge gate tied to approvals, code owners, and security findings. Evaluate enabling it on GitLab pipelines if your org has rising AI-generated code volume; note the $0.25/review cost model before rolling out org-wide.
- Leader — Learn: GitLab’s GA of policy-governed AI code review introduces a per-review cost model ($0.25/review) and positions automated review as a platform control, not just a developer aid — worth tracking as a pattern for how AI-in-delivery scales and what it costs at volume.
- Signals: GA announcement
- Platform/SRE — Plan: Teams running self-hosted GitLab should schedule an upgrade to 19.5; the EOL signal (2027-01-21) confirms this is the current supported target — review release notes for any breaking changes or infra-side migration steps before upgrading.
- CI/CD — Learn: A new GitLab minor release may include pipeline, runner, or CI/CD workflow improvements worth evaluating — review the 19.5 changelog for any relevant build or deployment features, but no concrete deadline or breaking pipeline change is signaled.
- Leader — Skip
- Signals: GitLab 19.5 EOL 2027-01-21
- Platform/SRE — Skip
- CI/CD — Plan: New GA GitHub Enterprise Cloud feature enables ruleset-based OSS license checks in pipelines; schedule evaluation to enforce centralized license policy as a supply-chain hardening step this quarter.
- Leader — Plan: GA tooling for enforcing OSS license policy at scale on GitHub Enterprise Cloud directly addresses legal/compliance risk from dependency licensing; evaluate enabling it as a formal org standard this planning cycle.
- Signals: GA announcement
- Platform/SRE — Plan: New Docker 29 installs default to the containerd image store, which has different behavior for image layering, multi-platform support, and tooling compatibility; review and test before rolling out Docker 29 on new nodes or golden AMIs to avoid unexpected differences from existing hosts still on the legacy store.
- CI/CD — Plan: Any CI runner provisioning that installs Docker 29 fresh will get the containerd image store by default, which may affect build caching behavior and image layer handling; audit runner provisioning scripts and validate build pipelines against Docker 29 before upgrading runner images.
- Leader — Skip
- Platform/SRE — Plan: If your org has IPv6 compliance or architecture requirements, you can now route IPv6 traffic end-to-end through CloudFront to private ALB/NLB/EC2 origins without exposing them publicly. Evaluate updating VPC origin configs to dual-stack in your next architecture review.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: New GA Azure VMSS capability that passively redistributes VM instances across availability zones to prevent zonal skew; assess whether existing VMSS deployments should enable it this quarter to improve resilience without manual rebalancing.
- CI/CD — Skip
- Leader — Skip
- Signals: GA announcement
- Platform/SRE — Plan: New GA capability enabling precision time on Gen8/Gen9 instance families via Precision Time Placement Groups; evaluate PTPG adoption this quarter for distributed workloads requiring ordered event sequencing or accurate one-way latency measurement.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: If your team runs Grafana Cloud with Adaptive Metrics, this new GA cost-first auto-apply mode can reduce active series counts without manual review — evaluate enabling it this quarter to lower observability ingestion costs.
- CI/CD — Skip
- Leader — Learn: Grafana’s cost-first auto-apply is a concrete example of automated FinOps tooling for observability spend — useful framing if you’re evaluating how to manage metrics cardinality costs at scale, but no leadership decision required.
- Signals: GA announcement
- Platform/SRE — Skip
- CI/CD — Plan: GitHub’s AI Scan for PRs is now GA, extending code vulnerability detection to languages and frameworks CodeQL doesn’t cover — evaluate enabling it in your GitHub Actions workflows this quarter to broaden supply-chain security coverage.
- Leader — Plan: GA availability makes this worth adding to your security standards: assess whether to mandate AI Scan alongside CodeQL as part of the org’s golden-path security policy for pull requests.
- Signals: GA announcement
- Platform/SRE — Skip
- CI/CD — Plan: This GA feature can automatically remediate code scanning alerts within your GitHub workflows, reducing manual triage burden. Evaluate enabling it on repositories that use GitHub Advanced Security to tighten the security feedback loop in your pipelines.
- Leader — Learn: GitHub’s agentic autofix moves automated security remediation from a developer convenience into a pipeline-integrated capability, which could reshape how teams handle vulnerability backlog — worth tracking as AI-driven developer tooling matures, but no immediate strategic decision is required.
- Signals: GA announcement
- Platform/SRE — Plan: New GA CloudWatch Pipelines capabilities let you split log streams by severity, source, or type into separate log groups with distinct retention and access controls, and apply sequential parsers to nested formats. Worth evaluating this quarter if you’re using CloudWatch Pipelines or considering consolidating log routing into a managed service.
- CI/CD — Skip
- Leader — Learn: This GA capability improves CloudWatch’s log-routing sophistication and could reduce observability costs via targeted retention policies, but it doesn’t change vendor risk, licensing, or require a strategic decision now.
- Signals: GA announcement
- Platform/SRE — Plan: If you manage ARC-enabled VMware or physical Windows servers, evaluate adding ASR for disaster recovery coverage this quarter — this closes a gap for hybrid infrastructure protection.
- CI/CD — Skip
- Leader — Learn: ASR support for ARC-managed on-premise workloads expands Azure’s hybrid DR story; worth noting if the org is evaluating or expanding ARC adoption for governance of on-premise fleets.
- Signals: GA announcement
- Platform/SRE — Plan: GA hardware-level audit logging for Azure Cloud HSM is a concrete compliance and forensic capability; orgs using HSM for key management should schedule enablement and integrate log feeds into their SIEM/observability pipeline this quarter.
- CI/CD — Skip
- Leader — Learn: Informs compliance posture for regulated environments relying on Azure Cloud HSM, but introduces no licensing, pricing, or vendor-risk change that requires a leadership decision now.
- Signals: GA announcement
- Platform/SRE — Plan: If you run Transfer Family SFTP servers, evaluate migrating host keys to Secrets Manager this quarter to simplify cross-region failover and server migrations without requiring clients to re-trust new host keys.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: New GA capability lets teams upgrade EC2 Ubuntu LTS fleets to Ubuntu Pro in-place via License Manager without AMI rebuilds, unlocking 10-year patch coverage and Kernel Livepatch. Worth evaluating this quarter if running Ubuntu LTS instances with compliance or extended-support requirements.
- CI/CD — Skip
- Leader — Learn: Simplifies the path to Ubuntu Pro subscriptions for EC2 fleets, which can reduce compliance risk and extend OS support windows at a Marketplace-managed cost; no forced decision, but relevant context for Ubuntu fleet licensing strategy.
- Platform/SRE — Plan: If your platform runs multi-step or agentic Lambda workflows, the 30,000 operation limit and 1 MB checkpoint open up architectures previously blocked by quota; evaluate whether existing workflows hitting the old 3,000-op ceiling should be redesigned to take advantage.
- CI/CD — Skip
- Leader — Learn: The expanded limits make Lambda durable functions more viable for long-running agentic AI orchestration, worth tracking if your org is evaluating serverless vs. container-based workflow engines for AI workloads.
- Platform/SRE — Plan: The new service quota parity checks and wait-for-target-group-health blocks directly address common multi-region failover failure modes; platform teams using ARC Region switch should evaluate updating their recovery plans to incorporate these execution blocks this quarter.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: If you run RDS for SQL Server 2022, you can now add RDS Proxy to gain connection pooling and up to 83% faster Multi-AZ failover with preserved app connections; evaluate whether to enable this for existing SQL Server 2022 instances this quarter.
- CI/CD — Skip
- Leader — Learn: RDS Proxy now covers SQL Server 2022, expanding HA and connection-pooling options for SQL Server workloads on AWS; no strategic or cost decision required, but worth noting for future SQL Server architecture reviews.
- Platform/SRE — Plan: If your platform automation still uses classic PATs for GitHub API access, schedule a migration to fine-grained GitHub Apps tokens this quarter — fewer broad credentials reduces blast radius from a compromised token.
- CI/CD — Plan: Pipelines relying on classic PATs for repo access or triggering workflows should be migrated to GitHub Apps with scoped permissions; no hard deadline, but this hardening step fits a Q4 supply-chain hygiene project.
- Leader — Skip
- Platform/SRE — Plan: ingress-nginx is one of the most widely deployed Kubernetes ingress controllers; its retirement means planning a migration to an alternative (Gateway API, Traefik, Emissary, etc.) before it goes unmaintained. No hard deadline surfaced in signals, so schedule migration evaluation this quarter.
- CI/CD — Skip
- Leader — Plan: Organizations standardized on ingress-nginx will need to choose and adopt a replacement ingress strategy; evaluate Gateway API or alternative controllers and factor the migration into the next infrastructure planning cycle.
- Signals: deprecation mentioned (no explicit date found)
- Platform/SRE — Skip
- CI/CD — Plan: Verify your repositories have push protection enabled and audit any existing Anthropic API keys or Salesforce credentials in build logs or secrets; no deadline but this is a worthwhile supply-chain hardening step to schedule.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Plan: If your org runs internal package mirrors accessible without credentials, configure the new Anonymous auth method at the org level to simplify Dependabot registry setup and reduce credential management overhead.
- Leader — Skip
- Platform/SRE — Plan: This GA capability changes how serverless web apps can be architected on AWS — Lambda Web Functions can now sit behind CloudFront for edge TLS, caching, DDoS protection, and WAF, with OAC locking down direct access. Worth evaluating for teams running Lambda-based web workloads this quarter.
- CI/CD — Skip
- Leader — Learn: New AWS capability that shifts the serverless-plus-CDN architecture picture — Lambda Web Functions are now a first-class CloudFront origin — but no pricing change, licensing impact, or forced migration means no decision is pending.
- Platform/SRE — Plan: New GA capability worth evaluating this quarter for any workloads using Databricks or Twilio: eliminates custom rotation Lambda functions and ensures applications pick up rotated credentials automatically without code changes.
- CI/CD — Learn: Relevant if pipelines consume Databricks personal access tokens or Twilio API keys, but there is no deadline or pipeline breakage — file as a pattern to consider when next reviewing how build credentials are rotated.
- Leader — Skip
- Platform/SRE — Learn: New GA AWS Lambda primitive supporting direct HTTP handling (Express/Hono, no adapters) with a different billing model; worth tracking for future platform architecture patterns, but no existing infrastructure needs changing and existing Lambda Event Functions require no migration.
- CI/CD — Skip
- Leader — Plan: The active-CPU billing model (vs. idle CPU) could meaningfully reduce Lambda costs for I/O-bound workloads; evaluate this as a golden-path serverless option and assess cost-optimization potential against current Lambda spend this planning cycle.
- Platform/SRE — Plan: This GA minor release patches a snapshot integrity error and restores elided asset contents from prior state — real correctness bugs for teams running Pulumi in production. Schedule an upgrade within the current planning cycle; no hard deadline exists.
- CI/CD — Learn: The new automation API methods (version, whoami, install) across Node/Python/Go SDKs expand programmatic pipeline control options, but no deprecation or breaking change makes this actionable today.
- Leader — Skip
- Platform/SRE — Plan: If you use pulumi-java with Maven 3.10, plugin downloads are silently broken because Maven 3.10 mixes log output into stdout and corrupts JSON parsing; upgrade to Pulumi SDK v3.268.0 to restore correct behavior while the upstream Maven bug is resolved.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: Four HTTP/2 CVEs in the Docker daemon (daemon crash, memory exhaustion, flow-control bypass, CPU spike) are fixed in this release; none are KEV-listed and EPSS scores are near zero, so no active exploitation clock, but schedule an upgrade to v29.9.0 if running Docker Engine on cluster nodes or VM fleets.
- CI/CD — Plan: If Docker-in-Docker or a Docker socket is part of your build runners, the same HTTP/2 daemon vulnerabilities apply; plan to update the Docker Engine version in runner images or host provisioning to v29.9.0, no hard deadline but meaningful DoS risk in shared build infrastructure.
- Leader — Skip
- Signals: deprecation mentioned (no explicit date found) · CVE-2026-56857 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-78659 — CISA KEV: not listed, EPSS 0.01 · CVE-2026-78663 — CISA KEV: not listed, EPSS 0.01
- Platform/SRE — Plan: Two GHSA-tracked crash vulnerabilities in the oauth2 and api_key_auth filters (triggered by CONNECT requests lacking a :path header) are patched in 1.39.3; no KEV listing or active exploitation reported, but operators using either filter should schedule the patch within the current sprint. Envoy 1.39 is supported until 2027-07-14.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.39 EOL 2027-07-14
- Platform/SRE — Plan: Upgrade Envoy 1.38.x to 1.38.7 this quarter: it fixes a non-KEV/EPSS-0.00 CVE in wasmtime, several worker-thread race conditions during RDS route-config updates, and a 1.38.0-introduced regression that underreported Prometheus native histogram quantiles. No hard deadline; 1.38 EOL is 2027-04-23.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.38 EOL 2027-04-23 · CVE-2026-54786 — CISA KEV: not listed, EPSS 0.00
- Platform/SRE — Plan: Two crash-inducing security fixes (GHSA-8vc2-jrm4-835w, GHSA-47vj-9r25-wv5j) affect Envoy’s oauth2 and api_key_auth filters when handling CONNECT requests; no KEV listing or active exploitation reported, so schedule an upgrade to 1.38.6 this sprint if either filter is in use.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.38 EOL 2027-04-23
- Platform/SRE — Plan: Patch Envoy to 1.37.9 this quarter to resolve CVE-2026-54786 (not KEV-listed, EPSS 0.00) and three worker-thread race conditions in AWS request signing, local rate limiting, and SDS secret handling that could cause instability under RDS route updates; no forced deadline, 1.37 EOL is 2027-01-13.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.37 EOL 2027-01-13 · CVE-2026-54786 — CISA KEV: not listed, EPSS 0.00
- Platform/SRE — Plan: Two GHSA-classified crash vulnerabilities in Envoy’s oauth2 and api_key_auth filters can be triggered by CONNECT requests; no KEV listing or active exploitation reported, but any team running these filters in production should schedule an upgrade to v1.37.8 this sprint. Envoy 1.37 EOL is 2027-01-13, so the branch is still supported.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.37 EOL 2027-01-13
- Platform/SRE — Act: Envoy 1.36 reaches end-of-life on 2026-10-14 — apply v1.36.13 now (includes CVE-2026-54786 wasm fix and three race-condition fixes) and immediately begin upgrading to a supported Envoy minor version before that date.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.36 reaches EOL in 2d (2026-10-14) · CVE-2026-54786 — CISA KEV: not listed, EPSS 0.00
- Platform/SRE — Plan: Four CRITICAL CVEs patched — including RCE via Kustomize remote refs and Jsonnet imports in the repo-server, plus an AppProject restriction bypass — with no KEV listing or confirmed active exploitation. Schedule upgrade to v3.4.10 this sprint; none of the exploits have a forced deadline, but CRITICAL severity in a GitOps control plane warrants prompt action.
- CI/CD — Plan: The HIGH-severity command injection via SSH Git repository proxy URL (CVE-2026-55797) and the AppProject hook bypass directly affect the deploy path managed through Argo CD. No active exploitation is confirmed, but teams running Argo CD for GitOps deployments should plan an upgrade to v3.4.10 before end of current sprint.
- Leader — Skip
- Signals: Argo CD 3.4 supported · CVE-2025-61560 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-55797 — CISA KEV: not listed, EPSS 0.02 · CVE-2026-77459 — CISA KEV: not listed, EPSS n/a
- Platform/SRE — Plan: Four CRITICAL-severity vulnerabilities patched, including repo-server command execution via Kustomize and AppProject restriction bypass — none are KEV-listed and EPSS scores are near zero, so no confirmed exploitation, but schedule upgrade of Argo CD to v3.3.15 this sprint given the RCE class of findings.
- CI/CD — Plan: Argo CD v3.3.15 patches CRITICAL command-execution flaws in the GitOps deployment tool; coordinate with the platform team to schedule a cluster upgrade to v3.3.15, prioritizing any environments where untrusted Kustomize or Jsonnet sources are in use.
- Leader — Skip
- Signals: Argo CD 3.3 supported · CVE-2025-61560 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-55797 — CISA KEV: not listed, EPSS 0.02 · CVE-2026-77459 — CISA KEV: not listed, EPSS n/a
- Platform/SRE — Plan: Argo CD 3.5.4 fixes four CRITICAL CVEs including arbitrary command execution in the repo-server via Kustomize and Jsonnet, plus an AppProject restriction bypass. None are KEV-listed and EPSS is very low, but CRITICAL severity in a core GitOps component warrants patching this sprint — upgrade clusters to 3.5.4 promptly.
- CI/CD — Plan: The CRITICAL command-injection paths (Kustomize remote refs, Helm home, Jsonnet imports) run inside the repo-server that processes your GitOps manifests, making this directly relevant to the deploy path. Schedule an upgrade to 3.5.4; no active exploitation confirmed yet but the attack surface is in build artifact processing.
- Leader — Skip
- Signals: Argo CD 3.5 supported · CVE-2025-61560 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-55797 — CISA KEV: not listed, EPSS 0.02 · CVE-2026-77459 — CISA KEV: not listed, EPSS n/a
- Platform/SRE — Plan: Critical patch releases in GitLab warrant upgrading if you self-host; review CVE details in the release notes and schedule the upgrade to the applicable branch (19.4.2, 19.3.4, or 19.2.8) this sprint. No exploitation confirmed in signals, so Act ceiling is not reached.
- CI/CD — Plan: If GitLab CI is your pipeline platform and you run a self-managed instance, plan an upgrade to the patched version matching your branch; critical patches can affect runner availability and API stability. No hard deadline or active exploitation in signals.
- Leader — Skip
- Platform/SRE — Plan: Regex matchers in Application Load Balancer URL maps are now GA, enabling more precise traffic routing via RE2 syntax on paths, headers, and query params — evaluate adopting this for routing rules this quarter.
- CI/CD — Plan: Cloud Build now lets you pin builds to a release channel controlling how often the underlying Debian and Docker versions are updated — review your build configs and private pools to choose an appropriate channel for reproducibility.
- Leader — Skip
- Signals: GA announcement
- Platform/SRE — Plan: If any Docker Hub personal accounts were converted to organizations in your org, PATs used for image pulls in infrastructure tooling may have been re-assigned to unintended owners. Audit and rotate affected Docker Hub PATs; no hard deadline but treat as a near-term security hygiene task.
- CI/CD — Plan: Docker Hub PATs are widely embedded in CI/CD pipelines for registry auth; if any team converted a personal Docker Hub account to an org, those tokens may have changed hands. Identify any converted accounts and rotate all associated PATs in pipeline secrets before they can be leveraged.
- Leader — Skip
- Signals: CVE-2026-105445 — CISA KEV: not listed, EPSS n/a
- Platform/SRE — Plan: A new GA CloudWatch dashboard surfacing OTel metrics (memory, network, latency, keyspace, errors) for Valkey node clusters — worth scheduling adoption to consolidate cache observability; note that detailed 15-second metrics incur standard CloudWatch OTel pricing.
- CI/CD — Skip
- Leader — Learn: AWS now bundles a pre-built observability layer for ElastiCache Valkey at no additional platform cost (standard CloudWatch OTel pricing applies for enhanced polling), relevant context if the org is evaluating its caching observability spend.
- Platform/SRE — Plan: If you run Azure Arc-enabled Kubernetes clusters, plan migration from the Azure Key Vault Secrets Provider Extension to the Azure Key Vault Secret Store Extension before the hard retirement date of October 9, 2027. One year is enough runway to schedule the migration, but start scoping which clusters are affected now.
- CI/CD — Skip
- Leader — Plan: Azure is retiring a secrets-integration extension for Arc-enabled Kubernetes with a clear replacement in the same ecosystem; ensure teams using Arc clusters have this migration on their roadmap before October 9, 2027, as there is no stay-on-current option beyond that date.
- Signals: deprecation/EOL deadline mentioned: October 9, 2027
- Platform/SRE — Plan: New GA capability for Aurora PostgreSQL and RDS for PostgreSQL that detects post-credential-compromise data exfiltration and destruction with no agent or config changes required; platform teams running RDS/Aurora should evaluate enabling the add-on for their organization this quarter via the GuardDuty console or CloudFormation.
- CI/CD — Skip
- Leader — Learn: GuardDuty now extends RDS threat detection beyond login anomalies to query-pattern behavior using ML, relevant for understanding current AWS-native security coverage breadth — no strategic decision or policy change is immediately required.
- Platform/SRE — Plan: GA feature worth adopting for teams using AWS Network Firewall with EKS/ECS — wildcard patterns like app=payments-* can replace per-variant rules, reducing rule sprawl in dynamic container environments. Evaluate and consolidate existing container attribute rules this quarter.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: New GA billing dimension adds model, provider, and inference-type breakdowns for Bedrock spend in Cost Explorer and Budgets — useful context for teams managing cloud cost allocation, but no operational infrastructure change required.
- CI/CD — Skip
- Leader — Plan: If your org runs Bedrock workloads, configure Bedrock product attribute dimensions in Cost Explorer and Budgets this quarter to gain per-model and per-provider spend visibility — enables tighter budget guardrails and informs model-selection trade-offs.
- Platform/SRE — Plan: New GA instance type offering 30% better compute than Graviton3 and higher EBS bandwidth (up to 300 Gbps / 1.6M IOPS) is worth evaluating this quarter for EBS-bound workloads like high-performance file systems; no forced migration, just an adoption decision.
- CI/CD — Skip
- Leader — Learn: Graviton4-based C8gb instances improve the performance-per-dollar profile for compute and storage-intensive workloads, useful background for future FinOps or Graviton migration conversations, but no strategic decision is forced now.
- Signals: GA announcement
- Platform/SRE — Plan: StandardV2 is now the default managed NAT Gateway SKU for new AKS clusters in supported regions, which may affect cluster provisioning templates and IaC modules. Review and update cluster-creation configurations to account for the new default SKU before spinning up new clusters.
- CI/CD — Skip
- Leader — Learn: AKS now manages a higher-performance NAT Gateway SKU by default for new clusters, shifting the networking default without a licensing or cost-model change — worth noting as AKS managed networking capabilities mature.
- Signals: GA announcement
- Platform/SRE — Plan: If your team uses CDKTF for infrastructure, this HN discussion signals potential direction changes worth tracking; no concrete EOL date means no Act, but evaluate whether to continue investing in CDKTF vs. native HCL or OpenTofu-based workflows this quarter.
- CI/CD — Skip
- Leader — Plan: A high-signal HN thread (136 pts, 134 comments) on CDKTF’s future warrants a toolchain-risk review if your org has standardized on it — especially given the HashiCorp/IBM acquisition context; assess alternatives before teams invest further.
- Platform/SRE — Plan: If you operate multiple OpenTelemetry Collector deployments, this GA release enables centralized config management via OpAMP without migrating to Grafana Alloy first — worth evaluating this quarter as a way to reduce config drift across collector fleets.
- CI/CD — Skip
- Leader — Learn: Grafana’s GA of OpAMP-based fleet management signals a maturing centralized-observability management model worth tracking if your org is standardizing on OpenTelemetry — no decision required now but relevant to future platform strategy.
- Signals: GA announcement
- Platform/SRE — Plan: GitLab 19.4 reaches EOL on 2026-12-17 (70 days); if self-hosting on 19.4, schedule an upgrade to a supported minor now. The featured security dashboard is beta-only and should not factor into upgrade timing.
- CI/CD — Skip
- Leader — Learn: Centralized org-wide risk scoring that incorporates KEV and EPSS across all top-level groups is a meaningful step for security program governance and auditor readiness, but the feature is currently in beta for GitLab.com only — no adoption decision warranted yet.
- Signals: GitLab 19.4 reaches EOL in 70d (2026-12-17)
- Platform/SRE — Learn: Improved secret detection in GitHub repositories is a useful security capability, but it has no operational change or deadline for infrastructure teams to act on.
- CI/CD — Plan: Evaluate enabling the new context-aware secret scanning model in GitHub Advanced Security to strengthen supply-chain hygiene; no hard deadline, but worth scheduling as part of a supply-chain hardening quarter.
- Leader — Learn: GitHub’s investment in AI-driven secret detection signals maturing supply-chain security tooling, worth factoring into security posture reviews, but no pricing, licensing, or strategic decision is triggered.
- Platform/SRE — Plan: If ‘record all resource types’ is enabled, these 77 types—including EC2, GuardDuty, Inspector, and S3—will be tracked automatically, which quietly expands coverage and may increase Config costs. Review the new type list against your compliance rules and cost baseline this quarter.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: Kubernetes 1.35 (currently GA, EOL 2027-02-28) defaults failCgroupV1 to true, meaning kubelet refuses to start on cgroup v1 nodes without an explicit override. Audit all Linux nodes for cgroup version and complete migration to cgroup v2 before upgrading any cluster to 1.35 or later.
- CI/CD — Skip
- Leader — Skip
- Signals: Kubernetes 1.31 is past EOL (2025-11-11, 330d ago) · Kubernetes 1.25 is past EOL (2023-10-27, 1076d ago) · Kubernetes 1.35 EOL 2027-02-28 · deprecation mentioned (no explicit date found)
- Platform/SRE — Plan: Cloud SDK 588.0.0 has already removed the managed-flink-client component; audit any gcloud automation or IaC scripts that invoke it and update them before upgrading the SDK in your environment.
- CI/CD — Plan: If CI runners auto-update gcloud, pipelines using managed-flink-client commands will break on Cloud SDK 588.0.0; audit build scripts now and pin the SDK version or remove the dependency before runners pull this release.
- Leader — Skip
- Signals: GA announcement · breaking-change flagged
- Platform/SRE — Plan: Teams running AWS Batch workloads can now replace custom metric scrapers with native CloudWatch metrics covering queue health, failure rates, and state-transition durations; worth integrating into existing dashboards and alerting this quarter.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: The pod name dimension on AKS platform metrics (kube_pod_status_phase and related) is being removed September 30, 2027; audit Azure Monitor dashboards and alerts that rely on per-pod granularity from these metrics and plan migration to aggregate counters or Prometheus-based alternatives before that date.
- CI/CD — Skip
- Leader — Skip
- Signals: deprecation/EOL deadline mentioned: September 30, 2027
- Platform/SRE — Plan: New GA capability to restrict Identity Store and SCIM API access by VPC endpoint or IP allowlist; evaluate enforcing VPC-endpoint-only access for the Identity Store API as part of your AWS SSO hardening roadmap this quarter.
- CI/CD — Skip
- Leader — Learn: AWS now allows network-level perimeter controls around the APIs that manage SSO users and groups; worth noting as an available hardening option when setting identity-security standards across accounts.
- Platform/SRE — Plan: Teams running AFT for multi-account provisioning should evaluate upgrading to AFT 1.22.0 to enable plan-only runs, which support pre-rollout drift detection and safer customization validation; no hard deadline, but it’s a meaningful operational improvement worth scheduling this quarter.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: If you run AWS Batch compute environments on EKS, you can now migrate from the aws-auth ConfigMap to the newer access entry API for IAM-principal authentication; schedule an UpdateComputeEnvironment pass to set accessEntry.desiredState=ENABLED, simplifying auth lifecycle management on those clusters.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: If you manage shared AMIs across accounts or organizations, this new GA feature can replace any custom tag-replication automation you’ve built; evaluate adopting the ’ec2:SharedTag/’ prefix pattern this quarter to simplify your cross-account AMI workflows.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: New GA capability keeps ACME cert issuance traffic inside the AWS network via a VPC interface endpoint; worth scheduling adoption this quarter for compliance-sensitive or egress-restricted environments that already use ACM with ACME clients.
- CI/CD — Skip
- Leader — Learn: ACM now offers a private network path for certificate issuance, which strengthens the compliance and network-isolation story for regulated workloads; no strategic decision or cost change is forced by this GA addition.
- Platform/SRE — Plan: Prometheus 3.13.4 patches a gRPC HTTP/2 memory-exhaustion vulnerability (GO-2026-6348) and fixes federation corruption of float native histograms — schedule an upgrade to 3.13.4 this sprint for any federated Prometheus deployment.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: Upgrade OpenTofu to v1.12.7 to address CVE-2026-78662 and CVE-2026-56855, which allow an attacker-controlled SSH server to deadlock remote-exec/file provisioner connections; neither CVE is KEV-listed and EPSS scores are near zero, so schedule within the next IaC toolchain maintenance cycle rather than treating as an emergency.
- CI/CD — Skip
- Leader — Skip
- Signals: CVE-2026-56855 — CISA KEV: not listed, EPSS 0.01 · CVE-2026-78662 — CISA KEV: not listed, EPSS 0.00
- Platform/SRE — Plan: GA IaC release with real breaking changes: WinRM provisioner removed, macOS 13 Ventura now minimum, and 1.13.x will be the last series supporting 32-bit CPUs — audit current usage of these before upgrading, and plan the 32-bit migration for the next cycle.
- CI/CD — Plan: If OpenTofu runs inside pipelines (infra provisioning steps), audit for WinRM provisioner usage and verify the base64gzip output change doesn’t break deterministic artifact checks before scheduling the upgrade.
- Leader — Learn: OpenTofu 1.13’s healthy GA cadence (new planning primitives, upcoming linting/policy experiment) reinforces confidence in the Terraform-alternative bet, but there is no licensing, pricing, or vendor-risk development requiring a leadership decision here.
- Signals: OpenTofu 1.13 EOL 2027-08-01 · deprecation mentioned (no explicit date found)
- Platform/SRE — Plan: CVE-2026-17106 allows a crafted tar archive to write outside the extraction directory in the Docker engine — real exposure for any host running Moby/Docker, but not KEV-listed and EPSS is 0.00 with no active exploitation evidence. Schedule an upgrade to v25.0.18 this sprint rather than treating it as an emergency.
- CI/CD — Skip
- Leader — Skip
- Signals: major release (25.0) · CVE-2026-17106 — CISA KEV: not listed, EPSS 0.00
- Platform/SRE — Skip
- CI/CD — Plan: Jenkins 2.580.1 carries a breaking-change flag; review the upgrade guide and schedule a controlled upgrade of your Jenkins controller before the change causes pipeline failures.
- Leader — Skip
- Signals: breaking-change flagged
- Platform/SRE — Plan: Grafana is a common observability-stack component; upgrade to 13.2.3 to remediate CVE-2026-13719, CVE-2026-13720, and CVE-2026-81841 — none are KEV-listed and all carry EPSS 0.00, so this is a scheduled patch, not an emergency.
- CI/CD — Skip
- Leader — Skip
- Signals: CVE-2026-13719 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-13720 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-81841 — CISA KEV: not listed, EPSS 0.00
- Platform/SRE — Plan: Upgrade Grafana to 13.1.7 to remediate CVE-2026-13719, CVE-2026-13720, and CVE-2026-81841; none are KEV-listed and all carry EPSS 0.00, so schedule the patch this sprint rather than treating it as an emergency response.
- CI/CD — Skip
- Leader — Skip
- Signals: CVE-2026-13719 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-13720 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-81841 — CISA KEV: not listed, EPSS 0.00
- Platform/SRE — Plan: CVE-2026-35189 fixes a remote DoS in TLS certificate parsing via BoringSSL; not KEV-listed and EPSS is near-zero, so no evidence of active exploitation — schedule an upgrade to v1.39.2 this sprint rather than treating it as an emergency.
- CI/CD — Skip
- Leader — Skip
- Signals: Envoy 1.39 EOL 2027-07-14 · deprecation mentioned (no explicit date found) · CVE-2026-35189 — CISA KEV: not listed, EPSS 0.00
- Platform/SRE — Plan: Kubernetes v1.34 GA swap support with NVMe backing is worth evaluating for memory-dense node pools this quarter; assess enabling swap on nodes running agentic AI or sandboxed workloads to reduce OOM kills and improve pod density without fleet-wide urgency.
- CI/CD — Learn: The benchmark covers CI/CD kernel build workloads as a validated use case, but enabling swap on nodes is a platform configuration decision — useful context for understanding build pod resource headroom if your CI runs on shared Kubernetes clusters.
- Leader — Plan: Up to 3× pod density on existing hardware is a material FinOps opportunity worth adding to the next infrastructure planning cycle; evaluate whether adopting Kubernetes v1.34 swap + NVMe changes the cost model for memory-intensive AI and build workloads in your standard platform stack.
- Signals: GA announcement
- Platform/SRE — Plan: If you operate AWS Private CA, the new IssueCertificateDetails CloudTrail management event (auto-delivered, no opt-in) enables compliance auditing and failed-issuance alerting that wasn’t possible before; schedule a review of your CloudTrail-based monitoring to add rules for this event, including pre-signing failures and algorithm tracking.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Plan: Copilot model deprecations took effect October 2, 2026, affecting all Copilot experiences including code completions and agent modes; review which models your teams rely on and confirm any workflow or policy updates needed before breakage occurs.
- Signals: deprecation/EOL deadline mentioned: October 2, 2026
- Platform/SRE — Skip
- CI/CD — Plan: CI/CD pipelines can now trigger Copilot code reviews programmatically via API; evaluate integrating into PR automation workflows to enforce review coverage without manual steps.
- Leader — Skip
- Platform/SRE — Learn: Infrastructure automation using GitHub App tokens (e.g., Flux, Argo CD, Terraform GitHub provider) should still work without changes, but teams relying on token introspection or format-specific parsing should verify compatibility with the new stateless format.
- CI/CD — Plan: The rollout is complete, so all newly minted GitHub App installation tokens already use the stateless format; audit any pipeline code or tooling that parses or makes structural assumptions about token format to confirm nothing breaks.
- Leader — Skip
- Platform/SRE — Plan: New GA capability lets teams query ElastiCache Valkey metrics via PromQL in Grafana and CloudWatch, with optional 15-second granularity for catching short-lived latency spikes; schedule enablement of standard OTel metrics now (free) and evaluate detailed monitoring for critical clusters this quarter.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: This new GA feature provides a centralized, API-queryable view of EOL/end-of-support timelines for EKS, RDS, Lambda, and more — directly relevant to managing upgrade schedules before account-specific Planned Lifecycle Events fire. Plan to integrate the AWS Health API into operational runbooks and upgrade planning workflows this quarter, particularly for EKS version tracking.
- CI/CD — Skip
- Leader — Learn: This AWS feature enables proactive version governance across RDS, EKS, Lambda and more, which supports building org-wide upgrade standards and reducing reactive EOL scrambles; no immediate decision required, but worth factoring into platform governance policy discussions.
- Platform/SRE — Plan: Kubernetes 1.37 is now GA on EKS with notable promotions (Metrics API to GA as metrics.k8s.io/v1, DRA device taints to GA). Plan an upgrade evaluation this quarter; no forced-upgrade deadline exists yet, but staying current reduces future skew risk.
- CI/CD — Skip
- Leader — Skip
- Signals: GA announcement
- Platform/SRE — Plan: GA capability that changes how ECS services using VPC Lattice handle progressive delivery — evaluate adopting native traffic-shifting to replace or simplify any existing CodeDeploy or manual canary setups this quarter.
- CI/CD — Plan: Native canary/linear deployment strategies with CloudWatch alarm rollback and lifecycle hooks are worth integrating into ECS deployment pipelines; evaluate replacing custom traffic-shifting logic with this managed approach.
- Leader — Skip