Google Cloud Release Notes

310 notes from 21 of 29 services · updated

Dialogflow ↗
Feature
gemini-3.5-flash-lite has become generally available (GA). See Generative quotas for how to request quota for Gemini 3 and later models.
Google Kubernetes Engine Main ↗
Change

For GKE Standard CPU node pools, GKE can now upgrade nodes by updating the existing Compute Engine VM in place, instead of deleting the VM and creating a new one. Because the node keeps its underlying VM, it also keeps its compute capacity during the upgrade. This lowers the risk that a node upgrade fails or stalls because resources aren't available.

To enable this type of upgrade, use surge upgrades with the maxUnavailable field set to a value greater than 0. For more details about when GKE reuses the same Compute Engine instance, including exceptions, see maxUnavailable: GKE makes an existing node unavailable to recreate it.

This change applies to all GKE versions. To opt out, contact Cloud Customer Care.

BigQuery ↗
Feature
You can copy tables across regions. This feature is now generally available (GA).
Feature

You can now use column aliases in GoogleSQL. This feature lets you define an alias for an expression in the SELECT clause of a SQL query and immediately reference that alias within the same SELECT list or in the WHERE clause of the same query block.

Column aliases also streamline the migration of workloads from other data warehouses such as Snowflake and Teradata, by supporting their syntax.

This feature is generally available, and is opt-in only. To use column aliases, you must first enable the feature.

Feature
You can export a conversational analytics agent's answer, including text, visualizations, tables, and citations, to a PDF or CSV file. This feature is generally available (GA).
Compute Engine ↗
Feature

Preview: You can create regional disks, including Hyperdisk Balanced High Availability volumes, by cloning a zonal boot disk.

For more information, see Duplicate a disk with clones.

Change
If you try to create an on-demand reservation or increase the number of reserved Compute Engine instances in a reservation when the zone has reached its reservation capacity limit for your requested machine family, then the request fails with a RESERVATION_CAPACITY_LIMIT_EXCEEDED error. For more information, see Reservation capacity limit exceeded.
Feature

Generally available: The storage-optimized Z4M machine series is generally available for Compute Engine. Powered by fifth generation Intel Emerald Rapids Xeon Scalable processors and Titanium offload processors, Z4M instances are purpose-built for workloads that require larger storage capacity, such as:

  • Parallel file systems to support AI/ML workloads
  • I/O intensive workloads such as SQL, NoSQL, and vector databases
  • AI/ML training and inference workloads such as checkpointing and distributed Key-Value (KV) cache

The Z4M machine series delivers up to 1,536 GB of memory and 168,000 GiB of local Titanium SSD capacity. Z4M also supports up to 400 Gbps of network bandwidth using two physical NICs. Z4M instances use Titanium and Cloud RDMA to help enable higher levels of networking performance, isolation, and security.

For more information, see Storage-optimized machine family.

Dataflow ↗
Feature

Dataflow Auto VM Selection now supports 4th generation Compute Engine machine series. When Auto VM Selection is enabled, the service prioritizes these newer generation VMs for improved performance. If 4th generation VMs are unavailable at startup, the service automatically falls back to widely available 2nd generation machine families to ensure that your jobs can start without unnecessary delays.

For more information, see Auto VM Selection.

BigQuery ↗
Feature

The Apache Hive catalog endpoint in the Lakehouse runtime catalog is now generally available (GA). This integration lets you use the metastore as a serverless, central metadata layer, enabling seamless data sharing and unified querying across Apache Spark, Apache Hive, and BigQuery.

For more information, see About the Hive catalog endpoint and Set up Spark and Hive with the Lakehouse runtime catalog.

Feature

Metadata migration from Dataproc Metastore to Lakehouse is now generally available (GA). You can perform a one-time backfill migration or dry run to migrate metadata from a Dataproc Metastore service to an Apache Iceberg REST catalog endpoint or a Hive catalog endpoint using the Google Cloud console, the gcloud CLI, or the REST API.

For more information, see Migrate metadata from Dataproc Metastore to Lakehouse.

Feature
Conversational analytics now lets you create a conversation with all of the data sources in multiple projects, or create a conversation with a dataset. These features are generally available (GA).
Feature
You can publish a BigQuery Conversational Analytics agent in Gemini Enterprise. This feature is now generally available (GA).
Feature
The AI.AGG function now supports the output_schema argument, which lets you specify the schema of the function output as a comma-separated list of fields. This feature is generally available (GA).
Compute Engine ↗
Feature
Generally available: When you reserve capacity by using future reservation requests, you can specify that Compute Engine delivers your reserved capacity as specifically targeted reservations. Specifically targeted reservations help you track and control which Compute Engine instances consume your reserved capacity. For more information, see About future reservation requests.
Feature

Generally available: You can increase the size of a Google Cloud Hyperdisk volume that's in multi-writer mode while the volume is attached to multiple instances. Previously, you had to detach the volume from all instances before you could resize it.

For more information, see Share disks between instances and Change the size or provisioned performance of a Hyperdisk volume.

Google Kubernetes Engine Main ↗
Change

(2026-R44) Version updates

GKE cluster versions have been updated.

New versions available for upgrades and new clusters.

The following versions are now available for new GKE clusters, and for manual control plane upgrades and node upgrades for existing clusters. For more information about versioning and upgrades, see GKE versioning and support and About GKE cluster upgrades.

Rapid channel

Note: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones.
  • Version 1.37.1-gke.1552000 is now the default version for cluster creation in the Rapid channel.
  • The following versions are now available in the Rapid channel:
  • Alpha version 1.38.0-gke.2884000+preview is now available for GKE alpha clusters in the Rapid channel.
  • The following versions are no longer available in the Rapid channel:
    • 1.34.12-gke.1011000
    • 1.35.8-gke.1796000
    • 1.36.4-gke.2046002
    • 1.36.4-gke.2202002 is deprecated in the Rapid channel. This version will be removed in 90 days, or at the end of support, if sooner.
    • 1.36.4-gke.2304000 is deprecated in the Rapid channel. This version will be removed in 90 days, or at the end of support, if sooner.
    • 1.37.0-gke.3503000
  • Alpha version 1.38.0-gke.1002000+preview is no longer available in the Rapid channel.
  • Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release:

Regular channel

Note: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones.

Stable channel

Note: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones.
  • The following versions are now available in the Stable channel:
  • Version 1.34.9-gke.1655001 is deprecated in the Stable channel. This version will be removed in 90 days, or at the end of support, if sooner.
  • Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release:

Extended channel

Note: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones.

No channel (deprecated)

Note: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones.
Security

(2026-R44) Security updates

This release includes new GKE versions that use updated Container-Optimized OS images. These updated images are cumulative, incorporating security fixes from all Container-Optimized OS versions released since the previous GKE release.

To identify the specific vulnerabilities that were resolved in each updated Container-Optimized OS image, see the Security release notes for that image. The following table includes links to the release notes for each updated Container-Optimized OS image:

GKE versionContainer-Optimized OS versionDetails
1.31.14-gke.2963000cos-121-18867-624-8cos-121-18867-624-8 release notes
1.35.8-gke.1975000cos-125-19216-700-23cos-125-19216-700-23 release notes
1.37.1-gke.1697000cos-133-19999-44-85cos-133-19999-44-85 release notes
1.38.0-gke.2884000+previewcos-133-19999-44-85cos-133-19999-44-85 release notes

Fixed

Fixed an issue in GKE Sandbox where Pods using the Cloud Storage FUSE CSI driver could become indefinitely stuck in a Terminating state.

To resolve this issue, upgrade your node pools to GKE version 1.37.1-gke.1552000 or later and add the dev.gvisor.fuse.abort-on-teardown: "true" annotation to your Pod or Deployment metadata.

For more information, see About Cloud Storage FUSE CSI driver for GKE and GKE Known Issues.

Cloud Storage ↗
Feature
Object enrichments is now available in Preview. When you configure object enrichments, Cloud Storage applies Google's pre-trained machine learning models to eligible images and PDF documents in your buckets and attaches the resulting metadata to your objects as object contexts. You can inspect enrichments on individual objects or query them at scale in BigQuery by using Storage Insights datasets. For more information, see About object enrichments and Configure object enrichments.
Feature
Object contexts with extended data are available in Preview. Google services attach these contexts to your objects during automated analysis, such as machine learning labeling. To retrieve a context and its extended data, use the viewFullContext JSON API method.
Feature
Storage Insights datasets include the Object Contexts Catalog view (object_contexts_catalog_view), which you can use to analyze object contexts in BigQuery. For more information, see Object contexts catalog and Analyze object contexts.
Compute Engine ↗
Feature
Generally available: You can query regional views of global Compute Engine project and OS image resources by using the regional read-only projectViews and imageViews endpoints. Querying regional views isolates your control-plane read requests to a specific region, helping your workloads stay available during global API disruptions. For more information, see Use regional views for resilient control-plane reads and Access global resources regionally for high availability.
Managed Service for Apache Airflow ↗
Announcement
A new Managed Service for Apache Airflow release has started on October 13, 2026. Get ready for upcoming changes and features as we roll out the new release to all regions. This release is in progress at the moment. Listed changes and features might not be available in some regions yet.
Feature

Development mode environments and Environment hibernation are now generally available (GA).

You can now create Managed Airflow (Gen 3) environments with Airflow 3 in development mode to test and develop DAGs before publishing them to production. You can hibernate development mode environments when you no longer need them. Hibernation reduces most environment costs to zero.

Feature

Upgrade rollbacks are available in Managed Airflow (Gen 3). You can roll back an environment upgrade if you encounter degraded performance, Airflow bugs, or compatibility issues with your DAGs, plugins, or dependencies.

This feature is gradually rolling out over several releases. In this release, it's available in the following regions: europe-north1, europe-west3, us-east1, and us-west2.

Feature
New Managed Airflow (Gen 3) environments created while the Restrict Endpoint Usage (constraints/gcp.restrictEndpointUsage) organization policy is active now use regional endpoints for services like Cloud Storage, Cloud Logging, Pub/Sub, and Data Lineage.
Feature

(Managed Airflow Gen 3) Added the scheduler loop duration metric:

  • composer.googleapis.com/workload/scheduler/loop_duration: time spent running one Scheduler loop.
Feature

Database retention in Managed Airflow (Gen 3) now includes new Airflow 3 metadata tables, and updated retention logs to report the exact number of removed rows.

This feature is gradually rolling out over several releases. In this release, it's available in the following regions: europe-north1, europe-west3, us-east1, and us-west2.

Fixed

Managed Airflow (Gen 3) environments now report Airflow workloads startup failure logs for issues such as internal quota limits, insufficient capacity, or internal errors (excluding failures related to KubernetesPodOperator or KubernetesExecutor).

This fix is available without an upgrade and will gradually roll out to all Managed Airflow Gen 3 environments. You can upgrade your environment to receive this update immediately.

Fixed
Fixed an issue where a redundant image-version property set in the API request body could sometimes cause a long-running operation to fail.
Fixed
(Managed Airflow Gen 2) Fixed an issue where the airflow-monitoring pod could run out of memory (OOMKilled) when calculating scheduled snapshot metrics in environments with a large number of files in their environment's bucket.
Change
The apache-airflow-providers-google package was upgraded to version 22.6.0. For more information about changes, see the apache-airflow-providers-google changelog.
Deprecated
The following Managed Airflow versions and builds have reached their end of support period: composer-3-airflow-2.9.3-build.35, composer-3-airflow-2.10.5-build.15, composer-3-airflow-2.9.3-build.36, composer-3-airflow-2.10.5-build.16, composer-2.14.3-airflow-2.9.3, composer-2.14.3-airflow-2.10.5, composer-2.14.4-airflow-2.9.3, and composer-2.14.4-airflow-2.10.5.
Change
The apache-airflow-providers-cncf-kubernetes package was upgraded to version 10.23.0. For changes in other packages, see the preinstalled packages changelog.
Change

New images are available in Managed Airflow (Gen 2):

Change

New Airflow builds are available in Managed Airflow (Gen 3):

Cloud DNS ↗
Feature

Outbound Endpoints for Cloud DNS is available in Preview.

Attach Outbound Endpoints to forwarding zones or server policies to enable direct DNS query forwarding from VPC networks to external and on-premises DNS resolvers using private IP addresses. For more information, see Outbound Endpoints overview.

Google Kubernetes Engine Main ↗
Change

(2026-R43) Version updates

GKE cluster versions have been updated.

New versions available for upgrades and new clusters.

The following versions are now available for new GKE clusters, and for manual control plane upgrades and node upgrades for existing clusters. For more information about versioning and upgrades, see GKE versioning and support and About GKE cluster upgrades.

Rapid channel

Note: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones.

Regular channel

Note: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones.
  • Version 1.36.4-gke.1391002 is now the default version for cluster creation in the Regular channel.
  • The following versions are now available in the Regular channel:
  • The following versions are no longer available in the Regular channel:
    • 1.34.11-gke.1056000
    • 1.35.8-gke.1380001 is deprecated in the Regular channel. This version will be removed in 90 days, or at the end of support, if sooner.
    • 1.35.8-gke.1225000
    • 1.36.4-gke.1247000 is deprecated in the Regular channel. This version will be removed in 90 days, or at the end of support, if sooner.
    • 1.36.4-gke.1391000 is deprecated in the Regular channel. This version will be removed in 90 days, or at the end of support, if sooner.
  • Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release:

Stable channel

Note: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones.
  • Version 1.34.11-gke.1056000 is now available in the Stable channel.
  • Version 1.34.11-gke.1044000 is deprecated in the Stable channel. This version will be removed in 90 days, or at the end of support, if sooner.

Extended channel

Note: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones.

No channel (deprecated)

Note: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones.
Security

(2026-R43) Security updates

This release includes new GKE versions that use updated Container-Optimized OS images. These updated images are cumulative, incorporating security fixes from all Container-Optimized OS versions released since the previous GKE release.

To identify the specific vulnerabilities that were resolved in each updated Container-Optimized OS image, see the Security release notes for that image. The following table includes links to the release notes for each updated Container-Optimized OS image:

GKE versionContainer-Optimized OS versionDetails
1.31.14-gke.2925000cos-121-18867-624-2cos-121-18867-624-2 release notes
1.32.13-gke.2662000cos-121-18867-624-2cos-121-18867-624-2 release notes
1.33.13-gke.1915000cos-121-18867-624-2cos-121-18867-624-2 release notes
1.34.12-gke.1153000cos-125-19216-700-7cos-125-19216-700-7 release notes
1.35.8-gke.1919000cos-125-19216-700-7cos-125-19216-700-7 release notes
1.36.4-gke.2202002cos-129-19506-505-8cos-129-19506-505-8 release notes
1.37.1-gke.1552000cos-133-19999-44-85cos-133-19999-44-85 release notes
1.38.0-gke.2743000+previewcos-133-19999-44-85cos-133-19999-44-85 release notes

BigQuery ↗
Feature

BigQuery offers TimesFM 3.0, a built-in time series forecasting model that implements Google Research's open source TimesFM model. You can use TimesFM 3.0 with the following functions:

  • Use AI.FORECAST to perform time series forecasting. In addition to univariate forecasting, you can now perform multivariate forecasting that predicts values for multiple time series based on historical values and additional covariates.
  • Use AI.EVALUATE to perform univariate time series evaluation.
  • Use AI.DETECT_ANOMALIES to perform univariate time series anomaly detection.

Conversational analytics in BigQuery also supports using TimesFM 3.0 with these functions.

To try using the TimesFM 3.0 model for multivariate forecasting with the AI.FORECAST function, see Forecast a single time series with a TimesFM multivariate model and Forecast multiple time series with a TimesFM multivariate model.

The TimesFM 3.0 model is in Preview.

Virtual Private Cloud ↗
Feature

General Availability: VPC Flow Logs supports TCP connection logging for VM instances and serverless endpoints. Connection logging captures outbound TCP connection attempts and acknowledged inbound TCP connections.

You can enable this feature in a VPC Flow Logs configuration for a subnet (through the Network Management API), a VPC network, or an organization.

Feature
Service producers can let service consumers establish more connections to a Private Service Connect endpoint or backend by configuring the target published service (service attachment) to use an additional NAT IP address. For more information, see Maximum connections.
Compute Engine ↗
Feature
Generally available: When you reserve compute resources for H4D instances through your account team, you can include a Hyperdisk pool in the same request or in a subsequent request. This option helps ensure that your high performance computing (HPC) workloads have the storage resources that they require close to your compute instances. For more information, see Reserve capacity through your account team.
Google Kubernetes Engine Main ↗
Issue

Starting with GKE version 1.36, the default engine for kube-dns is CoreDNS. For Pod IP DNS queries in the ..pod.cluster.local format, CoreDNS returns NXDOMAIN if the specified does not exist. The legacy kubernetes/dns implementation skipped checking the existence of the namespace provided in the segment in these queries.

Queries in the ..pod.cluster.local format are not part of the Kubernetes DNS specification. We can't guarantee that uses outside of those specified in the DNS spec will remain consistent across releases.

Mitigation:

  • Recommended: Migrate to supported headless Service DNS records (...svc.cluster.local).
  • Workaround: Ensure the specified in the DNS query exists in the cluster.
Google Kubernetes Engine Main ↗
Deprecated

Starting on July 1, 2026, Identity Service for GKE is deprecated in GKE version 1.36 and earlier. This feature is also unavailable in organizations that were created on or after July 1, 2025. GKE version 1.37 and later don't support Identity Service for GKE. Before you upgrade clusters to 1.37 and later, disable this feature and migrate to Workforce Identity Federation.

For more information, see Identity Service for GKE deprecation.

Google Kubernetes Engine Main ↗
Change

(2026-R42) Version updates

GKE cluster versions have been updated.

New versions available for upgrades and new clusters.

The following versions are now available for new GKE clusters, and for manual control plane upgrades and node upgrades for existing clusters. For more information about versioning and upgrades, see GKE versioning and support and About GKE cluster upgrades.

Rapid channel

Note: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones.
  • Version 1.36.4-gke.1495000 is now the default version for cluster creation in the Rapid channel.
  • The following versions are now available in the Rapid channel:
  • Alpha version 1.38.0-gke.2240000+preview is now available for GKE alpha clusters in the Rapid channel.
  • The following versions are no longer available in the Rapid channel:
    • 1.34.11-gke.1102000
    • 1.35.8-gke.1439000 is deprecated in the Rapid channel. This version will be removed in 90 days, or at the end of support, if sooner.
    • 1.35.8-gke.1626000 is deprecated in the Rapid channel. This version will be removed in 90 days, or at the end of support, if sooner.
    • 1.36.4-gke.1391000
  • Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release:

Regular channel

Note: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones.
  • The following versions are now available in the Regular channel:
  • The following versions are no longer available in the Regular channel:
    • 1.34.11-gke.1044000
    • 1.35.8-gke.1380000 is deprecated in the Regular channel. This version will be removed in 90 days, or at the end of support, if sooner.
    • 1.36.3-gke.1767000 is deprecated in the Regular channel. This version will be removed in 90 days, or at the end of support, if sooner.
  • Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release:

Stable channel

Note: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones.
  • Version 1.35.6-gke.1250001 is now the default version for cluster creation in the Stable channel.
  • The following versions are now available in the Stable channel:
  • The following versions are no longer available in the Stable channel:
    • 1.34.10-gke.1328000 is deprecated in the Stable channel. This version will be removed in 90 days, or at the end of support, if sooner.
    • 1.35.6-gke.1250000
  • Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release:
    • GKE upgrades clusters to the following new minor versions if there are no factors, such as maintenance exclusions or deprecated APIs, preventing upgrades:
    • GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has maintenance exclusions or other factors preventing minor version upgrades:

Extended channel

Note: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones.

No channel (deprecated)

Note: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones.
Security

(2026-R42) Security updates

This release includes new GKE versions that use updated Container-Optimized OS images. These updated images are cumulative, incorporating security fixes from all Container-Optimized OS versions released since the previous GKE release.

To identify the specific vulnerabilities that were resolved in each updated Container-Optimized OS image, see the Security release notes for that image. The following table includes links to the release notes for each updated Container-Optimized OS image:

GKE versionContainer-Optimized OS versionDetails
1.31.14-gke.2825000cos-121-18867-584-32cos-121-18867-584-32 release notes
1.32.13-gke.2567000cos-121-18867-584-32cos-121-18867-584-32 release notes
1.33.13-gke.1815000cos-121-18867-584-32cos-121-18867-584-32 release notes
1.34.12-gke.1011000cos-125-19216-655-40cos-125-19216-655-40 release notes
1.35.8-gke.1796000cos-125-19216-655-40cos-125-19216-655-40 release notes
1.38.0-gke.2240000+previewcos-beta-133-19999-44-28cos-beta-133-19999-44-28 release notes

Issue

In GKE control plane versions 1.36.3-gke.1244000 and later, Cloud Storage FUSE CSI driver (gcsfusecsi-node) DaemonSet Pods fail to start on specific node pools. The Pods crash and log the following error:

MountVolume.SetUp failed for volume "host-proc-sys-fs-fuse" : hostPath type check failed: /proc/sys/fs/fuse is not a directory.

This issue occurs during a version skew when node pools run an older kernel lacking the required host path (earlier than 6.12.67 for Container-Optimized OS, or earlier than 6.13 for Ubuntu). Affected node pool configurations include:

  • All Ubuntu with containerd (ubuntu_containerd) node pools.
  • Container-Optimized OS with containerd (cos_containerd) node pools on GKE versions 1.33 and earlier, 1.34 versions earlier than 1.34.6-gke.1154000, and 1.35 versions earlier than 1.35.3-gke.1389000.

Workaround: For cos_containerd node pools, upgrade the node pool to a version with the required kernel support (for example, 1.34.6-gke.1154000 or later, 1.35.3-gke.1389000 or later, or match the control plane). For ubuntu_containerd node pools, a fix is in progress. Alternatively, downgrade the control plane to a version earlier than 1.36.3-gke.1244000.

BigQuery ↗
Change
An updated version of the Simba JDBC driver for BigQuery is now available.
Feature
Chatting with graphs in conversational analytics is now generally available. You can use a combination of multiple graphs, tables, views, and UDFs as data sources.
Feature
BigQuery pipelines provides support for automated metadata enrichment and Knowledge Catalog data quality scorecard integration. In addition, the Data Engineering Agent can proactively generate semantic metadata for your pipeline assets. For more information, see Metadata enrichment and data quality scorecard integration. These features are generally available.
Compute Engine ↗
Feature

Generally available: Expanded machine series support for sharing the same Hyperdisk volume between instances:

  • C3 bare metal instances support multi-writer mode for Hyperdisk Balanced volumes.
  • C4 instances created after May 1, 2026, support multi-writer mode for Hyperdisk Balanced, Hyperdisk Extreme, and Hyperdisk Balanced High Availability volumes.

For more information, see Sharing a disk between instances.

Pub/Sub ↗
Feature
You can use Gemini Enterprise to generate code for user-defined function (UDF) single-message transforms (SMTs). For more information, see Create a UDF SMT.
BigQuery ↗
Feature
The BigQuery Security center is now available in the Google Cloud console. You can use the Security center to analyze your data security profile, create and manage row- and column-level security policies, and configure and manage data governance and policy tags. This feature is generally available (GA).
Feature
BigQuery jobs explorer layout and filtering improvements, including status counts in the filter bar, resource grouping, and timeline metric charts, are generally available (GA).
Feature

You can now use the OBJ.LIST function to perform spontaneous discovery and analysis of unstructured data. The OBJ.LIST function returns a table of metadata and ObjectRef values for files stored in Cloud Storage, and does not require you to create a persistent object table.

This feature is generally available (GA).

Cloud Storage ↗
Feature
Cloud Storage client libraries now provide automated, end-to-end checksumming by default for object read and write operations to help maintain data integrity from client to storage. For more information, see data validation.
Compute Engine ↗
Feature
Generally available: You can specify a 120-second preemption notice duration while creating Spot VMs. Use this feature for workloads on Spot VMs where you want up to an additional 120 seconds for handling preemption. If you want to migrate existing Spot VMs workloads, make sure you update your workload to handle preemption outside of a shutdown script and test preemption. For more information, see Spot VMs and Create and use Spot VMs.
Dialogflow ↗
Fixed
Dialogflow CX: An issue in Dialogflow CX was identified where sensitive authentication tokens stored in conversational session parameters could be returned in cleartext via DetectIntent API responses. A server-side fix has been applied to redact and sanitize authentication credentials from conversational API outputs. No customer configuration changes or updates are required.
Deprecated
All generative features: gemini-2.5-flash and gemini-2.5-flash-lite models will be deprecated by Dec 23, 2026. Upgrade to newer Gemini models such as gemini-3.1-flash-lite before the deprecation date.
Feature
BidiStreamingAnalyzeContent API has become generally available (GA).
Compute Engine ↗
Announcement

Interface-based versioning (IBV) for the Compute Engine API is now generally available. IBV lets you call a specific, date-based API version so you can adopt API changes on your own schedule.

For more information, see Compute Engine API versioning.

Feature

Generally available: Compute Engine API version 2026-09-01 is now generally available. In this version, aggregatedList methods return partial results by default when a scope is unreachable. The returnPartialSuccess query parameter is no longer available in aggregatedList and list methods.

For more information, see the 2026-09-01 REST reference.

Feature

Preview: Compute Engine API version 2026-10-01-preview is now available in Preview. In this version, the quotas field is no longer available in responses from the projects.get, regions.get, and regions.list methods. To view and manage quota information, use the Cloud Quotas API.

For more information, see the 2026-10-01-preview REST reference.

Feature

Generally available: You can create a standard or archive snapshot of a disk and protect the snapshot with a customer-managed encryption key (CMEK), even if the source disk isn't protected with a CMEK. If the source disk is protected with a CMEK, then you can use a different CMEK to encrypt the new snapshot.

For more information, see Create a CMEK-encrypted snapshot.

Cloud Logging ↗
Deprecated

The legacy Logging agent has officially reached its end of support. All standard maintenance and regular bug fixes for the agent have ceased. We recommend migrating to one of the supported alternatives. For more information about this deprecation, see Legacy Monitoring and Logging agents end of support.

Breaking

Only platform services can write log entries to billing accounts. These logs have names with the format billingAccounts/[BILLING_ACCOUNT_ID]/logs/[LOG_ID]. For more information, see entries.write.

Cloud Run ↗
Feature
Create custom URLs, like example.cloud.run, that are easy to remember and globally available for your Cloud Run services. No DNS configuration, load balancers, or extra costs required (Preview).
Compute Engine ↗
Feature
Allowlisted GA: You can expose the host ID of a Compute Engine instance to verify its physical location in relation to other compute instances in your Google Cloud organization. Use compute instance proximity in a zone to optimize latency-sensitive workloads or improve the reliability of your applications. For more information, see View the physical location of a Compute Engine instance.
Feature

Generally available: The C4D machine series supports Hyperdisk Throughput.

For more information, see About Hyperdisk Throughput and Hyperdisk Throughput performance limits.

Compute Engine ↗
Feature
Generally available: New X5 series with 50% larger memory instances: Breaking the previous 32TB memory limit of the X4 memory-optimized machine type, a new X5 series introduces massive 48TB configurations. This empowers the largest SAP HANA and RISE with SAP customers to easily scale up their mission-critical databases on a single node.
Managed Service for Apache Airflow ↗
Change
(Airflow 3.3.1, 3.2.2, and 2.11.1) The apache-airflow-providers-google package was upgraded to version 22.4.0. For more information about changes, see the apache-airflow-providers-google changelog.
Fixed
Fixed an issue where OpenID Connect (OIDC) ID token audience strings were incorrectly converted to lowercase. The audience field now preserves case-sensitivity. This fixes integration failures with external services that require case-sensitive audience values.
Change
Airflow 2.10.5 is no longer included in new Managed Airflow images and builds
Change

New Airflow builds are available in Managed Airflow (Gen 3):

Change

New images are available in Managed Airflow (Gen 2):

Deprecated
The following Managed Airflow versions and builds have reached their end of support period: composer-3-airflow-2.9.3-build.33, composer-3-airflow-2.10.5-build.13, composer-3-airflow-2.9.3-build.34, composer-3-airflow-2.10.5-build.14, composer-2.14.1-airflow-2.9.3, composer-2.14.1-airflow-2.10.5, composer-2.14.2-airflow-2.9.3, and composer-2.14.2-airflow-2.10.5.
Compute Engine ↗
Feature

Preview: To protect standard snapshots from accidental or malicious deletion, Compute Engine retains deleted snapshots in the recycle bin for three days before permanently erasing the snapshots.

For more information, see Retain deleted resources in the recycle bin.

Cloud Key Management Service ↗
Feature

Preview: Cloud EKM supports external key migration. For keys with the EXTERNAL or EXTERNAL_VPC protection levels, you can create new key versions with either of these protection levels. You can also change the protection level of existing external key versions to change how you access your existing key material with zero downtime and without reconfiguring your applications.

For more information about migrating external keys, see Migrate external keys.

Google Kubernetes Engine Main ↗
Change

(2026-R40) Version updates

GKE cluster versions have been updated.

New versions available for upgrades and new clusters.

The following versions are now available for new GKE clusters, and for manual control plane upgrades and node upgrades for existing clusters. For more information about versioning and upgrades, see GKE versioning and support and About GKE cluster upgrades.

Rapid channel

Note: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones.

Regular channel

Note: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones.
  • Version 1.35.8-gke.1225000 is now the default version for cluster creation in the Regular channel.
  • The following versions are now available in the Regular channel:
  • The following versions are no longer available in the Regular channel:
    • 1.34.10-gke.1328000
    • 1.35.8-gke.1036000
    • 1.36.4-gke.1082000 is deprecated in the Regular channel. This version will be removed in 90 days, or at the end of support, if sooner.
  • Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release:

Stable channel

Note: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones.
  • Version 1.34.10-gke.1328000 is now available in the Stable channel.
  • Version 1.34.10-gke.1236000 is deprecated in the Stable channel. This version will be removed in 90 days, or at the end of support, if sooner.

Extended channel

Note: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones.

No channel (deprecated)

Note: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones.
Security

(2026-R40) Security updates

This release includes new GKE versions that use updated Container-Optimized OS images. These updated images are cumulative, incorporating security fixes from all Container-Optimized OS versions released since the previous GKE release.

To identify the specific vulnerabilities that were resolved in each updated Container-Optimized OS image, see the Security release notes for that image. The following table includes links to the release notes for each updated Container-Optimized OS image:

GKE versionContainer-Optimized OS versionDetails
1.31.14-gke.2759000cos-121-18867-584-7cos-121-18867-584-7 release notes
1.32.13-gke.2504000cos-121-18867-584-7cos-121-18867-584-7 release notes
1.33.13-gke.1721000cos-121-18867-584-7cos-121-18867-584-7 release notes
1.34.11-gke.1209000cos-125-19216-655-12cos-125-19216-655-12 release notes
1.35.8-gke.1626000cos-125-19216-655-12cos-125-19216-655-12 release notes
1.36.4-gke.1495000cos-129-19506-448-20cos-129-19506-448-20 release notes
1.38.0-gke.1002000+previewcos-beta-133-19999-44-28cos-beta-133-19999-44-28 release notes

Compute Engine ↗
Deprecated

As of September 15, 2026, NVIDIA P100 (nvidia-tesla-p100 and nvidia-tesla-p100-vws) GPUs have reached end of support (EOS) and are shut down. You can no longer create, launch, or access Compute Engine instances or other Google Cloud resources that use NVIDIA P100 GPUs.

For information about migrating your workloads to supported GPU alternatives such as the G2 (NVIDIA L4) or G4 (NVIDIA RTX PRO 6000) machine series, see NVIDIA P100 end of support.

Deprecated

NVIDIA T4 (nvidia-tesla-t4 and nvidia-tesla-t4-vws) and NVIDIA P4 (nvidia-tesla-p4 and nvidia-tesla-p4-vws) GPUs are deprecated and will reach end of support (EOS) on August 1, 2027. After August 1, 2027, you won't be able to create, launch, or access Compute Engine instances or other Google Cloud resources that run NVIDIA T4 or P4 GPUs. In addition, you can no longer purchase or renew 3-year committed use discounts (CUDs) for NVIDIA T4 or P4 GPUs.

To transition your workloads to supported GPU models such as the G2 (NVIDIA L4) or G4 (NVIDIA RTX PRO 6000) machine series before the EOS date, see NVIDIA T4 end of support and NVIDIA P4 end of support.

Identity and Access Management ↗
Feature

You can use System for Cross-domain Identity Management (SCIM) data as the source for both user and group claims in the OAuth sign-in workflows for Looker. You can also use Extended Session Length (ESL) when using SCIM.

This feature is in Preview.

For more information, see the following:

Spanner ↗
Feature

Spanner supports automatic parameterization of SQL query literals to improve query performance, reduce latency, and lower CPU costs. Spanner converts literal values hardcoded in CRUD-style queries, such as primary key lookups, index lookups, and primary key joins, into query parameters, allowing execution plans to be cached and reused to reduce latency and CPU costs.

For more information, see Use query parameters and statement hints (GoogleSQL and PostgreSQL).

Compute Engine ↗
Feature

Generally available: The storage-optimized Z4D machine series is generally available for Compute Engine. Powered by AMD EPYC Turin processors and Titanium offload processors, Z4D instances are purpose-built for low core usage and high storage density workloads such as:

  • SQL, NoSQL, and vector databases
  • Data analytics and data warehouses
  • Search
  • Parallel file systems for AI/ML

The Z4D machine series delivers up to 3 TB of memory and 42,000 GiB of local Titanium SSD capacity. Z4D also supports up to 400 Gbps of network bandwidth using two physical NICs. Z4D instances are available in predefined standardlssd and highlssd machine shapes.

For more information, see Storage-optimized machine family.

Google Kubernetes Engine Main ↗
Change

(2026-R39) Version updates

GKE cluster versions have been updated.

New versions available for upgrades and new clusters.

The following versions are now available for new GKE clusters, and for manual control plane upgrades and node upgrades for existing clusters. For more information about versioning and upgrades, see GKE versioning and support and About GKE cluster upgrades.

Rapid channel

Note: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones.

Regular channel

Note: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones.
  • Version 1.35.8-gke.1036000 is now the default version for cluster creation in the Regular channel.
  • The following versions are now available in the Regular channel:
  • The following versions are no longer available in the Regular channel:
    • 1.34.10-gke.1236000
    • 1.35.7-gke.1222000
    • 1.36.3-gke.1640000 is deprecated in the Regular channel. This version will be removed in 90 days, or at the end of support, if sooner.
  • Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release:

Stable channel

Note: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones.
  • Version 1.34.10-gke.1236000 is now available in the Stable channel.
  • Version 1.34.10-gke.1106000 is deprecated in the Stable channel. This version will be removed in 90 days, or at the end of support, if sooner.
  • Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release:

Extended channel

Note: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones.

No channel (deprecated)

Note: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones.
Security

(2026-R39) Security updates

This release includes new GKE versions that use updated Container-Optimized OS images. These updated images are cumulative, incorporating security fixes from all Container-Optimized OS versions released since the previous GKE release.

To identify the specific vulnerabilities that were resolved in each updated Container-Optimized OS image, see the Security release notes for that image. The following table includes links to the release notes for each updated Container-Optimized OS image:

GKE versionContainer-Optimized OS versionDetails
1.37.0-gke.3503000cos-129-19506-299-82cos-129-19506-299-82 release notes

Spanner ↗
Feature
Spanner queues are generally available (GA). Spanner queues provide transactional messaging to help you manage asynchronous work. The feature pairs this capability with the scalability and reliability of Spanner, letting you build event-driven applications. For more information, see the Spanner queues overview.
Filestore ↗
Feature

Small capacity Filestore instances for the Regional service tier are generally available (GA). Small capacity instances start at 100 GiB and scale in 1 GiB increments, providing an option for development, testing, and applications with low traffic or basic storage needs.

For more information, see Small capacity instances.

Feature

Filestore agent volumes provide managed, high-density elastic NFS storage backed by regional volume pools for stateful AI agent sandboxes, autonomous agent fleets, and multi-agent developer environments.

The Filestore agent volumes feature is available to all Google Cloud customers for evaluation and non-production use. To request access for your Google Cloud project, submit the Filestore agent volumes access request form. Production support is offered on an allow list basis under a limited General Availability (GA) program. To check your eligibility or to request production support, use the access form.

For more information, see About Filestore agent volumes.

Identity and Access Management ↗
Feature

The Cloud OAuth API (cloudoauth.googleapis.com) is available in Preview.

The Cloud OAuth API provides dedicated OAuth 2.0 and OpenID Connect (OIDC) token exchange and authentication endpoints for Workforce Identity Federation integrations. Applications can use the Cloud OAuth API to exchange external credentials, authorization codes, or refresh tokens for Google Cloud access tokens, or to retrieve authenticated user profile claims and enterprise group memberships.

For more information, see the following documentation:

Virtual Private Cloud ↗
Feature
General Availability: You can add Dynamic NICs to the same VPC network used by other network interfaces of a Compute Engine instance. For more information, see Multiple network interfaces.
Feature
General Availability: VPC Flow Logs supports logging for App Engine resources that are configured with Direct VPC egress. For more information, see Serverless flows and ServerlessDetails field format.
Feature

General Availability: VPC Flow Logs adds the following metadata annotations for Private Service Connect:

  • src_psc_interface and dest_psc_interface
  • psc.consumer_connection
  • psc.psc_endpoint.name
  • psc.psc_attachment.name

For more information, see Record format.

Compute Engine ↗
Feature

Public preview: Network-optimized C4N machine type with 375 GiB to 12,000 GiB of attached Titanium SSD are now available in Preview. You don't have to request allowlist approval.

For more information, see C4N machine series.

Cloud Logging ↗
Feature
Starting with version 2.71.0, you can use an Ops Agent configuration option to export your metrics, logs, and traces by using the OpenTelemetry-based Telemetry API rather than by using the Cloud Monitoring API, Logging API, or Trace API. For more information, see Use the Telemetry API.
Cloud Monitoring ↗
Feature
Starting with version 2.71.0, you can use an Ops Agent configuration option to export your metrics, logs, and traces by using the OpenTelemetry-based Telemetry API rather than by using the Cloud Monitoring API, Logging API, or Trace API For more information, see Use the Telemetry API.
Secret Manager ↗
Feature

Parameter Manager supports CRC32C checksums to verify data integrity when you add or access parameter versions.

For more information, see Data integrity assurance.

Spanner ↗
Feature

Spanner Graph supports the following enhancements for CREATE PROPERTY GRAPH:

  • Semantic options for labels and properties: You can configure OPTIONS (description and synonyms) on labels and properties to provide context and improve discoverability for natural language querying interfaces.
  • Element key uniqueness validation option: You can configure the validate_element_key_uniqueness option in the property graph OPTIONS clause to control whether Spanner Graph validates element key uniqueness at schema creation time.

For more information, see CREATE PROPERTY GRAPH statement and Disabled key validation.

Google Kubernetes Engine Main ↗
Change

(2026-R38) Version updates

GKE cluster versions have been updated.

New versions available for upgrades and new clusters.

The following versions are now available for new GKE clusters, and for manual control plane upgrades and node upgrades for existing clusters. For more information about versioning and upgrades, see GKE versioning and support and About GKE cluster upgrades.

Rapid channel

Note: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones.

Regular channel

Note: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones.
  • Version 1.35.7-gke.1222000 is now the default version for cluster creation in the Regular channel.
  • The following versions are now available in the Regular channel:
  • The following versions are no longer available in the Regular channel:
    • 1.34.10-gke.1106000
    • 1.35.7-gke.1150000
    • 1.36.3-gke.1537000 is deprecated in the Regular channel. This version will be removed in 90 days, or at the end of support, if sooner.
  • Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release:

Stable channel

Note: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones.
  • Version 1.34.10-gke.1106000 is now available in the Stable channel.
  • Version 1.34.10-gke.1079000 is deprecated in the Stable channel. This version will be removed in 90 days, or at the end of support, if sooner.

Extended channel

Note: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones.
  • Version 1.35.7-gke.1222000 is now the default version for cluster creation in the Extended channel.
  • The following versions are now available in the Extended channel:
  • The following versions are no longer available in the Extended channel:
    • 1.31.14-gke.2667000 is deprecated in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner.
    • 1.32.13-gke.2393000 is deprecated in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner.
    • 1.33.13-gke.1613000 is deprecated in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner.
    • 1.34.10-gke.1106000
    • 1.35.7-gke.1150000
    • 1.36.3-gke.1537000 is deprecated in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner.
  • Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release:

No channel (deprecated)

Note: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones.
Security

(2026-R38) Security updates

This release includes new GKE versions that use updated Container-Optimized OS images. These updated images are cumulative, incorporating security fixes from all Container-Optimized OS versions released since the previous GKE release.

To identify the specific vulnerabilities that were resolved in each updated Container-Optimized OS image, see the Security release notes for that image. The following table includes links to the release notes for each updated Container-Optimized OS image:

GKE versionContainer-Optimized OS versionDetails
1.31.14-gke.2689000cos-117-18613-731-2cos-117-18613-731-2 release notes
1.36.4-gke.1247000cos-129-19506-448-8cos-129-19506-448-8 release notes
1.37.0-gke.3165000cos-129-19506-299-82cos-129-19506-299-82 release notes

Secret Manager ↗
Feature

Parameter Manager supports using tags to group and organize parameters and conditionally manage access control using Identity and Access Management (IAM) policies.

For more information, see Create and manage tags.

Google Kubernetes Engine Main ↗
Announcement

Kubernetes 1.37 is available

Kubernetes 1.37 is now available in the Rapid channel. For more information about the content of Kubernetes 1.37, read the Kubernetes 1.37 Release Notes and Kubernetes 1.37 Release Blog.

Deprecated

Removed in 1.37

Change

Other changes in 1.37

  • Starting with GKE version 1.37.0-gke.2100000, newly created clusters default to using control plane node creation, which improves cluster security by having the control plane manage node registration instead of kubelet self-registration. Existing clusters are not affected. If your workloads require legacy kubelet self-registration, you can opt out during cluster creation by specifying --node-creation-mode=KUBELET. For more information, see Disable control plane node creation.
  • In version 1.37 and later, newly created node pools use an improved formula to calculate the default system reservation for CPU and memory resources on each node. This updated reservation algorithm reduces the system memory reservation by 10% to 15% when compared to the algorithm that's used in version 1.36 and earlier.
  • The updated default reservation algorithm applies only to new node pools that are created on version 1.37 and later. Existing node pools that you upgrade to 1.37 or later from version 1.36 or earlier don't use the updated algorithm.
  • Additionally, any new or existing node pool that runs GKE version 1.37 and later can modify the amount of CPU and memory that's reserved for system workloads in node pools by using the reservedResourcesConfig option in the node system configuration file.
Cloud Storage ↗
Feature

You can use Storage batch operations to do the following:

  • Select objects dynamically across a project by using Common Expression Language (CEL) filters based on metadata in your Storage Insights datasets, without manual CSV manifests or BigQuery export queries.
  • Target objects across up to 1,000 buckets in a single batch job.
  • Transition objects in bulk to different storage classes.
  • Patch object access control lists (ACLs) in bulk to update or remove permissions.
  • Use dry run to validate job configurations across multiple buckets, and create jobs directly from a dry run to process the same validated objects.

For more information, see Storage batch operations overview and Create and manage batch operations jobs.

Spanner ↗
Feature

Spanner supports the following PostgreSQL-dialect database operators:

  • ILIKE (~~*)
  • NOT ILIKE (!~~*)

Spanner supports the following PostgreSQL-dialect database functions:

  • pg.ilike
  • pg.not_ilike

For more information, see Pattern matching operators and Functions.

Google Kubernetes Engine Main ↗
Change

(2026-R37) Version updates

GKE cluster versions have been updated.

New versions available for upgrades and new clusters.

The following versions are now available for new GKE clusters, and for manual control plane upgrades and node upgrades for existing clusters. For more information about versioning and upgrades, see GKE versioning and support and About GKE cluster upgrades.

Rapid channel

Note: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones.

Regular channel

Note: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones.
  • Version 1.35.7-gke.1150000 is now the default version for cluster creation in the Regular channel.
  • The following versions are now available in the Regular channel:
  • The following versions are no longer available in the Regular channel:
    • 1.34.10-gke.1079000
    • 1.35.7-gke.1027000
    • 1.36.2-gke.2064000 is deprecated in the Regular channel. This version will be removed in 90 days, or at the end of support, if sooner.
  • Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release:

Stable channel

Note: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones.
  • Version 1.34.10-gke.1079000 is now available in the Stable channel.
  • Version 1.34.9-gke.1610001 is deprecated in the Stable channel. This version will be removed in 90 days, or at the end of support, if sooner.
  • Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release:
    • GKE upgrades clusters to the following new minor versions if there are no factors, such as maintenance exclusions or deprecated APIs, preventing upgrades:
    • GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has maintenance exclusions or other factors preventing minor version upgrades:

Extended channel

Note: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones.

No channel (deprecated)

Note: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones.
Security

(2026-R37) Security updates

This release includes new GKE versions that use updated Container-Optimized OS images. These updated images are cumulative, incorporating security fixes from all Container-Optimized OS versions released since the previous GKE release.

To identify the specific vulnerabilities that were resolved in each updated Container-Optimized OS image, see the Security release notes for that image. The following table includes links to the release notes for each updated Container-Optimized OS image:

GKE versionContainer-Optimized OS versionDetails
1.31.14-gke.2667000cos-117-18613-675-64cos-117-18613-675-64 release notes
1.32.13-gke.2393000cos-121-18867-584-3cos-121-18867-584-3 release notes
1.35.8-gke.1225000cos-125-19216-532-135cos-125-19216-532-135 release notes
1.36.4-gke.1082000cos-129-19506-299-161cos-129-19506-299-161 release notes
1.37.0-gke.2155000cos-129-19506-299-82cos-129-19506-299-82 release notes

Managed Service for Apache Airflow ↗
Announcement
A new Managed Service for Apache Airflow release has started on September 02, 2026. Get ready for upcoming changes and features as we roll out the new release to all regions. This release is in progress at the moment. Listed changes and features might not be available in some regions yet.
Feature
Managed Airflow (Gen 3) environments now provide Out-of-Memory (OOM) event logs to help troubleshoot and diagnose memory exhaustion.
Change
Improved Airflow task resilience against transient Kubernetes pod connection issues.
Change
Improved Airflow web server update process during environment upgrade operations.
Spanner ↗
Feature

Spanner supports using the TABLESAMPLE operator in PostgreSQL-dialect databases to select a random sample of a dataset.

For more information, see TABLESAMPLE operator.

Cloud Monitoring ↗
Feature
You can opt out of alert notifications from an SMS notification channel by sending a text message to the phone number associated with the notification channel. For more information, see Opt out of SMS notifications.
Google Kubernetes Engine Main ↗
Change

GKE version 1.35.1-gke.1031000 and later include the following changes to automatically created firewall rules for Services:

  • Changes the priority of multiple existing firewall rules for Services from 1000 to 999.
  • Creates additional firewall rules to deny traffic that is not explicitly allowed by other auto-created firewall rules.

If you use custom firewall rules to override GKE firewall rules for Services, these changes might cause unexpected behavior. Before you upgrade your clusters to version 1.35.1-gke.1031000 or later, do the following:

  • If you have custom firewall rules that allow or deny traffic with a priority of 1000, change the priority of those rules to a numerically lower value (such as 999 or lower) to maintain their precedence.
  • Verify that the new auto-created deny rules do not block required traffic for load balancers that use external IP addresses.
Spanner ↗
Feature
Spanner supports creating secondary indexes based on scalar expressions that apply to one or more table columns. Expression indexes eliminate the need to create and maintain a dedicated generated column in your table for indexing purposes. For more information, see Create an index based on a scalar expression.
Virtual Private Cloud ↗
Feature
General Availability: VPC Flow Logs generates log records for dropped traffic. For more information, see Records for dropped traffic.
Feature

General Availability: You can reserve static external IPv6 addresses from bring your own IP addresses (BYOIP) sub-prefixes that are in EXTERNAL_IPV6_FORWARDING_RULE_CREATION mode.

You can assign these addresses to forwarding rules for external passthrough Network Load Balancers and external protocol forwarding. You can also promote ephemeral IPv6 BYOIP addresses that are used by external forwarding rules to reserved static IP addresses.

For more information, see Create external forwarding rules.

Google Kubernetes Engine Main ↗
Change

(2026-R36) Version updates

GKE cluster versions have been updated.

New versions available for upgrades and new clusters.

The following versions are now available for new GKE clusters, and for manual control plane upgrades and node upgrades for existing clusters. For more information about versioning and upgrades, see GKE versioning and support and About GKE cluster upgrades.

Rapid channel

Note: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones.

Regular channel

Note: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones.
  • Version 1.35.7-gke.1027000 is now the default version for cluster creation in the Regular channel.
  • The following versions are now available in the Regular channel:
  • The following versions are no longer available in the Regular channel:
    • 1.34.9-gke.1655001
    • 1.35.6-gke.1710000
  • Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release:

Stable channel

Note: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones.
  • Version 1.34.9-gke.1655001 is now available in the Stable channel.
  • Version 1.34.9-gke.1322001 is deprecated in the Stable channel. This version will be removed in 90 days, or at the end of support, if sooner.
  • Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release:
    • GKE upgrades clusters to the following new minor versions if there are no factors, such as maintenance exclusions or deprecated APIs, preventing upgrades:
    • GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has maintenance exclusions or other factors preventing minor version upgrades:

Extended channel

Note: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones.

No channel (deprecated)

Note: Your clusters might not have these versions available. Rollouts are already in progress when we publish the release notes, and can take multiple days to complete across all Google Cloud zones.
Security

(2026-R36) Security updates

This release includes new GKE versions that use updated Container-Optimized OS images. These updated images are cumulative, incorporating security fixes from all Container-Optimized OS versions released since the previous GKE release.

To identify the specific vulnerabilities that were resolved in each updated Container-Optimized OS image, see the Security release notes for that image. The following table includes links to the release notes for each updated Container-Optimized OS image:

GKE versionContainer-Optimized OS versionDetails
1.31.14-gke.2630000cos-117-18613-675-56cos-117-18613-675-56 release notes
1.34.10-gke.1328000cos-125-19216-532-123cos-125-19216-532-123 release notes
1.35.8-gke.1026000cos-125-19216-532-123cos-125-19216-532-123 release notes
1.37.0-gke.2034000+previewcos-129-19506-299-82cos-129-19506-299-82 release notes

Identity and Access Management ↗
Feature

The Agent Identity auth manager and the Agent Identity APIs (agentidentity.googleapis.com and agentidentitycredentials.googleapis.com) are generally available.

Agent Identity auth manager provides a centralized credentials vault and authentication broker that simplifies outbound tool authentication for 3-legged OAuth, 2-legged OAuth, and API keys. The Agent Identity APIs replace the legacy IAM Connectors API (iamconnectors.googleapis.com) for managing auth providers and agent identities.

For more information, see the following documentation:

Cloud Storage ↗
Feature

Rapid Cache supports prefix-level ingest-on-write filtering, allowing you to selectively ingest objects that match specific prefixes rather than ingesting all objects written to a bucket.

For more information, see Ingesting data on write.

Virtual Private Cloud ↗
Feature
General Availability: You can use Private Service Connect endpoints and backends to access multi-regional service endpoints such as storage.us.rep.googleapis.com.
Cloud Storage ↗
Feature

If you delete your project, buckets that have soft delete enabled are now retained for a limited amount of time before being permanently deleted. If you restore a deleted project during this time period, these buckets are restored to the state that they were in when the project was deleted.

For more information about soft delete and the restoration window, see Soft delete.

Identity and Access Management ↗
Feature
You can use custom constraints with Organization Policy to provide more granular control over specific fields for Agent Identity resources, such as agentidentity.googleapis.com/AuthProvider. For more information, see Use custom organization policies for Agent Identity. This feature is in GA.
Feature

Agent Identity VPC Service Controls (VPC Service Controls) integration is generally available. You can add the Agent Identity API (agentidentity.googleapis.com) and Agent Identity Credentials API (agentidentitycredentials.googleapis.com) to a service perimeter and specify agent identities in ingress and egress rules.

For more information, see Agent Identity overview.

Bigtable ↗
Feature
You can use parameterized views in Bigtable to dynamically filter data ranges for logical views based on application context and mitigate SQL injection risks. This feature is generally available (GA). For more information, see Parameterized views overview.
Feature
You can use the CLUSTER_ATTRIBUTE() filter to restrict continuous materialized view processing to specific clusters. This function lets you isolate views within an instance. This feature is generally available (GA). For more information, see Non-deterministic SQL functions.
Identity and Access Management ↗
Change

The workflow for creating workforce identity pool providers in the Google Cloud console changed. After submitting the initial provider configuration, the console directs you to a centralized page to configure provider attributes, including attribute mappings, attribute conditions, and extra attributes.

For more information, see Manage workforce identity pools and providers.

Secret Manager ↗
Fixed

Parameter Manager enforces the location organization policy (constraints/gcp.resourceLocations) on resources in the global location.

If your organization policy restricts allowed resource locations, you must explicitly allow the global location in the policy. Otherwise, attempts to create global resources fail.

This helps ensure that Parameter Manager consistently applies the location organization policy checks to global resources.

For more information, see Defining resource locations.

Spanner ↗
Feature
For DML statements, Spanner now enforces the 80,000 mutation limit (including indexes) per statement rather than cumulatively across the transaction. This allows a transaction to execute multiple DML statements that collectively exceed the limit, as long as each individual statement remains under it. For the Mutation API, the 80,000 limit applies to all mutations in the commit. All transactions are still subject to the 100 MiB commit size limit.
Bigtable ↗
Libraries

Go

1.52.0 (2026-08-03)

Features

  • bigtable: Add AFE picker (Simple / LeastInFlight / LeastLatency) (#20204) (bcbf714)
  • bigtable: Add ClientConfig.DisableSession to opt out of session backend (#20297) (7ee5e44)
  • bigtable: Add getClientConfigDirectAccessChecker for session pools (#20209) (3b8d30a)
  • bigtable: Add NoOpChannelPrimer for session channel pools (#20208) (d055a8a)
  • bigtable: Add per-AFE sessionList for the two-tier session pool (#20224) (dbf0c3f)
  • bigtable: Add protoRowToRow conversion helper for TableShim (#20257) (1297143)
  • bigtable: Add Session debug surface (observability fields + methods) (#20211) (d8d3e16)
  • bigtable: Add Session lifecycle (Start, Close, ForceClose, readLoop, heartBeatLoop) (#20215) (b9e53c6)
  • bigtable: Add Session struct + state machine (#20117) (09acbb3)
  • bigtable: Add session.Config.EnableDebug to gate sessionz debug state (#20247) (ce74c31)
  • bigtable: Add SessionClient + SessionTable + lazyPool (#20228) (ab2c96c)
  • bigtable: Add SessionPoolImpl (two-tier pool + scaling + debug) (#20225) (683eda8)
  • bigtable: Rename session pool display to -(#20248) (35e146e)
  • bigtable: Route Client.Open()-returned *Table through the Diverter (#20273) (2b81c7d)
  • bigtable: State-based classification for abnormal session close (#20243) (f2905b7)
  • bigtable: TableShim fallback to classic on session UNIMPLEMENTED (#20269) (36540af)
  • bigtable: TTL-on-idle cache for per-resource session.TableAPI (#20263) (00b2a49)
  • bigtable: Wire Diverter on Client and route Open* via TableShim (#20256) (b32fbd7)

Bug Fixes

  • bigtable: AFE picker latency signal — subtract poolWait and compute TransportLatency = wire − backend at source (#20281) (bb8c4d5)
  • bigtable: Guard NewStream OnFinish against grpc-go double-fire (#20295) (b51da29)
  • bigtable: Real per-resource pool teardown on sessionTable.Close + cache close-race gate (#20264) (599aea9)
  • bigtable: Session.durations / session.uptime — set explicit histogram bucket boundaries (#20276) (97eee22)
  • bigtable: SessionTableHandle self-heals across cache eviction (#20296) (0dd98cd)
  • bigtable: Translate ctx errors to gRPC status on session vRPC (#20299) (0f3b2a5)
  • bigtable: Treat PingAndWarm NotFound as a successful prime (#20219) (a1557ad)

Performance Improvements

  • bigtable: Delete periodic Tick loop; sizing is event-driven (#20285) (2c096bd)
  • bigtable: Drop pick_lost_race debug tag from CheckoutSession hot path (#20280) (bd0e400)
Spanner ↗
Feature

Dynamic channel pooling (DCP) for gRPC channels in the Spanner Go and Java client libraries is generally available (GA).

DCP prevents performance issues from under-provisioned or over-provisioned channels and reduces configuration overhead. DCP is disabled by default.

For more information, see Configure the number of sessions and gRPC channels in the pools.

Cloud Key Management Service ↗
Feature

Preview: Cloud KMS supports quantum-safe key import. You can use the following quantum-safe import methods:

  • HPKE_KEM_XWING_HKDF_SHA256_AES_256_GCM
  • HPKE_KEM_ML_KEM_768_HKDF_SHA256_AES_256_GCM
  • HPKE_KEM_ML_KEM_1024_HKDF_SHA256_AES_256_GCM

For more information about quantum-safe key import, see Quantum-safe key import.

Dataflow ↗
Feature
You can now pause a Dataflow batch job using the pause_on_failure service option. This feature lets you preserve the state of your batch pipeline job, address external issues, and resume processing without losing completed work. You can use this option to automatically pause a job on failure, or use this feature to manually pause a job when you chose to. For more information, see Pause a Dataflow job.
Bigtable ↗
Feature
You can use Bigtable as a remote storage backend for LMCache. By storing the large language model (LLM) key-value (KV) cache externally in Bigtable, multiple AI serving instances can share and reuse precomputed attention tensors. This reduces compute overhead and significantly improves time-to-first-token (TTFT) for repeated prompts and shared documents. This feature is in Preview.
Virtual Private Cloud ↗
Feature

General Availability: You can use the Resolve subnet mask setting on a subnet to configure all attached Compute Engine instances with the same netmask as the subnet (instead of /32). Configuring larger instance netmasks lets compute instances discover the MAC addresses of other machines within the same subnet and directly communicate with them by using destination MAC addresses.

For more information, see Compute instance netmasks.

Cloud Key Management Service ↗
Feature

Cloud KMS Autokey with same-project key storage (formerly known as Autokey for delegated key management) is generally available. Autokey with same-project key storage can be used on its own or alongside Autokey with dedicated-project key storage (formerly known as Autokey for centralized key management).

For more information, see Enable Cloud KMS Autokey. To learn how to set guardrails to constrain how Autokey is used in your organization, see Control Autokey usage.

Spanner ↗
Feature
Spanner supports creating tables without defining primary keys. When you create a table without a primary key, Spanner creates a hidden rowid column that serves as the primary key. For more information, see Create a table without defining a primary key.
Bigtable ↗
Feature
The Bigtable remote MCP server supports the Bigtable Data API, which provides the execute_sql tool that you can use to query Bigtable data using natural language prompts. This feature is generally available (GA). For more information, see Use the Bigtable remote MCP server.
Libraries

Go

1.51.0 (2026-07-23)

Features

  • bigtable: Add ChainInterceptors and RetryingVRpc for vRPC pipeline (#20185) (c7a832a)
  • bigtable: Add ClientConfigurationManager (#19986) (3a8f927)
  • bigtable: Add debug tag counter (recordDebugTag / assertDebugTag) (#20114) (3c97590)
  • bigtable: Add lazyPool helper for on-demand session pool opening (#20182) (f6ae3fb)
  • bigtable: Add PeakEwma continuous time-decay latency tracker (#20187) (9d124ef)
  • bigtable: Add PoolSizer for server-driven session pool capacity (#20189) (57ebbeb)
  • bigtable: Add session package with SessionClient + SessionTableAPI interfaces (#20180) (4b82fd2)
  • bigtable: Add Session primitives (AttemptOutcome, vRPC ctx, msgtype) (#20116) (e1011e2)
  • bigtable: Add Session state enum (#19981) (0748972)
  • bigtable: Add SessionThrottler / AdaptiveSessionThrottler for OpenSession pacing (#20184) (02e3c6d)
  • bigtable: Add SessionThrottler / AdaptiveSessionThrottler for OpenSession pacing (#20184) (29be83e)
  • bigtable: Add sessionTracer for per-Session lifecycle + vRPC metrics (#20190) (a466345)
  • bigtable: Enable new auth library and JWT for instance admin client (#20013) (21c4a44)
  • bigtable: Modularize channel priming behind a ChannelPrimer interface (#20027) (5214ab7)
  • bigtable: Modularize Direct Access compatibility check (#19987) (a25e93d)
  • o11y: Regenerate clients for LRO tracing (#20107) (779074e)

Bug Fixes

  • bigtable: Default cluster/zone in toOtelMetricAttrs to avoid Monitoring reject (#20178) (14493f4)
  • bigtable: Eliminate stats-handler MD race in internal/metrics tracer (#20158) (c387066)
Secret Manager ↗
Feature

Automatic rotation of regional Cloud SQL database credentials in Secret Manager is available in Preview. This feature lets you automatically generate secure passwords, update target Cloud SQL database instances (PostgreSQL or SQL Server), and rotate secret versions on a configured schedule without custom Cloud Run functions.

For more information, see Automatic rotation of Cloud SQL secrets.

Virtual Private Cloud ↗
Feature
For Google Cloud resources that are registered as App Hub workloads or services, VPC Flow Logs records contain application-specific labels. For more information, see App Hub labels.
Virtual Private Cloud ↗
Feature

Preview: You can reserve static external IPv6 addresses from bring your own IP addresses (BYOIP) sub-prefixes that are in EXTERNAL_IPV6_FORWARDING_RULE_CREATION mode.

You can assign these addresses to forwarding rules for external passthrough Network Load Balancers and external protocol forwarding. You can also promote ephemeral IPv6 BYOIP addresses that are used by external forwarding rules to reserved static IP addresses.

For more information, see Create external forwarding rules.