Cloud Build release notes

You can now update access tokens from the Connection details page for your 2nd generation Bitbucket and 2nd generation Gitlab host connections. For more information, see the following:

• Rotate old or expired Bitbucket Cloud access tokens
• Rotate old or expired Bitbucket Data Center access tokens
• Rotate old or expired Bitbucket Server access tokens
• Rotate old or expired GitLab Enterprise Edition access tokens
• Rotate old or expired GitLab access tokens

An Incorrect Authorization vulnerability CVE-2026-19410, in GitHub Trigger Comment Control in Cloud Build, was fixed. No customer action is needed.

For GitLab Enterprise and Bitbucket Data Center connections, Cloud Build now checks permissions on the calling principal.

When you create or update repository connections, Cloud Build uses Secret Manager secrets to authenticate to third-party Git providers. Previously, these referenced secrets were retrieved by the Cloud Build service agent (P4SA) on your behalf, checking permissions only against the P4SA's credentials rather than those of the calling principal. To adhere to the security principle of least privilege, Cloud Build now checks permissions on both the calling principal (using end-user credentials) and the P4SA, to ensure both have the secretmanager.versions.access IAM permission on the referenced secrets.

This check only affects GitLab Enterprise (GLE) and Bitbucket Data Center (BBDC) connections.

For instructions and more details, see the Cloud Build security bulletin.

You can now configure the results field in build config files. This field allows a build step to store data and then attach that data in an attestation within the build results after the build has completed. For more information, see results.

Cloud Build now supports uploading generic artifacts to generic repositories, and also downloading generic repositories as build dependencies. For more information, see genericArtifacts and Specify a generic artifact as a dependency.

Cloud Build now supports uploading OCI images to Artifact Registry during a build process. OCI artifacts for a build are shown in the following locations:

• The Artifacts column of Build history page
• The Execution details tab of the Build details page
• The Build artifacts tab of the Build details page

For more information, see Store an OCI image in Artifact Registry after your build completes and the Cloud Build configuration file schema definition for oci.

The authorization vulnerability CVE-2026-3136 was fixed.

Cloud Build is now available in the asia-southeast3 region.

For more information, see Cloud Build locations.

In build config files, the mavenArtifacts field now supports the deployFolder field. You can use the deployFolder field to upload all Maven files in a folder to a specific Artifact Registry repository. For more information, see Upload all Maven files in a folder to an Artifact Registry repository.

The Service Account User role has been removed from the Cloud Build Permissions page in the Google Cloud Console. Instead, when you enable certain roles on your Cloud Build service account, you can configure your Cloud Build Service account to impersonate the service account of the managed services related to those roles. This configuration lets you deploy builds using managed services while maintaining minimal permissions. For more information, see Configure Cloud Build service account impersonation for managed services.

In addition, the Cloud Build Permissions page in the Google Cloud Console will only show the legacy Cloud Build service account if your organization's policy allows it.

Developer Connect build triggers are now generally available.

You can now create build triggers that build from repositories connected to Developer Connect using the Google Cloud Console, gcloud, the Cloud Build API, and Terraform.

Dark theme is now available for Cloud Build. To enable the dark theme, in the Google Cloud console, click Settings and utilities > Preferences. In the navigation menu, click Appearance, and then select your color theme and click Save.

C3 and N2D machine families are now generally available in private pools. For a complete list of supported machines, see the machineType entry in the private pool configuration file schema.

In addition, the Create private pool and Edit private pool pages now show a monthly estimate based on the pool's machine type configuration. For more information, see View private pool price estimates.

You can now create build triggers that build from repositories connected to Developer Connect.

You can now specify build dependencies in your build configuration file. For more information, see Manage build dependencies.

In the filtering toolbar of the Build history page, you can now filter builds by region. The region drop-down has been removed. For more information, see View build results.

You can now specify, in your build config file, a custom Pub/Sub topic for build notifications. For more information, see Pub/Sub topics for build notifications.

In the filtering toolbar of the Triggers page, you can now filter by trigger repository and region. The region drop-down has been removed. For more information, see Create and manage build triggers.

Cloud Build is now available in the northamerica-south1 region.

For more information, see Cloud Build locations.

You can now map specific build log fields to log entry fields when the build log is sent to Cloud Logging. For more information, see Map build log fields to log entry fields.

You can now use Cloud Build to push Go modules to Artifact Registry. For more information, see Build and test Go applications.

Cloud Build is now available in the africa-south1 region.

For more information, see Cloud Build locations.