Google Cloud release notes

Managed workload identity for backend mTLS is generally available for the following Application Load Balancers:

• Global external Application Load Balancers
• Regional external Application Load Balancers
• Cross-region internal Application Load Balancers
• Regional internal Application Load Balancers

The key benefits are as follows:

• Streamline certificate management: Automated certificate and trust management for backend mTLS through seamless integration with Certificate Authority Service and Certificate Manager.

• Eliminate operational toil: Certificates are automatically rotated based on the workload identity pool's configuration, removing the complexity and manual bottleneck of private key provisioning and maintenance.

• Improve visibility and governance: Gain visibility into communication between distributed services and proactively apply governance to workloads across environments.

For more information, see Backend mTLS with managed workload identity overview

Cloud Scheduler is available in the following location:

• asia-southeast3 (Bangkok, Thailand)

Gemini Enterprise: Support for new actions (Public Preview)

Support for new actions is available in Public Preview for the following data stores:

• Microsoft OneDrive: Copy folder, move file, move folder, rename file, rename folder, share file or folder, and update file properties.
• Microsoft Outlook: Create calendar, RSVP to event, and update calendar.
• Microsoft SharePoint: Create list item, discard check out document, get list fields, get list item, list lists, share resource, update file properties, update list, update list item, and update page.
• Microsoft Teams: Add member to channel, create channel, create chat, create schedule, create time off entry, update channel, update channel message, update chat, update chat message, and update time off entry.

For more information, see Connect a third-party data source.

xAI's Grok 4.6 is generally available

Grok 4.6 is now generally available (GA) and available for production use on the global endpoint and the US multi-region endpoint.

Agent Platform SDK for Python version 2.0.1 is available

Version 2.0.1 of the Agent Platform SDK for Python (google-cloud-agentplatform) is now available. This release migrates generative AI modules to the Google Gen AI SDK, decouples the agent surface from google-cloud-aiplatform into a dedicated package, and introduces restructured namespaces.

For details and migration instructions from google-cloud-aiplatform, see the Agent Platform SDK for Python version 2.0.1 migration guide.

This release addresses the following issues:

• Fixed an issue where session metadata and data feed files were missing from external storage for chats that ended before the first message from the end-user.

• Fixed an issue with Kustomer integrations where the caller's information didn't appear on the Incoming call page of the call adapter for direct-line inbound calls.

• Fixed an issue with inbound mobile calls where the end-user leg of the call failed, returning Unknown error, while the agent leg connected normally.

• Fixed an agent desktop issue where live call and chat data were lost.

• Fixed an issue that occurred when the receiving agent in an agent-to-agent transfer didn't answer the call. The receiving agent was marked as active on the call indefinitely, even after the call ended.

• Fixed an issue where the Dismiss button remained active after an agent sent a message, resulting in a 409 error when clicked.

• Fixed an issue where duplicate "chat finished" events were reported when the end-user left a chat session at nearly the same time that the agent ended the chat session.

• Fixed an issue where deflected calls were missing from the All Call History and Voice Inbound (IVR) History reports.

• Fixed an issue that occurred when a direct inbound call was deflected to the agent's overcapacity queue, then that queue redirected to a SIP URI. The SIP redirect didn't include the custom SIP headers.

• Fixed an issue where an in-queue announcement interval of several minutes for inbound IVR calls was incorrectly reduced to approximately 60 seconds.

• Fixed an issue where calls that agents were unable to answer due to microphone failures were incorrectly reported as "picked up" in the Agent Activity Timeline report.

• Fixed an issue where the system incorrectly marked agents as still being on a call after it ended, which either prevented them from changing their status to Available or silently blocked them from receiving new calls.

• Fixed an issue where processing delays for ended calls caused timeout errors.

• Fixed an issue where a sudden spike in calls bypassed capacity limits, causing agent availability to drop below required minimums.

• Fixed an issue where the Agent Activity Timeline report incorrectly attributed manual agent logins and logouts to System instead of the appropriate agents.

• Fixed an issue where calls with a missed offer became permanently stuck in the queue, preventing them from being routed to other available agents. This occurred with queues configured with multicast fallback disabled.

• Fixed an issue where manual or cascade outbound calls that were canceled before connecting were missing from team-filtered Call History reports.

• Fixed an issue that prevented over-capacity deflection from triggering when an agent warm-transferred an outbound call to a queue.

• Fixed an issue where calls weren't correctly routed to the top-ranked agent when using agent priority overrides.

• Fixed an issue where escalated voice calls were incorrectly reported as both answered and abandoned.

• Fixed an issue where calls were missing from the All Call History and Voice Inbound History reports if the caller hung up before leaving a voicemail.

• Fixed an issue where Salesforce click-to-dial outbound calls were incorrectly associated with the most recent open case instead of the case from which the call was initiated.

• Fixed an issue where email accounts remained disconnected indefinitely after a temporary authentication failure.

• Fixed an issue in Agent Assist where long periods of silence during calls caused connection timeouts, triggering false-positive error alerts.

• Fixed an issue where the arrow-down-icon and arrow-up-icon arrows on the Agents > Filter Settings page were rendered at an incorrect scale.

• Fixed an issue where incoming calls incorrectly created duplicate Salesforce accounts instead of linking to existing accounts.

• Fixed an issue where the outbound call queue list displayed stale information, potentially causing calls to be placed in a queue that didn't match the agent's selected language.

• Fixed an issue where the menus for transferring calls and forwarding calls to voicemail appeared in English instead of the agent's selected language.

• Fixed an issue where the wrap-up disposition panel froze after a network reconnection even though the submission had completed successfully.

• Fixed an issue where outbound, click-to-dial calls initiated in Salesforce incorrectly linked to and reassigned ownership of other cases associated with the same phone number.

• Fixed an issue where the agent adapter went blank and prevented new calls from reaching the agent if an end-user hung up immediately after the agent received the call notification.

• Fixed an issue where calls that failed to connect got stuck in a silent 'connecting' state in the call adapter.

• Fixed an issue where Salesforce CRM connections dropped for organizations enforcing OAuth Refresh Token Rotation.

• Fixed an issue where part of an agent's audio was dropped from recordings when a virtual task assistant ran in the middle of a call.

• Fixed a web SDK issue where menus in the pre-chat and chat screens didn't comply with WAI-ARIA keyboard navigation standards.

• Fixed a web SDK issue where screen readers couldn't identify the purpose of the Text size options for the chat screen.

Advanced reporting dashboards 6.4

We've released version 6.4 of the advanced reporting dashboards.

Real-time Agent Monitoring dashboard: new Active call ID(s) column

The Real-time Agent Monitoring dashboard now has an Active Call ID(s) column in the Live Agent Data table. The column displays the call ID(s) for any call in a connecting, connected, or reconnecting state for the agent. If an agent is handling multiple concurrent calls, the call IDs appear in a comma-separated list. The Active Call ID(s) column reduces the number of steps required for supervisors to identify active calls during live monitoring.

Improved filtering by team

We made the following changes to team-based filtering:

• Renamed the Teams filter to Agent Teams to clarify that it filters by the agent team handling the interactions. This change is in the Real-time Queue Monitoring - Calls, Real-time Queue Monitoring - Chats, Real-time Connected - Calls, and Real-time Connected - Chats dashboards. For more information, see Queue monitoring dashboards, Real-time Connected - Calls dashboard, and Real-time Connected - Chats dashboard.

• Added a Queue Teams filter to the Real-time Queued - Calls and Real-time Queued - Chats dashboards. This lets you filter queued interactions by the team assigned to the queue.

Improved the Real-time Calls and Real-time Chats dashboards

We made the following dashboard improvements:

• Real-time Calls - Calls Connected dashboard. Added the following columns to the Connected Calls table:

  • Total Consumer Talk Time. Total time since the call first connected to a virtual agent or a human agent.

  • Total Hold Time. Total time the call has spent on hold so far, including a hold currently in progress.

• Real-time Chats - Chats Connected dashboard. Added the following column to the Connected Chats table:

  • Total Consumer Chat Time. Total time since the chat first connected to a virtual agent or a human agent.

Real-time Calls - Calls Queued dashboard: new Projecting column

The Real-time Calls - Calls Queued dashboard has a new Projecting column in the Call Queued table. Indicates whether the routing engine (deltacast) is currently projecting this queued call to an available agent.

Advanced reporting available in French Canadian

All advanced reporting dashboards and Explores are now available in French Canadian. When you select French Canadian as your profile language in the CCAI Platform portal, these dashboards and Explores display in that language.

Administrators: There's a new Français (CAN) option when you click Admin > Change Language in the CCAI Platform portal.

This release addresses the following issues:

• Fixed an issue where the formatting of numeric values was inconsistent across tiles.

• Fixed an issue where column headers, filter labels, and tile titles didn't immediately switch to a newly selected language.

• Fixed an issue where the Productive Agents column in the tables of the Queue Group Performance - All dashboard didn't display values appropriate to the queue group settings.

• Fixed an issue in the Call Queue Metrics (Historical) Explore where filtering by Agent Name without including it as a visible column resulted in zero rows being returned.

• Fixed an issue that affected calls to a sub-menu that were deflected using Custom After Hours Deflection to a message. These calls were incorrectly attributed to the parent menu in the All Queued Interactions report.

• Fixed the effectiveness of the Direction filter in the following dashboards:

  • Agent Performance. The Agent Productivity Detailed – Calls and Agent Productivity Detailed – Chats tables correctly reflect the filter setting.

  • Real-time Agent Monitoring. The Agent Performance table and historical metrics tiles correctly reflect the filter setting.

  • All Interactions – Calls and All Interactions – Chats. The IVR Interactions (calls only) and Virtual Agent Interactions tables correctly reflect the filter setting.

• Fixed an issue with the Queue Performance - Calls dashboard when short abandons were present in the specified date range. The Avg Queue Time column in the Queue Summary table incorrectly displayed the raw sum of queue durations instead of a true average.

• Fixed an issue where team filters didn't apply correctly when generating the Individual Call History Report and the Individual Chat History Report. This resulted in the inclusion of data from unmanaged queues.

• Fixed an issue where French Canadian translations for several dashboard metrics and labels were incorrect, incomplete, or missing.

• Fixed the following issues with the Real-time Calls - Calls Queued dashboard:

  • The Total Queued Now metric didn't include callers who were returned to the queue after an automated-answer detection miss.

  • The Current Max Queue Wait Time (H:M:S) and Current Avg Queue Wait Time (H:M:S) metrics mistakenly measured from a caller's original entry into the queue, rather than from their most recent return to the queue.

• Fixed an issue where a gray bar appeared at the bottom of the advanced reporting dashboards, preventing a full view of the dashboards.

The basic token-based authentication feature is generally available.

Filter version v4 is available and set as the default for the Latest alias. Filter version v3 is promoted to the Stable alias in all supported regions except the following:

• In asia-northeast3, v1 remains the Stable version.
• In australia-southeast2, v3 becomes the Stable version on September 25, 2026.

If your templates use the Stable alias, they automatically upgrade to v3 when v3 becomes Stable in that region.

Filter versions v1 (except in asia-northeast3, and starting September 25, 2026 in australia-southeast2) and v2 transition to Legacy status and retire on December 17, 2026. If your templates are explicitly configured with v1 or v2 in regions where those versions are in Legacy status, you must migrate them to v3 or the Stable alias before December 17, 2026.

For more information, see Version release timeline and Model Armor filter version history.

v1.16.10

On September 17, 2026 we released an updated version of the Apigee hybrid software, v1.16.10.

• For information on upgrading, see Upgrading Apigee hybrid to version v1.16.10.
• For information on new installations, see The big picture.

Fixed in this release

Kubernetes 1.36 support

Apigee hybrid v1.16.10 adds support for Kubernetes 1.36 on Google Kubernetes Engine (GKE), Google Distributed Cloud Virtual for VMware (vSphere), Google Distributed Cloud Virtual for bare metal, Amazon EKS, Azure AKS, and Rancher Kubernetes Engine (RKE2).

For more information, see Supported platforms.

Forward proxy support for AI policies

Apigee hybrid v1.16.10 adds forward proxy support for AI policies, such as the Model Armor and semantic caching policies. Outbound calls from these policies can now be routed through an HTTP forward proxy.

For more information, see Configure a forward proxy, Get started with the Model Armor policies, and Get started with semantic caching policies.

You can add unit tests to pipelines to validate your SQL transformation logic against mock datasets. Unit tests for pipelines are generally available (GA).

The following resource type is publicly available through the ExportAssets, ListAssets, BatchGetAssetsHistory, QueryAssets, and Feed APIs.

• Cloud TPU API
  • tpu.googleapis.com/QueuedResource

Cloud SQL for MySQL now automatically enables point-in-time recovery (PITR) in a separate, asynchronous operation after disaster recovery (DR) switchover and replica failover operations complete. Because PITR enablement no longer blocks switchover and replica failover, these operations complete faster, helping you reduce your recovery time.

For more information, see Use advanced disaster recovery (DR).

Cloud SQL for PostgreSQL now automatically enables point-in-time recovery (PITR) in a separate, asynchronous operation after disaster recovery (DR) switchover and replica failover operations complete. Because PITR enablement no longer blocks switchover and replica failover, these operations complete faster, helping you reduce your recovery time.

For more information, see Use advanced disaster recovery (DR).

Generally available: The storage-optimized Z4D machine series is generally available for Compute Engine. Powered by AMD EPYC Turin processors and Titanium offload processors, Z4D instances are purpose-built for low core usage and high storage density workloads such as:

• SQL, NoSQL, and vector databases
• Data analytics and data warehouses
• Search
• Parallel file systems for AI/ML

The Z4D machine series delivers up to 3 TB of memory and 42,000 GiB of local Titanium SSD capacity. Z4D also supports up to 400 Gbps of network bandwidth using two physical NICs. Z4D instances are available in predefined standardlssd and highlssd machine shapes.

For more information, see Storage-optimized machine family.

cos-beta-133-19999-44-44

cos-129-19506-448-36

Fixed CVE-2026-56391 in sys-apps/coreutils.

Fixed CVE-2026-56391 in sys-apps/coreutils.

Fixed CVE-2026-58470 in net-misc/wget.

Fixed CVE-2026-80590 in the Linux kernel.

Fixed CVE-2026-59890 in dev-python/setuptools.

Fixed CVE-2026-80737 in the Linux kernel.

Upgraded net-libs/nghttp2 to 1.69.0 and fixed CVE-2026-58055.

Fixed CVE-2026-80788 in the Linux kernel.

Fixed CVE-2026-80789 in the Linux kernel.

Fixed CVE-2026-80791 in the Linux kernel.

Fixed CVE-2026-80792 in the Linux kernel.

Fixed CVE-2026-80793 in the Linux kernel.

Fixed CVE-2026-80805 in the Linux kernel.

Fixed CVE-2026-80806 in the Linux kernel.

Fixed CVE-2026-80808 in the Linux kernel.

Fixed CVE-2026-80837 in the Linux kernel.

Fixed CVE-2026-80838 in the Linux kernel.

Fixed CVE-2026-80839 in the Linux kernel.

Fixed CVE-2026-80842 in the Linux kernel.

Fixed CVE-2026-80843 in the Linux kernel.

Fixed CVE-2026-80845 in the Linux kernel.

Fixed CVE-2026-80852 in the Linux kernel.

Fixed CVE-2026-80854 in the Linux kernel.

Fixed CVE-2026-80855 in the Linux kernel.

Fixed CVE-2026-80856 in the Linux kernel.

Fixed CVE-2026-80862 in the Linux kernel.

Fixed CVE-2026-80916 in the Linux kernel.

Fixed CVE-2026-80917 in the Linux kernel.

cos-125-19216-655-28

Fixed a performance issue in the GVE driver on multi-NUMA systems.

Upgraded net-libs/libnftnl to v1.2.9.

Fixed CVE-2026-80590 in the Linux kernel.

Fixed CVE-2026-80737 in the Linux kernel.

Fixed CVE-2026-80788 in the Linux kernel.

Fixed CVE-2026-80789 in the Linux kernel.

Fixed CVE-2026-80791 in the Linux kernel.

Fixed CVE-2026-80792 in the Linux kernel.

Fixed CVE-2026-80793 in the Linux kernel.

Fixed CVE-2026-80805 in the Linux kernel.

Fixed CVE-2026-80806 in the Linux kernel.

Fixed CVE-2026-80808 in the Linux kernel.

Fixed CVE-2026-80837 in the Linux kernel.

Fixed CVE-2026-80838 in the Linux kernel.

Fixed CVE-2026-80839 in the Linux kernel.

Fixed CVE-2026-80842 in the Linux kernel.

Fixed CVE-2026-80843 in the Linux kernel.

Fixed CVE-2026-80845 in the Linux kernel.

Fixed CVE-2026-80852 in the Linux kernel.

Fixed CVE-2026-80854 in the Linux kernel.

Fixed CVE-2026-80855 in the Linux kernel.

Fixed CVE-2026-80856 in the Linux kernel.

Fixed CVE-2026-80862 in the Linux kernel.

Fixed CVE-2026-80916 in the Linux kernel.

Fixed CVE-2026-80917 in the Linux kernel.

Runtime sysctl changes:

• Changed: net.ipv4.udp_mem: 188034 250714 376068 -> 188034 250715 376068

cos-117-18613-731-21

Fixed CVE-2026-80590 in the Linux kernel.

Fixed CVE-2026-80737 in the Linux kernel.

Fixed CVE-2026-80788 in the Linux kernel.

Fixed CVE-2026-80789 in the Linux kernel.

Fixed CVE-2026-80791 in the Linux kernel.

Fixed CVE-2026-80792 in the Linux kernel.

Fixed CVE-2026-80793 in the Linux kernel.

Fixed CVE-2026-80805 in the Linux kernel.

Fixed CVE-2026-80806 in the Linux kernel.

Fixed CVE-2026-80808 in the Linux kernel.

Fixed CVE-2026-80842 in the Linux kernel.

Fixed CVE-2026-80843 in the Linux kernel.

Fixed CVE-2026-80852 in the Linux kernel.

Fixed CVE-2026-80854 in the Linux kernel.

Fixed CVE-2026-80855 in the Linux kernel.

Fixed CVE-2026-80856 in the Linux kernel.

Fixed CVE-2026-80916 in the Linux kernel.

Fixed CVE-2026-80917 in the Linux kernel.

cos-121-18867-584-23

Fixed CVE-2026-80590 in the Linux kernel.

Fixed CVE-2026-80737 in the Linux kernel.

Fixed CVE-2026-80788 in the Linux kernel.

Fixed CVE-2026-80789 in the Linux kernel.

Fixed CVE-2026-80791 in the Linux kernel.

Fixed CVE-2026-80792 in the Linux kernel.

Fixed CVE-2026-80793 in the Linux kernel.

Fixed CVE-2026-80805 in the Linux kernel.

Fixed CVE-2026-80806 in the Linux kernel.

Fixed CVE-2026-80808 in the Linux kernel.

Fixed CVE-2026-80842 in the Linux kernel.

Fixed CVE-2026-80843 in the Linux kernel.

Fixed CVE-2026-80852 in the Linux kernel.

Fixed CVE-2026-80854 in the Linux kernel.

Fixed CVE-2026-80855 in the Linux kernel.

Fixed CVE-2026-80856 in the Linux kernel.

Fixed CVE-2026-80917 in the Linux kernel.

You can use unit tests to test Dataform actions against mock data with an expected result set. Dataform unit tests are generally available (GA).

Gemini Enterprise: Gemini Code Assist availability update for subscriptions

If you're getting a new Gemini Enterprise Standard or Plus subscription or renewing an existing subscription online, the subscription no longer includes access to Gemini Code Assist features. Existing subscriptions that include Gemini Code Assist features can still access the features until the end of their subscription term.

Instead of Gemini Code Assist, you can use Antigravity for IDEs with AI developer tools. For more information, see AI developer tools overview.

If you're still looking to use Gemini Code Assist with your Gemini Enterprise licenses, you can obtain a new Gemini Enterprise subscription that includes Gemini Code Assist by contacting Google Cloud sales.

Gemini Enterprise: Voice input for the chat box

You can speak your queries and prompts to Gemini Enterprise. Use the microphone button to record your voice, review and edit the transcribed text, and then submit the text.

This feature is generally available (GA). To make voice input available to users, a Gemini Enterprise administrator must turn on the Enable speech-to-text toggle in the Google Cloud console.

For more information, see the following:

• Manage web app features
• Chat with the assistant

Gemini Omni Flash supports stateful and streaming video generation (Preview)

Gemini Omni Flash supports stateful (store: true) and server-sent event (SSE) streaming (stream: true) video generation in the Interactions API in Preview. You can temporarily store generated videos and interaction state on the server, stream status updates and final outputs over an SSE connection, or retrieve completed asynchronous interactions using unary or streaming GET requests.

For more information, see Generate videos from text.

Cloud Armor managed rulesets protect your backend services and APIs from a wide range of web application threats using threat signatures which are automatically kept up-to-date. For more information, see Managed rules overview. This feature is available in Preview.

Google Distributed Cloud (software only) for VMware 1.34.900-gke.135 is now available for download. To upgrade, see Upgrade a cluster. Google Distributed Cloud 1.34.900-gke.135 runs on Kubernetes v1.34.7-gke.200.

If you use a third-party storage vendor, check the listing of our previously-qualified storage partners.

After a release, it takes approximately 7 to 14 days for the version to become available for use with GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

The following issues were fixed in 1.34.900-gke.135:

• Fixed vulnerabilities listed in Vulnerability fixes.
• Fixed an issue where user clusters repeatedly alternated between Reconciling and Running states if the management cluster configured a different pod density than the user cluster.
• Updated etcd to v3.5.33-0-gke.3 to address security vulnerabilities CVE-2026-46595 and CVE-2026-39821.
• Fixed an issue where gkectl diagnose and preflight validations failed to locate PersistentVolume datastores for user clusters deployed in a separate vSphere datacenter from the admin cluster (cpNodesInAdminDatacenter: true).
• Fixed an issue where deleting a cluster could get stuck because the node pool controller attempted to recreate machine resources while deletion was in progress.

Google Distributed Cloud (software only) for bare metal 1.34.900-gke.135 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.34.900-gke.135 runs on Kubernetes v1.34.7-gke.200.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the listing of our previously-qualified storage partners.

The following issues were fixed in 1.34.900-gke.135:

• Fixed vulnerabilities listed in Vulnerability fixes.
• Fixed an issue where the status for Ingress resources was not updated when using bundled Ingress.
• Fixed an issue where user clusters repeatedly alternated between reconciling and running states if the management cluster had a different pod density configuration than the user cluster.
• Updated etcd to v3.5.33-0-gke.3 to address security vulnerabilities CVE-2026-46595 and CVE-2026-39821.
• Fixed an issue where deleting a cluster could get stuck because the node pool controller attempted to recreate machine resources while cluster deletion was in progress.

(2026-R39) Version updates

GKE cluster versions have been updated.

New versions available for upgrades and new clusters.

The following versions are now available for new GKE clusters, and for manual control plane upgrades and node upgrades for existing clusters. For more information about versioning and upgrades, see GKE versioning and support and About GKE cluster upgrades.

(2026-R39) Security updates

This release includes new GKE versions that use updated Container-Optimized OS images. These updated images are cumulative, incorporating security fixes from all Container-Optimized OS versions released since the previous GKE release.

To identify the specific vulnerabilities that were resolved in each updated Container-Optimized OS image, see the Security release notes for that image. The following table includes links to the release notes for each updated Container-Optimized OS image:

(2026-R39) Version updates

• Version 1.34.10-gke.1236000 is now available in the Stable channel.
• Version 1.34.10-gke.1106000 is deprecated in the Stable channel. This version will be removed in 90 days, or at the end of support, if sooner.
• Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release:
  • GKE upgrades clusters to the following new minor versions if there are no factors, such as maintenance exclusions or deprecated APIs, preventing upgrades:
    • 1.34 to 1.35.6-gke.1250000

(2026-R39) Version updates

• Version 1.35.8-gke.1036000 is now the default version for cluster creation in the Regular channel.
• The following versions are now available in the Regular channel:
  • 1.34.11-gke.1044000
  • 1.35.8-gke.1225000
  • 1.36.4-gke.1082000
• The following versions are no longer available in the Regular channel:
  • 1.34.10-gke.1236000
  • 1.35.7-gke.1222000
  • 1.36.3-gke.1640000 is deprecated in the Regular channel. This version will be removed in 90 days, or at the end of support, if sooner.
• Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release:
  • GKE upgrades clusters to the following new minor versions if there are no factors, such as maintenance exclusions or deprecated APIs, preventing upgrades:
    • 1.33 to 1.34.10-gke.1328000
    • 1.34 to 1.35.8-gke.1036000
  • GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has maintenance exclusions or other factors preventing minor version upgrades:
    • 1.34 to 1.34.10-gke.1328000
    • 1.35 to 1.35.8-gke.1036000
    • 1.36 to 1.36.3-gke.1767000

(2026-R39) Version updates

• Version 1.36.4-gke.1247000 is now the default version for cluster creation in the Rapid channel.
• The following versions are now available in the Rapid channel:
  • 1.34.11-gke.1102000
  • 1.35.8-gke.1439000
  • 1.36.4-gke.1391000
  • 1.37.0-gke.3503000
• The following versions are no longer available in the Rapid channel:
  • 1.34.11-gke.1044000
  • 1.35.8-gke.1225000
  • 1.36.4-gke.1082000
  • 1.37.0-gke.2941000
• Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release:
  • GKE upgrades clusters to the following new minor versions if there are no factors, such as maintenance exclusions or deprecated APIs, preventing upgrades:
    • 1.33 to 1.34.11-gke.1056000
    • 1.34 to 1.35.8-gke.1380000
    • 1.35 to 1.36.4-gke.1247000
  • GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has maintenance exclusions or other factors preventing minor version upgrades:
    • 1.34 to 1.34.11-gke.1056000
    • 1.35 to 1.35.8-gke.1380000
    • 1.36 to 1.36.4-gke.1247000
    • 1.37 to 1.37.0-gke.3165000

(2026-R39) Version updates

• Version 1.35.8-gke.1036000 is now the default version for cluster creation.
• The following versions are now available:
  • 1.34.11-gke.1102000
  • 1.35.8-gke.1439000
  • 1.36.4-gke.1391000
• The following node versions are now available:
  • 1.31.14-gke.2704000
  • 1.32.13-gke.2427000
  • 1.33.13-gke.1647000
  • 1.34.11-gke.1102000
  • 1.35.8-gke.1439000
  • 1.36.4-gke.1391000
• The following versions are no longer available:
  • 1.34.10-gke.1106000 is deprecated. This version will be removed in 90 days, or at the end of support, if sooner.
  • 1.35.7-gke.1150000 is deprecated. This version will be removed in 90 days, or at the end of support, if sooner.
  • 1.36.3-gke.1640000 is deprecated. This version will be removed in 90 days, or at the end of support, if sooner.
• Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release:
  • GKE upgrades clusters to the following new minor versions if there are no factors, such as maintenance exclusions or deprecated APIs, preventing upgrades:
    • 1.33 to 1.34.10-gke.1328000
    • 1.34 to 1.35.6-gke.1250000
  • GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has maintenance exclusions or other factors preventing minor version upgrades:
    • 1.34 to 1.34.10-gke.1328000
    • 1.35 to 1.35.6-gke.1250000
    • 1.36 to 1.36.3-gke.1767000

(2026-R39) Version updates

• Version 1.35.8-gke.1036000 is now the default version for cluster creation in the Extended channel.
• The following versions are now available in the Extended channel:
  • 1.31.14-gke.2630000
  • 1.31.14-gke.2667000
  • 1.31.14-gke.2704000
  • 1.32.13-gke.2337000
  • 1.32.13-gke.2393000
  • 1.32.13-gke.2427000
  • 1.33.13-gke.1547000
  • 1.33.13-gke.1613000
  • 1.33.13-gke.1647000
  • 1.34.11-gke.1044000
  • 1.35.8-gke.1225000
  • 1.36.4-gke.1082000
• The following versions are no longer available in the Extended channel:
  • 1.31.14-gke.2579000 is deprecated in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner.
  • 1.31.14-gke.2613000 is deprecated in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner.
  • 1.31.14-gke.2689000 is deprecated in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner.
  • 1.32.13-gke.2268000 is deprecated in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner.
  • 1.32.13-gke.2314000 is deprecated in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner.
  • 1.32.13-gke.2411000 is deprecated in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner.
  • 1.33.13-gke.1329000 is deprecated in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner.
  • 1.33.13-gke.1499000 is deprecated in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner.
  • 1.33.13-gke.1636000 is deprecated in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner.
  • 1.34.10-gke.1236000
  • 1.35.7-gke.1222000
  • 1.36.3-gke.1640000 is deprecated in the Extended channel. This version will be removed in 90 days, or at the end of support, if sooner.
• Clusters in this channel running the listed minor version have new general auto-upgrade targets. GKE can upgrade control planes and nodes to the following new versions with this release:
  • GKE upgrades clusters to the following new minor versions if there are no factors, such as maintenance exclusions or deprecated APIs, preventing upgrades:
    • 1.30 to 1.31.14-gke.2630000
    • 1.31 to 1.32.13-gke.2337000
  • GKE upgrades clusters to the following new patch versions if no minor version upgrade is available, or if the cluster has maintenance exclusions or other factors preventing minor version upgrades:
    • 1.31 to 1.31.14-gke.2630000
    • 1.32 to 1.32.13-gke.2337000
    • 1.33 to 1.33.13-gke.1547000
    • 1.34 to 1.34.10-gke.1328000
    • 1.35 to 1.35.8-gke.1036000
    • 1.36 to 1.36.3-gke.1767000

Looker 26.18 will roll out to Looker (original) instances on the following schedule:

• Expected deployment start: Monday, September 21, 2026
• Expected final deployment and download available: Sunday, October 4, 2026

Looker 26.18 is expected to include the following changes, features, and fixes.

An issue has been fixed where custom content theme fonts were improperly applied to the Look edit mode bar. This feature now performs as expected.

An issue has been fixed where downloading a dashboard as a CSV or ZIP file could result in a 500 error if any dashboard elements lacked an explicit title. This feature now performs as expected.

An issue has been fixed where links created using the LookML link parameter could return a 500 error if no label was specified. This feature now performs as expected.

An issue has been fixed where dashboard filter token chips didn't display an active highlighted background when a filter value was selected. This feature now performs as expected.

An issue has been fixed where the Git connection test could fail to recognize Git credentials as sufficient if a branch protection rule on the Git provider restricted temporary branches. This feature now performs as expected.

An issue has been fixed where analytic models that referenced cross-database, schema-qualified, or dot-delimited table names failed to compile in BigQuery and Snowflake DDL generation. This feature now performs as expected.

An issue has been fixed where custom tooltips in Single Record visualizations appeared at the bottom of the Explore panel rather than directly beneath the selected row. This feature now performs as expected.

An issue has been fixed where dashboard filter tokens and popover menus could fail to inherit fonts from custom themes. This feature now performs as expected.

An issue has been fixed where dragging series between Y-axes on pivoted Cartesian charts could cause the Explore page to crash or prevent visualization configurations from being saved. This feature now performs as expected.

An issue has been fixed in Explores where you couldn't scroll within the Chart Config Editor dialog when editing JSON visualization configurations. This feature now performs as expected.

An issue has been fixed where scheduled PDF deliveries to Cloud Storage could produce corrupted files and unexpectedly replace spaces in filenames with underscores. This feature now performs as expected.

An issue has been fixed where attempting to visualize pivoted query results in SQL Runner resulted in a TypeError configuration error. This feature now performs as expected.

API requests that target a LookML project whose files or directories aren't found on the instance now return a 404 Not Found error instead of a 500 Internal Server Error.

In Conversational Analytics, the Open in Explore button and sidebar exploration links are now hidden or disabled with explanatory tooltips when you lack explore permissions for the underlying model.

The embed preload page now supports custom theming using the theme URL query parameter.

Donut Multiples visualizations now automatically hide overlapping value labels.

An issue has been fixed in self-service analytics where CSV and Excel uploads to BigQuery and Snowflake could fail or corrupt data when files contained multiline headers, leading numeric characters, UTF-8 BOM markers, or special characters. This feature now performs as expected.

An issue has been fixed where creating a shared branch based on the production branch in a bare repository project could initialize from stale remote commits, causing the Looker IDE to immediately report the branch as being behind production. This feature now performs as expected.

An issue has been fixed where scheduled deliveries intermittently failed with permission errors such as Cannot send all results because user permissions were incorrectly cached across scheduled jobs on worker threads. This feature now performs as expected.

Organization Policy Service custom constraints are available for Google Cloud NetApp Volumes. You can use custom constraints to control how NetApp Volumes is used in your organization. For example, you can restrict storage pool or volume capacity, or enforce that storage pools are created only with Premium or Extreme service levels.

For more information, see Custom organization policy constraints.

For Exadata Database Service, Oracle Database@Google Cloud is available in europe-west12 (Turin, Italy) region.

For a list of supported locations, see Supported regions and zones.

Spanner queues are generally available (GA). Spanner queues provide transactional messaging to help you manage asynchronous work. The feature pairs this capability with the scalability and reliability of Spanner, letting you build event-driven applications. For more information, see the Spanner queues overview.

You can now use auto-protection policies and resource labels to automatically protect Compute Engine instances and Persistent Disks at scale in Backup and DR. This feature allows you to automatically assign a backup plan to qualifying resources across projects based on user-defined labels. This feature is in Preview. For more information, see Automate resource protection.

You can use the migration lineage service to visualize the data flow and connections in your source database and help you plan a BigQuery data warehouse migration. This feature is in Preview.

You must designate a project to manage Cloud Number Registry before you can set up Cloud Number Registry for an organization.

Datastream now supports MongoDB extended JSON canonical mode as the default format for new streams from MongoDB sources to BigQuery destinations.

Canonical mode provides higher data fidelity by explicitly labeling every BSON type to prevent precision loss during data exchange.

For more information, see the following:

• Stream data from MongoDB databases
• MongoDB data types in BigQuery

Small capacity Filestore instances for the Regional service tier are generally available (GA). Small capacity instances start at 100 GiB and scale in 1 GiB increments, providing an option for development, testing, and applications with low traffic or basic storage needs.

For more information, see Small capacity instances.

CodeMender updates (v0.8.0)

This release introduces updates to CodeMender:

• Gemini 3.8 Flash default: Gemini 3.8 Flash (gemini-3.8-flash) is now supported and enabled as the default model for CodeMender CLI sessions, delivering faster inference and improved reasoning. A one-time notice in the CLI informs users when the new default is active.
• Tool payload guardrails: Introduced safe output limits for file reading (2 MiB) and codebase grep search (512 KiB) with centered match context windows, eliminating payload overflow errors and improving stability during large repository scans.
• Bug fixes:
  • Fixed an issue where shell detection and command execution on Windows could fail during repository resets and exploit verification when Git Bash was installed in standard registry or non-PATH locations.
  • Fixed an issue in cm verify where verified findings could report "not found" or fail to persist confidence and status upon session completion or resumption.
  • Fixed syntax errors in generated verification scripts caused by invalid regex escaping in grep assertions during cm verify.
  • Prevented HTTP 409 lease conflict errors during long-running sessions by ensuring streaming HTTP connections are promptly released.

For more information, see CodeMender documentation.

Secure Source Manager webhooks now support Pull request comment trigger events. You can configure webhooks to trigger notifications whenever a comment is added, edited, or deleted on a pull request.

For more information, see the Pull request comment event payload in the Webhooks overview.

You can use the following MCP server endpoints to enable LLM agents to perform investigative and management tasks in Security Command Center.

• Security Command Center
• Security Command Center Management

This feature is in Preview.

General Availability: You can add Dynamic NICs to the same VPC network used by other network interfaces of a Compute Engine instance. For more information, see Multiple network interfaces.

General Availability: VPC Flow Logs supports logging for App Engine resources that are configured with Direct VPC egress. For more information, see Serverless flows and ServerlessDetails field format.

General Availability: VPC Flow Logs adds the following metadata annotations for Private Service Connect:

• src_psc_interface and dest_psc_interface
• psc.consumer_connection
• psc.psc_endpoint.name
• psc.psc_attachment.name

For more information, see Record format.

Artifact Registry support for managing Conda packages with Artifact Registry repositories is in Preview. For more information, see Get started with Conda packages.

A workaround has been added for the known issue that jobs might fail when specifying Compute Engine (or custom) VM OS images with outdated kernels.

For the July 2026 data release (published mid-September 2026), we have upgraded the carbon model to version 17 and implemented the following updates:

Updating Scope 1 & 3 Emissions from Google's Corporate Footprint

• Allocation factor refresh: Updated Scope 1 and Scope 3 allocation factors using company-wide data from the 2026 Google Environmental Report.
• Methodology application: For details on how corporate Scope 1 and Scope 3 emissions are distributed across cloud products and services, refer to the non-electricity emission sources section of the methodology documentation.

Updating Inputs for Scope 2 Market-Based Emissions Calculations

• Updated annual renewable electricity allocation percentages in accordance with the 2026 Google Environmental Report.
• Refreshed background annual emissions factors using updated government data sources across Scope 1, Scope 2, and Scope 3. Note that Scope 2 location-based emissions continue to be calculated using hourly greenhouse gas emission factors. Learn more in the Scope 2 market-based allocation documentation.
• Incorporated marketplace purchases of Granular Certificates (Type B certificates / T-EACs) covering a significant portion of electricity load across carbon-intensive regions.
• Granular certificate purchases represent market-based accounting allocations. Customers seeking to minimize emissions are encouraged to prioritize regions with high Carbon Free Energy (CFE) scores for new workloads.

Regional Accounting & Boundary Updates

• Aligned European clean energy matching boundaries with updated RE100 criteria.
• Corrected country mapping configurations in annual emission factor scripts to resolve historical data discrepancies across select Asian market regions (e.g., asia-east2, asia-northeast3).

To correct your July emissions data, schedule a manual data backfill for the month.

The following resource type is publicly available through the ExportAssets, ListAssets, BatchGetAssetsHistory, QueryAssets, and Feed APIs.

• Network Management API
  • networkmanagement.googleapis.com/VpcFlowLogsConfig

Public preview: Network-optimized C4N machine type with 375 GiB to 12,000 GiB of attached Titanium SSD are now available in Preview. You don't have to request allowlist approval.

For more information, see C4N machine series.

A new Confidential Space image (260800) is available. Support for Confidential Space on H100 GPU (a3-highgpu-1g machine family) with Intel Trust Authority (ITA) attestation is generally available.

Reinforcement learning fine-tuning in the Google Cloud console (Preview)

You can create, monitor, and test reinforcement learning fine-tuning jobs for Gemini models in the Google Cloud console (Preview). From the Models > Tuning page, you can configure Python code or model-based reward functions, test reward logic against sample prompts before launching a job, track training and evaluation metrics in real time, and test tuned checkpoints in Agent Studio.

For more information, see Quick start: Reinforcement learning fine-tuning using the console.

Mobile SDKs 2.16.2

We've released version 2.16.2 of the mobile SDKs.

Chat check-in for the Mobile SDKs

Chat check-in is now available for the mobile SDKs. Chat check-in ensures that end-users are present and ready to engage before the system connects them to a human agent. This decreases the average agent handle time by eliminating the time lost when agents wait for end-users who have abandoned a chat.

For more information, see:

• Chat check-in

• SDK configuration (Android)

• Chat check-in after-hours options (iOS)

New "is typing" indicator in the Mobile SDKs

The mobile SDKs now display an "is typing" indicator to the end-user when an agent is typing.

We've addressed the following issues.

Android and iOS SDKs:

• Fixed an issue that occurred after force-closing a mobile app while the check-in timeout dialog was displayed. When the app was relaunched, the check-in dialog didn't reappear.

• Fixed an issue where mobile inbound calls didn't connect.

iOS SDK only:

• Fixed an issue where end-users received duplicate end-of-chat notifications when a virtual agent ended a conversation.

• Fixed an issue where a virtual agent's final message appeared out of order during a chat escalation.

• Fixed an issue where apps didn't upload logs when the server returned a relative URL.

Android SDK only:

• Fixed an issue where a five-second delay occurred between session creation and the initial chat fetch, significantly delaying when the message appeared.

Google Distributed Cloud (software only) for VMware 1.33.1200-gke.83 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud 1.33.1200-gke.83 runs on Kubernetes v1.33.11-gke.100.

If you use a third-party storage vendor, check the listing of our previously-qualified storage partners.

After a release, it takes approximately 7 to 14 days for the version to become available for use with GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

The following issues were fixed in 1.33.1200-gke.83:

• Fixed vulnerabilities listed in Vulnerability fixes.

Google Distributed Cloud (software only) for bare metal 1.33.1200-gke.83 is now available for download. To upgrade, see Upgrade clusters. Google Distributed Cloud for bare metal 1.33.1200-gke.83 runs on Kubernetes v1.33.11-gke.100.

After a release, it takes approximately 7 to 14 days for the version to become available for installations or upgrades with the GKE On-Prem API clients: the Google Cloud console, the gcloud CLI, and Terraform.

If you use a third-party storage vendor, check the listing of our previously-qualified storage partners.