Loading...

Skip to main content

AppDev

Weekly, source-backed updates for application development on Google Cloud — anything in scope for the domain — plus notable moves across the wider industry. Newest first.

Week of Oct 12 – Oct 18, 2026​

What changed in Google Cloud​

  • Budget spend caps that pause Cloud Run workloads are now generally available, after a preview that started on July 27, 2026; like all Cloud Billing spend caps, they are limited to first-party (direct) billing accounts, not reseller billing accounts. — Cloud Run release notes, Oct 12; spend cap docs
  • From October 15, 2026, Application Integration enforces fixes for IAM, run-as service accounts and iam.serviceAccounts.actAs checks, so testing and new integrations need the correct permissions. — Application Integration release notes, Oct 12
  • Apigee Edge for Private Cloud 4.54.00 is a long-term support release with breaking changes: Java 8 is replaced by Java 17 and 21, the Classic UI and apigee-sso are removed, the UI port moves from 9000 to 3001, and Message Processors on Java 21 no longer allow static RSA key-exchange cipher suites. — Google Cloud release notes, Oct 15
  • Apigee hybrid v1.16.11 fixes a server-side request forgery vulnerability in the SemanticCacheLookup policy, fixes LLMTokenQuota ignoring operation-level quotas, and patches CVEs across its components. — Apigee hybrid release notes, Oct 14
  • Cloud Build lets you choose a release channel for a build config or private pool, which controls how often the underlying Debian and Docker versions are updated. — Cloud Build release notes, Oct 12

Industry​

  • Commentary: Next.js v16.4.1 and v15.5.28 fix two Critical unauthenticated remote code execution vulnerabilities, in use cache functions and in Image Optimization with SVG, plus a High denial of service in Server Actions, so teams on the 16.4 and 15.5 lines should upgrade now. — Next.js blog, Oct 14

Week of Oct 4 – Oct 11, 2026​

What changed in Google Cloud​

  • SSH into Cloud Run services and instances, for an interactive shell on running instances, is in preview. — Cloud Run release notes, Oct 7
  • The MCP Toolbox Java SDK reached version 1.0, adding a transport abstraction, pluggable credential providers, and server-side bound parameters that are hidden from the model. — Google Cloud blog, Oct 7
  • The App Optimize API now has a remote MCP server, in preview. — App Optimize API release notes, Oct 7
  • Apigee hybrid v1.14.9 fixes JWKS key-rotation and tracing bugs, blocks Message Processor outbound requests to *.svc.cluster.local hostnames, and patches CVEs across its components. — Apigee hybrid release notes, Oct 7

Industry​

  • Commentary: Next.js will publish an out-of-band security update on October 14, 2026 for two Critical and one High vulnerability in upstream dependencies, so teams running Next.js should plan a patch window. — Next.js blog, Oct 8

Week of Sep 27 – Oct 3, 2026​

What changed in Google Cloud​

  • Cloud Run now generally supports specifying custom target CPU or concurrency utilization through scaling controls. — Cloud Run release notes, Sep 29
  • API Gateway added public preview support for streaming requests and responses instead of buffering them, across HTTP/2, HTTP/1.1 chunked transfer encoding, Server-Sent Events, WebSockets, and gRPC. — API Gateway release notes, Sep 29
  • Apigee hybrid 1.17.1 added support for connecting a runtime to an external Cassandra datastore running in a separate Kubernetes cluster, decoupling the runtime from the data layer. — Apigee hybrid release notes, Sep 30
  • Cloud Tasks now generally supports setting retry parameters per task, creating a batch of tasks, and deleting a batch of tasks from a queue. — Cloud Tasks release notes, Sep 30

Industry​

  • Commentary: Next.js shipped its September 2026 security release (v16.3.8 and v15.5.27), fixing seven vulnerabilities including a high-severity server-side request forgery in Image Optimization plus several cache-poisoning and information-disclosure issues, so any team running self-hosted Next.js should patch promptly. — Next.js security release, Sep 30

Week of Sep 20 – Sep 26, 2026​

What changed in Google Cloud​

  • Apigee hybrid 1.15.8 fixed security issues in JWT refresh token revocation handling, HTTP target 103 Early Hints response handling, and the JavaCallout policy, and added an optional RejectDuplicateKeys setting to the JSONThreatProtection policy. — Apigee release notes, Sep 24

Week of Sep 14 – Sep 20, 2026​

What changed in Google Cloud​

  • Apigee hybrid 1.16.10 adds support for Kubernetes 1.36 across GKE, Google Distributed Cloud Virtual for VMware and bare metal, Amazon EKS, Azure AKS, and Rancher Kubernetes Engine. — Apigee hybrid release notes, Sep 17

Week of Sep 6 – Sep 12, 2026​

What changed in Google Cloud​

  • Cloud Run jobs can now delay execution by up to 12 hours, in preview, to defer non-urgent tasks and qualify for reduced pricing. — Cloud Run release notes, Sep 8
  • You can now configure API Gateway to act as a remote Model Context Protocol server, in public preview, exposing existing REST APIs to AI agents as tools without changing backend services. — API Gateway release notes, Sep 11
  • Apigee's SemanticCacheLookup policy now supports additional Vertex AI Vector Search distance measures, dot product, cosine, squared L2, and L1, through a new DistanceMeasureType element. — Apigee release notes, Sep 9
  • A bug that made Apigee's SemanticCacheLookup policy incompatible with Vertex AI Vector Search Private Service Connect endpoints was fixed. — Apigee release notes, Sep 10

Industry​

  • Commentary: Kubernetes v1.37 introduced Scheduler Preemption for In-Place Pod Resize as an alpha feature, letting kube-scheduler preempt lower-priority pods to free node capacity for pending higher-priority in-place resize requests, worth watching for teams relying on in-place vertical scaling on GKE. — Kubernetes blog, Sep 10