DevOps news

Cloudflare released a new tool for defining CI/CD pipelines in TypeScript. It uses serverless workflows to make each step durable, allowing for automatic retries and replays to create more resilient software build processes.

Grafana has released new tools that allow AI coding agents to directly query live system data like metrics and logs. This enables developers to build and debug applications using real-time information, not just static code.

Cloudflare's new Cache Response Rules let you control caching *after* your server responds. This gives developers powerful, fine-grained control to optimize performance and reduce origin server load, all from the Cloudflare dashboard.

HashiCorp's Packer can now automatically generate and sign attestations for every machine image it builds. This gives teams a verifiable, cryptographic record to prove an image's origin and integrity, strengthening software supply chain security.

LaunchDarkly is now available on the Vercel Marketplace, letting developers add powerful feature flags to their projects with a single command. This integration automates setup, speeding up testing and safe feature rollouts for web applications.

Google Cloud launched a new platform that uses AI agents to automate mobile app testing on real devices. This aims to simplify the complex process of ensuring apps work across thousands of different phone models, evolving from Firebase Test Lab.

Google Cloud has launched ClusterNetworkPolicy for its Kubernetes Engine (GKE). The new feature lets platform administrators set cluster-wide security rules that work alongside developer policies, improving security without slowing down individual teams.

A critical TeamCity vulnerability follow-up is a key highlight in recent Java news. The ecosystem also saw a major performance enhancement proposed for a future Java Development Kit (JDK) version, alongside several tool updates.

GitHub has launched Code Quality, a new tool that uses AI to automatically find and suggest fixes for code maintainability problems. It's designed to help development teams manage the growing volume of AI-generated code.

Cloud Native Buildpacks are shifting container security away from individual Dockerfiles to centralized "builders." This allows platform teams to apply security patches across all company applications at once, simplifying and speeding up vulnerability response.

Developers are building custom AI skills locally, creating a massive governance challenge for companies. Enterprises are left struggling to manage a growing, decentralized library of unvetted AI tools and runbooks, creating a new form of 'shadow IT'.

Vercel now allows developers to make their container repositories public. This lets any Vercel user pull and use images, simplifying distribution for open-source projects and public tools, a feature common on other major cloud platforms.

Spotify created an AI coding agent called "Honk" to automatically update its massive codebase. This helps them manage technical debt and standardize code across thousands of repositories, offering a model for large-scale software maintenance.

AWS has launched Dogwood, a new open-source tool for AI agents. It prevents them from taking individually valid actions that become dangerous in sequence, giving developers more control over agent safety and reliability.

GitLab's Secrets Manager now works with Terraform and Kubernetes via the External Secrets Operator. This lets teams stop managing separate secret stores, simplifying workflows and boosting security by having one central place for all credentials.

A new approach for running AI agents on Kubernetes argues that assigning one pod per agent is wasteful. Instead, a shared pool of worker pods can run many agents, saving resources and improving efficiency for AI-native applications.

Vercel has significantly increased the capacity of its Sandbox feature for Pro and Enterprise users. The update allows for 10,000 concurrent sandboxes and a tenfold increase in CPU allocation, enabling more complex, large-scale applications like AI tools.

Vercel's AI Gateway is now on the AWS Marketplace, letting teams buy and manage access to hundreds of AI models directly through their AWS account. This simplifies billing and cost control for companies using multiple AI services.

Microservices expert Chris Richardson explains how to build internal platforms that reduce developer cognitive load. He outlines six key patterns to help teams ship features faster without getting bogged down by infrastructure complexity.

E-Maj, a PostgreSQL extension for database management, released version 5.0.0. It now allows non-superusers to use the tool, significantly improving security by limiting administrator privileges and simplifying automated scripting for developers.

Vercel has launched its Web Application Firewall for Blob storage, available on all plans. This lets developers protect stored files like images and AI media from unwanted traffic, preventing high costs and security risks.

HashiCorp released a public beta of a new Vault feature for Kubernetes. It lets you manage the encryption keys for your cluster's sensitive data outside of Kubernetes itself, adding a powerful new layer of security and compliance.

A new open-source tool called Bor lets IT and security teams centrally manage fleets of Linux desktops. It uses a modern architecture to enforce policies for browsers, package management, and system settings in real time.

HashiCorp's Terraform now has a built-in policy framework called tfpolicy. This lets teams write and enforce infrastructure rules using the same HCL language they already use, simplifying compliance and security without needing extra tools.

AWS Lambda no longer enforces its 75 GB per-region code storage quota for functions stored in your own S3 bucket. This change helps large organizations scale their serverless applications without hitting a previously restrictive account-wide limit.

Dynatrace is upgrading its AIOps platform to move beyond predictions. The new system uses deterministic analysis to pinpoint root causes and automatically resolve infrastructure issues, aiming for truly autonomous IT operations for SRE teams.

The role of software engineers is shifting from writing and fixing code to designing the systems and infrastructure that AI agents will operate within. This change elevates the engineer's role to that of a system architect.

The popular cloud deployment tool Argo CD is getting a major security boost. Its latest update adds features to verify that your code is authentic and to encrypt internal traffic, helping to secure your software supply chain.

A new plugin for the Headlamp Kubernetes UI now supports Volcano, a popular batch scheduler for AI and high-performance computing. This gives developers a simple web interface to inspect and manage complex batch jobs directly within Kubernetes.

HashiCorp's Boundary 1.0 is now production-ready, adding a key feature: RDP session recording. This helps security and IT teams monitor remote desktop access and meet strict compliance and audit requirements.

A new service from PGX offers security patches and bug fixes for old, unsupported versions of PostgreSQL. This helps companies that can't upgrade stay secure and maintain data integrity without a costly migration.

Cloudflare now lets all developers use OAuth for third-party app integrations. This offers a more secure alternative to traditional API tokens, giving users granular control over what data and actions an application can access.

A new GitLab report finds AI code tools are turning developers into validators, not just writers. This shift creates new risks, as teams struggle to control the quality and security of code they didn't write.

Vercel has launched a redesigned trace viewer for its Workflows tool. The update helps developers debug complex processes more quickly by making it easier to search, zoom, and inspect each step of a workflow run.

A post-mortem of Azure's 2023 global outage reveals a crucial lesson: "human error" is a myth. Engineering leaders should instead focus on fixing systemic flaws to build truly resilient systems and protect their teams from blame.

Vercel has launched its own feature flagging tool, built directly into its platform. This gives developers a native way to safely roll out new features and test changes, potentially replacing third-party services like LaunchDarkly.

Vercel now supports WebSockets in its serverless functions, a long-requested feature. This allows developers to build real-time applications like live chats and collaborative tools directly on the platform, paying only for active processing time.

Amazon Cognito now automatically copies user data to a backup region. This means if one AWS region fails, your application can still authenticate users from another, improving reliability and simplifying disaster recovery for developers.

Amazon ECS can now adjust application capacity much faster, thanks to new high-resolution metrics. This allows services to react to traffic spikes in seconds instead of minutes, improving performance and potentially lowering cloud costs.

GitHub now lets open-source maintainers limit pull requests from new contributors. This helps them manage high volumes of submissions and focus on quality contributions instead of getting bogged down by spam or low-effort changes.

The CNCF, Linux Foundation, and Udemy have partnered to offer a unified training and certification path. This makes it much easier for developers to purchase courses and sit for official Kubernetes exams like CKA, CKAD, and CKS.

Elastic 9.4 now offers two ways to build custom integrations. A new no-code tool makes it faster for anyone, while a developer toolkit provides full control for complex needs, simplifying data ingestion from any source.

Vercel now allows its Sandboxes to run for up to 24 hours, a major increase from the previous five-hour limit. This change helps developers run complex, long-running tasks like large data processing and extensive testing.

Docker is retiring its original Content Trust (DCT) feature and the Notary v1 service. This change requires developers and security teams to migrate to modern tools to continue verifying the integrity and publisher of their container images.

The Java ecosystem saw a wave of updates, including progress on Jakarta EE 12 and new releases for GraalVM, Gradle, and Micrometer. These changes bring stability, new features, and performance improvements for developers.

PagerDuty's Chief AI Officer warns that while AI accelerates code delivery, it also increases incidents. Most current AI tools for incident response lack a critical layer of operational context, making them less effective.

An automated attack named Megalodon targeted 5,561 GitHub repositories in a six-hour period. Attackers used throwaway accounts to push malicious commits containing GitHub Actions workflows designed to steal secrets from CI/CD pipelines, such as API keys and other sensitive environment variables.

Enterprise outages rarely start where operations teams first look. The growing complexity of hybrid cloud environments, combined with siloed teams and the recent addition of AI, makes it nearly impossible to observe and understand the true root cause, leading to instability and security risks.

DepsGuard is a new open-source tool that simplifies securing JavaScript projects. It applies recommended security settings, like package cooldowns and disabling install scripts, across multiple package managers (npm, pnpm, yarn, bun, uv) with a single command, addressing common supply chain vulnerabilities.

Filemat is a new open-source, self-hosted web file manager designed for simple setup. Its key feature is filesystem-wide permissions, unlike apps that restrict permissions to a single folder. The tool is currently in beta and the creator is seeking feedback from the developer community on GitHub.

OpenTelemetry (OTel) offers a standard for telemetry data, promising vendor neutrality. However, a recent analysis highlights the complexities behind this promise. While OTel provides a common format, true neutrality is challenging as vendor-specific features can still lead to forms of lock-in.

Redis has released version 8.8, focusing on significant performance enhancements. The update delivers faster execution for core commands like MGET and MSET, improves stream processing, and optimizes memory usage. This release continues Redis's commitment to increasing efficiency on the same hardware with each new version.

Vercel is updating its pricing model for serverless function invocations, shifting from package-based billing to a per-unit system. The change affects Pro and new Enterprise customers and will take effect at the start of their next billing cycle, aligning costs more directly with actual usage.

Customer expectations are now set by digital giants like Google and Netflix. To meet these standards, companies need a unified view across tech, service, and business. Collaborative observability connects system performance directly to customer experience and business outcomes, enabling better, more aligned decision-making across teams.

Ubuntu has released a security update for its Long-Term Support versions to address a vulnerability in the Little CMS color management engine. The flaw could allow an attacker to cause a denial of service or potentially execute arbitrary code using a specially crafted ICC profile.

A denial-of-service vulnerability was found in pip, the Python package manager. The flaw, related to how its urllib3 library handles compressed data, could allow an attacker to crash development environments and CI/CD pipelines by consuming excessive resources. Ubuntu has released a patch to fix the issue.

As teams use AI for more complex coding tasks, the focus is shifting from speed to safety. A new framework called AC/DC helps organizations govern AI coding agents, ensuring code quality, managing risk, and creating a repeatable system for steering, checking, and correcting machine-generated code.

LinkedIn is building a unified platform to manage its AI agents for engineering tasks like coding and UI testing. This approach moves beyond scattered AI tools, creating a scalable system for complex, multi-agent workflows.

CoreWeave's CTO, Peter Salanki, discussed the challenges of running AI in production. He highlighted the growing importance of observability, resource utilization, and scheduling for efficient operations. Salanki also advised teams to avoid the common mistake of over-architecting their systems too early.

A new opinion piece warns that the rush to build AI agents is repeating the mistakes of early software development, where deploying apps was as simple and risky as copying a .exe file.