Skip to main content

Release 2026.38.0

· 13 min read
meshcloud

Release period: 2026-09-09 to 2026-09-16

This release includes the following issues:

  • Clearer Error Message for Building Block Definition Text Length
  • Bulk Upgrade Building Blocks Without Triggering a Run
  • Published Building Block Definitions No Longer Offer to Remove Input Conditions
  • Read and Filter the Status of a User via the API
  • Improved Project Deletion Across Workspaces
  • A Building Block Now Tells You When meshStack Could Not Start Its Run
  • Deleted Building Blocks No Longer Listed as Dependencies in Workspace Overview
  • Removal of OSB Sensitive Services
  • Removal of Expiring OSB Service Bindings
  • Preview the Building Block Control Plane in your workspace
  • Preview Your Building Block Inputs While You Create a Definition
  • Optional Tag Inputs Let a Building Block Run Without the Tag
  • Building Block Runs No Longer Report Hidden Conditional Inputs as Missing
  • Sign In URL outputs are rejected on workspace-level Building Block Definitions
  • Workspace Deletion Now Checks for Owned Building Block Definitions
  • Building Block Definition Overview Links Owners by Workspace Identifier
  • AWS CloudFormation StackSets Support Removed
  • Purge a Building Block Whose Dependents Are Already Being Purged
  • Google Cloud Deployment Manager Support Removed
  • Removal of OSB Service Instance Sharing
  • Removal of OSB Tenant Bindings
  • Short Interruptions No Longer Leave a Building Block Run or Notification Stuck
  • Who Can Read a Project Is Now Decided the Same Way Everywhere

Ticket Details​

Clearer Error Message for Building Block Definition Text Length​

Audience: User

Description​

When you save a Building Block definition whose text exceeds the length meshStack stores, you now receive an error that names the field and the limit. Previously the save failed with a cryptic internal error, which gave you nothing to go on. This covers a definition's display name, support URL and documentation URL, an input's display name, description, validation regex and validation error message, and an output's key and display name.

The definition editor now names the limit below the field as you type it. Previously it stopped accepting characters at the limit without saying why, and silently shortened a text you pasted.

Bulk Upgrade Building Blocks Without Triggering a Run​

Audience: User

Description​

When you bulk upgrade building blocks to a newer definition version, you can now decide whether the upgraded building blocks run afterwards. Until now every bulk upgrade started a run for every upgraded building block, even when the new version only added a dropdown option or tightened an input validation and nothing had to be provisioned. This saves runs on large fleets and spares sensitive building blocks, such as networking blocks, a run they do not need.

Published Building Block Definitions No Longer Offer to Remove Input Conditions​

Audience: User

Description​

When you open a published version of a building block definition, its inputs are read-only. The "Remove Condition" and "Remove Validation" buttons on an input stayed clickable anyway. They are now disabled together with the rest of the inputs form, so a published version can no longer look editable. To change a condition or a validation, create a new draft version as before.

Read and Filter the Status of a User via the API​

Audience: User

Description​

The meshUser v2 meshObject API now tells you whether a user is active or deactivated, when the deactivation happened, and when the user last signed in. You can also list only the users in a given lifecycle state, so finding everyone your identity provider has deactivated is a single request. This helps you review deactivated and dormant users and clean them up, which matters when your identity provider deactivates users without ever deleting them.

Requesting a single deactivated user by username now returns that user as well. Previously we reported it as not found, so you could not read the details of a user you had just found in the list.

Improved Project Deletion Across Workspaces​

Audience: User

Description​

We improved project deletion across workspaces. Delete actions are no longer offered when the required permissions are missing. Administrators with wider access continue to work as before.

A Building Block Now Tells You When meshStack Could Not Start Its Run​

Audience: User

Description​

When meshStack cannot resolve a building block's configuration, it cannot start a run for it. The building block used to say nothing about that and simply stayed pending. It now shows the reason, asks you to review its errors, and sends you a failure e-mail.

This is rare. It needs a draft version of a building block definition to change in a way the building blocks already created from it can no longer satisfy. A released version cannot change like that, so building blocks built on one were never affected.

How to use​

The reason names what meshStack could not resolve and what you can do about it. It disappears as soon as meshStack can resolve the building block again.

Deleted Building Blocks No Longer Listed as Dependencies in Workspace Overview​

Audience: User

Description​

When you deleted a Building Block that depended on another Building Block, the Workspace Overview kept showing it as a "Child" of that other Building Block. The deleted Building Block now disappears from the dependency badges as soon as its deletion has completed, so the overview only shows the dependencies that still exist.

Removal of OSB Sensitive Services​

Audience: User, Operator

Description​

OSB Sensitive Services, deprecated since 01.04.2025, have been removed. This feature allowed a service broker author to request that meshStack offers a binding credential only for immediate download, without persisting it. This feature has been replaced with Building Blocks, which offer easy ways to store secrets in dedicated secret management systems.

Removal of Expiring OSB Service Bindings​

Audience: User, Operator

Description​

Expiring OSB Tenant Bindings, deprecated since 01.04.2025, have been removed from meshStack. This feature allowed service broker authors to enforce binding credential rotation. This feature has been replaced with Building Blocks, which can enforce similar credential rotation pattern by combining OpenTofu resource replacement triggers and meshStack's automated drift detection and remediation feature.

Preview the Building Block Control Plane in your workspace​

Audience: User

Description​

Building Blocks in your workspace can now be opened in the same tabbed Control Plane that platform teams use, with an Overview of the latest run and its live log, and Settings for inputs and outputs. It replaces the single long detail page, and you can switch back to that page at any time while the preview runs. The preview is optional until 2026-11-03, after which the new view becomes the only one.

Preview Your Building Block Inputs While You Create a Definition​

Audience: User

Description​

The Configuration Preview is now available in the Inputs step of the Building Block Definition creation wizard, not only when you edit an existing definition. You can see what a workspace user will see when ordering your Building Block, and fix confusing labels, wrong default values or a broken display name before you create the definition at all.

Optional Tag Inputs Let a Building Block Run Without the Tag​

Audience: User

Description​

A building block input sourced from a tag no longer has to hold the building block back. Mark the input as optional and the building block runs even when the tag holds no value, so your implementation can fall back to the default it declares in its own code.

Until now every tag input was mandatory. If the tag was unset on the workspace, project, payment method or landing zone the building block reads it from, the run never started and the building block sat there waiting. That made a tag input unusable for anything your tag schema does not require people to fill in.

We also made the wait visible. A tag input you leave mandatory now reports "Waiting for Operator" instead of "Waiting for Dependency", so you can see that someone has to set a tag rather than hunt for a building block dependency that does not exist. The building block's inputs now name the tag each one reads and the object it is read from, and say whether that tag holds a value today. Until now they showed an empty text box that looked like an input nobody had filled in.

Building Block Runs No Longer Report Hidden Conditional Inputs as Missing​

Audience: User

Description​

A building block run showed the warning "This run is missing values for the following inputs" for inputs whose condition was not met. Such an input does not apply to the run and is left unset on purpose, so the warning was wrong. The run details and the approval banner now list only inputs that actually apply and still have no value.

Sign In URL outputs are rejected on workspace-level Building Block Definitions​

Audience: User

Description​

A Sign In URL output only takes effect on tenant-level Building Block Definitions, where it becomes the sign-in URL of the tenant. Workspace-level definitions silently ignored it. meshStack now rejects a Sign In URL output on a workspace-level definition with a clear error, both in meshPanel and in the meshObject API, and meshPanel no longer offers the option for workspace-level definitions.

How to use​

If one of your workspace-level Building Block Definitions already has an output with assignment type Sign In URL, change it to None the next time you edit the outputs of that version, whether in meshPanel, via the meshObject API or with the Terraform provider. The value keeps round-tripping as a regular output.

Workspace Deletion Now Checks for Owned Building Block Definitions​

Audience: User

Description​

A workspace can no longer be deleted while it still owns building block definitions. Previously such definitions were left behind without an owner. The workspace deletion dialog now lists the owned definitions with their number of building blocks and links to the definitions overview, so you can delete them or transfer their ownership to another workspace before deleting the workspace. The same check applies to workspace deletion via the meshObject API.

Audience: User

Description​

In the admin Building Block Definitions overview, the "Owned By" column now shows the owning workspace's identifier and links to the Workspaces overview filtered by that identifier, so you land on exactly one workspace instead of a name search. The "Owning Workspace" filter accepts either the workspace name or its identifier.

AWS CloudFormation StackSets Support Removed​

Audience: User

Description​

As previously announced, we have removed the deprecated AWS CloudFormation StackSets support from meshStack. AWS Landing Zones no longer offer the AccessStack Template URL, StackSet ARN and deploy region settings, and meshStack no longer creates or updates StackInstances or access stacks during tenant replication. StackInstances that were already deployed to your AWS accounts remain in place, but meshStack no longer manages them. To bootstrap new AWS accounts, use a Lambda function that triggers your own Account Vending Machine, as described in the AWS Landing Zone documentation.

Purge a Building Block Whose Dependents Are Already Being Purged​

Audience: User

Description​

You can now purge a building block while the building blocks that depend on it are still waiting for their own purge to finish. Before, we refused the purge and asked you to remove the dependent building blocks first, even when you had already requested exactly that. Purging a group of building blocks one at a time could therefore leave you with no way to finish the job.

Google Cloud Deployment Manager Support Removed​

Audience: User

Description​

We removed support for deploying Google Cloud Deployment Manager templates as part of GCP replication. The Template Config URL option is no longer available in landing zone configuration, and the gcpTemplateUrl field was removed from the meshLandingZone API. Existing template deployments in your GCP projects are not deleted, meshStack just no longer manages them. Your replication service account no longer needs the deploymentmanager.* and serviceusage.* permissions, or the template-bucket Storage permissions previously required for this feature.

Removal of OSB Service Instance Sharing​

Audience: User, Operator

Description​

OSB Service Instance Sharing, deprecated since 01.04.2025, has been removed.

This feature has been replaced with Building Blocks for Workspaces, which solve the same problem.

Removal of OSB Tenant Bindings​

Audience: User, Operator

Description​

OSB Tenant Bindings, deprecated since 01.04.2025, have been removed.

This feature has been replaced with Tenant Building Blocks, which offer a better solution to add tenant-level capabilities to your platforms.

Short Interruptions No Longer Leave a Building Block Run or Notification Stuck​

Audience: User

Description​

A temporary problem inside meshStack could keep a building block run, a tenant replication, a marketplace service operation or a notification from going through, and we gave up on it within seconds, so it never happened. We now keep retrying with growing pauses for about two days, so meshStack recovers on its own once the problem clears. This has always been rare, and there is nothing you need to do.

Who Can Read a Project Is Now Decided the Same Way Everywhere​

Audience: User

Description​

Who may read a project used to be decided by different code in the meshPanel and on the meshObject API. We now use one rule in both places: Workspace Owners and Managers read every project of their workspace, Workspace Members read only the projects they are assigned to, and administrators read the projects of every workspace. Most roles read exactly the projects they read before, so for most of you nothing changes. Three things change:

  • A project mention in a building block summary, written as @project[workspace.project], now resolves only for projects you may read: as a Workspace Owner or Manager, every project of the workspace you are currently working in; as a Workspace Member, the projects of that workspace you are assigned to. Any other mention shows "Item not found". Until now a mention also resolved for the other projects of your workspace and for projects of other workspaces you are assigned to.
  • On the meshObject API, a workspace-scoped API key that filters the project list by another workspace now gets an empty page. Until now the request silently ignored that filter and returned the projects of the key's own workspace instead. Which projects an API key can read does not change.
  • The project assignments of a user group, shown on the group's detail page, now list only the projects you may read. As a Workspace Member you see the group's assignments on the projects you are assigned to; until now you also saw its assignments on the other projects of the workspace.